diff options
Diffstat (limited to 'applications/luci-app-firewall/luasrc')
12 files changed, 1877 insertions, 0 deletions
diff --git a/applications/luci-app-firewall/luasrc/controller/firewall.lua b/applications/luci-app-firewall/luasrc/controller/firewall.lua new file mode 100644 index 000000000..5a6ab0ad3 --- /dev/null +++ b/applications/luci-app-firewall/luasrc/controller/firewall.lua @@ -0,0 +1,23 @@ +module("luci.controller.firewall", package.seeall) + +function index() + entry({"admin", "network", "firewall"}, + alias("admin", "network", "firewall", "zones"), + _("Firewall"), 60) + + entry({"admin", "network", "firewall", "zones"}, + arcombine(cbi("firewall/zones"), cbi("firewall/zone-details")), + _("General Settings"), 10).leaf = true + + entry({"admin", "network", "firewall", "forwards"}, + arcombine(cbi("firewall/forwards"), cbi("firewall/forward-details")), + _("Port Forwards"), 20).leaf = true + + entry({"admin", "network", "firewall", "rules"}, + arcombine(cbi("firewall/rules"), cbi("firewall/rule-details")), + _("Traffic Rules"), 30).leaf = true + + entry({"admin", "network", "firewall", "custom"}, + cbi("firewall/custom"), + _("Custom Rules"), 40).leaf = true +end diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/custom.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/custom.lua new file mode 100644 index 000000000..9b53a8a62 --- /dev/null +++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/custom.lua @@ -0,0 +1,38 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2011 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local fs = require "nixio.fs" + +local f = SimpleForm("firewall", + translate("Firewall - Custom Rules"), + translate("Custom rules allow you to execute arbritary iptables commands \ + which are not otherwise covered by the firewall framework. \ + The commands are executed after each firewall restart, right after \ + the default ruleset has been loaded.")) + +local o = f:field(Value, "_custom") + +o.template = "cbi/tvalue" +o.rows = 20 + +function o.cfgvalue(self, section) + return fs.readfile("/etc/firewall.user") +end + +function o.write(self, section, value) + value = value:gsub("\r\n?", "\n") + fs.writefile("/etc/firewall.user", value) +end + +return f diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua new file mode 100644 index 000000000..c80a6d0e7 --- /dev/null +++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua @@ -0,0 +1,161 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2011 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local sys = require "luci.sys" +local dsp = require "luci.dispatcher" +local ft = require "luci.tools.firewall" + +local m, s, o + +arg[1] = arg[1] or "" + +m = Map("firewall", + translate("Firewall - Port Forwards"), + translate("This page allows you to change advanced properties of the port \ + forwarding entry. In most cases there is no need to modify \ + those settings.")) + +m.redirect = dsp.build_url("admin/network/firewall/forwards") + +if m.uci:get("firewall", arg[1]) ~= "redirect" then + luci.http.redirect(m.redirect) + return +else + local name = m:get(arg[1], "name") or m:get(arg[1], "_name") + if not name or #name == 0 then + name = translate("(Unnamed Entry)") + end + m.title = "%s - %s" %{ translate("Firewall - Port Forwards"), name } +end + +s = m:section(NamedSection, arg[1], "redirect", "") +s.anonymous = true +s.addremove = false + +ft.opt_enabled(s, Button) +ft.opt_name(s, Value, translate("Name")) + + +o = s:option(Value, "proto", translate("Protocol")) +o:value("tcp udp", "TCP+UDP") +o:value("tcp", "TCP") +o:value("udp", "UDP") +o:value("icmp", "ICMP") + +function o.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v +end + + +o = s:option(Value, "src", translate("Source zone")) +o.nocreate = true +o.default = "wan" +o.template = "cbi/firewall_zonelist" + + +o = s:option(DynamicList, "src_mac", + translate("Source MAC address"), + translate("Only match incoming traffic from these MACs.")) +o.rmempty = true +o.datatype = "neg(macaddr)" +o.placeholder = translate("any") + +luci.sys.net.mac_hints(function(mac, name) + o:value(mac, "%s (%s)" %{ mac, name }) +end) + + +o = s:option(Value, "src_ip", + translate("Source IP address"), + translate("Only match incoming traffic from this IP or range.")) +o.rmempty = true +o.datatype = "neg(ip4addr)" +o.placeholder = translate("any") + +luci.sys.net.ipv4_hints(function(ip, name) + o:value(ip, "%s (%s)" %{ ip, name }) +end) + + +o = s:option(Value, "src_port", + translate("Source port"), + translate("Only match incoming traffic originating from the given source port or port range on the client host")) +o.rmempty = true +o.datatype = "neg(portrange)" +o.placeholder = translate("any") + + +o = s:option(Value, "src_dip", + translate("External IP address"), + translate("Only match incoming traffic directed at the given IP address.")) + +luci.sys.net.ipv4_hints(function(ip, name) + o:value(ip, "%s (%s)" %{ ip, name }) +end) + + +o.rmempty = true +o.datatype = "neg(ip4addr)" +o.placeholder = translate("any") + + +o = s:option(Value, "src_dport", translate("External port"), + translate("Match incoming traffic directed at the given " .. + "destination port or port range on this host")) +o.datatype = "neg(portrange)" + + + +o = s:option(Value, "dest", translate("Internal zone")) +o.nocreate = true +o.default = "lan" +o.template = "cbi/firewall_zonelist" + + +o = s:option(Value, "dest_ip", translate("Internal IP address"), + translate("Redirect matched incoming traffic to the specified \ + internal host")) +o.datatype = "ip4addr" + +luci.sys.net.ipv4_hints(function(ip, name) + o:value(ip, "%s (%s)" %{ ip, name }) +end) + + +o = s:option(Value, "dest_port", + translate("Internal port"), + translate("Redirect matched incoming traffic to the given port on \ + the internal host")) +o.placeholder = translate("any") +o.datatype = "portrange" + + +o = s:option(Flag, "reflection", translate("Enable NAT Loopback")) +o.rmempty = true +o.default = o.enabled +o.cfgvalue = function(...) + return Flag.cfgvalue(...) or "1" +end + + +s:option(Value, "extra", + translate("Extra arguments"), + translate("Passes additional arguments to iptables. Use with care!")) + + +return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua new file mode 100644 index 000000000..5f7a69b25 --- /dev/null +++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua @@ -0,0 +1,144 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> +Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +]]-- + +local ds = require "luci.dispatcher" +local ft = require "luci.tools.firewall" + +m = Map("firewall", translate("Firewall - Port Forwards"), + translate("Port forwarding allows remote computers on the Internet to \ + connect to a specific computer or service within the \ + private LAN.")) + +-- +-- Port Forwards +-- + +s = m:section(TypedSection, "redirect", translate("Port Forwards")) +s.template = "cbi/tblsection" +s.addremove = true +s.anonymous = true +s.sortable = true +s.extedit = ds.build_url("admin/network/firewall/forwards/%s") +s.template_addremove = "firewall/cbi_addforward" + +function s.create(self, section) + local n = m:formvalue("_newfwd.name") + local p = m:formvalue("_newfwd.proto") + local E = m:formvalue("_newfwd.extzone") + local e = m:formvalue("_newfwd.extport") + local I = m:formvalue("_newfwd.intzone") + local a = m:formvalue("_newfwd.intaddr") + local i = m:formvalue("_newfwd.intport") + + if p == "other" or (p and a) then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "DNAT") + self.map:set(created, "src", E or "wan") + self.map:set(created, "dest", I or "lan") + self.map:set(created, "proto", (p ~= "other") and p or "all") + self.map:set(created, "src_dport", e) + self.map:set(created, "dest_ip", a) + self.map:set(created, "dest_port", i) + self.map:set(created, "name", n) + end + + if p ~= "other" then + created = nil + end +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin/network/firewall/redirect", created + )) + end +end + +function s.filter(self, sid) + return (self.map:get(sid, "target") ~= "SNAT") +end + + +ft.opt_name(s, DummyValue, translate("Name")) + + +local function forward_proto_txt(self, s) + return "%s-%s" %{ + translate("IPv4"), + ft.fmt_proto(self.map:get(s, "proto"), + self.map:get(s, "icmp_type")) or "TCP+UDP" + } +end + +local function forward_src_txt(self, s) + local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone")) + local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host")) + local p = ft.fmt_port(self.map:get(s, "src_port")) + local m = ft.fmt_mac(self.map:get(s, "src_mac")) + + if p and m then + return translatef("From %s in %s with source %s and %s", a, z, p, m) + elseif p or m then + return translatef("From %s in %s with source %s", a, z, p or m) + else + return translatef("From %s in %s", a, z) + end +end + +local function forward_via_txt(self, s) + local a = ft.fmt_ip(self.map:get(s, "src_dip"), translate("any router IP")) + local p = ft.fmt_port(self.map:get(s, "src_dport")) + + if p then + return translatef("Via %s at %s", a, p) + else + return translatef("Via %s", a) + end +end + +match = s:option(DummyValue, "match", translate("Match")) +match.rawhtml = true +match.width = "50%" +function match.cfgvalue(self, s) + return "<small>%s<br />%s<br />%s</small>" % { + forward_proto_txt(self, s), + forward_src_txt(self, s), + forward_via_txt(self, s) + } +end + + +dest = s:option(DummyValue, "dest", translate("Forward to")) +dest.rawhtml = true +dest.width = "40%" +function dest.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone")) + local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) or + ft.fmt_port(self.map:get(s, "src_dport")) + + if p then + return translatef("%s, %s in %s", a, p, z) + else + return translatef("%s in %s", a, z) + end +end + +ft.opt_enabled(s, Flag, translate("Enable")).width = "1%" + +return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua new file mode 100644 index 000000000..d29879c24 --- /dev/null +++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua @@ -0,0 +1,329 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> +Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +]]-- + +local sys = require "luci.sys" +local utl = require "luci.util" +local dsp = require "luci.dispatcher" +local nxo = require "nixio" + +local ft = require "luci.tools.firewall" +local nw = require "luci.model.network" +local m, s, o, k, v + +arg[1] = arg[1] or "" + +m = Map("firewall", + translate("Firewall - Traffic Rules"), + translate("This page allows you to change advanced properties of the \ + traffic rule entry, such as matched source and destination \ + hosts.")) + +m.redirect = dsp.build_url("admin/network/firewall/rules") + +nw.init(m.uci) + +local rule_type = m.uci:get("firewall", arg[1]) +if rule_type == "redirect" and m:get(arg[1], "target") ~= "SNAT" then + rule_type = nil +end + +if not rule_type then + luci.http.redirect(m.redirect) + return + +-- +-- SNAT +-- +elseif rule_type == "redirect" then + + local name = m:get(arg[1], "name") or m:get(arg[1], "_name") + if not name or #name == 0 then + name = translate("(Unnamed SNAT)") + else + name = "SNAT %s" % name + end + + m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name } + + local wan_zone = nil + + m.uci:foreach("firewall", "zone", + function(s) + local n = s.network or s.name + if n then + local i + for i in utl.imatch(n) do + if i == "wan" then + wan_zone = s.name + return false + end + end + end + end) + + s = m:section(NamedSection, arg[1], "redirect", "") + s.anonymous = true + s.addremove = false + + + ft.opt_enabled(s, Button) + ft.opt_name(s, Value, translate("Name")) + + + o = s:option(Value, "proto", + translate("Protocol"), + translate("You may specify multiple by selecting \"-- custom --\" and \ + then entering protocols separated by space.")) + + o:value("all", "All protocols") + o:value("tcp udp", "TCP+UDP") + o:value("tcp", "TCP") + o:value("udp", "UDP") + o:value("icmp", "ICMP") + + function o.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v + end + + + o = s:option(Value, "src", translate("Source zone")) + o.nocreate = true + o.default = "wan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "src_ip", translate("Source IP address")) + o.rmempty = true + o.datatype = "neg(ipaddr)" + o.placeholder = translate("any") + + luci.sys.net.ipv4_hints(function(ip, name) + o:value(ip, "%s (%s)" %{ ip, name }) + end) + + + o = s:option(Value, "src_port", + translate("Source port"), + translate("Match incoming traffic originating from the given source \ + port or port range on the client host.")) + o.rmempty = true + o.datatype = "neg(portrange)" + o.placeholder = translate("any") + + + o = s:option(Value, "dest", translate("Destination zone")) + o.nocreate = true + o.default = "lan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "dest_ip", translate("Destination IP address")) + o.datatype = "neg(ip4addr)" + + luci.sys.net.ipv4_hints(function(ip, name) + o:value(ip, "%s (%s)" %{ ip, name }) + end) + + + o = s:option(Value, "dest_port", + translate("Destination port"), + translate("Match forwarded traffic to the given destination port or \ + port range.")) + + o.rmempty = true + o.placeholder = translate("any") + o.datatype = "neg(portrange)" + + + o = s:option(Value, "src_dip", + translate("SNAT IP address"), + translate("Rewrite matched traffic to the given address.")) + o.rmempty = false + o.datatype = "ip4addr" + + for k, v in ipairs(nw:get_interfaces()) do + local a + for k, a in ipairs(v:ipaddrs()) do + o:value(a:host():string(), '%s (%s)' %{ + a:host():string(), v:shortname() + }) + end + end + + + o = s:option(Value, "src_dport", translate("SNAT port"), + translate("Rewrite matched traffic to the given source port. May be \ + left empty to only rewrite the IP address.")) + o.datatype = "portrange" + o.rmempty = true + o.placeholder = translate('Do not rewrite') + + + s:option(Value, "extra", + translate("Extra arguments"), + translate("Passes additional arguments to iptables. Use with care!")) + + +-- +-- Rule +-- +else + local name = m:get(arg[1], "name") or m:get(arg[1], "_name") + if not name or #name == 0 then + name = translate("(Unnamed Rule)") + end + + m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name } + + + s = m:section(NamedSection, arg[1], "rule", "") + s.anonymous = true + s.addremove = false + + ft.opt_enabled(s, Button) + ft.opt_name(s, Value, translate("Name")) + + + o = s:option(ListValue, "family", translate("Restrict to address family")) + o.rmempty = true + o:value("", translate("IPv4 and IPv6")) + o:value("ipv4", translate("IPv4 only")) + o:value("ipv6", translate("IPv6 only")) + + + o = s:option(Value, "proto", translate("Protocol")) + o:value("all", translate("Any")) + o:value("tcp udp", "TCP+UDP") + o:value("tcp", "TCP") + o:value("udp", "UDP") + o:value("icmp", "ICMP") + + function o.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v + end + + + o = s:option(DynamicList, "icmp_type", translate("Match ICMP type")) + o:value("", "any") + o:value("echo-reply") + o:value("destination-unreachable") + o:value("network-unreachable") + o:value("host-unreachable") + o:value("protocol-unreachable") + o:value("port-unreachable") + o:value("fragmentation-needed") + o:value("source-route-failed") + o:value("network-unknown") + o:value("host-unknown") + o:value("network-prohibited") + o:value("host-prohibited") + o:value("TOS-network-unreachable") + o:value("TOS-host-unreachable") + o:value("communication-prohibited") + o:value("host-precedence-violation") + o:value("precedence-cutoff") + o:value("source-quench") + o:value("redirect") + o:value("network-redirect") + o:value("host-redirect") + o:value("TOS-network-redirect") + o:value("TOS-host-redirect") + o:value("echo-request") + o:value("router-advertisement") + o:value("router-solicitation") + o:value("time-exceeded") + o:value("ttl-zero-during-transit") + o:value("ttl-zero-during-reassembly") + o:value("parameter-problem") + o:value("ip-header-bad") + o:value("required-option-missing") + o:value("timestamp-request") + o:value("timestamp-reply") + o:value("address-mask-request") + o:value("address-mask-reply") + + + o = s:option(Value, "src", translate("Source zone")) + o.nocreate = true + o.allowany = true + o.default = "wan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "src_mac", translate("Source MAC address")) + o.datatype = "list(macaddr)" + o.placeholder = translate("any") + + luci.sys.net.mac_hints(function(mac, name) + o:value(mac, "%s (%s)" %{ mac, name }) + end) + + + o = s:option(Value, "src_ip", translate("Source address")) + o.datatype = "neg(ipaddr)" + o.placeholder = translate("any") + + luci.sys.net.ipv4_hints(function(ip, name) + o:value(ip, "%s (%s)" %{ ip, name }) + end) + + + o = s:option(Value, "src_port", translate("Source port")) + o.datatype = "list(neg(portrange))" + o.placeholder = translate("any") + + + o = s:option(Value, "dest", translate("Destination zone")) + o.nocreate = true + o.allowany = true + o.allowlocal = true + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "dest_ip", translate("Destination address")) + o.datatype = "neg(ipaddr)" + o.placeholder = translate("any") + + luci.sys.net.ipv4_hints(function(ip, name) + o:value(ip, "%s (%s)" %{ ip, name }) + end) + + + o = s:option(Value, "dest_port", translate("Destination port")) + o.datatype = "list(neg(portrange))" + o.placeholder = translate("any") + + + o = s:option(ListValue, "target", translate("Action")) + o.default = "ACCEPT" + o:value("DROP", translate("drop")) + o:value("ACCEPT", translate("accept")) + o:value("REJECT", translate("reject")) + o:value("NOTRACK", translate("don't track")) + + + s:option(Value, "extra", + translate("Extra arguments"), + translate("Passes additional arguments to iptables. Use with care!")) +end + +return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua new file mode 100644 index 000000000..9bfa66bd0 --- /dev/null +++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua @@ -0,0 +1,269 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> +Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +]]-- + +local ds = require "luci.dispatcher" +local ft = require "luci.tools.firewall" + +m = Map("firewall", + translate("Firewall - Traffic Rules"), + translate("Traffic rules define policies for packets traveling between \ + different zones, for example to reject traffic between certain hosts \ + or to open WAN ports on the router.")) + +-- +-- Rules +-- + +s = m:section(TypedSection, "rule", translate("Traffic Rules")) +s.addremove = true +s.anonymous = true +s.sortable = true +s.template = "cbi/tblsection" +s.extedit = ds.build_url("admin/network/firewall/rules/%s") +s.defaults.target = "ACCEPT" +s.template_addremove = "firewall/cbi_addrule" + + +function s.create(self, section) + created = TypedSection.create(self, section) +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + + local i_n = m:formvalue("_newopen.name") + local i_p = m:formvalue("_newopen.proto") + local i_e = m:formvalue("_newopen.extport") + local i_x = m:formvalue("_newopen.submit") + + local f_n = m:formvalue("_newfwd.name") + local f_s = m:formvalue("_newfwd.src") + local f_d = m:formvalue("_newfwd.dest") + local f_x = m:formvalue("_newfwd.submit") + + if i_x then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "ACCEPT") + self.map:set(created, "src", "wan") + self.map:set(created, "proto", (i_p ~= "other") and i_p or "all") + self.map:set(created, "dest_port", i_e) + self.map:set(created, "name", i_n) + + if i_p ~= "other" and i_e and #i_e > 0 then + created = nil + end + + elseif f_x then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "ACCEPT") + self.map:set(created, "src", f_s) + self.map:set(created, "dest", f_d) + self.map:set(created, "name", f_n) + end + + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin/network/firewall/rules", created + )) + end +end + +ft.opt_name(s, DummyValue, translate("Name")) + +local function rule_proto_txt(self, s) + local f = self.map:get(s, "family") + local p = ft.fmt_proto(self.map:get(s, "proto"), + self.map:get(s, "icmp_type")) or translate("traffic") + + if f and f:match("4") then + return "%s-%s" %{ translate("IPv4"), p } + elseif f and f:match("6") then + return "%s-%s" %{ translate("IPv6"), p } + else + return "%s %s" %{ translate("Any"), p } + end +end + +local function rule_src_txt(self, s) + local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone")) + local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host")) + local p = ft.fmt_port(self.map:get(s, "src_port")) + local m = ft.fmt_mac(self.map:get(s, "src_mac")) + + if p and m then + return translatef("From %s in %s with source %s and %s", a, z, p, m) + elseif p or m then + return translatef("From %s in %s with source %s", a, z, p or m) + else + return translatef("From %s in %s", a, z) + end +end + +local function rule_dest_txt(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) + + -- Forward + if z then + local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host")) + if p then + return translatef("To %s, %s in %s", a, p, z) + else + return translatef("To %s in %s", a, z) + end + + -- Input + else + local a = ft.fmt_ip(self.map:get(s, "dest_ip"), + translate("any router IP")) + + if p then + return translatef("To %s at %s on <var>this device</var>", a, p) + else + return translatef("To %s on <var>this device</var>", a) + end + end +end + +local function snat_dest_txt(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone")) + local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) or + ft.fmt_port(self.map:get(s, "src_dport")) + + if p then + return translatef("To %s, %s in %s", a, p, z) + else + return translatef("To %s in %s", a, z) + end +end + + +match = s:option(DummyValue, "match", translate("Match")) +match.rawhtml = true +match.width = "70%" +function match.cfgvalue(self, s) + return "<small>%s<br />%s<br />%s</small>" % { + rule_proto_txt(self, s), + rule_src_txt(self, s), + rule_dest_txt(self, s) + } +end + +target = s:option(DummyValue, "target", translate("Action")) +target.rawhtml = true +target.width = "20%" +function target.cfgvalue(self, s) + local t = ft.fmt_target(self.map:get(s, "target"), self.map:get(s, "dest")) + local l = ft.fmt_limit(self.map:get(s, "limit"), + self.map:get(s, "limit_burst")) + + if l then + return translatef("<var>%s</var> and limit to %s", t, l) + else + return "<var>%s</var>" % t + end +end + +ft.opt_enabled(s, Flag, translate("Enable")).width = "1%" + + +-- +-- SNAT +-- + +s = m:section(TypedSection, "redirect", + translate("Source NAT"), + translate("Source NAT is a specific form of masquerading which allows \ + fine grained control over the source IP used for outgoing traffic, \ + for example to map multiple WAN addresses to internal subnets.")) +s.template = "cbi/tblsection" +s.addremove = true +s.anonymous = true +s.sortable = true +s.extedit = ds.build_url("admin/network/firewall/rules/%s") +s.template_addremove = "firewall/cbi_addsnat" + +function s.create(self, section) + created = TypedSection.create(self, section) +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + + local n = m:formvalue("_newsnat.name") + local s = m:formvalue("_newsnat.src") + local d = m:formvalue("_newsnat.dest") + local a = m:formvalue("_newsnat.dip") + local p = m:formvalue("_newsnat.dport") + local x = m:formvalue("_newsnat.submit") + + if x and a and #a > 0 then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "SNAT") + self.map:set(created, "src", s) + self.map:set(created, "dest", d) + self.map:set(created, "proto", "all") + self.map:set(created, "src_dip", a) + self.map:set(created, "src_dport", p) + self.map:set(created, "name", n) + end + + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin/network/firewall/rules", created + )) + end +end + +function s.filter(self, sid) + return (self.map:get(sid, "target") == "SNAT") +end + +ft.opt_name(s, DummyValue, translate("Name")) + +match = s:option(DummyValue, "match", translate("Match")) +match.rawhtml = true +match.width = "70%" +function match.cfgvalue(self, s) + return "<small>%s<br />%s<br />%s</small>" % { + rule_proto_txt(self, s), + rule_src_txt(self, s), + snat_dest_txt(self, s) + } +end + +snat = s:option(DummyValue, "via", translate("Action")) +snat.rawhtml = true +snat.width = "20%" +function snat.cfgvalue(self, s) + local a = ft.fmt_ip(self.map:get(s, "src_dip")) + local p = ft.fmt_port(self.map:get(s, "src_dport")) + + if a and p then + return translatef("Rewrite to source %s, %s", a, p) + else + return translatef("Rewrite to source %s", a or p) + end +end + +ft.opt_enabled(s, Flag, translate("Enable")).width = "1%" + + +return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua new file mode 100644 index 000000000..e5bcb34da --- /dev/null +++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua @@ -0,0 +1,243 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> +Copyright 2010-2011 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local nw = require "luci.model.network" +local fw = require "luci.model.firewall" +local ds = require "luci.dispatcher" +local ut = require "luci.util" + +local m, p, i, v +local s, name, net, family, msrc, mdest, log, lim +local s2, out, inp + + +m = Map("firewall", translate("Firewall - Zone Settings")) +m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones") + +fw.init(m.uci) +nw.init(m.uci) + + +local zone = fw:get_zone(arg[1]) +if not zone then + luci.http.redirect(dsp.build_url("admin/network/firewall/zones")) + return +else + m.title = "%s - %s" %{ + translate("Firewall - Zone Settings"), + translatef("Zone %q", zone:name() or "?") + } +end + + +s = m:section(NamedSection, zone.sid, "zone", + translatef("Zone %q", zone:name()), + translatef("This section defines common properties of %q. \ + The <em>input</em> and <em>output</em> options set the default \ + policies for traffic entering and leaving this zone while the \ + <em>forward</em> option describes the policy for forwarded traffic \ + between different networks within the zone. \ + <em>Covered networks</em> specifies which available networks are \ + members of this zone.", zone:name())) + +s.anonymous = true +s.addremove = false + +m.on_commit = function(map) + local zone = fw:get_zone(arg[1]) + if zone then + s.section = zone.sid + s2.section = zone.sid + end +end + + +s:tab("general", translate("General Settings")) +s:tab("advanced", translate("Advanced Settings")) + + +name = s:taboption("general", Value, "name", translate("Name")) +name.optional = false +name.forcewrite = true +name.datatype = "uciname" + +function name.write(self, section, value) + if zone:name() ~= value then + fw:rename_zone(zone:name(), value) + out.exclude = value + inp.exclude = value + end + + m.redirect = ds.build_url("admin/network/firewall/zones", value) + m.title = "%s - %s" %{ + translate("Firewall - Zone Settings"), + translatef("Zone %q", value or "?") + } +end + +p = { + s:taboption("general", ListValue, "input", translate("Input")), + s:taboption("general", ListValue, "output", translate("Output")), + s:taboption("general", ListValue, "forward", translate("Forward")) +} + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + +s:taboption("general", Flag, "masq", translate("Masquerading")) +s:taboption("general", Flag, "mtu_fix", translate("MSS clamping")) + +net = s:taboption("general", Value, "network", translate("Covered networks")) +net.template = "cbi/network_netlist" +net.widget = "checkbox" +net.cast = "string" + +function net.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function net.cfgvalue(self, section) + return Value.cfgvalue(self, section) or name:cfgvalue(section) +end + +function net.write(self, section, value) + zone:clear_networks() + + local n + for n in ut.imatch(value) do + zone:add_network(n) + end +end + + +family = s:taboption("advanced", ListValue, "family", + translate("Restrict to address family")) + +family.rmempty = true +family:value("", translate("IPv4 and IPv6")) +family:value("ipv4", translate("IPv4 only")) +family:value("ipv6", translate("IPv6 only")) + +msrc = s:taboption("advanced", DynamicList, "masq_src", + translate("Restrict Masquerading to given source subnets")) + +msrc.optional = true +msrc.datatype = "list(neg(or(uciname,hostname,ip4addr)))" +msrc.placeholder = "0.0.0.0/0" +msrc:depends("family", "") +msrc:depends("family", "ipv4") + +mdest = s:taboption("advanced", DynamicList, "masq_dest", + translate("Restrict Masquerading to given destination subnets")) + +mdest.optional = true +mdest.datatype = "list(neg(or(uciname,hostname,ip4addr)))" +mdest.placeholder = "0.0.0.0/0" +mdest:depends("family", "") +mdest:depends("family", "ipv4") + +s:taboption("advanced", Flag, "conntrack", + translate("Force connection tracking")) + +log = s:taboption("advanced", Flag, "log", + translate("Enable logging on this zone")) + +log.rmempty = true +log.enabled = "1" + +lim = s:taboption("advanced", Value, "log_limit", + translate("Limit log messages")) + +lim.placeholder = "10/minute" +lim:depends("log", "1") + + +s2 = m:section(NamedSection, zone.sid, "fwd_out", + translate("Inter-Zone Forwarding"), + translatef("The options below control the forwarding policies between \ + this zone (%s) and other zones. <em>Destination zones</em> cover \ + forwarded traffic <strong>originating from %q</strong>. \ + <em>Source zones</em> match forwarded traffic from other zones \ + <strong>targeted at %q</strong>. The forwarding rule is \ + <em>unidirectional</em>, e.g. a forward from lan to wan does \ + <em>not</em> imply a permission to forward from wan to lan as well.", + zone:name(), zone:name(), zone:name() + + )) + +out = s2:option(Value, "out", + translate("Allow forward to <em>destination zones</em>:")) + +out.nocreate = true +out.widget = "checkbox" +out.exclude = zone:name() +out.template = "cbi/firewall_zonelist" + +inp = s2:option(Value, "in", + translate("Allow forward from <em>source zones</em>:")) + +inp.nocreate = true +inp.widget = "checkbox" +inp.exclude = zone:name() +inp.template = "cbi/firewall_zonelist" + +function out.cfgvalue(self, section) + local v = { } + local f + for _, f in ipairs(zone:get_forwardings_by("src")) do + v[#v+1] = f:dest() + end + return table.concat(v, " ") +end + +function inp.cfgvalue(self, section) + local v = { } + local f + for _, f in ipairs(zone:get_forwardings_by("dest")) do + v[#v+1] = f:src() + end + return v +end + +function out.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function inp.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function out.write(self, section, value) + zone:del_forwardings_by("src") + + local f + for f in ut.imatch(value) do + zone:add_forwarding_to(f) + end +end + +function inp.write(self, section, value) + zone:del_forwardings_by("dest") + + local f + for f in ut.imatch(value) do + zone:add_forwarding_from(f) + end +end + +return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua new file mode 100644 index 000000000..e6d8548bf --- /dev/null +++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua @@ -0,0 +1,88 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local ds = require "luci.dispatcher" +local fw = require "luci.model.firewall" + +local m, s, o, p, i, v + +m = Map("firewall", + translate("Firewall - Zone Settings"), + translate("The firewall creates zones over your network interfaces to control network traffic flow.")) + +fw.init(m.uci) + +s = m:section(TypedSection, "defaults", translate("General Settings")) +s.anonymous = true +s.addremove = false + +s:option(Flag, "syn_flood", translate("Enable SYN-flood protection")) + +o = s:option(Flag, "drop_invalid", translate("Drop invalid packets")) +o.default = o.disabled + +p = { + s:option(ListValue, "input", translate("Input")), + s:option(ListValue, "output", translate("Output")), + s:option(ListValue, "forward", translate("Forward")) +} + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + + +s = m:section(TypedSection, "zone", translate("Zones")) +s.template = "cbi/tblsection" +s.anonymous = true +s.addremove = true +s.extedit = ds.build_url("admin", "network", "firewall", "zones", "%s") + +function s.create(self) + local z = fw:new_zone() + if z then + luci.http.redirect( + ds.build_url("admin", "network", "firewall", "zones", z.sid) + ) + end +end + +function s.remove(self, section) + return fw:del_zone(section) +end + +o = s:option(DummyValue, "_info", translate("Zone ⇒ Forwardings")) +o.template = "cbi/firewall_zoneforwards" +o.cfgvalue = function(self, section) + return self.map:get(section, "name") +end + +p = { + s:option(ListValue, "input", translate("Input")), + s:option(ListValue, "output", translate("Output")), + s:option(ListValue, "forward", translate("Forward")) +} + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + +s:option(Flag, "masq", translate("Masquerading")) +s:option(Flag, "mtu_fix", translate("MSS clamping")) + +return m diff --git a/applications/luci-app-firewall/luasrc/tools/firewall.lua b/applications/luci-app-firewall/luasrc/tools/firewall.lua new file mode 100644 index 000000000..07162cba5 --- /dev/null +++ b/applications/luci-app-firewall/luasrc/tools/firewall.lua @@ -0,0 +1,289 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2011-2012 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +]]-- + +module("luci.tools.firewall", package.seeall) + +local ut = require "luci.util" +local ip = require "luci.ip" +local nx = require "nixio" + +local translate, translatef = luci.i18n.translate, luci.i18n.translatef + +local function tr(...) + return tostring(translate(...)) +end + +function fmt_neg(x) + if type(x) == "string" then + local v, neg = x:gsub("^ *! *", "") + if neg > 0 then + return v, "%s " % tr("not") + else + return x, "" + end + end + return x, "" +end + +function fmt_mac(x) + if x and #x > 0 then + local m, n + local l = { tr("MAC"), " " } + for m in ut.imatch(x) do + m, n = fmt_neg(m) + l[#l+1] = "<var>%s%s</var>" %{ n, m } + l[#l+1] = ", " + end + if #l > 1 then + l[#l] = nil + if #l > 3 then + l[1] = tr("MACs") + end + return table.concat(l, "") + end + end +end + +function fmt_port(x, d) + if x and #x > 0 then + local p, n + local l = { tr("port"), " " } + for p in ut.imatch(x) do + p, n = fmt_neg(p) + local a, b = p:match("(%d+)%D+(%d+)") + if a and b then + l[1] = tr("ports") + l[#l+1] = "<var>%s%d-%d</var>" %{ n, a, b } + else + l[#l+1] = "<var>%s%d</var>" %{ n, p } + end + l[#l+1] = ", " + end + if #l > 1 then + l[#l] = nil + if #l > 3 then + l[1] = tr("ports") + end + return table.concat(l, "") + end + end + return d and "<var>%s</var>" % d +end + +function fmt_ip(x, d) + if x and #x > 0 then + local l = { tr("IP"), " " } + local v, a, n + for v in ut.imatch(x) do + v, n = fmt_neg(v) + a, m = v:match("(%S+)/(%d+%.%S+)") + a = a or v + a = a:match(":") and ip.IPv6(a, m) or ip.IPv4(a, m) + if a and (a:is6() and a:prefix() < 128 or a:prefix() < 32) then + l[1] = tr("IP range") + l[#l+1] = "<var title='%s - %s'>%s%s</var>" %{ + a:minhost():string(), + a:maxhost():string(), + n, a:string() + } + else + l[#l+1] = "<var>%s%s</var>" %{ + n, + a and a:string() or v + } + end + l[#l+1] = ", " + end + if #l > 1 then + l[#l] = nil + if #l > 3 then + l[1] = tr("IPs") + end + return table.concat(l, "") + end + end + return d and "<var>%s</var>" % d +end + +function fmt_zone(x, d) + if x == "*" then + return "<var>%s</var>" % tr("any zone") + elseif x and #x > 0 then + return "<var>%s</var>" % x + elseif d then + return "<var>%s</var>" % d + end +end + +function fmt_icmp_type(x) + if x and #x > 0 then + local t, v, n + local l = { tr("type"), " " } + for v in ut.imatch(x) do + v, n = fmt_neg(v) + l[#l+1] = "<var>%s%s</var>" %{ n, v } + l[#l+1] = ", " + end + if #l > 1 then + l[#l] = nil + if #l > 3 then + l[1] = tr("types") + end + return table.concat(l, "") + end + end +end + +function fmt_proto(x, icmp_types) + if x and #x > 0 then + local v, n + local l = { } + local t = fmt_icmp_type(icmp_types) + for v in ut.imatch(x) do + v, n = fmt_neg(v) + if v == "tcpudp" then + l[#l+1] = "TCP" + l[#l+1] = ", " + l[#l+1] = "UDP" + l[#l+1] = ", " + elseif v ~= "all" then + local p = nx.getproto(v) + if p then + -- ICMP + if (p.proto == 1 or p.proto == 58) and t then + l[#l+1] = translatef( + "%s%s with %s", + n, p.aliases[1] or p.name, t + ) + else + l[#l+1] = "%s%s" %{ + n, + p.aliases[1] or p.name + } + end + l[#l+1] = ", " + end + end + end + if #l > 0 then + l[#l] = nil + return table.concat(l, "") + end + end +end + +function fmt_limit(limit, burst) + burst = tonumber(burst) + if limit and #limit > 0 then + local l, u = limit:match("(%d+)/(%w+)") + l = tonumber(l or limit) + u = u or "second" + if l then + if u:match("^s") then + u = tr("second") + elseif u:match("^m") then + u = tr("minute") + elseif u:match("^h") then + u = tr("hour") + elseif u:match("^d") then + u = tr("day") + end + if burst and burst > 0 then + return translatef("<var>%d</var> pkts. per <var>%s</var>, \ + burst <var>%d</var> pkts.", l, u, burst) + else + return translatef("<var>%d</var> pkts. per <var>%s</var>", l, u) + end + end + end +end + +function fmt_target(x, dest) + if dest and #dest > 0 then + if x == "ACCEPT" then + return tr("Accept forward") + elseif x == "REJECT" then + return tr("Refuse forward") + elseif x == "NOTRACK" then + return tr("Do not track forward") + else --if x == "DROP" then + return tr("Discard forward") + end + else + if x == "ACCEPT" then + return tr("Accept input") + elseif x == "REJECT" then + return tr("Refuse input") + elseif x == "NOTRACK" then + return tr("Do not track input") + else --if x == "DROP" then + return tr("Discard input") + end + end +end + + +function opt_enabled(s, t, ...) + if t == luci.cbi.Button then + local o = s:option(t, "__enabled") + function o.render(self, section) + if self.map:get(section, "enabled") ~= "0" then + self.title = tr("Rule is enabled") + self.inputtitle = tr("Disable") + self.inputstyle = "reset" + else + self.title = tr("Rule is disabled") + self.inputtitle = tr("Enable") + self.inputstyle = "apply" + end + t.render(self, section) + end + function o.write(self, section, value) + if self.map:get(section, "enabled") ~= "0" then + self.map:set(section, "enabled", "0") + else + self.map:del(section, "enabled") + end + end + return o + else + local o = s:option(t, "enabled", ...) + o.default = "1" + return o + end +end + +function opt_name(s, t, ...) + local o = s:option(t, "name", ...) + + function o.cfgvalue(self, section) + return self.map:get(section, "name") or + self.map:get(section, "_name") or "-" + end + + function o.write(self, section, value) + if value ~= "-" then + self.map:set(section, "name", value) + self.map:del(section, "_name") + else + self:remove(section) + end + end + + function o.remove(self, section) + self.map:del(section, "name") + self.map:del(section, "_name") + end + + return o +end diff --git a/applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm new file mode 100644 index 000000000..3726f643d --- /dev/null +++ b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm @@ -0,0 +1,115 @@ +<%- + local fw = require "luci.model.firewall".init() + local izl = { } + local ezl = { } + local _, z + for _, z in ipairs(fw:get_zones()) do + if z:name() ~= "wan" then + izl[#izl+1] = z + elseif z:name() ~= "lan" then + ezl[#ezl+1] = z + end + end +-%> +<div class="cbi-section-create cbi-tblsection-create"> + <br /> + <table class="cbi-section-table" style="width:810px; margin-left:5px"> + <tr class="cbi-section-table-titles"> + <th class="cbi-section-table-cell" colspan="8"><%:New port forward%>:</th> + </tr> + <tr class="cbi-section-table-descr"> + <th class="cbi-section-table-cell"><%:Name%></th> + <th class="cbi-section-table-cell"><%:Protocol%></th> + <th class="cbi-section-table-cell"><%:External zone%></th> + <th class="cbi-section-table-cell"><%:External port%></th> + <th class="cbi-section-table-cell"><%:Internal zone%></th> + <th class="cbi-section-table-cell"><%:Internal IP address%></th> + <th class="cbi-section-table-cell"><%:Internal port%></th> + <th class="cbi-section-table-cell"></th> + </tr> + <tr class="cbi-section-table-row"> + <td class="cbi-section-table-cell"> + <input type="text" class="cbi-input-text" id="_newfwd.name" name="_newfwd.name" placeholder="<%:New port forward%>" /> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <select class="cbi-input-select" id="_newfwd.proto" name="_newfwd.proto"> + <option value="tcp udp">TCP+UDP</option> + <option value="tcp">TCP</option> + <option value="udp">UDP</option> + <option value="other"><%:Other...%></option> + </select> + </td> + <td class="cbi-section-table-cell" style="width:55px"> + <select class="cbi-input-select" id="_newfwd.extzone" name="_newfwd.extzone"> + <% for _, z in ipairs(ezl) do -%><option value="<%=z:name()%>"><%=z:name()%></option><%- end %> + </select> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <input type="text" class="cbi-input-text" id="_newfwd.extport" name="_newfwd.extport" /> + </td> + <td class="cbi-section-table-cell" style="width:55px"> + <select class="cbi-input-select" id="_newfwd.intzone" name="_newfwd.intzone"> + <% for _, z in ipairs(izl) do -%><option value="<%=z:name()%>"><%=z:name()%></option><%- end %> + </select> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <input type="text" class="cbi-input-text" id="_newfwd.intaddr" name="_newfwd.intaddr" /> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <input type="text" class="cbi-input-text" id="_newfwd.intport" name="_newfwd.intport" /> + </td> + <td class="cbi-section-table-cell"> + <input type="submit" class="cbi-button cbi-button-add" name="cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>" value="<%:Add%>" /> + </td> + </tr> + </table> + + <script type="text/javascript">//<![CDATA[ + cbi_validate_field('_newfwd.extport', true, 'portrange'); + cbi_validate_field('_newfwd.intaddr', true, 'host'); + cbi_validate_field('_newfwd.intport', true, 'portrange'); + + cbi_combobox_init('_newfwd.intaddr', { + <% first = true; luci.sys.net.ipv4_hints(function(ip, name) %> + <%- if first then first = false else %>,<% end -%>'<%=ip%>': '<%=ip%> (<%=name%>)' + <%- end) %> }, '', '<%: -- custom -- %>'); + + cbi_bind(document.getElementById('_newfwd.extport'), 'blur', + function() { + var n = document.getElementById('_newfwd.name'); + var p = document.getElementById('_newfwd.proto'); + var i = document.getElementById('_newfwd.intport'); + var hints = { + /* port name 0=both, 1=tcp, 2=udp, 3=other */ + 21: [ 'FTP', 1 ], + 22: [ 'SSH', 1 ], + 53: [ 'DNS', 0 ], + 80: [ 'HTTP', 1 ], + 443: [ 'HTTPS', 1 ], + 3389: [ 'RDP', 1 ], + 5900: [ 'VNC', 1 ], + }; + + if (!this.className.match(/invalid/)) + { + if (!i.value) i.value = this.value; + + var hint = hints[this.value || 0] || hints[i.value || 0]; + if (hint) + { + p.selectedIndex = hint[1]; + + if (!n.value) + n.value = hint[0]; + } + else if (!n.value) + { + n.value = 'Forward' + this.value; + } + } + }); + + + cbi_validate_field('cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>', true, 'uciname'); + //]]></script> +</div> diff --git a/applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm new file mode 100644 index 000000000..463b2e05f --- /dev/null +++ b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm @@ -0,0 +1,112 @@ +<% + local fw = require "luci.model.firewall".init() + local wz = fw:get_zone("wan") + local lz = fw:get_zone("lan") +%> + +<div class="cbi-section-create cbi-tblsection-create"> + <% if wz and lz then %> + <br /> + <table class="cbi-section-table" style="margin-left:5px"> + <tr class="cbi-section-table-titles"> + <th class="cbi-section-table-cell left" colspan="4"><%:Open ports on router%>:</th> + </tr> + <tr class="cbi-section-table-descr"> + <th class="cbi-section-table-cell"><%:Name%></th> + <th class="cbi-section-table-cell"><%:Protocol%></th> + <th class="cbi-section-table-cell"><%:External port%></th> + <th class="cbi-section-table-cell"></th> + </tr> + <tr class="cbi-section-table-row"> + <td class="cbi-section-table-cell" style="width:130px"> + <input type="text" class="cbi-input-text" id="_newopen.name" name="_newopen.name" placeholder="<%:New input rule%>" /> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <select class="cbi-input-select" id="_newopen.proto" name="_newopen.proto"> + <option value="tcp udp">TCP+UDP</option> + <option value="tcp">TCP</option> + <option value="udp">UDP</option> + <option value="other"><%:Other...%></option> + </select> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <input type="text" class="cbi-input-text" id="_newopen.extport" name="_newopen.extport" /> + </td> + <td class="cbi-section-table-cell left"> + <input type="submit" class="cbi-button cbi-button-add" name="_newopen.submit" value="<%:Add%>" /> + </td> + </tr> + </table> + + <table class="cbi-section-table" style="margin-left:5px"> + <tr class="cbi-section-table-titles"> + <th class="cbi-section-table-cell left" colspan="6"><br /><%:New forward rule%>:</th> + </tr> + <tr class="cbi-section-table-descr"> + <th class="cbi-section-table-cell"><%:Name%></th> + <th class="cbi-section-table-cell"><%:Source zone%></th> + <th class="cbi-section-table-cell"><%:Destination zone%></th> + <th class="cbi-section-table-cell"></th> + </tr> + <tr class="cbi-section-table-row"> + <td class="cbi-section-table-cell" style="width:130px"> + <input type="text" class="cbi-input-text" id="_newfwd.name" name="_newfwd.name" placeholder="<%:New forward rule%>" /> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <select class="cbi-input-text" id="_newfwd.src" name="_newfwd.src"> + <% local k, v; for k, v in ipairs(fw:get_zones()) do -%> + <option<%=ifattr(v:name() == "lan", "selected", "selected")%> value="<%=v:name()%>"><%=v:name()%></option> + <%- end %> + </select> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <select class="cbi-input-text" id="_newfwd.dest" name="_newfwd.dest"> + <% local k, v; for k, v in ipairs(fw:get_zones()) do -%> + <option<%=ifattr(v:name() == "wan", "selected", "selected")%> value="<%=v:name()%>"><%=v:name()%></option> + <%- end %> + </select> + </td> + <td class="cbi-section-table-cell left"> + <input type="submit" class="cbi-button cbi-button-link" name="_newfwd.submit" value="<%:Add and edit...%>" /> + </td> + </tr> + </table> + + <script type="text/javascript">//<![CDATA[ + cbi_validate_field('_newopen.extport', true, 'list(neg(portrange))'); + cbi_bind(document.getElementById('_newopen.extport'), 'blur', + function() { + var n = document.getElementById('_newopen.name'); + var p = document.getElementById('_newopen.proto'); + var hints = { + /* port name 0=both, 1=tcp, 2=udp, 3=other */ + 22: [ 'SSH', 1 ], + 53: [ 'DNS', 0 ], + 80: [ 'HTTP', 1 ], + 443: [ 'HTTPS', 1 ], + }; + + if (!this.className.match(/invalid/)) + { + var hint = hints[this.value || 0]; + if (hint) + { + p.selectedIndex = hint[1]; + + if (!n.value) + n.value = hint[0]; + } + else if (!n.value && this.value) + { + n.value = 'Open' + this.value; + } + } + }); + + + cbi_validate_field('cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>', true, 'uciname'); + //]]></script> + <% else %> + <input type="submit" class="cbi-button cbi-button-add" name="cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>" value="<%:Add%>" /> + <% end %> +</div> diff --git a/applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm new file mode 100644 index 000000000..4e1681c11 --- /dev/null +++ b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm @@ -0,0 +1,66 @@ +<% + local fw = require "luci.model.firewall".init() + local nw = require "luci.model.network".init() + local wz = fw:get_zone("wan") + local lz = fw:get_zone("lan") +%> + +<div class="cbi-section-create cbi-tblsection-create"> + <% if wz and lz then %> + <br /> + <table class="cbi-section-table" style="width:700px; margin-left:5px"> + <tr class="cbi-section-table-titles"> + <th class="cbi-section-table-cell left" colspan="6"><%:New source NAT%>:</th> + </tr> + <tr class="cbi-section-table-descr"> + <th class="cbi-section-table-cell"><%:Name%></th> + <th class="cbi-section-table-cell"><%:Source zone%></th> + <th class="cbi-section-table-cell"><%:Destination zone%></th> + <th class="cbi-section-table-cell"><%:To source IP%></th> + <th class="cbi-section-table-cell"><%:To source port%></th> + <th class="cbi-section-table-cell"></th> + </tr> + <tr class="cbi-section-table-row"> + <td class="cbi-section-table-cell"> + <input type="text" class="cbi-input-text" id="_newsnat.name" name="_newsnat.name" placeholder="<%:New SNAT rule%>" /> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <select class="cbi-input-text" id="_newsnat.src" name="_newsnat.src"> + <% local k, v; for k, v in ipairs(fw:get_zones()) do -%> + <option<%=ifattr(v:name() == "lan", "selected", "selected")%> value="<%=v:name()%>"><%=v:name()%></option> + <%- end %> + </select> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <select class="cbi-input-text" id="_newsnat.dest" name="_newsnat.dest"> + <% local k, v; for k, v in ipairs(fw:get_zones()) do -%> + <option<%=ifattr(v:name() == "wan", "selected", "selected")%> value="<%=v:name()%>"><%=v:name()%></option> + <%- end %> + </select> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <input type="text" class="cbi-input-text" id="_newsnat.dip" name="_newsnat.dip" /> + </td> + <td class="cbi-section-table-cell" style="width:110px"> + <input type="text" class="cbi-input-text" id="_newsnat.dport" name="_newsnat.dport" placeholder="<%:Do not rewrite%>" /> + </td> + <td class="cbi-section-table-cell"> + <input type="submit" class="cbi-button cbi-button-link" name="_newsnat.submit" value="<%:Add and edit...%>" /> + </td> + </tr> + </table> + + <script type="text/javascript">//<![CDATA[ + cbi_validate_field('_newsnat.dport', true, 'portrange'); + cbi_validate_field('_newsnat.dip', true, 'ip4addr'); + cbi_combobox_init('_newsnat.dip', { + <% local c, k, v = 0; for k, v in ipairs(nw:get_interfaces()) do -%> + <%- local a; for k, a in ipairs(v:ipaddrs()) do c = c + 1 -%> + <% if c > 1 then %>,<% end %>'<%=a:host():string()%>': '<%=a:host():string()%> (<%=v:shortname()%>)' + <%- end %> + <%- end %> }, '<%: -- Please choose -- %>', '<%: -- custom -- %>'); + //]]></script> + <% else %> + <input type="submit" class="cbi-button cbi-button-add" name="cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>" value="<%:Add%>" /> + <% end %> +</div> |