From: Jo-Philipp Wich Date: Mon, 8 Nov 2010 11:32:56 +0000 (+0000) Subject: applications/luci-firewall: add missing zone model X-Git-Tag: 0.10.0~513 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=c6a63e1794d347daba1ff469814c5ebeab47b769;p=oweals%2Fluci.git applications/luci-firewall: add missing zone model --- diff --git a/applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua b/applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua new file mode 100644 index 000000000..0aa618d29 --- /dev/null +++ b/applications/luci-firewall/luasrc/model/cbi/luci_fw/zone.lua @@ -0,0 +1,236 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id$ +]]-- + +local nw = require "luci.model.network" +local fw = require "luci.model.firewall" +local utl = require "luci.util" +local dsp = require "luci.dispatcher" + +local has_v2 = nixio.fs.access("/lib/firewall/fw.sh") +local out, inp + +require("luci.tools.webadmin") +m = Map("firewall", translate("Firewall - Zone Settings")) + +fw.init(m.uci) +nw.init(m.uci) + + +local zone = fw:get_zone(arg[1]) +if not zone then + luci.http.redirect(dsp.build_url("admin", "network", "firewall")) + return +end + + +s = m:section(NamedSection, zone.sid, "zone", + translatef("Zone %q", zone:name()), + translatef("This section defines common properties of %q. " .. + "The input and output options set the default ".. + "policies for traffic entering and leaving this zone while the " .. + "forward option describes the policy for forwarded traffic " .. + "between different networks within the zone. " .. + "Covered networks specifies which available networks are " .. + "member of this zone.", zone:name())) + +s.anonymous = true +s.addremove = false + +m.on_commit = function(map) + local zone = fw:get_zone(arg[1]) + if zone then + s.section = zone.sid + s2.section = zone.sid + end +end + + +s:tab("general", translate("General Settings")) +s:tab("advanced", translate("Advanced Settings")) + + +name = s:taboption("general", Value, "name", translate("Name")) +name.optional = false +name.forcewrite = true +name.datatype = "uciname" + +function name.write(self, section, value) + if zone:name() ~= value then + fw:rename_zone(zone:name(), value) + out.exclude = value + inp.exclude = value + end + + m.redirect = luci.dispatcher.build_url( + "admin", "network", "firewall", "zones", value + ) +end + +p = {} +p[1] = s:taboption("general", ListValue, "input", translate("Input")) +p[2] = s:taboption("general", ListValue, "output", translate("Output")) +p[3] = s:taboption("general", ListValue, "forward", translate("Forward")) + +for i, v in ipairs(p) do + v:value("REJECT", translate("reject")) + v:value("DROP", translate("drop")) + v:value("ACCEPT", translate("accept")) +end + +s:taboption("general", Flag, "masq", translate("Masquerading")) +s:taboption("general", Flag, "mtu_fix", translate("MSS clamping")) + +net = s:taboption("general", Value, "network", translate("Covered networks")) +net.template = "cbi/network_netlist" +net.widget = "checkbox" +net.cast = "string" + +function net.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function net.cfgvalue(self, section) + return Value.cfgvalue(self, section) or name:cfgvalue(section) +end + +function net.write(self, section, value) + zone:clear_networks() + + local n + for n in utl.imatch(value) do + zone:add_network(n) + end +end + + +if has_v2 then + family = s:taboption("advanced", ListValue, "family", + translate("Restrict to address family")) + + family.rmempty = true + family:value("", translate("IPv4 and IPv6")) + family:value("ipv4", translate("IPv4 only")) + family:value("ipv6", translate("IPv6 only")) +end + +msrc = s:taboption("advanced", DynamicList, "masq_src", + translate("Restrict Masquerading to given source subnets")) + +msrc.optional = true +msrc.datatype = "ip4addr" +msrc.placeholder = "0.0.0.0/0" +msrc:depends("family", "") +msrc:depends("family", "ipv4") + +mdest = s:taboption("advanced", DynamicList, "masq_dest", + translate("Restrict Masquerading to given destination subnets")) + +mdest.optional = true +mdest.datatype = "ip4addr" +mdest.placeholder = "0.0.0.0/0" +mdest:depends("family", "") +mdest:depends("family", "ipv4") + +s:taboption("advanced", Flag, "conntrack", + translate("Force connection tracking")) + +if has_v2 then + log = s:taboption("advanced", Flag, "log", + translate("Enable logging on this zone")) + + log.rmempty = true + log.enabled = "1" + + lim = s:taboption("advanced", Value, "log_limit", + translate("Limit log messages")) + + lim.placeholder = "10/minute" + lim:depends("log", "1") +end + + +s2 = m:section(NamedSection, zone.sid, "fwd_out", + translate("Inter-Zone Forwarding"), + translatef("The options below control the forwarding policies between " .. + "this zone (%s) and other zones. Destination zones cover " .. + "forwarded traffic originating from %q. " .. + "Source zones match forwarded traffic from other zones " .. + "targeted at %q. The forwarding rule is " .. + "unidirectional, e.g. a forward from lan to wan does " .. + "not imply a permission to forward from wan to lan as well.", + zone:name(), zone:name(), zone:name() + + )) + +out = s2:option(Value, "out", + translate("Allow forward to destination zones:")) + +out.nocreate = true +out.widget = "checkbox" +out.exclude = zone:name() +out.template = "cbi/firewall_zonelist" + +inp = s2:option(Value, "in", + translate("Allow forward from source zones:")) + +inp.nocreate = true +inp.widget = "checkbox" +inp.exclude = zone:name() +inp.template = "cbi/firewall_zonelist" + +function out.cfgvalue(self, section) + local v = { } + local f + for _, f in ipairs(zone:get_forwardings_by("src")) do + v[#v+1] = f:dest() + end + return table.concat(v, " ") +end + +function inp.cfgvalue(self, section) + local v = { } + local f + for _, f in ipairs(zone:get_forwardings_by("dest")) do + v[#v+1] = f:src() + end + return v +end + +function out.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function inp.formvalue(self, section) + return Value.formvalue(self, section) or "-" +end + +function out.write(self, section, value) + zone:del_forwardings_by("src") + + local f + for f in utl.imatch(value) do + zone:add_forwarding_to(f) + end +end + +function inp.write(self, section, value) + zone:del_forwardings_by("dest") + + local f + for f in utl.imatch(value) do + zone:add_forwarding_from(f) + end +end + +return m