diff options
Diffstat (limited to 'applications/luci-firewall/luasrc/model')
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/firewall/custom.lua | 38 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/firewall/forward-details.lua (renamed from applications/luci-firewall/luasrc/model/cbi/luci_fw/rrule.lua) | 73 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/firewall/forwards.lua | 141 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/firewall/rule-details.lua | 300 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/firewall/rules.lua | 300 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua (renamed from applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua) | 107 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/firewall/zones.lua | 88 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/luci_fw/miniportfw.lua | 48 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/luci_fw/trule.lua | 155 | ||||
| -rw-r--r-- | applications/luci-firewall/luasrc/model/cbi/luci_fw/zones.lua | 273 |
10 files changed, 961 insertions, 562 deletions
diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/custom.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/custom.lua new file mode 100644 index 0000000000..9b53a8a62f --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/custom.lua @@ -0,0 +1,38 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2011 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local fs = require "nixio.fs" + +local f = SimpleForm("firewall", + translate("Firewall - Custom Rules"), + translate("Custom rules allow you to execute arbritary iptables commands \ + which are not otherwise covered by the firewall framework. \ + The commands are executed after each firewall restart, right after \ + the default ruleset has been loaded.")) + +local o = f:field(Value, "_custom") + +o.template = "cbi/tvalue" +o.rows = 20 + +function o.cfgvalue(self, section) + return fs.readfile("/etc/firewall.user") +end + +function o.write(self, section, value) + value = value:gsub("\r\n?", "\n") + fs.writefile("/etc/firewall.user", value) +end + +return f diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/rrule.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/forward-details.lua index 675cdbb352..1cc5ecbb46 100644 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/rrule.lua +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/forward-details.lua @@ -1,8 +1,7 @@ --[[ LuCI - Lua Configuration Interface -Copyright 2008 Steven Barth <steven@midlink.org> -Copyright 2010 Jo-Philipp Wich <xm@subsignal.org> +Copyright 2011 Jo-Philipp Wich <xm@subsignal.org> Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -18,18 +17,25 @@ local dsp = require "luci.dispatcher" arg[1] = arg[1] or "" -m = Map("firewall", translate("Traffic Redirection"), - translate("Traffic redirection allows you to change the " .. - "destination address of forwarded packets.")) +m = Map("firewall", + translate("Firewall - Port Forwards"), + translate("This page allows you to change advanced properties of the port \ + forwarding entry. In most cases there is no need to modify \ + those settings.")) -m.redirect = dsp.build_url("admin", "network", "firewall") +m.redirect = dsp.build_url("admin/network/firewall/forwards") -if not m.uci:get(arg[1]) == "redirect" then +if m.uci:get("firewall", arg[1]) ~= "redirect" then luci.http.redirect(m.redirect) return +else + local name = m:get(arg[1], "_name") + if not name or #name == 0 then + name = translate("(Unnamed Entry)") + end + m.title = "%s - %s" %{ translate("Firewall - Port Forwards"), name } end -local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") local wan_zone = nil m.uci:foreach("firewall", "zone", @@ -57,30 +63,36 @@ name = s:taboption("general", Value, "_name", translate("Name")) name.rmempty = true name.size = 10 -src = s:taboption("general", Value, "src", translate("Source zone")) +src = s:taboption("advanced", Value, "src", translate("Source zone")) src.nocreate = true src.default = "wan" src.template = "cbi/firewall_zonelist" proto = s:taboption("general", Value, "proto", translate("Protocol")) proto.optional = true -proto:value("tcpudp", "TCP+UDP") +proto:value("tcp udp", "TCP+UDP") proto:value("tcp", "TCP") proto:value("udp", "UDP") +proto:value("icmp", "ICMP") + +function proto.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v +end dport = s:taboption("general", Value, "src_dport", translate("External port"), translate("Match incoming traffic directed at the given " .. "destination port or port range on this host")) dport.datatype = "portrange" -dport:depends("proto", "tcp") -dport:depends("proto", "udp") -dport:depends("proto", "tcpudp") to = s:taboption("general", Value, "dest_ip", translate("Internal IP address"), translate("Redirect matched incoming traffic to the specified " .. "internal host")) to.datatype = "ip4addr" -for i, dataset in ipairs(luci.sys.net.arptable()) do +for i, dataset in ipairs(sys.net.arptable()) do to:value(dataset["IP address"]) end @@ -90,13 +102,6 @@ toport = s:taboption("general", Value, "dest_port", translate("Internal port (op toport.optional = true toport.placeholder = "0-65535" toport.datatype = "portrange" -toport:depends("proto", "tcp") -toport:depends("proto", "udp") -toport:depends("proto", "tcpudp") - -target = s:taboption("advanced", ListValue, "target", translate("Redirection type")) -target:value("DNAT") -target:value("SNAT") dest = s:taboption("advanced", Value, "dest", translate("Destination zone")) dest.nocreate = true @@ -105,34 +110,32 @@ dest.template = "cbi/firewall_zonelist" src_dip = s:taboption("advanced", Value, "src_dip", translate("Intended destination address"), - translate( - "For DNAT, match incoming traffic directed at the given destination ".. - "ip address. For SNAT rewrite the source address to the given address." - )) + translate("Only match incoming traffic directed at the given IP address.")) src_dip.optional = true src_dip.datatype = "ip4addr" src_dip.placeholder = translate("any") -src_mac = s:taboption("advanced", Value, "src_mac", translate("Source MAC address")) +src_mac = s:taboption("advanced", DynamicList, "src_mac", + translate("Source MAC address"), + translate("Only match incoming traffic from these MACs.")) src_mac.optional = true src_mac.datatype = "macaddr" src_mac.placeholder = translate("any") -src_ip = s:taboption("advanced", Value, "src_ip", translate("Source IP address")) +src_ip = s:taboption("advanced", Value, "src_ip", + translate("Source IP address"), + translate("Only match incoming traffic from this IP or range.")) src_ip.optional = true -src_ip.datatype = "neg_ip4addr" +src_ip.datatype = "neg(ip4addr)" src_ip.placeholder = translate("any") -sport = s:taboption("advanced", Value, "src_port", translate("Source port"), - translate("Match incoming traffic originating from the given " .. - "source port or port range on the client host")) +sport = s:taboption("advanced", Value, "src_port", + translate("Source port"), + translate("Only match incoming traffic originating from the given source port or port range on the client host")) sport.optional = true sport.datatype = "portrange" -sport.placeholder = "0-65536" -sport:depends("proto", "tcp") -sport:depends("proto", "udp") -sport:depends("proto", "tcpudp") +sport.placeholder = translate("any") reflection = s:taboption("advanced", Flag, "reflection", translate("Enable NAT Loopback")) reflection.rmempty = true diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/forwards.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/forwards.lua new file mode 100644 index 0000000000..3ab3658e9e --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/forwards.lua @@ -0,0 +1,141 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local ds = require "luci.dispatcher" +local ft = require "luci.tools.firewall" + +m = Map("firewall", translate("Firewall - Port Forwards"), + translate("Port forwarding allows remote computers on the Internet to \ + connect to a specific computer or service within the \ + private LAN.")) + +-- +-- Port Forwards +-- + +s = m:section(TypedSection, "redirect", translate("Port Forwards")) +s.template = "cbi/tblsection" +s.addremove = true +s.anonymous = true +s.sortable = true +s.extedit = ds.build_url("admin/network/firewall/forwards/%s") +s.template_addremove = "firewall/cbi_addforward" + +function s.create(self, section) + local n = m:formvalue("_newfwd.name") + local p = m:formvalue("_newfwd.proto") + local e = m:formvalue("_newfwd.extport") + local a = m:formvalue("_newfwd.intaddr") + local i = m:formvalue("_newfwd.intport") + + if p == "other" or (p and a) then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "DNAT") + self.map:set(created, "src", "wan") + self.map:set(created, "dest", "lan") + self.map:set(created, "proto", (p ~= "other") and p or "all") + self.map:set(created, "src_dport", e) + self.map:set(created, "dest_ip", a) + self.map:set(created, "dest_port", i) + self.map:set(created, "_name", n) + end + + if p ~= "other" then + created = nil + end +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin", "network", "firewall", "redirect", created + )) + end +end + +function s.filter(self, sid) + return (self.map:get(sid, "target") ~= "SNAT") +end + +name = s:option(DummyValue, "_name", translate("Name")) +function name.cfgvalue(self, s) + return self.map:get(s, "_name") or "-" +end + +proto = s:option(DummyValue, "proto", translate("Protocol")) +proto.rawhtml = true +function proto.cfgvalue(self, s) + return ft.fmt_proto(self.map:get(s, "proto")) or "Any" +end + + +src = s:option(DummyValue, "src", translate("Source")) +src.rawhtml = true +src.width = "20%" +function src.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "src")) + local a = ft.fmt_ip(self.map:get(s, "src_ip")) + local p = ft.fmt_port(self.map:get(s, "src_port")) + local m = ft.fmt_mac(self.map:get(s, "src_mac")) + + local s = "From %s in %s " %{ + (a or "<var>any host</var>"), + (z or "<var>any zone</var>") + } + + if p and m then + s = s .. "with source %s and %s" %{ p, m } + elseif p or m then + s = s .. "with source %s" %( p or m ) + end + + return s +end + +via = s:option(DummyValue, "via", translate("Via")) +via.rawhtml = true +via.width = "20%" +function via.cfgvalue(self, s) + local a = ft.fmt_ip(self.map:get(s, "src_dip")) + local p = ft.fmt_port(self.map:get(s, "src_dport")) + + --local z = self.map:get(s, "src") + --local s = "To %s " %(a or "<var>any %s IP</var>" %( z or "router" )) + + return "To %s%s" %{ + (a or "<var>any router IP</var>"), + (p and " at %s" % p or "") + } +end + +dest = s:option(DummyValue, "dest", translate("Destination")) +dest.rawhtml = true +dest.width = "30%" +function dest.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local a = ft.fmt_ip(self.map:get(s, "dest_ip")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) or + ft.fmt_port(self.map:get(s, "src_dport")) + + return "Forward to %s%s in %s " %{ + (a or "<var>any host</var>"), + (p and ", %s" % p or ""), + (z or "<var>any zone</var>") + } +end + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/rule-details.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/rule-details.lua new file mode 100644 index 0000000000..1f7df65136 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/rule-details.lua @@ -0,0 +1,300 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> +Copyright 2010 Jo-Philipp Wich <xm@subsignal.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local sys = require "luci.sys" +local dsp = require "luci.dispatcher" +local nxo = require "nixio" + +local nw = require "luci.model.network" +local m, s, o, k, v + +arg[1] = arg[1] or "" + +m = Map("firewall", + translate("Firewall - Traffic Rules"), + translate("This page allows you to change advanced properties of the \ + traffic rule entry, such as matched source and destination \ + hosts.")) + +m.redirect = dsp.build_url("admin/network/firewall/rules") + +nw.init(m.uci) + +local rule_type = m.uci:get("firewall", arg[1]) +if rule_type == "redirect" and m:get(arg[1], "target") ~= "SNAT" then + rule_type = nil +end + +if not rule_type then + luci.http.redirect(m.redirect) + return + +-- +-- SNAT +-- +elseif rule_type == "redirect" then + + local name = m:get(arg[1], "_name") + if not name or #name == 0 then + name = translate("(Unnamed SNAT)") + else + name = "SNAT %s" % name + end + + m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name } + + local wan_zone = nil + + m.uci:foreach("firewall", "zone", + function(s) + local n = s.network or s.name + if n then + local i + for i in n:gmatch("%S+") do + if i == "wan" then + wan_zone = s.name + return false + end + end + end + end) + + s = m:section(NamedSection, arg[1], "redirect", "") + s.anonymous = true + s.addremove = false + + + o = s:option(Value, "_name", translate("Name")) + o.rmempty = true + o.size = 10 + + + o = s:option(Value, "proto", + translate("Protocol"), + translate("You may specify multiple by selecting \"-- custom --\" and \ + then entering protocols separated by space.")) + + o:value("all", "All protocols") + o:value("tcp udp", "TCP+UDP") + o:value("tcp", "TCP") + o:value("udp", "UDP") + o:value("icmp", "ICMP") + + function o.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v + end + + + o = s:option(Value, "src", translate("Source zone")) + o.nocreate = true + o.default = "wan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(DynamicList, "src_mac", translate("Source MAC address")) + o.rmempty = true + o.datatype = "neg(macaddr)" + o.placeholder = translate("any") + + + o = s:option(Value, "src_ip", translate("Source IP address")) + o.rmempty = true + o.datatype = "neg(ip4addr)" + o.placeholder = translate("any") + + + o = s:option(Value, "src_port", + translate("Source port"), + translate("Match incoming traffic originating from the given source \ + port or port range on the client host.")) + o.rmempty = true + o.datatype = "neg(portrange)" + o.placeholder = translate("any") + + + o = s:option(Value, "dest", translate("Destination zone")) + o.nocreate = true + o.default = "lan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "dest_ip", translate("Destination IP address")) + o.datatype = "neg(ip4addr)" + + for i, dataset in ipairs(luci.sys.net.arptable()) do + o:value(dataset["IP address"]) + end + + + o = s:option(Value, "dest_port", + translate("Destination port"), + translate("Match forwarded traffic to the given destination port or \ + port range.")) + + o.rmempty = true + o.placeholder = translate("any") + o.datatype = "portrange" + + + o = s:option(Value, "src_dip", + translate("SNAT IP address"), + translate("Rewrite matched traffic to the given address.")) + o.rmempty = false + o.datatype = "ip4addr" + + for k, v in ipairs(nw:get_interfaces()) do + local a + for k, a in ipairs(v:ipaddrs()) do + o:value(a:host():string(), '%s (%s)' %{ + a:host():string(), v:shortname() + }) + end + end + + + o = s:option(Value, "src_dport", translate("SNAT port"), + translate("Rewrite matched traffic to the given source port. May be \ + left empty to only rewrite the IP address.")) + o.datatype = "portrange" + o.rmempty = true + o.placeholder = translate('Do not rewrite') + + +-- +-- Rule +-- +else + s = m:section(NamedSection, arg[1], "rule", "") + s.anonymous = true + s.addremove = false + + s:option(Value, "_name", translate("Name").." "..translate("(optional)")) + + + o = s:option(ListValue, "family", translate("Restrict to address family")) + o.rmempty = true + o:value("", translate("IPv4 and IPv6")) + o:value("ipv4", translate("IPv4 only")) + o:value("ipv6", translate("IPv6 only")) + + + o = s:option(Value, "proto", translate("Protocol")) + o:value("all", translate("Any")) + o:value("tcp udp", "TCP+UDP") + o:value("tcp", "TCP") + o:value("udp", "UDP") + o:value("icmp", "ICMP") + + function o.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v + end + + + o = s:option(DynamicList, "icmp_type", translate("Match ICMP type")) + o:value("", "any") + o:value("echo-reply") + o:value("destination-unreachable") + o:value("network-unreachable") + o:value("host-unreachable") + o:value("protocol-unreachable") + o:value("port-unreachable") + o:value("fragmentation-needed") + o:value("source-route-failed") + o:value("network-unknown") + o:value("host-unknown") + o:value("network-prohibited") + o:value("host-prohibited") + o:value("TOS-network-unreachable") + o:value("TOS-host-unreachable") + o:value("communication-prohibited") + o:value("host-precedence-violation") + o:value("precedence-cutoff") + o:value("source-quench") + o:value("redirect") + o:value("network-redirect") + o:value("host-redirect") + o:value("TOS-network-redirect") + o:value("TOS-host-redirect") + o:value("echo-request") + o:value("router-advertisement") + o:value("router-solicitation") + o:value("time-exceeded") + o:value("ttl-zero-during-transit") + o:value("ttl-zero-during-reassembly") + o:value("parameter-problem") + o:value("ip-header-bad") + o:value("required-option-missing") + o:value("timestamp-request") + o:value("timestamp-reply") + o:value("address-mask-request") + o:value("address-mask-reply") + + + o = s:option(Value, "src", translate("Source zone")) + o.nocreate = true + o.allowany = true + o.default = "wan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "src_mac", translate("Source MAC address")) + o.datatype = "list(macaddr)" + o.placeholder = translate("any") + + + o = s:option(Value, "src_ip", translate("Source address")) + o.datatype = "neg(ipaddr)" + o.placeholder = translate("any") + + + o = s:option(Value, "src_port", translate("Source port")) + o.datatype = "list(neg,portrange)" + o.placeholder = translate("any") + + + o = s:option(Value, "dest", translate("Destination zone")) + o.nocreate = true + o.allowany = true + o.allowlocal = true + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "dest_ip", translate("Destination address")) + o.datatype = "neg(ipaddr)" + o.placeholder = translate("any") + + + o = s:option(Value, "dest_port", translate("Destination port")) + o.datatype = "list(neg,portrange)" + o.placeholder = translate("any") + + + o = s:option(ListValue, "target", translate("Action")) + o.default = "ACCEPT" + o:value("DROP", translate("drop")) + o:value("ACCEPT", translate("accept")) + o:value("REJECT", translate("reject")) + o:value("NOTRACK", translate("don't track")) +end + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/rules.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/rules.lua new file mode 100644 index 0000000000..05e98a9db7 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/rules.lua @@ -0,0 +1,300 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local ds = require "luci.dispatcher" +local ft = require "luci.tools.firewall" + +m = Map("firewall", + translate("Firewall - Traffic Rules"), + translate("Traffic rules define policies for packets traveling between \ + different zones, for example to reject traffic between certain hosts \ + or to open WAN ports on the router.")) + +-- +-- Rules +-- + +s = m:section(TypedSection, "rule", translate("Traffic Rules")) +s.addremove = true +s.anonymous = true +s.sortable = true +s.template = "cbi/tblsection" +s.extedit = ds.build_url("admin/network/firewall/rules/%s") +s.defaults.target = "ACCEPT" +s.template_addremove = "firewall/cbi_addrule" + + +function s.create(self, section) + created = TypedSection.create(self, section) +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + + local i_n = m:formvalue("_newopen.name") + local i_p = m:formvalue("_newopen.proto") + local i_e = m:formvalue("_newopen.extport") + local i_x = m:formvalue("_newopen.submit") + + local f_n = m:formvalue("_newfwd.name") + local f_s = m:formvalue("_newfwd.src") + local f_d = m:formvalue("_newfwd.dest") + local f_x = m:formvalue("_newfwd.submit") + + if i_x then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "ACCEPT") + self.map:set(created, "src", "wan") + self.map:set(created, "proto", (i_p ~= "other") and i_p or "all") + self.map:set(created, "dest_port", i_e) + self.map:set(created, "_name", i_n) + + if i_p ~= "other" and i_e and #i_e > 0 then + created = nil + end + + elseif f_x then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "ACCEPT") + self.map:set(created, "src", f_s) + self.map:set(created, "dest", f_d) + self.map:set(created, "_name", f_n) + end + + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin", "network", "firewall", "rules", created + )) + end +end + +name = s:option(DummyValue, "_name", translate("Name")) +function name.cfgvalue(self, s) + return self.map:get(s, "_name") or "-" +end + +family = s:option(DummyValue, "family", translate("Family")) +function family.cfgvalue(self, s) + local f = self.map:get(s, "family") + if f and f:match("4") then + return translate("IPv4") + elseif f and f:match("6") then + return translate("IPv6") + else + return translate("Any") + end +end + +proto = s:option(DummyValue, "proto", translate("Protocol")) +proto.rawhtml = true +proto.width = "20%" +function proto.cfgvalue(self, s) + return ft.fmt_proto(self.map:get(s, "proto"), self.map:get(s, "icmp_type")) + or "TCP+UDP" +end + +src = s:option(DummyValue, "src", translate("Source")) +src.rawhtml = true +src.width = "20%" +function src.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "src")) + local a = ft.fmt_ip(self.map:get(s, "src_ip")) + local p = ft.fmt_port(self.map:get(s, "src_port")) + local m = ft.fmt_mac(self.map:get(s, "src_mac")) + + local s = "From %s in %s " %{ + (a or "<var>any host</var>"), + (z or "<var>any zone</var>") + } + + if p and m then + s = s .. "with source %s and %s" %{ p, m } + elseif p or m then + s = s .. "with source %s" %( p or m ) + end + + return s +end + +dest = s:option(DummyValue, "dest", translate("Destination")) +dest.rawhtml = true +dest.width = "20%" +function dest.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local a = ft.fmt_ip(self.map:get(s, "dest_ip")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) + + -- Forward + if z then + return "To %s%s in %s" %{ + (a or "<var>any host</var>"), + (p and ", %s" % p or ""), + z + } + + -- Input + else + return "To %s%s on <var>this device</var>" %{ + (a or "<var>any router IP</var>"), + (p and " at %s" % p or "") + } + end +end + + +target = s:option(DummyValue, "target", translate("Action")) +target.rawhtml = true +target.width = "20%" +function target.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local l = ft.fmt_limit(self.map:get(s, "limit"), self.map:get(s, "limit_burst")) + local t = ft.fmt_target(self.map:get(s, "target")) + + return "<var>%s</var> %s%s" %{ + t, + (z and "forward" or "input"), + (l and " and limit to %s" % l or "") + } +end + + +-- +-- SNAT +-- + +s = m:section(TypedSection, "redirect", + translate("Source NAT"), + translate("Source NAT is a specific form of masquerading which allows \ + fine grained control over the source IP used for outgoing traffic, \ + for example to map multiple WAN addresses to internal subnets.")) +s.template = "cbi/tblsection" +s.addremove = true +s.anonymous = true +s.sortable = true +s.extedit = ds.build_url("admin/network/firewall/rules/%s") +s.template_addremove = "firewall/cbi_addsnat" + +function s.create(self, section) + created = TypedSection.create(self, section) +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + + local n = m:formvalue("_newsnat.name") + local s = m:formvalue("_newsnat.src") + local d = m:formvalue("_newsnat.dest") + local a = m:formvalue("_newsnat.dip") + local p = m:formvalue("_newsnat.dport") + local x = m:formvalue("_newsnat.submit") + + if x and a and #a > 0 then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "SNAT") + self.map:set(created, "src", s) + self.map:set(created, "dest", d) + self.map:set(created, "proto", "all") + self.map:set(created, "src_dip", a) + self.map:set(created, "src_dport", p) + self.map:set(created, "_name", n) + end + + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin/network/firewall/rules", created + )) + end +end + +function s.filter(self, sid) + return (self.map:get(sid, "target") == "SNAT") +end + +name = s:option(DummyValue, "_name", translate("Name")) +function name.cfgvalue(self, s) + return self.map:get(s, "_name") or "-" +end + +proto = s:option(DummyValue, "proto", translate("Protocol")) +proto.rawhtml = true +function proto.cfgvalue(self, s) + return ft.fmt_proto(self.map:get(s, "proto")) or "TCP+UDP" +end + + +src = s:option(DummyValue, "src", translate("Source")) +src.rawhtml = true +src.width = "20%" +function src.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "src")) + local a = ft.fmt_ip(self.map:get(s, "src_ip")) + local p = ft.fmt_port(self.map:get(s, "src_port")) + local m = ft.fmt_mac(self.map:get(s, "src_mac")) + + local s = "From %s in %s " %{ + (a or "<var>any host</var>"), + (z or "<var>any zone</var>") + } + + if p and m then + s = s .. "with source %s and %s" %{ p, m } + elseif p or m then + s = s .. "with source %s" %( p or m ) + end + + return s +end + +dest = s:option(DummyValue, "dest", translate("Destination")) +dest.rawhtml = true +dest.width = "30%" +function dest.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local a = ft.fmt_ip(self.map:get(s, "dest_ip")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) or + ft.fmt_port(self.map:get(s, "src_dport")) + + return "To %s%s in %s " %{ + (a or "<var>any host</var>"), + (p and ", %s" % p or ""), + (z or "<var>any zone</var>") + } +end + +snat = s:option(DummyValue, "via", translate("SNAT")) +snat.rawhtml = true +snat.width = "20%" +function snat.cfgvalue(self, s) + local a = ft.fmt_ip(self.map:get(s, "src_dip")) + local p = ft.fmt_port(self.map:get(s, "src_dport")) + + --local z = self.map:get(s, "src") + --local s = "To %s " %(a or "<var>any %s IP</var>" %( z or "router" )) + + if a and p then + return "Rewrite to source %s, %s" %{ a, p } + elseif a or p then + return "Rewrite to source %s" %( a or p ) + else + return "Bug" + end +end + + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua index 8c9c09102f..a8ae894417 100644 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua @@ -14,15 +14,16 @@ $Id$ local nw = require "luci.model.network" local fw = require "luci.model.firewall" -local utl = require "luci.util" -local dsp = require "luci.dispatcher" +local ds = require "luci.dispatcher" +local ut = require "luci.util" + +local m, p, i, v +local s, name, net, family, msrc, mdest, log, lim +local s2, out, inp -local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") -local out, inp -require("luci.tools.webadmin") m = Map("firewall", translate("Firewall - Zone Settings")) -m.redirect = luci.dispatcher.build_url("admin/network/firewall") +m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones") fw.init(m.uci) nw.init(m.uci) @@ -30,20 +31,25 @@ nw.init(m.uci) local zone = fw:get_zone(arg[1]) if not zone then - luci.http.redirect(dsp.build_url("admin", "network", "firewall")) + luci.http.redirect(dsp.build_url("admin/network/firewall/zones")) return +else + m.title = "%s - %s" %{ + translate("Firewall - Zone Settings"), + translatef("Zone %q", zone:name() or "?") + } end s = m:section(NamedSection, zone.sid, "zone", translatef("Zone %q", zone:name()), - translatef("This section defines common properties of %q. " .. - "The <em>input</em> and <em>output</em> options set the default ".. - "policies for traffic entering and leaving this zone while the " .. - "<em>forward</em> option describes the policy for forwarded traffic " .. - "between different networks within the zone. " .. - "<em>Covered networks</em> specifies which available networks are " .. - "member of this zone.", zone:name())) + translatef("This section defines common properties of %q. \ + The <em>input</em> and <em>output</em> options set the default \ + policies for traffic entering and leaving this zone while the \ + <em>forward</em> option describes the policy for forwarded traffic \ + between different networks within the zone. \ + <em>Covered networks</em> specifies which available networks are \ + member of this zone.", zone:name())) s.anonymous = true s.addremove = false @@ -73,15 +79,18 @@ function name.write(self, section, value) inp.exclude = value end - m.redirect = luci.dispatcher.build_url( - "admin", "network", "firewall", "zones", value - ) + m.redirect = ds.build_url("admin/network/firewall/zones", value) + m.title = "%s - %s" %{ + translate("Firewall - Zone Settings"), + translatef("Zone %q", value or "?") + } end -p = {} -p[1] = s:taboption("general", ListValue, "input", translate("Input")) -p[2] = s:taboption("general", ListValue, "output", translate("Output")) -p[3] = s:taboption("general", ListValue, "forward", translate("Forward")) +p = { + s:taboption("general", ListValue, "input", translate("Input")), + s:taboption("general", ListValue, "output", translate("Output")), + s:taboption("general", ListValue, "forward", translate("Forward")) +} for i, v in ipairs(p) do v:value("REJECT", translate("reject")) @@ -109,27 +118,25 @@ function net.write(self, section, value) zone:clear_networks() local n - for n in utl.imatch(value) do + for n in ut.imatch(value) do zone:add_network(n) end end -if has_v2 then - family = s:taboption("advanced", ListValue, "family", - translate("Restrict to address family")) +family = s:taboption("advanced", ListValue, "family", + translate("Restrict to address family")) - family.rmempty = true - family:value("", translate("IPv4 and IPv6")) - family:value("ipv4", translate("IPv4 only")) - family:value("ipv6", translate("IPv6 only")) -end +family.rmempty = true +family:value("", translate("IPv4 and IPv6")) +family:value("ipv4", translate("IPv4 only")) +family:value("ipv6", translate("IPv6 only")) msrc = s:taboption("advanced", DynamicList, "masq_src", translate("Restrict Masquerading to given source subnets")) msrc.optional = true -msrc.datatype = "neg(network)" +msrc.datatype = "neg_network_ip4addr" msrc.placeholder = "0.0.0.0/0" msrc:depends("family", "") msrc:depends("family", "ipv4") @@ -138,7 +145,7 @@ mdest = s:taboption("advanced", DynamicList, "masq_dest", translate("Restrict Masquerading to given destination subnets")) mdest.optional = true -mdest.datatype = "neg(network)" +mdest.datatype = "neg_network_ip4addr" mdest.placeholder = "0.0.0.0/0" mdest:depends("family", "") mdest:depends("family", "ipv4") @@ -146,30 +153,28 @@ mdest:depends("family", "ipv4") s:taboption("advanced", Flag, "conntrack", translate("Force connection tracking")) -if has_v2 then - log = s:taboption("advanced", Flag, "log", - translate("Enable logging on this zone")) +log = s:taboption("advanced", Flag, "log", + translate("Enable logging on this zone")) - log.rmempty = true - log.enabled = "1" +log.rmempty = true +log.enabled = "1" - lim = s:taboption("advanced", Value, "log_limit", - translate("Limit log messages")) +lim = s:taboption("advanced", Value, "log_limit", + translate("Limit log messages")) - lim.placeholder = "10/minute" - lim:depends("log", "1") -end +lim.placeholder = "10/minute" +lim:depends("log", "1") s2 = m:section(NamedSection, zone.sid, "fwd_out", translate("Inter-Zone Forwarding"), - translatef("The options below control the forwarding policies between " .. - "this zone (%s) and other zones. <em>Destination zones</em> cover " .. - "forwarded traffic <strong>originating from %q</strong>. " .. - "<em>Source zones</em> match forwarded traffic from other zones " .. - "<strong>targeted at %q</strong>. The forwarding rule is " .. - "<em>unidirectional</em>, e.g. a forward from lan to wan does " .. - "<em>not</em> imply a permission to forward from wan to lan as well.", + translatef("The options below control the forwarding policies between \ + this zone (%s) and other zones. <em>Destination zones</em> cover \ + forwarded traffic <strong>originating from %q</strong>. \ + <em>Source zones</em> match forwarded traffic from other zones \ + <strong>targeted at %q</strong>. The forwarding rule is \ + <em>unidirectional</em>, e.g. a forward from lan to wan does \ + <em>not</em> imply a permission to forward from wan to lan as well.", zone:name(), zone:name(), zone:name() )) @@ -220,7 +225,7 @@ function out.write(self, section, value) zone:del_forwardings_by("src") local f - for f in utl.imatch(value) do + for f in ut.imatch(value) do zone:add_forwarding_to(f) end end @@ -229,7 +234,7 @@ function inp.write(self, section, value) zone:del_forwardings_by("dest") local f - for f in utl.imatch(value) do + for f in ut.imatch(value) do zone:add_forwarding_from(f) end end diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/zones.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/zones.lua new file mode 100644 index 0000000000..e6d8548bf4 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/zones.lua @@ -0,0 +1,88 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local ds = require "luci.dispatcher" +local fw = require "luci.model.firewall" + +local m, s, o, p, i, v + +m = Map("firewall", + translate("Firewall - Zone Settings"), + translate("The firewall creates zones over your network interfaces to control network traffic flow.")) + +fw.init(m.uci) + +s = m:section(TypedSection, "defaults", translate("General Settings")) +s.anonymous = true +s.addremove = false + +s:option(Flag, "syn_flood", translate("Enable SYN-flood protection")) + +o = s:option(Flag, "drop_invalid", translate("Drop invalid packets")) +o.default = o.disabled + +p = { + s:option(ListValue, "input", translate("Input")), + s:option(ListValue, "output", translate("Output")), + s:option(ListValue, "forward", translate("Forward")) +} + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + + +s = m:section(TypedSection, "zone", translate("Zones")) +s.template = "cbi/tblsection" +s.anonymous = true +s.addremove = true +s.extedit = ds.build_url("admin", "network", "firewall", "zones", "%s") + +function s.create(self) + local z = fw:new_zone() + if z then + luci.http.redirect( + ds.build_url("admin", "network", "firewall", "zones", z.sid) + ) + end +end + +function s.remove(self, section) + return fw:del_zone(section) +end + +o = s:option(DummyValue, "_info", translate("Zone ⇒ Forwardings")) +o.template = "cbi/firewall_zoneforwards" +o.cfgvalue = function(self, section) + return self.map:get(section, "name") +end + +p = { + s:option(ListValue, "input", translate("Input")), + s:option(ListValue, "output", translate("Output")), + s:option(ListValue, "forward", translate("Forward")) +} + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + +s:option(Flag, "masq", translate("Masquerading")) +s:option(Flag, "mtu_fix", translate("MSS clamping")) + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/miniportfw.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/miniportfw.lua deleted file mode 100644 index 44b15f2c77..0000000000 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/miniportfw.lua +++ /dev/null @@ -1,48 +0,0 @@ ---[[ -LuCI - Lua Configuration Interface - -Copyright 2008 Steven Barth <steven@midlink.org> - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -$Id$ -]]-- -require("luci.sys") -m = Map("firewall", translate("Port forwarding"), - translate("Port forwarding allows to provide network services in " .. - "the internal network to an external network.")) - - -s = m:section(TypedSection, "redirect", "") -s:depends("src", "wan") -s.defaults.src = "wan" - -s.template = "cbi/tblsection" -s.addremove = true -s.anonymous = true - -name = s:option(Value, "_name", translate("Name"), translate("(optional)")) -name.size = 10 - -proto = s:option(ListValue, "proto", translate("Protocol")) -proto:value("tcp", "TCP") -proto:value("udp", "UDP") -proto:value("tcpudp", "TCP+UDP") - -dport = s:option(Value, "src_dport", translate("External port")) -dport.size = 5 - -to = s:option(Value, "dest_ip", translate("Internal IP address")) -for i, dataset in ipairs(luci.sys.net.arptable()) do - to:value(dataset["IP address"]) -end - -toport = s:option(Value, "dest_port", translate("Internal port"), - translate("(optional)")) -toport.size = 5 - -return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/trule.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/trule.lua deleted file mode 100644 index 10a9869490..0000000000 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/trule.lua +++ /dev/null @@ -1,155 +0,0 @@ ---[[ -LuCI - Lua Configuration Interface - -Copyright 2008 Steven Barth <steven@midlink.org> -Copyright 2010 Jo-Philipp Wich <xm@subsignal.org> - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -$Id$ -]]-- - -local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") -local dsp = require "luci.dispatcher" - -arg[1] = arg[1] or "" - -m = Map("firewall", translate("Advanced Rules"), - translate("Advanced rules let you customize the firewall to your " .. - "needs. Only new connections will be matched. Packets " .. - "belonging to already open connections are automatically " .. - "allowed to pass the firewall.")) - -m.redirect = dsp.build_url("admin", "network", "firewall") - -if not m.uci:get(arg[1]) == "rule" then - luci.http.redirect(m.redirect) - return -end - -s = m:section(NamedSection, arg[1], "rule", "") -s.anonymous = true -s.addremove = false - -s:tab("general", translate("General Settings")) -s:tab("advanced", translate("Advanced Options")) - -back = s:option(DummyValue, "_overview", translate("Overview")) -back.value = "" -back.titleref = dsp.build_url("admin", "network", "firewall", "rule") - - -name = s:taboption("general", Value, "_name", translate("Name").." "..translate("(optional)")) -name.rmempty = true - -src = s:taboption("general", Value, "src", translate("Source zone")) -src.nocreate = true -src.default = "wan" -src.template = "cbi/firewall_zonelist" - -dest = s:taboption("advanced", Value, "dest", translate("Destination zone")) -dest.nocreate = true -dest.allowlocal = true -dest.template = "cbi/firewall_zonelist" - -proto = s:taboption("general", Value, "proto", translate("Protocol")) -proto.optional = true -proto:value("all", translate("Any")) -proto:value("tcpudp", "TCP+UDP") -proto:value("tcp", "TCP") -proto:value("udp", "UDP") -proto:value("icmp", "ICMP") - -icmpt = s:taboption("general", Value, "icmp_type", translate("Match ICMP type")) -icmpt:depends("proto", "icmp") -icmpt:value("", "any") -icmpt:value("echo-reply") -icmpt:value("destination-unreachable") -icmpt:value("network-unreachable") -icmpt:value("host-unreachable") -icmpt:value("protocol-unreachable") -icmpt:value("port-unreachable") -icmpt:value("fragmentation-needed") -icmpt:value("source-route-failed") -icmpt:value("network-unknown") -icmpt:value("host-unknown") -icmpt:value("network-prohibited") -icmpt:value("host-prohibited") -icmpt:value("TOS-network-unreachable") -icmpt:value("TOS-host-unreachable") -icmpt:value("communication-prohibited") -icmpt:value("host-precedence-violation") -icmpt:value("precedence-cutoff") -icmpt:value("source-quench") -icmpt:value("redirect") -icmpt:value("network-redirect") -icmpt:value("host-redirect") -icmpt:value("TOS-network-redirect") -icmpt:value("TOS-host-redirect") -icmpt:value("echo-request") -icmpt:value("router-advertisement") -icmpt:value("router-solicitation") -icmpt:value("time-exceeded") -icmpt:value("ttl-zero-during-transit") -icmpt:value("ttl-zero-during-reassembly") -icmpt:value("parameter-problem") -icmpt:value("ip-header-bad") -icmpt:value("required-option-missing") -icmpt:value("timestamp-request") -icmpt:value("timestamp-reply") -icmpt:value("address-mask-request") -icmpt:value("address-mask-reply") - -src_ip = s:taboption("general", Value, "src_ip", translate("Source address")) -src_ip.optional = true -src_ip.datatype = has_v2 and "neg_ipaddr" or "neg_ip4addr" -src_ip.placeholder = translate("any") - -sport = s:taboption("general", Value, "src_port", translate("Source port")) -sport.optional = true -sport.datatype = "portrange" -sport.placeholder = "0-65535" -sport:depends("proto", "tcp") -sport:depends("proto", "udp") -sport:depends("proto", "tcpudp") - -dest_ip = s:taboption("general", Value, "dest_ip", translate("Destination address")) -dest_ip.optional = true -dest_ip.datatype = has_v2 and "neg_ipaddr" or "neg_ip4addr" -dest_ip.placeholder = translate("any") - -dport = s:taboption("general", Value, "dest_port", translate("Destination port")) -dport.optional = true -dport.datatype = "portrange" -dport:depends("proto", "tcp") -dport:depends("proto", "udp") -dport:depends("proto", "tcpudp") -dport.placeholder = "0-65535" - -jump = s:taboption("general", ListValue, "target", translate("Action")) -jump.rmempty = true -jump.default = "ACCEPT" -jump:value("DROP", translate("drop")) -jump:value("ACCEPT", translate("accept")) -jump:value("REJECT", translate("reject")) -jump:value("NOTRACK", translate("don't track")) - - -smac = s:taboption("advanced", Value, "src_mac", translate("Source MAC address")) -smac.optional = true -smac.datatype = "macaddr" -smac.placeholder = translate("any") - -if has_v2 then - family = s:taboption("advanced", ListValue, "family", translate("Restrict to address family")) - family.rmempty = true - family:value("", translate("IPv4 and IPv6")) - family:value("ipv4", translate("IPv4 only")) - family:value("ipv6", translate("IPv6 only")) -end - -return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zones.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/zones.lua deleted file mode 100644 index 79604c263f..0000000000 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zones.lua +++ /dev/null @@ -1,273 +0,0 @@ ---[[ -LuCI - Lua Configuration Interface - -Copyright 2008 Steven Barth <steven@midlink.org> - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -$Id$ -]]-- - -local nw = require "luci.model.network" -local fw = require "luci.model.firewall" -local ds = require "luci.dispatcher" - -local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") - -require("luci.tools.webadmin") -m = Map("firewall", translate("Firewall"), translate("The firewall creates zones over your network interfaces to control network traffic flow.")) - -fw.init(m.uci) -nw.init(m.uci) - -s = m:section(TypedSection, "defaults") -s.anonymous = true -s.addremove = false - -s:tab("general", translate("General Settings")) -s:tab("custom", translate("Custom Rules")) - - -s:taboption("general", Flag, "syn_flood", translate("Enable SYN-flood protection")) - -local di = s:taboption("general", Flag, "drop_invalid", translate("Drop invalid packets")) -di.rmempty = false -function di.cfgvalue(...) - return AbstractValue.cfgvalue(...) or "1" -end - -p = {} -p[1] = s:taboption("general", ListValue, "input", translate("Input")) -p[2] = s:taboption("general", ListValue, "output", translate("Output")) -p[3] = s:taboption("general", ListValue, "forward", translate("Forward")) - -for i, v in ipairs(p) do - v:value("REJECT", translate("reject")) - v:value("DROP", translate("drop")) - v:value("ACCEPT", translate("accept")) -end - -custom = s:taboption("custom", Value, "_custom", - translate("Custom Rules (/etc/firewall.user)")) - -custom.template = "cbi/tvalue" -custom.rows = 20 - -function custom.cfgvalue(self, section) - return nixio.fs.readfile("/etc/firewall.user") -end - -function custom.write(self, section, value) - value = value:gsub("\r\n?", "\n") - nixio.fs.writefile("/etc/firewall.user", value) -end - - -s = m:section(TypedSection, "zone", translate("Zones")) -s.template = "cbi/tblsection" -s.anonymous = true -s.addremove = true -s.extedit = ds.build_url("admin", "network", "firewall", "zones", "%s") - -function s.create(self) - local z = fw:new_zone() - if z then - luci.http.redirect( - ds.build_url("admin", "network", "firewall", "zones", z.sid) - ) - end -end - -function s.remove(self, section) - return fw:del_zone(section) -end - -info = s:option(DummyValue, "_info", translate("Zone ⇒ Forwardings")) -info.template = "cbi/firewall_zoneforwards" -function info.cfgvalue(self, section) - return self.map:get(section, "name") -end - -p = {} -p[1] = s:option(ListValue, "input", translate("Input")) -p[2] = s:option(ListValue, "output", translate("Output")) -p[3] = s:option(ListValue, "forward", translate("Forward")) - -for i, v in ipairs(p) do - v:value("REJECT", translate("reject")) - v:value("DROP", translate("drop")) - v:value("ACCEPT", translate("accept")) -end - -s:option(Flag, "masq", translate("Masquerading")) -s:option(Flag, "mtu_fix", translate("MSS clamping")) - - -local created = nil - --- --- Redirects --- - -s = m:section(TypedSection, "redirect", translate("Redirections")) -s.template = "cbi/tblsection" -s.addremove = true -s.anonymous = true -s.sortable = true -s.extedit = ds.build_url("admin", "network", "firewall", "redirect", "%s") - -function s.create(self, section) - created = TypedSection.create(self, section) -end - -function s.parse(self, ...) - TypedSection.parse(self, ...) - if created then - m.uci:save("firewall") - luci.http.redirect(ds.build_url( - "admin", "network", "firewall", "redirect", created - )) - end -end - -name = s:option(DummyValue, "_name", translate("Name")) -function name.cfgvalue(self, s) - return self.map:get(s, "_name") or "-" -end - -proto = s:option(DummyValue, "proto", translate("Protocol")) -function proto.cfgvalue(self, s) - local p = self.map:get(s, "proto") - if not p or p == "tcpudp" then - return "TCP+UDP" - else - return p:upper() - end -end - -src = s:option(DummyValue, "src", translate("Source")) -function src.cfgvalue(self, s) - local rv = "%s:%s:%s" % { - self.map:get(s, "src") or "*", - self.map:get(s, "src_ip") or "0.0.0.0/0", - self.map:get(s, "src_port") or "*" - } - - local mac = self.map:get(s, "src_mac") - if mac then - rv = rv .. ", MAC " .. mac - end - - return rv -end - -via = s:option(DummyValue, "via", translate("Via")) -function via.cfgvalue(self, s) - return "%s:%s:%s" % { - translate("Device"), - self.map:get(s, "src_dip") or "0.0.0.0/0", - self.map:get(s, "src_dport") or "*" - } -end - -dest = s:option(DummyValue, "dest", translate("Destination")) -function dest.cfgvalue(self, s) - return "%s:%s:%s" % { - self.map:get(s, "dest") or "*", - self.map:get(s, "dest_ip") or "0.0.0.0/0", - self.map:get(s, "dest_port") or "*" - } -end - -target = s:option(DummyValue, "target", translate("Action")) -function target.cfgvalue(self, s) - return self.map:get(s, "target") or "DNAT" -end - - --- --- Rules --- - -s = m:section(TypedSection, "rule", translate("Rules")) -s.addremove = true -s.anonymous = true -s.sortable = true -s.template = "cbi/tblsection" -s.extedit = ds.build_url("admin", "network", "firewall", "rule", "%s") -s.defaults.target = "ACCEPT" - -function s.create(self, section) - local created = TypedSection.create(self, section) - m.uci:save("firewall") - luci.http.redirect(ds.build_url( - "admin", "network", "firewall", "rule", created - )) - return -end - -name = s:option(DummyValue, "_name", translate("Name")) -function name.cfgvalue(self, s) - return self.map:get(s, "_name") or "-" -end - -if has_v2 then - family = s:option(DummyValue, "family", translate("Family")) - function family.cfgvalue(self, s) - local f = self.map:get(s, "family") - if f and f:match("4") then - return translate("IPv4 only") - elseif f and f:match("6") then - return translate("IPv6 only") - else - return translate("IPv4 and IPv6") - end - end -end - -proto = s:option(DummyValue, "proto", translate("Protocol")) -function proto.cfgvalue(self, s) - local p = self.map:get(s, "proto") - local t = self.map:get(s, "icmp_type") - if p == "icmp" and t then - return "ICMP (%s)" % t - elseif p == "tcpudp" or not p then - return "TCP+UDP" - else - return p:upper() - end -end - -src = s:option(DummyValue, "src", translate("Source")) -function src.cfgvalue(self, s) - local rv = "%s:%s:%s" % { - self.map:get(s, "src") or "*", - self.map:get(s, "src_ip") or "0.0.0.0/0", - self.map:get(s, "src_port") or "*" - } - - local mac = self.map:get(s, "src_mac") - if mac then - rv = rv .. ", MAC " .. mac - end - - return rv -end - -dest = s:option(DummyValue, "dest", translate("Destination")) -function dest.cfgvalue(self, s) - return "%s:%s:%s" % { - self.map:get(s, "dest") or translate("Device"), - self.map:get(s, "dest_ip") or "0.0.0.0/0", - self.map:get(s, "dest_port") or "*" - } -end - - -s:option(DummyValue, "target", translate("Action")) - -return m |