libs/core: explicitely load luci.i18n in network model
[project/luci.git] / libs / core / luasrc / model / firewall.lua
1 --[[
2 LuCI - Firewall model
3
4 Copyright 2009 Jo-Philipp Wich <xm@subsignal.org>
5
6 Licensed under the Apache License, Version 2.0 (the "License");
7 you may not use this file except in compliance with the License.
8 You may obtain a copy of the License at
9
10 http://www.apache.org/licenses/LICENSE-2.0
11
12 Unless required by applicable law or agreed to in writing, software
13 distributed under the License is distributed on an "AS IS" BASIS,
14 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 See the License for the specific language governing permissions and
16 limitations under the License.
17
18 ]]--
19
20 local type, pairs, ipairs, table, luci, math
21 = type, pairs, ipairs, table, luci, math
22
23 local lmo = require "lmo"
24 local utl = require "luci.util"
25 local uci = require "luci.model.uci"
26
27 module "luci.model.firewall"
28
29
30 local uci_r, uci_s
31
32 function _valid_id(x)
33 return (x and #x > 0 and x:match("^[a-zA-Z0-9_]+$"))
34 end
35
36 function _get(c, s, o)
37 return uci_r:get(c, s, o)
38 end
39
40 function _set(c, s, o, v)
41 if v ~= nil then
42 if type(v) == "boolean" then v = v and "1" or "0" end
43 return uci_r:set(c, s, o, v)
44 else
45 return uci_r:delete(c, s, o)
46 end
47 end
48
49
50 function init(cursor)
51 uci_r = cursor or uci_r or uci.cursor()
52 uci_s = uci_r:substate()
53
54 return _M
55 end
56
57 function save(self, ...)
58 uci_r:save(...)
59 uci_r:load(...)
60 end
61
62 function commit(self, ...)
63 uci_r:commit(...)
64 uci_r:load(...)
65 end
66
67 function get_defaults()
68 return defaults()
69 end
70
71 function new_zone(self)
72 local name = "newzone"
73 local count = 1
74
75 while self:get_zone(name) do
76 count = count + 1
77 name = "newzone%d" % count
78 end
79
80 return self:add_zone(name)
81 end
82
83 function add_zone(self, n)
84 if _valid_id(n) and not self:get_zone(n) then
85 local d = defaults()
86 local z = uci_r:section("firewall", "zone", nil, {
87 name = n,
88 network = " ",
89 input = d:input() or "DROP",
90 forward = d:forward() or "DROP",
91 output = d:output() or "DROP"
92 })
93
94 return z and zone(z)
95 end
96 end
97
98 function get_zone(self, n)
99 if uci_r:get("firewall", n) == "zone" then
100 return zone(n)
101 else
102 local z
103 uci_r:foreach("firewall", "zone",
104 function(s)
105 if n and s.name == n then
106 z = s['.name']
107 return false
108 end
109 end)
110 return z and zone(z)
111 end
112 end
113
114 function get_zones(self)
115 local zones = { }
116 local znl = { }
117
118 uci_r:foreach("firewall", "zone",
119 function(s)
120 if s.name then
121 znl[s.name] = zone(s['.name'])
122 end
123 end)
124
125 local z
126 for z in utl.kspairs(znl) do
127 zones[#zones+1] = znl[z]
128 end
129
130 return zones
131 end
132
133 function get_zone_by_network(self, net)
134 local z
135
136 uci_r:foreach("firewall", "zone",
137 function(s)
138 if s.name and net then
139 local n
140 for n in utl.imatch(s.network or s.name) do
141 if n == net then
142 z = s['.name']
143 return false
144 end
145 end
146 end
147 end)
148
149 return z and zone(z)
150 end
151
152 function del_zone(self, n)
153 local r = false
154
155 if uci_r:get("firewall", n) == "zone" then
156 local z = uci_r:get("firewall", n, "name")
157 r = uci_r:delete("firewall", n)
158 n = z
159 else
160 uci_r:foreach("firewall", "zone",
161 function(s)
162 if n and s.name == n then
163 r = uci_r:delete("firewall", s['.name'])
164 return false
165 end
166 end)
167 end
168
169 if r then
170 uci_r:foreach("firewall", "rule",
171 function(s)
172 if s.src == n or s.dest == n then
173 uci_r:delete("firewall", s['.name'])
174 end
175 end)
176
177 uci_r:foreach("firewall", "redirect",
178 function(s)
179 if s.src == n or s.dest == n then
180 uci_r:delete("firewall", s['.name'])
181 end
182 end)
183
184 uci_r:foreach("firewall", "forwarding",
185 function(s)
186 if s.src == n or s.dest == n then
187 uci_r:delete("firewall", s['.name'])
188 end
189 end)
190 end
191
192 return r
193 end
194
195 function rename_zone(self, old, new)
196 local r = false
197
198 if _valid_id(new) and not self:get_zone(new) then
199 uci_r:foreach("firewall", "zone",
200 function(s)
201 if old and s.name == old then
202 if not s.network then
203 uci_r:set("firewall", s['.name'], "network", old)
204 end
205 uci_r:set("firewall", s['.name'], "name", new)
206 r = true
207 return false
208 end
209 end)
210
211 if r then
212 uci_r:foreach("firewall", "rule",
213 function(s)
214 if s.src == old then
215 uci_r:set("firewall", s['.name'], "src", new)
216 end
217 if s.dest == old then
218 uci_r:set("firewall", s['.name'], "dest", new)
219 end
220 end)
221
222 uci_r:foreach("firewall", "redirect",
223 function(s)
224 if s.src == old then
225 uci_r:set("firewall", s['.name'], "src", new)
226 end
227 if s.dest == old then
228 uci_r:set("firewall", s['.name'], "dest", new)
229 end
230 end)
231
232 uci_r:foreach("firewall", "forwarding",
233 function(s)
234 if s.src == old then
235 uci_r:set("firewall", s['.name'], "src", new)
236 end
237 if s.dest == old then
238 uci_r:set("firewall", s['.name'], "dest", new)
239 end
240 end)
241 end
242 end
243
244 return r
245 end
246
247 function del_network(self, net)
248 local z
249 if net then
250 for _, z in ipairs(self:get_zones()) do
251 z:del_network(net)
252 end
253 end
254 end
255
256
257 defaults = utl.class()
258 function defaults.__init__(self)
259 uci_r:foreach("firewall", "defaults",
260 function(s)
261 self.sid = s['.name']
262 return false
263 end)
264
265 self.sid = self.sid or uci_r:section("firewall", "defaults", nil, { })
266 end
267
268 function defaults.get(self, opt)
269 return _get("firewall", self.sid, opt)
270 end
271
272 function defaults.set(self, opt, val)
273 return _set("firewall", self.sid, opt, val)
274 end
275
276 function defaults.syn_flood(self)
277 return (self:get("syn_flood") == "1")
278 end
279
280 function defaults.drop_invalid(self)
281 return (self:get("drop_invalid") == "1")
282 end
283
284 function defaults.input(self)
285 return self:get("input") or "DROP"
286 end
287
288 function defaults.forward(self)
289 return self:get("forward") or "DROP"
290 end
291
292 function defaults.output(self)
293 return self:get("output") or "DROP"
294 end
295
296
297 zone = utl.class()
298 function zone.__init__(self, z)
299 if uci_r:get("firewall", z) == "zone" then
300 self.sid = z
301 self.data = uci_r:get_all("firewall", z)
302 else
303 uci_r:foreach("firewall", "zone",
304 function(s)
305 if s.name == z then
306 self.sid = s['.name']
307 self.data = s
308 return false
309 end
310 end)
311 end
312 end
313
314 function zone.get(self, opt)
315 return _get("firewall", self.sid, opt)
316 end
317
318 function zone.set(self, opt, val)
319 return _set("firewall", self.sid, opt, val)
320 end
321
322 function zone.masq(self)
323 return (self:get("masq") == "1")
324 end
325
326 function zone.name(self)
327 return self:get("name")
328 end
329
330 function zone.network(self)
331 return self:get("network")
332 end
333
334 function zone.input(self)
335 return self:get("input") or defaults():input() or "DROP"
336 end
337
338 function zone.forward(self)
339 return self:get("forward") or defaults():forward() or "DROP"
340 end
341
342 function zone.output(self)
343 return self:get("output") or defaults():output() or "DROP"
344 end
345
346 function zone.add_network(self, net)
347 if uci_r:get("network", net) == "interface" then
348 local nets = { }
349
350 local n
351 for n in utl.imatch(self:get("network") or self:get("name")) do
352 if n ~= net then
353 nets[#nets+1] = n
354 end
355 end
356
357 nets[#nets+1] = net
358
359 _M:del_network(net)
360 self:set("network", table.concat(nets, " "))
361 end
362 end
363
364 function zone.del_network(self, net)
365 local nets = { }
366
367 local n
368 for n in utl.imatch(self:get("network") or self:get("name")) do
369 if n ~= net then
370 nets[#nets+1] = n
371 end
372 end
373
374 if #nets > 0 then
375 self:set("network", table.concat(nets, " "))
376 else
377 self:set("network", " ")
378 end
379 end
380
381 function zone.get_networks(self)
382 local nets = { }
383
384 local n
385 for n in utl.imatch(self:get("network") or self:get("name")) do
386 nets[#nets+1] = n
387 end
388
389 return nets
390 end
391
392 function zone.clear_networks(self)
393 self:set("network", " ")
394 end
395
396 function zone.get_forwardings_by(self, what)
397 local name = self:name()
398 local forwards = { }
399
400 uci_r:foreach("firewall", "forwarding",
401 function(s)
402 if s.src and s.dest and s[what] == name then
403 forwards[#forwards+1] = forwarding(s['.name'])
404 end
405 end)
406
407 return forwards
408 end
409
410 function zone.add_forwarding_to(self, dest)
411 local exist, forward
412
413 for _, forward in ipairs(self:get_forwardings_by('src')) do
414 if forward:dest() == dest then
415 exist = true
416 break
417 end
418 end
419
420 if not exist and dest ~= self:name() and _valid_id(dest) then
421 local s = uci_r:section("firewall", "forwarding", nil, {
422 src = self:name(),
423 dest = dest
424 })
425
426 return s and forwarding(s)
427 end
428 end
429
430 function zone.add_forwarding_from(self, src)
431 local exist, forward
432
433 for _, forward in ipairs(self:get_forwardings_by('dest')) do
434 if forward:src() == src then
435 exist = true
436 break
437 end
438 end
439
440 if not exist and src ~= self:name() and _valid_id(src) then
441 local s = uci_r:section("firewall", "forwarding", nil, {
442 src = src,
443 dest = self:name()
444 })
445
446 return s and forwarding(s)
447 end
448 end
449
450 function zone.del_forwardings_by(self, what)
451 local name = self:name()
452
453 uci_r:delete_all("firewall", "forwarding",
454 function(s)
455 return (s.src and s.dest and s[what] == name)
456 end)
457 end
458
459 function zone.add_redirect(self, options)
460 options = options or { }
461 options.src = self:name()
462
463 local s = uci_r:section("firewall", "redirect", nil, options)
464 return s and redirect(s)
465 end
466
467 function zone.add_rule(self, options)
468 options = options or { }
469 options.src = self:name()
470
471 local s = uci_r:section("firewall", "rule", nil, options)
472 return s and rule(s)
473 end
474
475 function zone.get_color(self)
476 if self and self:name() == "lan" then
477 return "#90f090"
478 elseif self and self:name() == "wan" then
479 return "#f09090"
480 elseif self then
481 math.randomseed(lmo.hash(self:name()))
482
483 local r = math.random(128)
484 local g = math.random(128)
485 local min = 0
486 local max = 128
487
488 if ( r + g ) < 128 then
489 min = 128 - r - g
490 else
491 max = 255 - r - g
492 end
493
494 local b = min + math.floor( math.random() * ( max - min ) )
495
496 return "#%02x%02x%02x" % { 0xFF - r, 0xFF - g, 0xFF - b }
497 else
498 return "#eeeeee"
499 end
500 end
501
502
503 forwarding = utl.class()
504 function forwarding.__init__(self, f)
505 self.sid = f
506 end
507
508 function forwarding.src(self)
509 return uci_r:get("firewall", self.sid, "src")
510 end
511
512 function forwarding.dest(self)
513 return uci_r:get("firewall", self.sid, "dest")
514 end
515
516 function forwarding.src_zone(self)
517 return zone(self:src())
518 end
519
520 function forwarding.dest_zone(self)
521 return zone(self:dest())
522 end
523
524
525 rule = utl.class()
526 function rule.__init__(self, f)
527 self.sid = f
528 end
529
530 function rule.get(self, opt)
531 return _get("firewall", self.sid, opt)
532 end
533
534 function rule.set(self, opt, val)
535 return _set("firewall", self.sid, opt, val)
536 end
537
538 function rule.src(self)
539 return uci_r:get("firewall", self.sid, "src")
540 end
541
542 function rule.dest(self)
543 return uci_r:get("firewall", self.sid, "dest")
544 end
545
546 function rule.src_zone(self)
547 return zone(self:src())
548 end
549
550 function rule.dest_zone(self)
551 return zone(self:dest())
552 end
553
554
555 redirect = utl.class()
556 function redirect.__init__(self, f)
557 self.sid = f
558 end
559
560 function redirect.get(self, opt)
561 return _get("firewall", self.sid, opt)
562 end
563
564 function redirect.set(self, opt, val)
565 return _set("firewall", self.sid, opt, val)
566 end
567
568 function redirect.src(self)
569 return uci_r:get("firewall", self.sid, "src")
570 end
571
572 function redirect.dest(self)
573 return uci_r:get("firewall", self.sid, "dest")
574 end
575
576 function redirect.src_zone(self)
577 return zone(self:src())
578 end
579
580 function redirect.dest_zone(self)
581 return zone(self:dest())
582 end