applications/luci-firewall/luasrc/model/cbi/firewall/rules.lua

   1 --[[
   2 LuCI - Lua Configuration Interface
   3
   4 Copyright 2008 Steven Barth <steven@midlink.org>
   5
   6 Licensed under the Apache License, Version 2.0 (the "License");
   7 you may not use this file except in compliance with the License.
   8 You may obtain a copy of the License at
   9
  10         http://www.apache.org/licenses/LICENSE-2.0
  11
  12 $Id$
  13 ]]--
  14
  15 local ds = require "luci.dispatcher"
  16 local ft = require "luci.tools.firewall"
  17
  18 m = Map("firewall",
  19         translate("Firewall - Traffic Rules"),
  20         translate("Traffic rules define policies for packets traveling between \
  21                 different zones, for example to reject traffic between certain hosts \
  22                 or to open WAN ports on the router."))
  23
  24 --
  25 -- Rules
  26 --
  27
  28 s = m:section(TypedSection, "rule", translate("Traffic Rules"))
  29 s.addremove = true
  30 s.anonymous = true
  31 s.sortable  = true
  32 s.template = "cbi/tblsection"
  33 s.extedit   = ds.build_url("admin/network/firewall/rules/%s")
  34 s.defaults.target = "ACCEPT"
  35 s.template_addremove = "firewall/cbi_addrule"
  36
  37
  38 function s.create(self, section)
  39         created = TypedSection.create(self, section)
  40 end
  41
  42 function s.parse(self, ...)
  43         TypedSection.parse(self, ...)
  44
  45         local i_n = m:formvalue("_newopen.name")
  46         local i_p = m:formvalue("_newopen.proto")
  47         local i_e = m:formvalue("_newopen.extport")
  48         local i_x = m:formvalue("_newopen.submit")
  49
  50         local f_n = m:formvalue("_newfwd.name")
  51         local f_s = m:formvalue("_newfwd.src")
  52         local f_d = m:formvalue("_newfwd.dest")
  53         local f_x = m:formvalue("_newfwd.submit")
  54
  55         if i_x then
  56                 created = TypedSection.create(self, section)
  57
  58                 self.map:set(created, "target",    "ACCEPT")
  59                 self.map:set(created, "src",       "wan")
  60                 self.map:set(created, "proto",     (i_p ~= "other") and i_p or "all")
  61                 self.map:set(created, "dest_port", i_e)
  62                 self.map:set(created, "_name",     i_n)
  63
  64                 if i_p ~= "other" and i_e and #i_e > 0 then
  65                         created = nil
  66                 end
  67
  68         elseif f_x then
  69                 created = TypedSection.create(self, section)
  70
  71                 self.map:set(created, "target", "ACCEPT")
  72                 self.map:set(created, "src",    f_s)
  73                 self.map:set(created, "dest",   f_d)
  74                 self.map:set(created, "_name",  f_n)
  75         end
  76
  77         if created then
  78                 m.uci:save("firewall")
  79                 luci.http.redirect(ds.build_url(
  80                         "admin", "network", "firewall", "rules", created
  81                 ))
  82         end
  83 end
  84
  85 name = s:option(DummyValue, "_name", translate("Name"))
  86 function name.cfgvalue(self, s)
  87         return self.map:get(s, "_name") or "-"
  88 end
  89
  90 family = s:option(DummyValue, "family", translate("Family"))
  91 function family.cfgvalue(self, s)
  92         local f = self.map:get(s, "family")
  93         if f and f:match("4") then
  94                 return translate("IPv4")
  95         elseif f and f:match("6") then
  96                 return translate("IPv6")
  97         else
  98                 return translate("Any")
  99         end
 100 end
 101
 102 proto = s:option(DummyValue, "proto", translate("Protocol"))
 103 proto.rawhtml = true
 104 proto.width   = "20%"
 105 function proto.cfgvalue(self, s)
 106         return ft.fmt_proto(self.map:get(s, "proto"), self.map:get(s, "icmp_type"))
 107                 or "TCP+UDP"
 108 end
 109
 110 src = s:option(DummyValue, "src", translate("Source"))
 111 src.rawhtml = true
 112 src.width   = "20%"
 113 function src.cfgvalue(self, s)
 114         local z = ft.fmt_zone(self.map:get(s, "src"))
 115         local a = ft.fmt_ip(self.map:get(s, "src_ip"))
 116         local p = ft.fmt_port(self.map:get(s, "src_port"))
 117         local m = ft.fmt_mac(self.map:get(s, "src_mac"))
 118
 119         local s = "From %s in %s " %{
 120                 (a or "<var>any host</var>"),
 121                 (z or "<var>any zone</var>")
 122         }
 123
 124         if p and m then
 125                 s = s .. "with source %s and %s" %{ p, m }
 126         elseif p or m then
 127                 s = s .. "with source %s" %( p or m )
 128         end
 129
 130         return s
 131 end
 132
 133 dest = s:option(DummyValue, "dest", translate("Destination"))
 134 dest.rawhtml = true
 135 dest.width   = "20%"
 136 function dest.cfgvalue(self, s)
 137         local z = ft.fmt_zone(self.map:get(s, "dest"))
 138         local a = ft.fmt_ip(self.map:get(s, "dest_ip"))
 139         local p = ft.fmt_port(self.map:get(s, "dest_port"))
 140
 141         -- Forward
 142         if z then
 143                 return "To %s%s in %s" %{
 144                         (a or "<var>any host</var>"),
 145                         (p and ", %s" % p or ""),
 146                         z
 147                 }
 148
 149         -- Input
 150         else
 151                 return "To %s%s on <var>this device</var>" %{
 152                         (a or "<var>any router IP</var>"),
 153                         (p and " at %s" % p or "")
 154                 }
 155         end
 156 end
 157
 158
 159 target = s:option(DummyValue, "target", translate("Action"))
 160 target.rawhtml = true
 161 target.width   = "20%"
 162 function target.cfgvalue(self, s)
 163         local z = ft.fmt_zone(self.map:get(s, "dest"))
 164         local l = ft.fmt_limit(self.map:get(s, "limit"), self.map:get(s, "limit_burst"))
 165         local t = ft.fmt_target(self.map:get(s, "target"))
 166
 167         return "<var>%s</var> %s%s" %{
 168                 t,
 169                 (z and "forward" or "input"),
 170                 (l and " and limit to %s" % l or "")
 171         }
 172 end
 173
 174
 175 --
 176 -- SNAT
 177 --
 178
 179 s = m:section(TypedSection, "redirect",
 180         translate("Source NAT"),
 181         translate("Source NAT is a specific form of masquerading which allows \
 182                 fine grained control over the source IP used for outgoing traffic, \
 183                 for example to map multiple WAN addresses to internal subnets."))
 184 s.template  = "cbi/tblsection"
 185 s.addremove = true
 186 s.anonymous = true
 187 s.sortable  = true
 188 s.extedit   = ds.build_url("admin/network/firewall/rules/%s")
 189 s.template_addremove = "firewall/cbi_addsnat"
 190
 191 function s.create(self, section)
 192         created = TypedSection.create(self, section)
 193 end
 194
 195 function s.parse(self, ...)
 196         TypedSection.parse(self, ...)
 197
 198         local n = m:formvalue("_newsnat.name")
 199         local s = m:formvalue("_newsnat.src")
 200         local d = m:formvalue("_newsnat.dest")
 201         local a = m:formvalue("_newsnat.dip")
 202         local p = m:formvalue("_newsnat.dport")
 203         local x = m:formvalue("_newsnat.submit")
 204
 205         if x and a and #a > 0 then
 206                 created = TypedSection.create(self, section)
 207
 208                 self.map:set(created, "target",    "SNAT")
 209                 self.map:set(created, "src",       s)
 210                 self.map:set(created, "dest",      d)
 211                 self.map:set(created, "proto",     "all")
 212                 self.map:set(created, "src_dip",   a)
 213                 self.map:set(created, "src_dport", p)
 214                 self.map:set(created, "_name",     n)
 215         end
 216
 217         if created then
 218                 m.uci:save("firewall")
 219                 luci.http.redirect(ds.build_url(
 220                         "admin/network/firewall/rules", created
 221                 ))
 222         end
 223 end
 224
 225 function s.filter(self, sid)
 226         return (self.map:get(sid, "target") == "SNAT")
 227 end
 228
 229 name = s:option(DummyValue, "_name", translate("Name"))
 230 function name.cfgvalue(self, s)
 231         return self.map:get(s, "_name") or "-"
 232 end
 233
 234 proto = s:option(DummyValue, "proto", translate("Protocol"))
 235 proto.rawhtml = true
 236 function proto.cfgvalue(self, s)
 237         return ft.fmt_proto(self.map:get(s, "proto")) or "TCP+UDP"
 238 end
 239
 240
 241 src = s:option(DummyValue, "src", translate("Source"))
 242 src.rawhtml = true
 243 src.width   = "20%"
 244 function src.cfgvalue(self, s)
 245         local z = ft.fmt_zone(self.map:get(s, "src"))
 246         local a = ft.fmt_ip(self.map:get(s, "src_ip"))
 247         local p = ft.fmt_port(self.map:get(s, "src_port"))
 248         local m = ft.fmt_mac(self.map:get(s, "src_mac"))
 249
 250         local s = "From %s in %s " %{
 251                 (a or "<var>any host</var>"),
 252                 (z or "<var>any zone</var>")
 253         }
 254
 255         if p and m then
 256                 s = s .. "with source %s and %s" %{ p, m }
 257         elseif p or m then
 258                 s = s .. "with source %s" %( p or m )
 259         end
 260
 261         return s
 262 end
 263
 264 dest = s:option(DummyValue, "dest", translate("Destination"))
 265 dest.rawhtml = true
 266 dest.width   = "30%"
 267 function dest.cfgvalue(self, s)
 268         local z = ft.fmt_zone(self.map:get(s, "dest"))
 269         local a = ft.fmt_ip(self.map:get(s, "dest_ip"))
 270         local p = ft.fmt_port(self.map:get(s, "dest_port")) or
 271                 ft.fmt_port(self.map:get(s, "src_dport"))
 272
 273         return "To %s%s in %s " %{
 274                 (a or "<var>any host</var>"),
 275                 (p and ", %s" % p or ""),
 276                 (z or "<var>any zone</var>")
 277         }
 278 end
 279
 280 snat = s:option(DummyValue, "via", translate("SNAT"))
 281 snat.rawhtml = true
 282 snat.width   = "20%"
 283 function snat.cfgvalue(self, s)
 284         local a = ft.fmt_ip(self.map:get(s, "src_dip"))
 285         local p = ft.fmt_port(self.map:get(s, "src_dport"))
 286
 287         --local z = self.map:get(s, "src")
 288         --local s = "To %s " %(a or "<var>any %s IP</var>" %( z or "router" ))
 289
 290         if a and p then
 291                 return "Rewrite to source %s, %s" %{ a, p }
 292         elseif a or p then
 293                 return "Rewrite to source %s" %( a or p )
 294         else
 295                 return "Bug"
 296         end
 297 end
 298
 299
 300 return m