Todo #15173 ยป statepolicy.patch
| src/etc/inc/filter.inc | ||
|---|---|---|
| 391 | 391 |
$limitrules = ""; |
| 392 | 392 |
} |
| 393 | 393 | |
| 394 |
$limitrules .= "set state-policy " . config_get_path('system/statepolicy', 'if-bound') . "\n";
|
|
| 395 | ||
| 394 | 396 |
/* User defined maximum table entries in Advanced menu. */ |
| 395 | 397 |
if (is_numeric(config_get_path('system/maximumtableentries'))) {
|
| 396 | 398 |
$limitrules .= sprintf("set limit table-entries %d\n", config_get_path('system/maximumtableentries'));
|
| src/usr/local/pfSense/include/www/system_advanced_firewall.inc | ||
|---|---|---|
| 27 | 27 |
require_once("util.inc");
|
| 28 | 28 |
require_once("pfsense-utils.inc");
|
| 29 | 29 | |
| 30 |
$state_policy_options = [ |
|
| 31 |
'if-bound' => gettext('Interface Bound States'),
|
|
| 32 |
'floating' => gettext('Floating States'),
|
|
| 33 |
]; |
|
| 34 | ||
| 30 | 35 | |
| 31 | 36 |
// Functions included by system_advanced_firewall.php ========================= |
| 32 | 37 |
function getSystemAdvancedFirewall($json = false) {
|
| ... | ... | |
| 40 | 45 |
$pconfig['bogonsinterval'] = config_get_path('system/bogons/interval');
|
| 41 | 46 |
$pconfig['bypassstaticroutes'] = isset($config['filter']['bypassstaticroutes']); |
| 42 | 47 |
$pconfig['checkaliasesurlcert'] = isset($config['system']['checkaliasesurlcert']); |
| 48 |
$pconfig['statepolicy'] = config_get_path('system/statepolicy');
|
|
| 43 | 49 |
$pconfig['disablefilter'] = config_get_path('system/disablefilter');
|
| 44 | 50 |
$pconfig['disablenatreflection'] = config_get_path('system/disablenatreflection');
|
| 45 | 51 |
$pconfig['disablenegate'] = isset($config['system']['disablenegate']); |
| ... | ... | |
| 82 | 88 |
} |
| 83 | 89 | |
| 84 | 90 |
function saveSystemAdvancedFirewall($post, $json = false) {
|
| 85 |
global $g, $config; |
|
| 91 |
global $g, $config, $state_policy_options;
|
|
| 86 | 92 | |
| 87 | 93 |
$rv = array(); |
| 88 | 94 | |
| 89 | 95 |
/* input validation */ |
| 96 | ||
| 97 |
if (!empty($post['statepolicy']) && |
|
| 98 |
!array_key_exists($post['statepolicy'], $state_policy_options)) {
|
|
| 99 |
$input_errors[] = gettext("Invalid Firewall State Policy value.");
|
|
| 100 |
} |
|
| 101 | ||
| 90 | 102 |
if ((isset($post['adaptivestart']) && !isset($post['adaptiveend'])) || (!isset($post['adaptivestart']) && isset($post['adaptiveend']))) {
|
| 91 | 103 |
$input_errors[] = gettext("The Firewall Adaptive values must be set together.");
|
| 92 | 104 |
} |
| ... | ... | |
| 193 | 205 |
config_del_path('system/disablefilter');
|
| 194 | 206 |
} |
| 195 | 207 | |
| 208 |
config_set_path('system/statepolicy', $post['statepolicy']);
|
|
| 209 | ||
| 196 | 210 |
if ($post['disablevpnrules'] == "yes") {
|
| 197 | 211 |
$config['system']['disablevpnrules'] = true; |
| 198 | 212 |
} else {
|
| src/usr/local/www/system_advanced_firewall.php | ||
|---|---|---|
| 250 | 250 |
'Note: This will also turn off NAT! To only disable NAT, '. |
| 251 | 251 |
'and not firewall rules, visit the %3$sOutbound NAT%4$s page.', g_get('product_label'), '<br/>', '<a href="firewall_nat_out.php">', '</a>');
|
| 252 | 252 | |
| 253 |
global $state_policy_options; |
|
| 254 | ||
| 255 |
$section->addInput(new Form_Select( |
|
| 256 |
'statepolicy', |
|
| 257 |
'Firewall State Policy', |
|
| 258 |
$pconfig['statepolicy'], |
|
| 259 |
$state_policy_options |
|
| 260 |
))->setHelp( |
|
| 261 |
'%1$sInterface Bound States are more strict and secure. States '. |
|
| 262 |
'are bound to specific interfaces by their OS/driver name (e.g. '. |
|
| 263 |
'igcX). If a packet attempts to takes an path through a different '. |
|
| 264 |
'interface than the one to which it is bound, the packet is '. |
|
| 265 |
'dropped. This policy is less likely to allow VPN or other '. |
|
| 266 |
'traffic to egress via unexpected paths (e.g. during interface '. |
|
| 267 |
'events). '. |
|
| 268 |
'%2$sFloating States are less secure, more lenient in their '. |
|
| 269 |
'checks, and are not strictly associated with any interface. The '. |
|
| 270 |
'interface is tracked in state properties, but it is informational '. |
|
| 271 |
'and not enforced. This policy allows HA nodes with different '. |
|
| 272 |
'hardware to utilize state synchronization. It is also more '. |
|
| 273 |
'forgiving of certain asymmetric routing scenarios. However, this '. |
|
| 274 |
'relaxed policy may allow connections to be misdirected or take '. |
|
| 275 |
'unexpected paths if the routing table can be manipulated. '. |
|
| 276 |
'%3$sThere is no difference in the ability to view or kill states ' . |
|
| 277 |
'between either mode.', |
|
| 278 |
'</span><ul class="help-block"><li>', '</li><li>', '</li></ul><span class="help-block">'); |
|
| 279 | ||
| 253 | 280 |
$section->addInput(new Form_Checkbox( |
| 254 | 281 |
'bypassstaticroutes', |
| 255 | 282 |
'Static route filtering', |