applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua

   1 --[[
   2 LuCI - Lua Configuration Interface
   3
   4 Copyright 2008 Steven Barth <steven@midlink.org>
   5 Copyright 2010-2011 Jo-Philipp Wich <xm@subsignal.org>
   6
   7 Licensed under the Apache License, Version 2.0 (the "License");
   8 you may not use this file except in compliance with the License.
   9 You may obtain a copy of the License at
  10
  11         http://www.apache.org/licenses/LICENSE-2.0
  12
  13 $Id$
  14 ]]--
  15
  16 local nw = require "luci.model.network"
  17 local fw = require "luci.model.firewall"
  18 local ds = require "luci.dispatcher"
  19 local ut = require "luci.util"
  20
  21 local m, p, i, v
  22 local s, name, net, family, msrc, mdest, log, lim
  23 local s2, out, inp
  24
  25
  26 m = Map("firewall", translate("Firewall - Zone Settings"))
  27 m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones")
  28
  29 fw.init(m.uci)
  30 nw.init(m.uci)
  31
  32
  33 local zone = fw:get_zone(arg[1])
  34 if not zone then
  35         luci.http.redirect(dsp.build_url("admin/network/firewall/zones"))
  36         return
  37 else
  38         m.title = "%s - %s" %{
  39                 translate("Firewall - Zone Settings"),
  40                 translatef("Zone %q", zone:name() or "?")
  41         }
  42 end
  43
  44
  45 s = m:section(NamedSection, zone.sid, "zone",
  46         translatef("Zone %q", zone:name()),
  47         translatef("This section defines common properties of %q. \
  48                 The <em>input</em> and <em>output</em> options set the default \
  49                 policies for traffic entering and leaving this zone while the \
  50                 <em>forward</em> option describes the policy for forwarded traffic \
  51                 between different networks within the zone. \
  52                 <em>Covered networks</em> specifies which available networks are \
  53                 member of this zone.", zone:name()))
  54
  55 s.anonymous = true
  56 s.addremove = false
  57
  58 m.on_commit = function(map)
  59         local zone = fw:get_zone(arg[1])
  60         if zone then
  61                 s.section  = zone.sid
  62                 s2.section = zone.sid
  63         end
  64 end
  65
  66
  67 s:tab("general", translate("General Settings"))
  68 s:tab("advanced", translate("Advanced Settings"))
  69
  70
  71 name = s:taboption("general", Value, "name", translate("Name"))
  72 name.optional = false
  73 name.forcewrite = true
  74 name.datatype = "uciname"
  75
  76 function name.write(self, section, value)
  77         if zone:name() ~= value then
  78                 fw:rename_zone(zone:name(), value)
  79                 out.exclude = value
  80                 inp.exclude = value
  81         end
  82
  83         m.redirect = ds.build_url("admin/network/firewall/zones", value)
  84         m.title = "%s - %s" %{
  85                 translate("Firewall - Zone Settings"),
  86                 translatef("Zone %q", value or "?")
  87         }
  88 end
  89
  90 p = {
  91         s:taboption("general", ListValue, "input", translate("Input")),
  92         s:taboption("general", ListValue, "output", translate("Output")),
  93         s:taboption("general", ListValue, "forward", translate("Forward"))
  94 }
  95
  96 for i, v in ipairs(p) do
  97         v:value("REJECT", translate("reject"))
  98         v:value("DROP", translate("drop"))
  99         v:value("ACCEPT", translate("accept"))
 100 end
 101
 102 s:taboption("general", Flag, "masq", translate("Masquerading"))
 103 s:taboption("general", Flag, "mtu_fix", translate("MSS clamping"))
 104
 105 net = s:taboption("general", Value, "network", translate("Covered networks"))
 106 net.template = "cbi/network_netlist"
 107 net.widget = "checkbox"
 108 net.cast = "string"
 109
 110 function net.formvalue(self, section)
 111         return Value.formvalue(self, section) or "-"
 112 end
 113
 114 function net.cfgvalue(self, section)
 115         return Value.cfgvalue(self, section) or name:cfgvalue(section)
 116 end
 117
 118 function net.write(self, section, value)
 119         zone:clear_networks()
 120
 121         local n
 122         for n in ut.imatch(value) do
 123                 zone:add_network(n)
 124         end
 125 end
 126
 127
 128 family = s:taboption("advanced", ListValue, "family",
 129         translate("Restrict to address family"))
 130
 131 family.rmempty = true
 132 family:value("", translate("IPv4 and IPv6"))
 133 family:value("ipv4", translate("IPv4 only"))
 134 family:value("ipv6", translate("IPv6 only"))
 135
 136 msrc = s:taboption("advanced", DynamicList, "masq_src",
 137         translate("Restrict Masquerading to given source subnets"))
 138
 139 msrc.optional = true
 140 msrc.datatype = "list(neg,network)"
 141 msrc.placeholder = "0.0.0.0/0"
 142 msrc:depends("family", "")
 143 msrc:depends("family", "ipv4")
 144
 145 mdest = s:taboption("advanced", DynamicList, "masq_dest",
 146         translate("Restrict Masquerading to given destination subnets"))
 147
 148 mdest.optional = true
 149 mdest.datatype = "list(neg,network)"
 150 mdest.placeholder = "0.0.0.0/0"
 151 mdest:depends("family", "")
 152 mdest:depends("family", "ipv4")
 153
 154 s:taboption("advanced", Flag, "conntrack",
 155         translate("Force connection tracking"))
 156
 157 log = s:taboption("advanced", Flag, "log",
 158         translate("Enable logging on this zone"))
 159
 160 log.rmempty = true
 161 log.enabled = "1"
 162
 163 lim = s:taboption("advanced", Value, "log_limit",
 164         translate("Limit log messages"))
 165
 166 lim.placeholder = "10/minute"
 167 lim:depends("log", "1")
 168
 169
 170 s2 = m:section(NamedSection, zone.sid, "fwd_out",
 171         translate("Inter-Zone Forwarding"),
 172         translatef("The options below control the forwarding policies between \
 173                 this zone (%s) and other zones. <em>Destination zones</em> cover \
 174                 forwarded traffic <strong>originating from %q</strong>. \
 175                 <em>Source zones</em> match forwarded traffic from other zones \
 176                 <strong>targeted at %q</strong>. The forwarding rule is \
 177                 <em>unidirectional</em>, e.g. a forward from lan to wan does \
 178                 <em>not</em> imply a permission to forward from wan to lan as well.",
 179                 zone:name(), zone:name(), zone:name()
 180
 181         ))
 182
 183 out = s2:option(Value, "out",
 184         translate("Allow forward to <em>destination zones</em>:"))
 185
 186 out.nocreate = true
 187 out.widget = "checkbox"
 188 out.exclude = zone:name()
 189 out.template = "cbi/firewall_zonelist"
 190
 191 inp = s2:option(Value, "in",
 192         translate("Allow forward from <em>source zones</em>:"))
 193
 194 inp.nocreate = true
 195 inp.widget = "checkbox"
 196 inp.exclude = zone:name()
 197 inp.template = "cbi/firewall_zonelist"
 198
 199 function out.cfgvalue(self, section)
 200         local v = { }
 201         local f
 202         for _, f in ipairs(zone:get_forwardings_by("src")) do
 203                 v[#v+1] = f:dest()
 204         end
 205         return table.concat(v, " ")
 206 end
 207
 208 function inp.cfgvalue(self, section)
 209         local v = { }
 210         local f
 211         for _, f in ipairs(zone:get_forwardings_by("dest")) do
 212                 v[#v+1] = f:src()
 213         end
 214         return v
 215 end
 216
 217 function out.formvalue(self, section)
 218         return Value.formvalue(self, section) or "-"
 219 end
 220
 221 function inp.formvalue(self, section)
 222         return Value.formvalue(self, section) or "-"
 223 end
 224
 225 function out.write(self, section, value)
 226         zone:del_forwardings_by("src")
 227
 228         local f
 229         for f in ut.imatch(value) do
 230                 zone:add_forwarding_to(f)
 231         end
 232 end
 233
 234 function inp.write(self, section, value)
 235         zone:del_forwardings_by("dest")
 236
 237         local f
 238         for f in ut.imatch(value) do
 239                 zone:add_forwarding_from(f)
 240         end
 241 end
 242
 243 return m