applications/luci-firewall/luasrc/model/cbi/firewall/rule-details.lua

   1 --[[
   2 LuCI - Lua Configuration Interface
   3
   4 Copyright 2008 Steven Barth <steven@midlink.org>
   5 Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org>
   6
   7 Licensed under the Apache License, Version 2.0 (the "License");
   8 you may not use this file except in compliance with the License.
   9 You may obtain a copy of the License at
  10
  11         http://www.apache.org/licenses/LICENSE-2.0
  12
  13 ]]--
  14
  15 local sys = require "luci.sys"
  16 local dsp = require "luci.dispatcher"
  17 local nxo = require "nixio"
  18
  19 local ft = require "luci.tools.firewall"
  20 local nw = require "luci.model.network"
  21 local m, s, o, k, v
  22
  23 arg[1] = arg[1] or ""
  24
  25 m = Map("firewall",
  26         translate("Firewall - Traffic Rules"),
  27         translate("This page allows you to change advanced properties of the \
  28                    traffic rule entry, such as matched source and destination \
  29                            hosts."))
  30
  31 m.redirect = dsp.build_url("admin/network/firewall/rules")
  32
  33 nw.init(m.uci)
  34
  35 local rule_type = m.uci:get("firewall", arg[1])
  36 if rule_type == "redirect" and m:get(arg[1], "target") ~= "SNAT" then
  37         rule_type = nil
  38 end
  39
  40 if not rule_type then
  41         luci.http.redirect(m.redirect)
  42         return
  43
  44 --
  45 -- SNAT
  46 --
  47 elseif rule_type == "redirect" then
  48
  49         local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
  50         if not name or #name == 0 then
  51                 name = translate("(Unnamed SNAT)")
  52         else
  53                 name = "SNAT %s" % name
  54         end
  55
  56         m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name }
  57
  58         local wan_zone = nil
  59
  60         m.uci:foreach("firewall", "zone",
  61                 function(s)
  62                         local n = s.network or s.name
  63                         if n then
  64                                 local i
  65                                 for i in n:gmatch("%S+") do
  66                                         if i == "wan" then
  67                                                 wan_zone = s.name
  68                                                 return false
  69                                         end
  70                                 end
  71                         end
  72                 end)
  73
  74         s = m:section(NamedSection, arg[1], "redirect", "")
  75         s.anonymous = true
  76         s.addremove = false
  77
  78
  79         ft.opt_enabled(s, Button)
  80         ft.opt_name(s, Value, translate("Name"))
  81
  82
  83         o = s:option(Value, "proto",
  84                 translate("Protocol"),
  85                 translate("You may specify multiple by selecting \"-- custom --\" and \
  86                            then entering protocols separated by space."))
  87
  88         o:value("all", "All protocols")
  89         o:value("tcp udp", "TCP+UDP")
  90         o:value("tcp", "TCP")
  91         o:value("udp", "UDP")
  92         o:value("icmp", "ICMP")
  93
  94         function o.cfgvalue(...)
  95                 local v = Value.cfgvalue(...)
  96                 if not v or v == "tcpudp" then
  97                         return "tcp udp"
  98                 end
  99                 return v
 100         end
 101
 102
 103         o = s:option(Value, "src", translate("Source zone"))
 104         o.nocreate = true
 105         o.default = "wan"
 106         o.template = "cbi/firewall_zonelist"
 107
 108
 109         o = s:option(DynamicList, "src_mac", translate("Source MAC address"))
 110         o.rmempty = true
 111         o.datatype = "neg(macaddr)"
 112         o.placeholder = translate("any")
 113
 114         luci.sys.net.mac_hints(function(mac, name)
 115                 o:value(mac, "%s (%s)" %{ mac, name })
 116         end)
 117
 118
 119         o = s:option(Value, "src_ip", translate("Source IP address"))
 120         o.rmempty = true
 121         o.datatype = "neg(ipaddr)"
 122         o.placeholder = translate("any")
 123
 124         luci.sys.net.ipv4_hints(function(ip, name)
 125                 o:value(ip, "%s (%s)" %{ ip, name })
 126         end)
 127
 128
 129         o = s:option(Value, "src_port",
 130                 translate("Source port"),
 131                 translate("Match incoming traffic originating from the given source \
 132                         port or port range on the client host."))
 133         o.rmempty = true
 134         o.datatype = "neg(portrange)"
 135         o.placeholder = translate("any")
 136
 137
 138         o = s:option(Value, "dest", translate("Destination zone"))
 139         o.nocreate = true
 140         o.default = "lan"
 141         o.template = "cbi/firewall_zonelist"
 142
 143
 144         o = s:option(Value, "dest_ip", translate("Destination IP address"))
 145         o.datatype = "neg(ip4addr)"
 146
 147         luci.sys.net.ipv4_hints(function(ip, name)
 148                 o:value(ip, "%s (%s)" %{ ip, name })
 149         end)
 150
 151
 152         o = s:option(Value, "dest_port",
 153                 translate("Destination port"),
 154                 translate("Match forwarded traffic to the given destination port or \
 155                         port range."))
 156
 157         o.rmempty = true
 158         o.placeholder = translate("any")
 159         o.datatype = "portrange"
 160
 161
 162         o = s:option(Value, "src_dip",
 163                 translate("SNAT IP address"),
 164                 translate("Rewrite matched traffic to the given address."))
 165         o.rmempty = false
 166         o.datatype = "ip4addr"
 167
 168         for k, v in ipairs(nw:get_interfaces()) do
 169                 local a
 170                 for k, a in ipairs(v:ipaddrs()) do
 171                         o:value(a:host():string(), '%s (%s)' %{
 172                                 a:host():string(), v:shortname()
 173                         })
 174                 end
 175         end
 176
 177
 178         o = s:option(Value, "src_dport", translate("SNAT port"),
 179                 translate("Rewrite matched traffic to the given source port. May be \
 180                         left empty to only rewrite the IP address."))
 181         o.datatype = "portrange"
 182         o.rmempty = true
 183         o.placeholder = translate('Do not rewrite')
 184
 185
 186         s:option(Value, "extra",
 187                 translate("Extra arguments"),
 188                 translate("Passes additional arguments to iptables. Use with care!"))
 189
 190
 191 --
 192 -- Rule
 193 --
 194 else
 195         local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
 196         if not name or #name == 0 then
 197                 name = translate("(Unnamed Rule)")
 198         end
 199
 200         m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name }
 201
 202
 203         s = m:section(NamedSection, arg[1], "rule", "")
 204         s.anonymous = true
 205         s.addremove = false
 206
 207         ft.opt_enabled(s, Button)
 208         ft.opt_name(s, Value, translate("Name"))
 209
 210
 211         o = s:option(ListValue, "family", translate("Restrict to address family"))
 212         o.rmempty = true
 213         o:value("", translate("IPv4 and IPv6"))
 214         o:value("ipv4", translate("IPv4 only"))
 215         o:value("ipv6", translate("IPv6 only"))
 216
 217
 218         o = s:option(Value, "proto", translate("Protocol"))
 219         o:value("all", translate("Any"))
 220         o:value("tcp udp", "TCP+UDP")
 221         o:value("tcp", "TCP")
 222         o:value("udp", "UDP")
 223         o:value("icmp", "ICMP")
 224
 225         function o.cfgvalue(...)
 226                 local v = Value.cfgvalue(...)
 227                 if not v or v == "tcpudp" then
 228                         return "tcp udp"
 229                 end
 230                 return v
 231         end
 232
 233
 234         o = s:option(DynamicList, "icmp_type", translate("Match ICMP type"))
 235         o:value("", "any")
 236         o:value("echo-reply")
 237         o:value("destination-unreachable")
 238         o:value("network-unreachable")
 239         o:value("host-unreachable")
 240         o:value("protocol-unreachable")
 241         o:value("port-unreachable")
 242         o:value("fragmentation-needed")
 243         o:value("source-route-failed")
 244         o:value("network-unknown")
 245         o:value("host-unknown")
 246         o:value("network-prohibited")
 247         o:value("host-prohibited")
 248         o:value("TOS-network-unreachable")
 249         o:value("TOS-host-unreachable")
 250         o:value("communication-prohibited")
 251         o:value("host-precedence-violation")
 252         o:value("precedence-cutoff")
 253         o:value("source-quench")
 254         o:value("redirect")
 255         o:value("network-redirect")
 256         o:value("host-redirect")
 257         o:value("TOS-network-redirect")
 258         o:value("TOS-host-redirect")
 259         o:value("echo-request")
 260         o:value("router-advertisement")
 261         o:value("router-solicitation")
 262         o:value("time-exceeded")
 263         o:value("ttl-zero-during-transit")
 264         o:value("ttl-zero-during-reassembly")
 265         o:value("parameter-problem")
 266         o:value("ip-header-bad")
 267         o:value("required-option-missing")
 268         o:value("timestamp-request")
 269         o:value("timestamp-reply")
 270         o:value("address-mask-request")
 271         o:value("address-mask-reply")
 272
 273
 274         o = s:option(Value, "src", translate("Source zone"))
 275         o.nocreate = true
 276         o.allowany = true
 277         o.default = "wan"
 278         o.template = "cbi/firewall_zonelist"
 279
 280
 281         o = s:option(Value, "src_mac", translate("Source MAC address"))
 282         o.datatype = "list(macaddr)"
 283         o.placeholder = translate("any")
 284
 285         luci.sys.net.mac_hints(function(mac, name)
 286                 o:value(mac, "%s (%s)" %{ mac, name })
 287         end)
 288
 289
 290         o = s:option(Value, "src_ip", translate("Source address"))
 291         o.datatype = "neg(ipaddr)"
 292         o.placeholder = translate("any")
 293
 294         luci.sys.net.ipv4_hints(function(ip, name)
 295                 o:value(ip, "%s (%s)" %{ ip, name })
 296         end)
 297
 298
 299         o = s:option(Value, "src_port", translate("Source port"))
 300         o.datatype = "list(neg(portrange))"
 301         o.placeholder = translate("any")
 302
 303
 304         o = s:option(Value, "dest", translate("Destination zone"))
 305         o.nocreate = true
 306         o.allowany = true
 307         o.allowlocal = true
 308         o.template = "cbi/firewall_zonelist"
 309
 310
 311         o = s:option(Value, "dest_ip", translate("Destination address"))
 312         o.datatype = "neg(ipaddr)"
 313         o.placeholder = translate("any")
 314
 315         luci.sys.net.ipv4_hints(function(ip, name)
 316                 o:value(ip, "%s (%s)" %{ ip, name })
 317         end)
 318
 319
 320         o = s:option(Value, "dest_port", translate("Destination port"))
 321         o.datatype = "list(neg(portrange))"
 322         o.placeholder = translate("any")
 323
 324
 325         o = s:option(ListValue, "target", translate("Action"))
 326         o.default = "ACCEPT"
 327         o:value("DROP", translate("drop"))
 328         o:value("ACCEPT", translate("accept"))
 329         o:value("REJECT", translate("reject"))
 330         o:value("NOTRACK", translate("don't track"))
 331
 332
 333         s:option(Value, "extra",
 334                 translate("Extra arguments"),
 335                 translate("Passes additional arguments to iptables. Use with care!"))
 336 end
 337
 338 return m