From: Jo-Philipp Wich Date: Mon, 19 Dec 2011 21:16:31 +0000 (+0000) Subject: applications/luci-firewall: complete rework firewall ui X-Git-Tag: 0.11.0~1221 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=033de64a0f66e727cb97c54403614917a49cc577;p=oweals%2Fluci.git applications/luci-firewall: complete rework firewall ui - split zone setup, port forwards, traffic rules and firewall.user - add quickadd forms for various common rules like port forwards - add tool class for textual formatting and descriptions of rules - simplify controller, remove old mini admin remainders --- diff --git a/applications/luci-firewall/luasrc/controller/firewall.lua b/applications/luci-firewall/luasrc/controller/firewall.lua new file mode 100644 index 000000000..c0149f8cf --- /dev/null +++ b/applications/luci-firewall/luasrc/controller/firewall.lua @@ -0,0 +1,23 @@ +module("luci.controller.firewall", package.seeall) + +function index() + entry({"admin", "network", "firewall"}, + alias("admin", "network", "firewall", "zones"), + _("Firewall"), 60).i18n = "firewall" + + entry({"admin", "network", "firewall", "zones"}, + arcombine(cbi("firewall/zones"), cbi("firewall/zone-details")), + _("General Settings"), 10).leaf = true + + entry({"admin", "network", "firewall", "forwards"}, + arcombine(cbi("firewall/forwards"), cbi("firewall/forward-details")), + _("Port Forwards"), 20).leaf = true + + entry({"admin", "network", "firewall", "rules"}, + arcombine(cbi("firewall/rules"), cbi("firewall/rule-details")), + _("Traffic Rules"), 30).leaf = true + + entry({"admin", "network", "firewall", "custom"}, + cbi("firewall/custom"), + _("Custom Rules"), 40).leaf = true +end diff --git a/applications/luci-firewall/luasrc/controller/luci_fw/luci_fw.lua b/applications/luci-firewall/luasrc/controller/luci_fw/luci_fw.lua deleted file mode 100644 index b3d440d1c..000000000 --- a/applications/luci-firewall/luasrc/controller/luci_fw/luci_fw.lua +++ /dev/null @@ -1,10 +0,0 @@ -module("luci.controller.luci_fw.luci_fw", package.seeall) - -function index() - entry({"admin", "network", "firewall"}, alias("admin", "network", "firewall", "zones"), _("Firewall"), 60).i18n = "firewall" - entry({"admin", "network", "firewall", "zones"}, arcombine(cbi("luci_fw/zones"), cbi("luci_fw/zone")), nil, 10).leaf = true - entry({"admin", "network", "firewall", "rule"}, arcombine(cbi("luci_fw/zones"), cbi("luci_fw/trule")), nil, 20).leaf = true - entry({"admin", "network", "firewall", "redirect"}, arcombine(cbi("luci_fw/zones"), cbi("luci_fw/rrule")), nil, 30).leaf = true - - entry({"mini", "network", "portfw"}, cbi("luci_fw/miniportfw", {autoapply=true}), _("Port forwarding"), 70).i18n = "firewall" -end diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/custom.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/custom.lua new file mode 100644 index 000000000..9b53a8a62 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/custom.lua @@ -0,0 +1,38 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2011 Jo-Philipp Wich + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local fs = require "nixio.fs" + +local f = SimpleForm("firewall", + translate("Firewall - Custom Rules"), + translate("Custom rules allow you to execute arbritary iptables commands \ + which are not otherwise covered by the firewall framework. \ + The commands are executed after each firewall restart, right after \ + the default ruleset has been loaded.")) + +local o = f:field(Value, "_custom") + +o.template = "cbi/tvalue" +o.rows = 20 + +function o.cfgvalue(self, section) + return fs.readfile("/etc/firewall.user") +end + +function o.write(self, section, value) + value = value:gsub("\r\n?", "\n") + fs.writefile("/etc/firewall.user", value) +end + +return f diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/forward-details.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/forward-details.lua new file mode 100644 index 000000000..1cc5ecbb4 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/forward-details.lua @@ -0,0 +1,148 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2011 Jo-Philipp Wich + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local sys = require "luci.sys" +local dsp = require "luci.dispatcher" + +arg[1] = arg[1] or "" + +m = Map("firewall", + translate("Firewall - Port Forwards"), + translate("This page allows you to change advanced properties of the port \ + forwarding entry. In most cases there is no need to modify \ + those settings.")) + +m.redirect = dsp.build_url("admin/network/firewall/forwards") + +if m.uci:get("firewall", arg[1]) ~= "redirect" then + luci.http.redirect(m.redirect) + return +else + local name = m:get(arg[1], "_name") + if not name or #name == 0 then + name = translate("(Unnamed Entry)") + end + m.title = "%s - %s" %{ translate("Firewall - Port Forwards"), name } +end + +local wan_zone = nil + +m.uci:foreach("firewall", "zone", + function(s) + local n = s.network or s.name + if n then + local i + for i in n:gmatch("%S+") do + if i == "wan" then + wan_zone = s.name + return false + end + end + end + end) + +s = m:section(NamedSection, arg[1], "redirect", "") +s.anonymous = true +s.addremove = false + +s:tab("general", translate("General Settings")) +s:tab("advanced", translate("Advanced Settings")) + +name = s:taboption("general", Value, "_name", translate("Name")) +name.rmempty = true +name.size = 10 + +src = s:taboption("advanced", Value, "src", translate("Source zone")) +src.nocreate = true +src.default = "wan" +src.template = "cbi/firewall_zonelist" + +proto = s:taboption("general", Value, "proto", translate("Protocol")) +proto.optional = true +proto:value("tcp udp", "TCP+UDP") +proto:value("tcp", "TCP") +proto:value("udp", "UDP") +proto:value("icmp", "ICMP") + +function proto.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v +end + +dport = s:taboption("general", Value, "src_dport", translate("External port"), + translate("Match incoming traffic directed at the given " .. + "destination port or port range on this host")) +dport.datatype = "portrange" + +to = s:taboption("general", Value, "dest_ip", translate("Internal IP address"), + translate("Redirect matched incoming traffic to the specified " .. + "internal host")) +to.datatype = "ip4addr" +for i, dataset in ipairs(sys.net.arptable()) do + to:value(dataset["IP address"]) +end + +toport = s:taboption("general", Value, "dest_port", translate("Internal port (optional)"), + translate("Redirect matched incoming traffic to the given port on " .. + "the internal host")) +toport.optional = true +toport.placeholder = "0-65535" +toport.datatype = "portrange" + +dest = s:taboption("advanced", Value, "dest", translate("Destination zone")) +dest.nocreate = true +dest.default = "lan" +dest.template = "cbi/firewall_zonelist" + +src_dip = s:taboption("advanced", Value, "src_dip", + translate("Intended destination address"), + translate("Only match incoming traffic directed at the given IP address.")) + +src_dip.optional = true +src_dip.datatype = "ip4addr" +src_dip.placeholder = translate("any") + +src_mac = s:taboption("advanced", DynamicList, "src_mac", + translate("Source MAC address"), + translate("Only match incoming traffic from these MACs.")) +src_mac.optional = true +src_mac.datatype = "macaddr" +src_mac.placeholder = translate("any") + +src_ip = s:taboption("advanced", Value, "src_ip", + translate("Source IP address"), + translate("Only match incoming traffic from this IP or range.")) +src_ip.optional = true +src_ip.datatype = "neg(ip4addr)" +src_ip.placeholder = translate("any") + +sport = s:taboption("advanced", Value, "src_port", + translate("Source port"), + translate("Only match incoming traffic originating from the given source port or port range on the client host")) +sport.optional = true +sport.datatype = "portrange" +sport.placeholder = translate("any") + +reflection = s:taboption("advanced", Flag, "reflection", translate("Enable NAT Loopback")) +reflection.rmempty = true +reflection.default = reflection.enabled +reflection:depends({ target = "DNAT", src = wan_zone }) +reflection.cfgvalue = function(...) + return Flag.cfgvalue(...) or "1" +end + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/forwards.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/forwards.lua new file mode 100644 index 000000000..3ab3658e9 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/forwards.lua @@ -0,0 +1,141 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local ds = require "luci.dispatcher" +local ft = require "luci.tools.firewall" + +m = Map("firewall", translate("Firewall - Port Forwards"), + translate("Port forwarding allows remote computers on the Internet to \ + connect to a specific computer or service within the \ + private LAN.")) + +-- +-- Port Forwards +-- + +s = m:section(TypedSection, "redirect", translate("Port Forwards")) +s.template = "cbi/tblsection" +s.addremove = true +s.anonymous = true +s.sortable = true +s.extedit = ds.build_url("admin/network/firewall/forwards/%s") +s.template_addremove = "firewall/cbi_addforward" + +function s.create(self, section) + local n = m:formvalue("_newfwd.name") + local p = m:formvalue("_newfwd.proto") + local e = m:formvalue("_newfwd.extport") + local a = m:formvalue("_newfwd.intaddr") + local i = m:formvalue("_newfwd.intport") + + if p == "other" or (p and a) then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "DNAT") + self.map:set(created, "src", "wan") + self.map:set(created, "dest", "lan") + self.map:set(created, "proto", (p ~= "other") and p or "all") + self.map:set(created, "src_dport", e) + self.map:set(created, "dest_ip", a) + self.map:set(created, "dest_port", i) + self.map:set(created, "_name", n) + end + + if p ~= "other" then + created = nil + end +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin", "network", "firewall", "redirect", created + )) + end +end + +function s.filter(self, sid) + return (self.map:get(sid, "target") ~= "SNAT") +end + +name = s:option(DummyValue, "_name", translate("Name")) +function name.cfgvalue(self, s) + return self.map:get(s, "_name") or "-" +end + +proto = s:option(DummyValue, "proto", translate("Protocol")) +proto.rawhtml = true +function proto.cfgvalue(self, s) + return ft.fmt_proto(self.map:get(s, "proto")) or "Any" +end + + +src = s:option(DummyValue, "src", translate("Source")) +src.rawhtml = true +src.width = "20%" +function src.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "src")) + local a = ft.fmt_ip(self.map:get(s, "src_ip")) + local p = ft.fmt_port(self.map:get(s, "src_port")) + local m = ft.fmt_mac(self.map:get(s, "src_mac")) + + local s = "From %s in %s " %{ + (a or "any host"), + (z or "any zone") + } + + if p and m then + s = s .. "with source %s and %s" %{ p, m } + elseif p or m then + s = s .. "with source %s" %( p or m ) + end + + return s +end + +via = s:option(DummyValue, "via", translate("Via")) +via.rawhtml = true +via.width = "20%" +function via.cfgvalue(self, s) + local a = ft.fmt_ip(self.map:get(s, "src_dip")) + local p = ft.fmt_port(self.map:get(s, "src_dport")) + + --local z = self.map:get(s, "src") + --local s = "To %s " %(a or "any %s IP" %( z or "router" )) + + return "To %s%s" %{ + (a or "any router IP"), + (p and " at %s" % p or "") + } +end + +dest = s:option(DummyValue, "dest", translate("Destination")) +dest.rawhtml = true +dest.width = "30%" +function dest.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local a = ft.fmt_ip(self.map:get(s, "dest_ip")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) or + ft.fmt_port(self.map:get(s, "src_dport")) + + return "Forward to %s%s in %s " %{ + (a or "any host"), + (p and ", %s" % p or ""), + (z or "any zone") + } +end + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/rule-details.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/rule-details.lua new file mode 100644 index 000000000..1f7df6513 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/rule-details.lua @@ -0,0 +1,300 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth +Copyright 2010 Jo-Philipp Wich + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local sys = require "luci.sys" +local dsp = require "luci.dispatcher" +local nxo = require "nixio" + +local nw = require "luci.model.network" +local m, s, o, k, v + +arg[1] = arg[1] or "" + +m = Map("firewall", + translate("Firewall - Traffic Rules"), + translate("This page allows you to change advanced properties of the \ + traffic rule entry, such as matched source and destination \ + hosts.")) + +m.redirect = dsp.build_url("admin/network/firewall/rules") + +nw.init(m.uci) + +local rule_type = m.uci:get("firewall", arg[1]) +if rule_type == "redirect" and m:get(arg[1], "target") ~= "SNAT" then + rule_type = nil +end + +if not rule_type then + luci.http.redirect(m.redirect) + return + +-- +-- SNAT +-- +elseif rule_type == "redirect" then + + local name = m:get(arg[1], "_name") + if not name or #name == 0 then + name = translate("(Unnamed SNAT)") + else + name = "SNAT %s" % name + end + + m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name } + + local wan_zone = nil + + m.uci:foreach("firewall", "zone", + function(s) + local n = s.network or s.name + if n then + local i + for i in n:gmatch("%S+") do + if i == "wan" then + wan_zone = s.name + return false + end + end + end + end) + + s = m:section(NamedSection, arg[1], "redirect", "") + s.anonymous = true + s.addremove = false + + + o = s:option(Value, "_name", translate("Name")) + o.rmempty = true + o.size = 10 + + + o = s:option(Value, "proto", + translate("Protocol"), + translate("You may specify multiple by selecting \"-- custom --\" and \ + then entering protocols separated by space.")) + + o:value("all", "All protocols") + o:value("tcp udp", "TCP+UDP") + o:value("tcp", "TCP") + o:value("udp", "UDP") + o:value("icmp", "ICMP") + + function o.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v + end + + + o = s:option(Value, "src", translate("Source zone")) + o.nocreate = true + o.default = "wan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(DynamicList, "src_mac", translate("Source MAC address")) + o.rmempty = true + o.datatype = "neg(macaddr)" + o.placeholder = translate("any") + + + o = s:option(Value, "src_ip", translate("Source IP address")) + o.rmempty = true + o.datatype = "neg(ip4addr)" + o.placeholder = translate("any") + + + o = s:option(Value, "src_port", + translate("Source port"), + translate("Match incoming traffic originating from the given source \ + port or port range on the client host.")) + o.rmempty = true + o.datatype = "neg(portrange)" + o.placeholder = translate("any") + + + o = s:option(Value, "dest", translate("Destination zone")) + o.nocreate = true + o.default = "lan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "dest_ip", translate("Destination IP address")) + o.datatype = "neg(ip4addr)" + + for i, dataset in ipairs(luci.sys.net.arptable()) do + o:value(dataset["IP address"]) + end + + + o = s:option(Value, "dest_port", + translate("Destination port"), + translate("Match forwarded traffic to the given destination port or \ + port range.")) + + o.rmempty = true + o.placeholder = translate("any") + o.datatype = "portrange" + + + o = s:option(Value, "src_dip", + translate("SNAT IP address"), + translate("Rewrite matched traffic to the given address.")) + o.rmempty = false + o.datatype = "ip4addr" + + for k, v in ipairs(nw:get_interfaces()) do + local a + for k, a in ipairs(v:ipaddrs()) do + o:value(a:host():string(), '%s (%s)' %{ + a:host():string(), v:shortname() + }) + end + end + + + o = s:option(Value, "src_dport", translate("SNAT port"), + translate("Rewrite matched traffic to the given source port. May be \ + left empty to only rewrite the IP address.")) + o.datatype = "portrange" + o.rmempty = true + o.placeholder = translate('Do not rewrite') + + +-- +-- Rule +-- +else + s = m:section(NamedSection, arg[1], "rule", "") + s.anonymous = true + s.addremove = false + + s:option(Value, "_name", translate("Name").." "..translate("(optional)")) + + + o = s:option(ListValue, "family", translate("Restrict to address family")) + o.rmempty = true + o:value("", translate("IPv4 and IPv6")) + o:value("ipv4", translate("IPv4 only")) + o:value("ipv6", translate("IPv6 only")) + + + o = s:option(Value, "proto", translate("Protocol")) + o:value("all", translate("Any")) + o:value("tcp udp", "TCP+UDP") + o:value("tcp", "TCP") + o:value("udp", "UDP") + o:value("icmp", "ICMP") + + function o.cfgvalue(...) + local v = Value.cfgvalue(...) + if not v or v == "tcpudp" then + return "tcp udp" + end + return v + end + + + o = s:option(DynamicList, "icmp_type", translate("Match ICMP type")) + o:value("", "any") + o:value("echo-reply") + o:value("destination-unreachable") + o:value("network-unreachable") + o:value("host-unreachable") + o:value("protocol-unreachable") + o:value("port-unreachable") + o:value("fragmentation-needed") + o:value("source-route-failed") + o:value("network-unknown") + o:value("host-unknown") + o:value("network-prohibited") + o:value("host-prohibited") + o:value("TOS-network-unreachable") + o:value("TOS-host-unreachable") + o:value("communication-prohibited") + o:value("host-precedence-violation") + o:value("precedence-cutoff") + o:value("source-quench") + o:value("redirect") + o:value("network-redirect") + o:value("host-redirect") + o:value("TOS-network-redirect") + o:value("TOS-host-redirect") + o:value("echo-request") + o:value("router-advertisement") + o:value("router-solicitation") + o:value("time-exceeded") + o:value("ttl-zero-during-transit") + o:value("ttl-zero-during-reassembly") + o:value("parameter-problem") + o:value("ip-header-bad") + o:value("required-option-missing") + o:value("timestamp-request") + o:value("timestamp-reply") + o:value("address-mask-request") + o:value("address-mask-reply") + + + o = s:option(Value, "src", translate("Source zone")) + o.nocreate = true + o.allowany = true + o.default = "wan" + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "src_mac", translate("Source MAC address")) + o.datatype = "list(macaddr)" + o.placeholder = translate("any") + + + o = s:option(Value, "src_ip", translate("Source address")) + o.datatype = "neg(ipaddr)" + o.placeholder = translate("any") + + + o = s:option(Value, "src_port", translate("Source port")) + o.datatype = "list(neg,portrange)" + o.placeholder = translate("any") + + + o = s:option(Value, "dest", translate("Destination zone")) + o.nocreate = true + o.allowany = true + o.allowlocal = true + o.template = "cbi/firewall_zonelist" + + + o = s:option(Value, "dest_ip", translate("Destination address")) + o.datatype = "neg(ipaddr)" + o.placeholder = translate("any") + + + o = s:option(Value, "dest_port", translate("Destination port")) + o.datatype = "list(neg,portrange)" + o.placeholder = translate("any") + + + o = s:option(ListValue, "target", translate("Action")) + o.default = "ACCEPT" + o:value("DROP", translate("drop")) + o:value("ACCEPT", translate("accept")) + o:value("REJECT", translate("reject")) + o:value("NOTRACK", translate("don't track")) +end + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/rules.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/rules.lua new file mode 100644 index 000000000..05e98a9db --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/rules.lua @@ -0,0 +1,300 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local ds = require "luci.dispatcher" +local ft = require "luci.tools.firewall" + +m = Map("firewall", + translate("Firewall - Traffic Rules"), + translate("Traffic rules define policies for packets traveling between \ + different zones, for example to reject traffic between certain hosts \ + or to open WAN ports on the router.")) + +-- +-- Rules +-- + +s = m:section(TypedSection, "rule", translate("Traffic Rules")) +s.addremove = true +s.anonymous = true +s.sortable = true +s.template = "cbi/tblsection" +s.extedit = ds.build_url("admin/network/firewall/rules/%s") +s.defaults.target = "ACCEPT" +s.template_addremove = "firewall/cbi_addrule" + + +function s.create(self, section) + created = TypedSection.create(self, section) +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + + local i_n = m:formvalue("_newopen.name") + local i_p = m:formvalue("_newopen.proto") + local i_e = m:formvalue("_newopen.extport") + local i_x = m:formvalue("_newopen.submit") + + local f_n = m:formvalue("_newfwd.name") + local f_s = m:formvalue("_newfwd.src") + local f_d = m:formvalue("_newfwd.dest") + local f_x = m:formvalue("_newfwd.submit") + + if i_x then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "ACCEPT") + self.map:set(created, "src", "wan") + self.map:set(created, "proto", (i_p ~= "other") and i_p or "all") + self.map:set(created, "dest_port", i_e) + self.map:set(created, "_name", i_n) + + if i_p ~= "other" and i_e and #i_e > 0 then + created = nil + end + + elseif f_x then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "ACCEPT") + self.map:set(created, "src", f_s) + self.map:set(created, "dest", f_d) + self.map:set(created, "_name", f_n) + end + + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin", "network", "firewall", "rules", created + )) + end +end + +name = s:option(DummyValue, "_name", translate("Name")) +function name.cfgvalue(self, s) + return self.map:get(s, "_name") or "-" +end + +family = s:option(DummyValue, "family", translate("Family")) +function family.cfgvalue(self, s) + local f = self.map:get(s, "family") + if f and f:match("4") then + return translate("IPv4") + elseif f and f:match("6") then + return translate("IPv6") + else + return translate("Any") + end +end + +proto = s:option(DummyValue, "proto", translate("Protocol")) +proto.rawhtml = true +proto.width = "20%" +function proto.cfgvalue(self, s) + return ft.fmt_proto(self.map:get(s, "proto"), self.map:get(s, "icmp_type")) + or "TCP+UDP" +end + +src = s:option(DummyValue, "src", translate("Source")) +src.rawhtml = true +src.width = "20%" +function src.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "src")) + local a = ft.fmt_ip(self.map:get(s, "src_ip")) + local p = ft.fmt_port(self.map:get(s, "src_port")) + local m = ft.fmt_mac(self.map:get(s, "src_mac")) + + local s = "From %s in %s " %{ + (a or "any host"), + (z or "any zone") + } + + if p and m then + s = s .. "with source %s and %s" %{ p, m } + elseif p or m then + s = s .. "with source %s" %( p or m ) + end + + return s +end + +dest = s:option(DummyValue, "dest", translate("Destination")) +dest.rawhtml = true +dest.width = "20%" +function dest.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local a = ft.fmt_ip(self.map:get(s, "dest_ip")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) + + -- Forward + if z then + return "To %s%s in %s" %{ + (a or "any host"), + (p and ", %s" % p or ""), + z + } + + -- Input + else + return "To %s%s on this device" %{ + (a or "any router IP"), + (p and " at %s" % p or "") + } + end +end + + +target = s:option(DummyValue, "target", translate("Action")) +target.rawhtml = true +target.width = "20%" +function target.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local l = ft.fmt_limit(self.map:get(s, "limit"), self.map:get(s, "limit_burst")) + local t = ft.fmt_target(self.map:get(s, "target")) + + return "%s %s%s" %{ + t, + (z and "forward" or "input"), + (l and " and limit to %s" % l or "") + } +end + + +-- +-- SNAT +-- + +s = m:section(TypedSection, "redirect", + translate("Source NAT"), + translate("Source NAT is a specific form of masquerading which allows \ + fine grained control over the source IP used for outgoing traffic, \ + for example to map multiple WAN addresses to internal subnets.")) +s.template = "cbi/tblsection" +s.addremove = true +s.anonymous = true +s.sortable = true +s.extedit = ds.build_url("admin/network/firewall/rules/%s") +s.template_addremove = "firewall/cbi_addsnat" + +function s.create(self, section) + created = TypedSection.create(self, section) +end + +function s.parse(self, ...) + TypedSection.parse(self, ...) + + local n = m:formvalue("_newsnat.name") + local s = m:formvalue("_newsnat.src") + local d = m:formvalue("_newsnat.dest") + local a = m:formvalue("_newsnat.dip") + local p = m:formvalue("_newsnat.dport") + local x = m:formvalue("_newsnat.submit") + + if x and a and #a > 0 then + created = TypedSection.create(self, section) + + self.map:set(created, "target", "SNAT") + self.map:set(created, "src", s) + self.map:set(created, "dest", d) + self.map:set(created, "proto", "all") + self.map:set(created, "src_dip", a) + self.map:set(created, "src_dport", p) + self.map:set(created, "_name", n) + end + + if created then + m.uci:save("firewall") + luci.http.redirect(ds.build_url( + "admin/network/firewall/rules", created + )) + end +end + +function s.filter(self, sid) + return (self.map:get(sid, "target") == "SNAT") +end + +name = s:option(DummyValue, "_name", translate("Name")) +function name.cfgvalue(self, s) + return self.map:get(s, "_name") or "-" +end + +proto = s:option(DummyValue, "proto", translate("Protocol")) +proto.rawhtml = true +function proto.cfgvalue(self, s) + return ft.fmt_proto(self.map:get(s, "proto")) or "TCP+UDP" +end + + +src = s:option(DummyValue, "src", translate("Source")) +src.rawhtml = true +src.width = "20%" +function src.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "src")) + local a = ft.fmt_ip(self.map:get(s, "src_ip")) + local p = ft.fmt_port(self.map:get(s, "src_port")) + local m = ft.fmt_mac(self.map:get(s, "src_mac")) + + local s = "From %s in %s " %{ + (a or "any host"), + (z or "any zone") + } + + if p and m then + s = s .. "with source %s and %s" %{ p, m } + elseif p or m then + s = s .. "with source %s" %( p or m ) + end + + return s +end + +dest = s:option(DummyValue, "dest", translate("Destination")) +dest.rawhtml = true +dest.width = "30%" +function dest.cfgvalue(self, s) + local z = ft.fmt_zone(self.map:get(s, "dest")) + local a = ft.fmt_ip(self.map:get(s, "dest_ip")) + local p = ft.fmt_port(self.map:get(s, "dest_port")) or + ft.fmt_port(self.map:get(s, "src_dport")) + + return "To %s%s in %s " %{ + (a or "any host"), + (p and ", %s" % p or ""), + (z or "any zone") + } +end + +snat = s:option(DummyValue, "via", translate("SNAT")) +snat.rawhtml = true +snat.width = "20%" +function snat.cfgvalue(self, s) + local a = ft.fmt_ip(self.map:get(s, "src_dip")) + local p = ft.fmt_port(self.map:get(s, "src_dport")) + + --local z = self.map:get(s, "src") + --local s = "To %s " %(a or "any %s IP" %( z or "router" )) + + if a and p then + return "Rewrite to source %s, %s" %{ a, p } + elseif a or p then + return "Rewrite to source %s" %( a or p ) + else + return "Bug" + end +end + + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua new file mode 100644 index 000000000..a8ae89441 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua @@ -0,0 +1,242 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local nw = require "luci.model.network" +local fw = require "luci.model.firewall" +local ds = require "luci.dispatcher" +local ut = require "luci.util" + +local m, p, i, v +local s, name, net, family, msrc, mdest, log, lim +local s2, out, inp + + +m = Map("firewall", translate("Firewall - Zone Settings")) +m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones") + +fw.init(m.uci) +nw.init(m.uci) + + +local zone = fw:get_zone(arg[1]) +if not zone then + luci.http.redirect(dsp.build_url("admin/network/firewall/zones")) + return +else + m.title = "%s - %s" %{ + translate("Firewall - Zone Settings"), + translatef("Zone %q", zone:name() or "?") + } +end + + +s = m:section(NamedSection, zone.sid, "zone", + translatef("Zone %q", zone:name()), + translatef("This section defines common properties of %q. \ + The input and output options set the default \ + policies for traffic entering and leaving this zone while the \ + forward option describes the policy for forwarded traffic \ + between different networks within the zone. \ + Covered networks specifies which available networks are \ + member of this zone.", zone:name())) + +s.anonymous = true +s.addremove = false + +m.on_commit = function(map) + local zone = fw:get_zone(arg[1]) + if zone then + s.section = zone.sid + s2.section = zone.sid + end +end + + +s:tab("general", translate("General Settings")) +s:tab("advanced", translate("Advanced Settings")) + + +name = s:taboption("general", Value, "name", translate("Name")) +name.optional = false +name.forcewrite = true +name.datatype = "uciname" + +function name.write(self, section, value) + if zone:name() ~= value then + fw:rename_zone(zone:name(), value) + out.exclude = value + inp.exclude = value + end + + m.redirect = ds.build_url("admin/network/firewall/zones", value) + m.title = "%s - %s" %{ + translate("Firewall - Zone Settings"), + translatef("Zone %q", value or "?") + } +end + +p = { + s:taboption("general", ListValue, "input", translate("Input")), + s:taboption("general", ListValue, "output", translate("Output")), + s:taboption("general", ListValue, "forward", translate("Forward")) +} + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + +s:taboption("general", Flag, "masq", translate("Masquerading")) +s:taboption("general", Flag, "mtu_fix", translate("MSS clamping")) + +net = s:taboption("general", Value, "network", translate("Covered networks")) +net.template = "cbi/network_netlist" +net.widget = "checkbox" +net.cast = "string" + +function net.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function net.cfgvalue(self, section) + return Value.cfgvalue(self, section) or name:cfgvalue(section) +end + +function net.write(self, section, value) + zone:clear_networks() + + local n + for n in ut.imatch(value) do + zone:add_network(n) + end +end + + +family = s:taboption("advanced", ListValue, "family", + translate("Restrict to address family")) + +family.rmempty = true +family:value("", translate("IPv4 and IPv6")) +family:value("ipv4", translate("IPv4 only")) +family:value("ipv6", translate("IPv6 only")) + +msrc = s:taboption("advanced", DynamicList, "masq_src", + translate("Restrict Masquerading to given source subnets")) + +msrc.optional = true +msrc.datatype = "neg_network_ip4addr" +msrc.placeholder = "0.0.0.0/0" +msrc:depends("family", "") +msrc:depends("family", "ipv4") + +mdest = s:taboption("advanced", DynamicList, "masq_dest", + translate("Restrict Masquerading to given destination subnets")) + +mdest.optional = true +mdest.datatype = "neg_network_ip4addr" +mdest.placeholder = "0.0.0.0/0" +mdest:depends("family", "") +mdest:depends("family", "ipv4") + +s:taboption("advanced", Flag, "conntrack", + translate("Force connection tracking")) + +log = s:taboption("advanced", Flag, "log", + translate("Enable logging on this zone")) + +log.rmempty = true +log.enabled = "1" + +lim = s:taboption("advanced", Value, "log_limit", + translate("Limit log messages")) + +lim.placeholder = "10/minute" +lim:depends("log", "1") + + +s2 = m:section(NamedSection, zone.sid, "fwd_out", + translate("Inter-Zone Forwarding"), + translatef("The options below control the forwarding policies between \ + this zone (%s) and other zones. Destination zones cover \ + forwarded traffic originating from %q. \ + Source zones match forwarded traffic from other zones \ + targeted at %q. The forwarding rule is \ + unidirectional, e.g. a forward from lan to wan does \ + not imply a permission to forward from wan to lan as well.", + zone:name(), zone:name(), zone:name() + + )) + +out = s2:option(Value, "out", + translate("Allow forward to destination zones:")) + +out.nocreate = true +out.widget = "checkbox" +out.exclude = zone:name() +out.template = "cbi/firewall_zonelist" + +inp = s2:option(Value, "in", + translate("Allow forward from source zones:")) + +inp.nocreate = true +inp.widget = "checkbox" +inp.exclude = zone:name() +inp.template = "cbi/firewall_zonelist" + +function out.cfgvalue(self, section) + local v = { } + local f + for _, f in ipairs(zone:get_forwardings_by("src")) do + v[#v+1] = f:dest() + end + return table.concat(v, " ") +end + +function inp.cfgvalue(self, section) + local v = { } + local f + for _, f in ipairs(zone:get_forwardings_by("dest")) do + v[#v+1] = f:src() + end + return v +end + +function out.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function inp.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function out.write(self, section, value) + zone:del_forwardings_by("src") + + local f + for f in ut.imatch(value) do + zone:add_forwarding_to(f) + end +end + +function inp.write(self, section, value) + zone:del_forwardings_by("dest") + + local f + for f in ut.imatch(value) do + zone:add_forwarding_from(f) + end +end + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/zones.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/zones.lua new file mode 100644 index 000000000..e6d8548bf --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/firewall/zones.lua @@ -0,0 +1,88 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local ds = require "luci.dispatcher" +local fw = require "luci.model.firewall" + +local m, s, o, p, i, v + +m = Map("firewall", + translate("Firewall - Zone Settings"), + translate("The firewall creates zones over your network interfaces to control network traffic flow.")) + +fw.init(m.uci) + +s = m:section(TypedSection, "defaults", translate("General Settings")) +s.anonymous = true +s.addremove = false + +s:option(Flag, "syn_flood", translate("Enable SYN-flood protection")) + +o = s:option(Flag, "drop_invalid", translate("Drop invalid packets")) +o.default = o.disabled + +p = { + s:option(ListValue, "input", translate("Input")), + s:option(ListValue, "output", translate("Output")), + s:option(ListValue, "forward", translate("Forward")) +} + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + + +s = m:section(TypedSection, "zone", translate("Zones")) +s.template = "cbi/tblsection" +s.anonymous = true +s.addremove = true +s.extedit = ds.build_url("admin", "network", "firewall", "zones", "%s") + +function s.create(self) + local z = fw:new_zone() + if z then + luci.http.redirect( + ds.build_url("admin", "network", "firewall", "zones", z.sid) + ) + end +end + +function s.remove(self, section) + return fw:del_zone(section) +end + +o = s:option(DummyValue, "_info", translate("Zone ⇒ Forwardings")) +o.template = "cbi/firewall_zoneforwards" +o.cfgvalue = function(self, section) + return self.map:get(section, "name") +end + +p = { + s:option(ListValue, "input", translate("Input")), + s:option(ListValue, "output", translate("Output")), + s:option(ListValue, "forward", translate("Forward")) +} + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + +s:option(Flag, "masq", translate("Masquerading")) +s:option(Flag, "mtu_fix", translate("MSS clamping")) + +return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/miniportfw.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/miniportfw.lua deleted file mode 100644 index 44b15f2c7..000000000 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/miniportfw.lua +++ /dev/null @@ -1,48 +0,0 @@ ---[[ -LuCI - Lua Configuration Interface - -Copyright 2008 Steven Barth - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -$Id$ -]]-- -require("luci.sys") -m = Map("firewall", translate("Port forwarding"), - translate("Port forwarding allows to provide network services in " .. - "the internal network to an external network.")) - - -s = m:section(TypedSection, "redirect", "") -s:depends("src", "wan") -s.defaults.src = "wan" - -s.template = "cbi/tblsection" -s.addremove = true -s.anonymous = true - -name = s:option(Value, "_name", translate("Name"), translate("(optional)")) -name.size = 10 - -proto = s:option(ListValue, "proto", translate("Protocol")) -proto:value("tcp", "TCP") -proto:value("udp", "UDP") -proto:value("tcpudp", "TCP+UDP") - -dport = s:option(Value, "src_dport", translate("External port")) -dport.size = 5 - -to = s:option(Value, "dest_ip", translate("Internal IP address")) -for i, dataset in ipairs(luci.sys.net.arptable()) do - to:value(dataset["IP address"]) -end - -toport = s:option(Value, "dest_port", translate("Internal port"), - translate("(optional)")) -toport.size = 5 - -return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/rrule.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/rrule.lua deleted file mode 100644 index 675cdbb35..000000000 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/rrule.lua +++ /dev/null @@ -1,145 +0,0 @@ ---[[ -LuCI - Lua Configuration Interface - -Copyright 2008 Steven Barth -Copyright 2010 Jo-Philipp Wich - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -$Id$ -]]-- - -local sys = require "luci.sys" -local dsp = require "luci.dispatcher" - -arg[1] = arg[1] or "" - -m = Map("firewall", translate("Traffic Redirection"), - translate("Traffic redirection allows you to change the " .. - "destination address of forwarded packets.")) - -m.redirect = dsp.build_url("admin", "network", "firewall") - -if not m.uci:get(arg[1]) == "redirect" then - luci.http.redirect(m.redirect) - return -end - -local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") -local wan_zone = nil - -m.uci:foreach("firewall", "zone", - function(s) - local n = s.network or s.name - if n then - local i - for i in n:gmatch("%S+") do - if i == "wan" then - wan_zone = s.name - return false - end - end - end - end) - -s = m:section(NamedSection, arg[1], "redirect", "") -s.anonymous = true -s.addremove = false - -s:tab("general", translate("General Settings")) -s:tab("advanced", translate("Advanced Settings")) - -name = s:taboption("general", Value, "_name", translate("Name")) -name.rmempty = true -name.size = 10 - -src = s:taboption("general", Value, "src", translate("Source zone")) -src.nocreate = true -src.default = "wan" -src.template = "cbi/firewall_zonelist" - -proto = s:taboption("general", Value, "proto", translate("Protocol")) -proto.optional = true -proto:value("tcpudp", "TCP+UDP") -proto:value("tcp", "TCP") -proto:value("udp", "UDP") - -dport = s:taboption("general", Value, "src_dport", translate("External port"), - translate("Match incoming traffic directed at the given " .. - "destination port or port range on this host")) -dport.datatype = "portrange" -dport:depends("proto", "tcp") -dport:depends("proto", "udp") -dport:depends("proto", "tcpudp") - -to = s:taboption("general", Value, "dest_ip", translate("Internal IP address"), - translate("Redirect matched incoming traffic to the specified " .. - "internal host")) -to.datatype = "ip4addr" -for i, dataset in ipairs(luci.sys.net.arptable()) do - to:value(dataset["IP address"]) -end - -toport = s:taboption("general", Value, "dest_port", translate("Internal port (optional)"), - translate("Redirect matched incoming traffic to the given port on " .. - "the internal host")) -toport.optional = true -toport.placeholder = "0-65535" -toport.datatype = "portrange" -toport:depends("proto", "tcp") -toport:depends("proto", "udp") -toport:depends("proto", "tcpudp") - -target = s:taboption("advanced", ListValue, "target", translate("Redirection type")) -target:value("DNAT") -target:value("SNAT") - -dest = s:taboption("advanced", Value, "dest", translate("Destination zone")) -dest.nocreate = true -dest.default = "lan" -dest.template = "cbi/firewall_zonelist" - -src_dip = s:taboption("advanced", Value, "src_dip", - translate("Intended destination address"), - translate( - "For DNAT, match incoming traffic directed at the given destination ".. - "ip address. For SNAT rewrite the source address to the given address." - )) - -src_dip.optional = true -src_dip.datatype = "ip4addr" -src_dip.placeholder = translate("any") - -src_mac = s:taboption("advanced", Value, "src_mac", translate("Source MAC address")) -src_mac.optional = true -src_mac.datatype = "macaddr" -src_mac.placeholder = translate("any") - -src_ip = s:taboption("advanced", Value, "src_ip", translate("Source IP address")) -src_ip.optional = true -src_ip.datatype = "neg_ip4addr" -src_ip.placeholder = translate("any") - -sport = s:taboption("advanced", Value, "src_port", translate("Source port"), - translate("Match incoming traffic originating from the given " .. - "source port or port range on the client host")) -sport.optional = true -sport.datatype = "portrange" -sport.placeholder = "0-65536" -sport:depends("proto", "tcp") -sport:depends("proto", "udp") -sport:depends("proto", "tcpudp") - -reflection = s:taboption("advanced", Flag, "reflection", translate("Enable NAT Loopback")) -reflection.rmempty = true -reflection.default = reflection.enabled -reflection:depends({ target = "DNAT", src = wan_zone }) -reflection.cfgvalue = function(...) - return Flag.cfgvalue(...) or "1" -end - -return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/trule.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/trule.lua deleted file mode 100644 index 10a986949..000000000 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/trule.lua +++ /dev/null @@ -1,155 +0,0 @@ ---[[ -LuCI - Lua Configuration Interface - -Copyright 2008 Steven Barth -Copyright 2010 Jo-Philipp Wich - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -$Id$ -]]-- - -local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") -local dsp = require "luci.dispatcher" - -arg[1] = arg[1] or "" - -m = Map("firewall", translate("Advanced Rules"), - translate("Advanced rules let you customize the firewall to your " .. - "needs. Only new connections will be matched. Packets " .. - "belonging to already open connections are automatically " .. - "allowed to pass the firewall.")) - -m.redirect = dsp.build_url("admin", "network", "firewall") - -if not m.uci:get(arg[1]) == "rule" then - luci.http.redirect(m.redirect) - return -end - -s = m:section(NamedSection, arg[1], "rule", "") -s.anonymous = true -s.addremove = false - -s:tab("general", translate("General Settings")) -s:tab("advanced", translate("Advanced Options")) - -back = s:option(DummyValue, "_overview", translate("Overview")) -back.value = "" -back.titleref = dsp.build_url("admin", "network", "firewall", "rule") - - -name = s:taboption("general", Value, "_name", translate("Name").." "..translate("(optional)")) -name.rmempty = true - -src = s:taboption("general", Value, "src", translate("Source zone")) -src.nocreate = true -src.default = "wan" -src.template = "cbi/firewall_zonelist" - -dest = s:taboption("advanced", Value, "dest", translate("Destination zone")) -dest.nocreate = true -dest.allowlocal = true -dest.template = "cbi/firewall_zonelist" - -proto = s:taboption("general", Value, "proto", translate("Protocol")) -proto.optional = true -proto:value("all", translate("Any")) -proto:value("tcpudp", "TCP+UDP") -proto:value("tcp", "TCP") -proto:value("udp", "UDP") -proto:value("icmp", "ICMP") - -icmpt = s:taboption("general", Value, "icmp_type", translate("Match ICMP type")) -icmpt:depends("proto", "icmp") -icmpt:value("", "any") -icmpt:value("echo-reply") -icmpt:value("destination-unreachable") -icmpt:value("network-unreachable") -icmpt:value("host-unreachable") -icmpt:value("protocol-unreachable") -icmpt:value("port-unreachable") -icmpt:value("fragmentation-needed") -icmpt:value("source-route-failed") -icmpt:value("network-unknown") -icmpt:value("host-unknown") -icmpt:value("network-prohibited") -icmpt:value("host-prohibited") -icmpt:value("TOS-network-unreachable") -icmpt:value("TOS-host-unreachable") -icmpt:value("communication-prohibited") -icmpt:value("host-precedence-violation") -icmpt:value("precedence-cutoff") -icmpt:value("source-quench") -icmpt:value("redirect") -icmpt:value("network-redirect") -icmpt:value("host-redirect") -icmpt:value("TOS-network-redirect") -icmpt:value("TOS-host-redirect") -icmpt:value("echo-request") -icmpt:value("router-advertisement") -icmpt:value("router-solicitation") -icmpt:value("time-exceeded") -icmpt:value("ttl-zero-during-transit") -icmpt:value("ttl-zero-during-reassembly") -icmpt:value("parameter-problem") -icmpt:value("ip-header-bad") -icmpt:value("required-option-missing") -icmpt:value("timestamp-request") -icmpt:value("timestamp-reply") -icmpt:value("address-mask-request") -icmpt:value("address-mask-reply") - -src_ip = s:taboption("general", Value, "src_ip", translate("Source address")) -src_ip.optional = true -src_ip.datatype = has_v2 and "neg_ipaddr" or "neg_ip4addr" -src_ip.placeholder = translate("any") - -sport = s:taboption("general", Value, "src_port", translate("Source port")) -sport.optional = true -sport.datatype = "portrange" -sport.placeholder = "0-65535" -sport:depends("proto", "tcp") -sport:depends("proto", "udp") -sport:depends("proto", "tcpudp") - -dest_ip = s:taboption("general", Value, "dest_ip", translate("Destination address")) -dest_ip.optional = true -dest_ip.datatype = has_v2 and "neg_ipaddr" or "neg_ip4addr" -dest_ip.placeholder = translate("any") - -dport = s:taboption("general", Value, "dest_port", translate("Destination port")) -dport.optional = true -dport.datatype = "portrange" -dport:depends("proto", "tcp") -dport:depends("proto", "udp") -dport:depends("proto", "tcpudp") -dport.placeholder = "0-65535" - -jump = s:taboption("general", ListValue, "target", translate("Action")) -jump.rmempty = true -jump.default = "ACCEPT" -jump:value("DROP", translate("drop")) -jump:value("ACCEPT", translate("accept")) -jump:value("REJECT", translate("reject")) -jump:value("NOTRACK", translate("don't track")) - - -smac = s:taboption("advanced", Value, "src_mac", translate("Source MAC address")) -smac.optional = true -smac.datatype = "macaddr" -smac.placeholder = translate("any") - -if has_v2 then - family = s:taboption("advanced", ListValue, "family", translate("Restrict to address family")) - family.rmempty = true - family:value("", translate("IPv4 and IPv6")) - family:value("ipv4", translate("IPv4 only")) - family:value("ipv6", translate("IPv6 only")) -end - -return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua deleted file mode 100644 index 8c9c09102..000000000 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua +++ /dev/null @@ -1,237 +0,0 @@ ---[[ -LuCI - Lua Configuration Interface - -Copyright 2008 Steven Barth - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -$Id$ -]]-- - -local nw = require "luci.model.network" -local fw = require "luci.model.firewall" -local utl = require "luci.util" -local dsp = require "luci.dispatcher" - -local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") -local out, inp - -require("luci.tools.webadmin") -m = Map("firewall", translate("Firewall - Zone Settings")) -m.redirect = luci.dispatcher.build_url("admin/network/firewall") - -fw.init(m.uci) -nw.init(m.uci) - - -local zone = fw:get_zone(arg[1]) -if not zone then - luci.http.redirect(dsp.build_url("admin", "network", "firewall")) - return -end - - -s = m:section(NamedSection, zone.sid, "zone", - translatef("Zone %q", zone:name()), - translatef("This section defines common properties of %q. " .. - "The input and output options set the default ".. - "policies for traffic entering and leaving this zone while the " .. - "forward option describes the policy for forwarded traffic " .. - "between different networks within the zone. " .. - "Covered networks specifies which available networks are " .. - "member of this zone.", zone:name())) - -s.anonymous = true -s.addremove = false - -m.on_commit = function(map) - local zone = fw:get_zone(arg[1]) - if zone then - s.section = zone.sid - s2.section = zone.sid - end -end - - -s:tab("general", translate("General Settings")) -s:tab("advanced", translate("Advanced Settings")) - - -name = s:taboption("general", Value, "name", translate("Name")) -name.optional = false -name.forcewrite = true -name.datatype = "uciname" - -function name.write(self, section, value) - if zone:name() ~= value then - fw:rename_zone(zone:name(), value) - out.exclude = value - inp.exclude = value - end - - m.redirect = luci.dispatcher.build_url( - "admin", "network", "firewall", "zones", value - ) -end - -p = {} -p[1] = s:taboption("general", ListValue, "input", translate("Input")) -p[2] = s:taboption("general", ListValue, "output", translate("Output")) -p[3] = s:taboption("general", ListValue, "forward", translate("Forward")) - -for i, v in ipairs(p) do - v:value("REJECT", translate("reject")) - v:value("DROP", translate("drop")) - v:value("ACCEPT", translate("accept")) -end - -s:taboption("general", Flag, "masq", translate("Masquerading")) -s:taboption("general", Flag, "mtu_fix", translate("MSS clamping")) - -net = s:taboption("general", Value, "network", translate("Covered networks")) -net.template = "cbi/network_netlist" -net.widget = "checkbox" -net.cast = "string" - -function net.formvalue(self, section) - return Value.formvalue(self, section) or "-" -end - -function net.cfgvalue(self, section) - return Value.cfgvalue(self, section) or name:cfgvalue(section) -end - -function net.write(self, section, value) - zone:clear_networks() - - local n - for n in utl.imatch(value) do - zone:add_network(n) - end -end - - -if has_v2 then - family = s:taboption("advanced", ListValue, "family", - translate("Restrict to address family")) - - family.rmempty = true - family:value("", translate("IPv4 and IPv6")) - family:value("ipv4", translate("IPv4 only")) - family:value("ipv6", translate("IPv6 only")) -end - -msrc = s:taboption("advanced", DynamicList, "masq_src", - translate("Restrict Masquerading to given source subnets")) - -msrc.optional = true -msrc.datatype = "neg(network)" -msrc.placeholder = "0.0.0.0/0" -msrc:depends("family", "") -msrc:depends("family", "ipv4") - -mdest = s:taboption("advanced", DynamicList, "masq_dest", - translate("Restrict Masquerading to given destination subnets")) - -mdest.optional = true -mdest.datatype = "neg(network)" -mdest.placeholder = "0.0.0.0/0" -mdest:depends("family", "") -mdest:depends("family", "ipv4") - -s:taboption("advanced", Flag, "conntrack", - translate("Force connection tracking")) - -if has_v2 then - log = s:taboption("advanced", Flag, "log", - translate("Enable logging on this zone")) - - log.rmempty = true - log.enabled = "1" - - lim = s:taboption("advanced", Value, "log_limit", - translate("Limit log messages")) - - lim.placeholder = "10/minute" - lim:depends("log", "1") -end - - -s2 = m:section(NamedSection, zone.sid, "fwd_out", - translate("Inter-Zone Forwarding"), - translatef("The options below control the forwarding policies between " .. - "this zone (%s) and other zones. Destination zones cover " .. - "forwarded traffic originating from %q. " .. - "Source zones match forwarded traffic from other zones " .. - "targeted at %q. The forwarding rule is " .. - "unidirectional, e.g. a forward from lan to wan does " .. - "not imply a permission to forward from wan to lan as well.", - zone:name(), zone:name(), zone:name() - - )) - -out = s2:option(Value, "out", - translate("Allow forward to destination zones:")) - -out.nocreate = true -out.widget = "checkbox" -out.exclude = zone:name() -out.template = "cbi/firewall_zonelist" - -inp = s2:option(Value, "in", - translate("Allow forward from source zones:")) - -inp.nocreate = true -inp.widget = "checkbox" -inp.exclude = zone:name() -inp.template = "cbi/firewall_zonelist" - -function out.cfgvalue(self, section) - local v = { } - local f - for _, f in ipairs(zone:get_forwardings_by("src")) do - v[#v+1] = f:dest() - end - return table.concat(v, " ") -end - -function inp.cfgvalue(self, section) - local v = { } - local f - for _, f in ipairs(zone:get_forwardings_by("dest")) do - v[#v+1] = f:src() - end - return v -end - -function out.formvalue(self, section) - return Value.formvalue(self, section) or "-" -end - -function inp.formvalue(self, section) - return Value.formvalue(self, section) or "-" -end - -function out.write(self, section, value) - zone:del_forwardings_by("src") - - local f - for f in utl.imatch(value) do - zone:add_forwarding_to(f) - end -end - -function inp.write(self, section, value) - zone:del_forwardings_by("dest") - - local f - for f in utl.imatch(value) do - zone:add_forwarding_from(f) - end -end - -return m diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zones.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/zones.lua deleted file mode 100644 index 79604c263..000000000 --- a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zones.lua +++ /dev/null @@ -1,273 +0,0 @@ ---[[ -LuCI - Lua Configuration Interface - -Copyright 2008 Steven Barth - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -$Id$ -]]-- - -local nw = require "luci.model.network" -local fw = require "luci.model.firewall" -local ds = require "luci.dispatcher" - -local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") - -require("luci.tools.webadmin") -m = Map("firewall", translate("Firewall"), translate("The firewall creates zones over your network interfaces to control network traffic flow.")) - -fw.init(m.uci) -nw.init(m.uci) - -s = m:section(TypedSection, "defaults") -s.anonymous = true -s.addremove = false - -s:tab("general", translate("General Settings")) -s:tab("custom", translate("Custom Rules")) - - -s:taboption("general", Flag, "syn_flood", translate("Enable SYN-flood protection")) - -local di = s:taboption("general", Flag, "drop_invalid", translate("Drop invalid packets")) -di.rmempty = false -function di.cfgvalue(...) - return AbstractValue.cfgvalue(...) or "1" -end - -p = {} -p[1] = s:taboption("general", ListValue, "input", translate("Input")) -p[2] = s:taboption("general", ListValue, "output", translate("Output")) -p[3] = s:taboption("general", ListValue, "forward", translate("Forward")) - -for i, v in ipairs(p) do - v:value("REJECT", translate("reject")) - v:value("DROP", translate("drop")) - v:value("ACCEPT", translate("accept")) -end - -custom = s:taboption("custom", Value, "_custom", - translate("Custom Rules (/etc/firewall.user)")) - -custom.template = "cbi/tvalue" -custom.rows = 20 - -function custom.cfgvalue(self, section) - return nixio.fs.readfile("/etc/firewall.user") -end - -function custom.write(self, section, value) - value = value:gsub("\r\n?", "\n") - nixio.fs.writefile("/etc/firewall.user", value) -end - - -s = m:section(TypedSection, "zone", translate("Zones")) -s.template = "cbi/tblsection" -s.anonymous = true -s.addremove = true -s.extedit = ds.build_url("admin", "network", "firewall", "zones", "%s") - -function s.create(self) - local z = fw:new_zone() - if z then - luci.http.redirect( - ds.build_url("admin", "network", "firewall", "zones", z.sid) - ) - end -end - -function s.remove(self, section) - return fw:del_zone(section) -end - -info = s:option(DummyValue, "_info", translate("Zone ⇒ Forwardings")) -info.template = "cbi/firewall_zoneforwards" -function info.cfgvalue(self, section) - return self.map:get(section, "name") -end - -p = {} -p[1] = s:option(ListValue, "input", translate("Input")) -p[2] = s:option(ListValue, "output", translate("Output")) -p[3] = s:option(ListValue, "forward", translate("Forward")) - -for i, v in ipairs(p) do - v:value("REJECT", translate("reject")) - v:value("DROP", translate("drop")) - v:value("ACCEPT", translate("accept")) -end - -s:option(Flag, "masq", translate("Masquerading")) -s:option(Flag, "mtu_fix", translate("MSS clamping")) - - -local created = nil - --- --- Redirects --- - -s = m:section(TypedSection, "redirect", translate("Redirections")) -s.template = "cbi/tblsection" -s.addremove = true -s.anonymous = true -s.sortable = true -s.extedit = ds.build_url("admin", "network", "firewall", "redirect", "%s") - -function s.create(self, section) - created = TypedSection.create(self, section) -end - -function s.parse(self, ...) - TypedSection.parse(self, ...) - if created then - m.uci:save("firewall") - luci.http.redirect(ds.build_url( - "admin", "network", "firewall", "redirect", created - )) - end -end - -name = s:option(DummyValue, "_name", translate("Name")) -function name.cfgvalue(self, s) - return self.map:get(s, "_name") or "-" -end - -proto = s:option(DummyValue, "proto", translate("Protocol")) -function proto.cfgvalue(self, s) - local p = self.map:get(s, "proto") - if not p or p == "tcpudp" then - return "TCP+UDP" - else - return p:upper() - end -end - -src = s:option(DummyValue, "src", translate("Source")) -function src.cfgvalue(self, s) - local rv = "%s:%s:%s" % { - self.map:get(s, "src") or "*", - self.map:get(s, "src_ip") or "0.0.0.0/0", - self.map:get(s, "src_port") or "*" - } - - local mac = self.map:get(s, "src_mac") - if mac then - rv = rv .. ", MAC " .. mac - end - - return rv -end - -via = s:option(DummyValue, "via", translate("Via")) -function via.cfgvalue(self, s) - return "%s:%s:%s" % { - translate("Device"), - self.map:get(s, "src_dip") or "0.0.0.0/0", - self.map:get(s, "src_dport") or "*" - } -end - -dest = s:option(DummyValue, "dest", translate("Destination")) -function dest.cfgvalue(self, s) - return "%s:%s:%s" % { - self.map:get(s, "dest") or "*", - self.map:get(s, "dest_ip") or "0.0.0.0/0", - self.map:get(s, "dest_port") or "*" - } -end - -target = s:option(DummyValue, "target", translate("Action")) -function target.cfgvalue(self, s) - return self.map:get(s, "target") or "DNAT" -end - - --- --- Rules --- - -s = m:section(TypedSection, "rule", translate("Rules")) -s.addremove = true -s.anonymous = true -s.sortable = true -s.template = "cbi/tblsection" -s.extedit = ds.build_url("admin", "network", "firewall", "rule", "%s") -s.defaults.target = "ACCEPT" - -function s.create(self, section) - local created = TypedSection.create(self, section) - m.uci:save("firewall") - luci.http.redirect(ds.build_url( - "admin", "network", "firewall", "rule", created - )) - return -end - -name = s:option(DummyValue, "_name", translate("Name")) -function name.cfgvalue(self, s) - return self.map:get(s, "_name") or "-" -end - -if has_v2 then - family = s:option(DummyValue, "family", translate("Family")) - function family.cfgvalue(self, s) - local f = self.map:get(s, "family") - if f and f:match("4") then - return translate("IPv4 only") - elseif f and f:match("6") then - return translate("IPv6 only") - else - return translate("IPv4 and IPv6") - end - end -end - -proto = s:option(DummyValue, "proto", translate("Protocol")) -function proto.cfgvalue(self, s) - local p = self.map:get(s, "proto") - local t = self.map:get(s, "icmp_type") - if p == "icmp" and t then - return "ICMP (%s)" % t - elseif p == "tcpudp" or not p then - return "TCP+UDP" - else - return p:upper() - end -end - -src = s:option(DummyValue, "src", translate("Source")) -function src.cfgvalue(self, s) - local rv = "%s:%s:%s" % { - self.map:get(s, "src") or "*", - self.map:get(s, "src_ip") or "0.0.0.0/0", - self.map:get(s, "src_port") or "*" - } - - local mac = self.map:get(s, "src_mac") - if mac then - rv = rv .. ", MAC " .. mac - end - - return rv -end - -dest = s:option(DummyValue, "dest", translate("Destination")) -function dest.cfgvalue(self, s) - return "%s:%s:%s" % { - self.map:get(s, "dest") or translate("Device"), - self.map:get(s, "dest_ip") or "0.0.0.0/0", - self.map:get(s, "dest_port") or "*" - } -end - - -s:option(DummyValue, "target", translate("Action")) - -return m diff --git a/applications/luci-firewall/luasrc/tools/firewall.lua b/applications/luci-firewall/luasrc/tools/firewall.lua new file mode 100644 index 000000000..a2e3bce34 --- /dev/null +++ b/applications/luci-firewall/luasrc/tools/firewall.lua @@ -0,0 +1,213 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2011 Jo-Philipp Wich + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +module("luci.tools.firewall", package.seeall) + +local ut = require "luci.util" +local ip = require "luci.ip" +local nx = require "nixio" + +local tr, trf = luci.i18n.translate, luci.i18n.translatef + +function fmt_neg(x) + if type(x) == "string" then + local v, neg = x:gsub("^ *! *", "") + if neg > 0 then + return v, "%s " % tr("not") + else + return x, "" + end + end + return x, "" +end + +function fmt_mac(x) + if x and #x > 0 then + local m, n + local l = { tr("MAC"), " " } + for m in ut.imatch(x) do + m, n = fmt_neg(m) + l[#l+1] = "%s%s" %{ n, m } + l[#l+1] = ", " + end + if #l > 1 then + l[#l] = nil + if #l > 3 then + l[1] = tr("MACs") + end + return table.concat(l, "") + end + end +end + +function fmt_port(x) + if x and #x > 0 then + local p, n + local l = { tr("port"), " " } + for p in ut.imatch(x) do + p, n = fmt_neg(p) + local a, b = p:match("(%d+)%D+(%d+)") + if a and b then + l[1] = tr("ports") + l[#l+1] = "%s%d-%d" %{ n, a, b } + else + l[#l+1] = "%s%d" %{ n, p } + end + l[#l+1] = ", " + end + if #l > 1 then + l[#l] = nil + if #l > 3 then + l[1] = tr("ports") + end + return table.concat(l, "") + end + end +end + +function fmt_ip(x) + if x and #x > 0 then + local l = { tr("IP"), " " } + local v, a, n + for v in ut.imatch(x) do + v, n = fmt_neg(v) + a, m = v:match("(%S+)/(%d+%.%S+)") + a = a or v + a = a:match(":") and ip.IPv6(a, m) or ip.IPv4(a, m) + if a and (a:is6() or a:prefix() < 32) then + l[1] = tr("IP range") + l[#l+1] = "%s%s" %{ + a:minhost():string(), + a:maxhost():string(), + n, a:string() + } + else + l[#l+1] = "%s%s" %{ + n, + a and a:string() or v + } + end + l[#l+1] = ", " + end + if #l > 1 then + l[#l] = nil + if #l > 3 then + l[1] = tr("IPs") + end + return table.concat(l, "") + end + end +end + +function fmt_zone(x) + if x == "*" then + return "%s" % tr("any zone") + elseif x and #x > 0 then + return "%s" % x + end +end + +function fmt_icmp_type(x) + if x and #x > 0 then + local t, v, n + local l = { tr("type"), " " } + for v in ut.imatch(x) do + v, n = fmt_neg(v) + l[#l+1] = "%s%s" %{ n, v } + l[#l+1] = ", " + end + if #l > 1 then + l[#l] = nil + if #l > 3 then + l[1] = tr("types") + end + return table.concat(l, "") + end + end +end + +function fmt_proto(x, icmp_types) + if x and #x > 0 then + local v, n + local l = { } + local t = fmt_icmp_type(icmp_types) + for v in ut.imatch(x) do + v, n = fmt_neg(v) + if v == "tcpudp" then + l[#l+1] = "TCP" + l[#l+1] = "UDP" + l[#l+1] = ", " + elseif v ~= "all" then + local p = nx.getproto(v) + if p then + -- ICMP + if (p.proto == 1 or p.proto == 58) and t then + l[#l+1] = trf( + "%s%s with %s", + n, p.aliases[1] or p.name, t + ) + else + l[#l+1] = "%s%s" %{ + n, + p.aliases[1] or p.name + } + end + l[#l+1] = ", " + end + end + end + if #l > 0 then + l[#l] = nil + return table.concat(l, "") + end + end +end + +function fmt_limit(limit, burst) + burst = tonumber(burst) + if limit and #limit > 0 then + local l, u = limit:match("(%d+)/(%w+)") + l = tonumber(l or limit) + u = u or "second" + if l then + if u:match("^s") then + u = tr("second") + elseif u:match("^m") then + u = tr("minute") + elseif u:match("^h") then + u = tr("hour") + elseif u:match("^d") then + u = tr("day") + end + if burst and burst > 0 then + return trf("%d pkts. per %s, \ + burst %d pkts.", l, u, burst) + else + return trf("%d pkts. per %s", l, u) + end + end + end +end + +function fmt_target(x) + if x == "ACCEPT" then + return tr("Accept") + elseif x == "REJECT" then + return tr("Refuse") + elseif x == "NOTRACK" then + return tr("Do not track") + else --if x == "DROP" then + return tr("Discard") + end +end diff --git a/applications/luci-firewall/luasrc/view/cbi_addforward.htm b/applications/luci-firewall/luasrc/view/cbi_addforward.htm new file mode 100644 index 000000000..6a49266b7 --- /dev/null +++ b/applications/luci-firewall/luasrc/view/cbi_addforward.htm @@ -0,0 +1,90 @@ +
+
+ + + + + + + + + + + + + + + + + + + + +
<%:New port forward%>:
<%:Name%><%:Protocol%><%:External port%><%:Internal IP address%><%:Internal port%>
+ + + + + + + + + + + +
+ + +
diff --git a/applications/luci-firewall/luasrc/view/cbi_addrule.htm b/applications/luci-firewall/luasrc/view/cbi_addrule.htm new file mode 100644 index 000000000..473f9f451 --- /dev/null +++ b/applications/luci-firewall/luasrc/view/cbi_addrule.htm @@ -0,0 +1,112 @@ +<% + local fw = require "luci.model.firewall".init() + local wz = fw:get_zone("wan") + local lz = fw:get_zone("lan") +%> + +
+ <% if wz and lz then %> +
+ + + + + + + + + + + + + + + + +
<%:Open ports on router%>:
<%:Name%><%:Protocol%><%:External port%>
+ + + + + + + +
+ + + + + + + + + + + + + + + + + +

<%:New forward rule%>:
<%:Name%><%:Source zone%><%:Destination zone%>
+ + + + + + + +
+ + + <% else %> + + <% end %> +
diff --git a/applications/luci-firewall/luasrc/view/cbi_addsnat.htm b/applications/luci-firewall/luasrc/view/cbi_addsnat.htm new file mode 100644 index 000000000..28bb22d40 --- /dev/null +++ b/applications/luci-firewall/luasrc/view/cbi_addsnat.htm @@ -0,0 +1,65 @@ +<% + local fw = require "luci.model.firewall".init() + local nw = require "luci.model.network".init() + local wz = fw:get_zone("wan") + local lz = fw:get_zone("lan") +%> + +
+ <% if wz and lz then %> +
+ + + + + + + + + + + + + + + + + + + + +
<%:New source NAT%>:
<%:Name%><%:Source zone%><%:Destination zone%><%:To source IP%><%:To source port%>
+ + + + + + + + + + + +
+ + + <% else %> + + <% end %> +