1 |
7ed0e844
|
Warren Baker
|
<?php
|
2 |
|
|
/* $Id$ */
|
3 |
|
|
/*
|
4 |
|
|
services_unbound_acls.php
|
5 |
c7281770
|
Chris Buechler
|
part of pfSense (https://www.pfsense.org/)
|
6 |
7ed0e844
|
Warren Baker
|
|
7 |
|
|
Copyright (C) 2011 Warren Baker <warren@decoy.co.za>
|
8 |
|
|
All rights reserved.
|
9 |
|
|
|
10 |
|
|
Redistribution and use in source and binary forms, with or without
|
11 |
|
|
modification, are permitted provided that the following conditions are met:
|
12 |
|
|
|
13 |
|
|
1. Redistributions of source code must retain the above copyright notice,
|
14 |
|
|
this list of conditions and the following disclaimer.
|
15 |
|
|
|
16 |
|
|
2. Redistributions in binary form must reproduce the above copyright
|
17 |
|
|
notice, this list of conditions and the following disclaimer in the
|
18 |
|
|
documentation and/or other materials provided with the distribution.
|
19 |
|
|
|
20 |
|
|
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
21 |
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
22 |
|
|
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
23 |
|
|
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
24 |
|
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
25 |
|
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
26 |
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
27 |
|
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
28 |
|
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
29 |
|
|
POSSIBILITY OF SUCH DAMAGE.
|
30 |
|
|
*/
|
31 |
|
|
|
32 |
|
|
require("guiconfig.inc");
|
33 |
|
|
require("unbound.inc");
|
34 |
|
|
|
35 |
|
|
if (!is_array($config['unbound']['acls']))
|
36 |
|
|
$config['unbound']['acls'] = array();
|
37 |
|
|
|
38 |
|
|
$a_acls = &$config['unbound']['acls'];
|
39 |
|
|
|
40 |
|
|
$id = $_GET['id'];
|
41 |
|
|
if (isset($_POST['aclid']))
|
42 |
|
|
$id = $_POST['aclid'];
|
43 |
|
|
|
44 |
|
|
$act = $_GET['act'];
|
45 |
|
|
if (isset($_POST['act']))
|
46 |
|
|
$act = $_POST['act'];
|
47 |
|
|
|
48 |
|
|
if ($act == "del") {
|
49 |
|
|
if (!$a_acls[$id]) {
|
50 |
|
|
pfSenseHeader("services_unbound_acls.php");
|
51 |
|
|
exit;
|
52 |
|
|
}
|
53 |
|
|
|
54 |
|
|
unset($a_acls[$id]);
|
55 |
|
|
write_config();
|
56 |
519597bc
|
Warren Baker
|
services_unbound_configure();
|
57 |
8cd558b6
|
ayvis
|
$savemsg = gettext("Access List successfully deleted")."<br />";
|
58 |
7ed0e844
|
Warren Baker
|
}
|
59 |
|
|
|
60 |
|
|
if ($act == "new") {
|
61 |
|
|
$id = unbound_get_next_id();
|
62 |
|
|
}
|
63 |
|
|
|
64 |
|
|
if ($act == "edit") {
|
65 |
|
|
if (isset($id) && $a_acls[$id]) {
|
66 |
|
|
$pconfig = $a_acls[$id];
|
67 |
|
|
$networkacl = $a_acls[$id]['row'];
|
68 |
|
|
}
|
69 |
|
|
}
|
70 |
|
|
|
71 |
|
|
if ($_POST) {
|
72 |
|
|
|
73 |
|
|
unset($input_errors);
|
74 |
|
|
$pconfig = $_POST;
|
75 |
|
|
|
76 |
519597bc
|
Warren Baker
|
// input validation - only allow 50 entries in a single ACL
|
77 |
7ed0e844
|
Warren Baker
|
for($x=0; $x<50; $x++) {
|
78 |
519597bc
|
Warren Baker
|
if (isset($pconfig["acl_network{$x}"])) {
|
79 |
7ed0e844
|
Warren Baker
|
$networkacl[$x] = array();
|
80 |
|
|
$networkacl[$x]['acl_network'] = $pconfig["acl_network{$x}"];
|
81 |
|
|
$networkacl[$x]['mask'] = $pconfig["mask{$x}"];
|
82 |
|
|
$networkacl[$x]['description'] = $pconfig["description{$x}"];
|
83 |
|
|
if (!is_ipaddr($networkacl[$x]['acl_network']))
|
84 |
|
|
$input_errors[] = gettext("You must enter a valid network IP address for {$networkacl[$x]['acl_network']}.");
|
85 |
|
|
|
86 |
|
|
if (is_ipaddr($networkacl[$x]['acl_network'])) {
|
87 |
|
|
if (!is_subnet($networkacl[$x]['acl_network']."/".$networkacl[$x]['mask']))
|
88 |
|
|
$input_errors[] = gettext("You must enter a valid IPv4 netmask for {$networkacl[$x]['acl_network']}/{$networkacl[$x]['mask']}.");
|
89 |
|
|
} else if (function_exists("is_ipaddrv6")) {
|
90 |
|
|
if (!is_ipaddrv6($networkacl[$x]['acl_network']))
|
91 |
|
|
$input_errors[] = gettext("You must enter a valid IPv6 address for {$networkacl[$x]['acl_network']}.");
|
92 |
|
|
else if (!is_subnetv6($networkacl[$x]['acl_network']."/".$networkacl[$x]['mask']))
|
93 |
|
|
$input_errors[] = gettext("You must enter a valid IPv6 netmask for {$networkacl[$x]['acl_network']}/{$networkacl[$x]['mask']}.");
|
94 |
|
|
} else
|
95 |
|
|
$input_errors[] = gettext("You must enter a valid IPv4 address for {$networkacl[$x]['acl_network']}.");
|
96 |
|
|
}
|
97 |
|
|
}
|
98 |
|
|
|
99 |
|
|
if (!$input_errors) {
|
100 |
|
|
if ($pconfig['Submit'] == gettext("Save")) {
|
101 |
8fccab67
|
Warren Baker
|
$acl_entry = array();
|
102 |
|
|
$acl_entry['aclid'] = $pconfig['aclid'];
|
103 |
|
|
$acl_entry['aclname'] = $pconfig['aclname'];
|
104 |
|
|
$acl_entry['aclaction'] = $pconfig['aclaction'];
|
105 |
|
|
$acl_entry['description'] = $pconfig['description'];
|
106 |
|
|
$acl_entry['aclid'] = $pconfig['aclid'];
|
107 |
|
|
$acl_entry['row'] = array();
|
108 |
|
|
foreach ($networkacl as $acl)
|
109 |
|
|
$acl_entry['row'][] = $acl;
|
110 |
|
|
|
111 |
|
|
if (isset($id) && $a_acls[$id])
|
112 |
|
|
$a_acls[$id] = $acl_entry;
|
113 |
|
|
else
|
114 |
|
|
$a_acls[] = $acl_entry;
|
115 |
|
|
|
116 |
|
|
|
117 |
|
|
mark_subsystem_dirty("unbound");
|
118 |
|
|
write_config();
|
119 |
|
|
|
120 |
7ed0e844
|
Warren Baker
|
pfSenseHeader("/services_unbound_acls.php");
|
121 |
|
|
exit;
|
122 |
|
|
}
|
123 |
|
|
|
124 |
|
|
if ($pconfig['apply']) {
|
125 |
8fccab67
|
Warren Baker
|
clear_subsystem_dirty("unbound");
|
126 |
|
|
$retval = 0;
|
127 |
|
|
$retval = services_unbound_configure();
|
128 |
|
|
$savemsg = get_std_save_message($retval);
|
129 |
7ed0e844
|
Warren Baker
|
}
|
130 |
|
|
}
|
131 |
|
|
}
|
132 |
|
|
|
133 |
|
|
|
134 |
|
|
$pgtitle = "Services: DNS Resolver: Access Lists";
|
135 |
|
|
include("head.inc");
|
136 |
|
|
|
137 |
|
|
?>
|
138 |
|
|
|
139 |
|
|
<script type="text/javascript" src="/javascript/row_helper.js">
|
140 |
|
|
</script>
|
141 |
|
|
|
142 |
|
|
<script type="text/javascript">
|
143 |
|
|
function mask_field(fieldname, fieldsize, n) {
|
144 |
|
|
return '<select name="' + fieldname + n + '" class="formselect" id="' + fieldname + n + '"><?php
|
145 |
|
|
for ($i = 128; $i >= 0; $i--) {
|
146 |
|
|
echo "<option value=\"$i\">$i</option>";
|
147 |
|
|
}
|
148 |
|
|
?></select>';
|
149 |
|
|
}
|
150 |
|
|
|
151 |
|
|
rowtype[0] = "textbox";
|
152 |
|
|
rowname[0] = "acl_network";
|
153 |
|
|
rowsize[0] = "30";
|
154 |
|
|
rowname[1] = "mask";
|
155 |
|
|
rowtype[1] = mask_field;
|
156 |
|
|
rowtype[2] = "textbox";
|
157 |
|
|
rowname[2] = "description";
|
158 |
|
|
rowsize[2] = "40";
|
159 |
|
|
</script>
|
160 |
|
|
|
161 |
9961044a
|
Warren Baker
|
<body>
|
162 |
7ed0e844
|
Warren Baker
|
|
163 |
|
|
<?php include("fbegin.inc"); ?>
|
164 |
|
|
<form action="services_unbound_acls.php" method="post" name="iform" id="iform">
|
165 |
|
|
<?php
|
166 |
|
|
if (!$savemsg)
|
167 |
|
|
$savemsg = "";
|
168 |
|
|
|
169 |
|
|
if ($input_errors)
|
170 |
|
|
print_input_errors($input_errors);
|
171 |
|
|
|
172 |
|
|
if ($savemsg)
|
173 |
|
|
print_info_box($savemsg);
|
174 |
|
|
|
175 |
|
|
if (is_subsystem_dirty("unbound"))
|
176 |
|
|
print_info_box_np(gettext("The settings for the DNS Resolver have changed. You must apply the configuration to take affect."));
|
177 |
|
|
?>
|
178 |
9961044a
|
Warren Baker
|
<table width="100%" border="0" cellpadding="0" cellspacing="0" summary="services unbound acls">
|
179 |
|
|
<tbody>
|
180 |
|
|
<tr>
|
181 |
|
|
<td class="tabnavtbl">
|
182 |
7ed0e844
|
Warren Baker
|
<?php
|
183 |
9961044a
|
Warren Baker
|
$tab_array = array();
|
184 |
|
|
$tab_array[] = array(gettext("General Settings"), false, "/services_unbound.php");
|
185 |
|
|
$tab_array[] = array(gettext("Advanced settings"), false, "services_unbound_advanced.php");
|
186 |
|
|
$tab_array[] = array(gettext("Access Lists"), true, "/services_unbound_acls.php");
|
187 |
|
|
display_top_tabs($tab_array, true);
|
188 |
7ed0e844
|
Warren Baker
|
?>
|
189 |
9961044a
|
Warren Baker
|
</td>
|
190 |
|
|
</tr>
|
191 |
|
|
<tr>
|
192 |
|
|
<td id="mainarea">
|
193 |
|
|
<div class="tabcont">
|
194 |
|
|
<?php if($act=="new" || $act=="edit"): ?>
|
195 |
|
|
<input name="aclid" type="hidden" value="<?=$id;?>">
|
196 |
|
|
<input name="act" type="hidden" value="<?=$act;?>">
|
197 |
|
|
|
198 |
|
|
<table width="100%" border="0" cellpadding="6" cellspacing="0">
|
199 |
|
|
<tr>
|
200 |
|
|
<td colspan="2" valign="top" class="listtopic"><?=ucwords(sprintf(gettext("%s Access List"),$act));?></td>
|
201 |
|
|
</tr>
|
202 |
|
|
<tr>
|
203 |
|
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Access List name");?></td>
|
204 |
|
|
<td width="78%" class="vtable">
|
205 |
|
|
<input name="aclname" type="text" class="formfld" id="aclname" size="30" maxlength="30" value="<?=htmlspecialchars($pconfig['aclname']);?>">
|
206 |
|
|
<br />
|
207 |
|
|
<span class="vexpl"><?=gettext("Provide an Access List name.");?></span>
|
208 |
|
|
</td>
|
209 |
|
|
</tr>
|
210 |
|
|
<tr>
|
211 |
|
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Action");?></td>
|
212 |
|
|
<td width="78%" class="vtable">
|
213 |
|
|
<select name="aclaction" class="formselect">
|
214 |
|
|
<?php $types = explode(",", "Allow,Deny,Refuse,Allow Snoop"); foreach ($types as $type): ?>
|
215 |
|
|
<option value="<?=strtolower($type);?>" <?php if (strtolower($type) == strtolower($pconfig['aclaction'])) echo "selected"; ?>>
|
216 |
|
|
<?=htmlspecialchars($type);?>
|
217 |
|
|
</option>
|
218 |
|
|
<?php endforeach; ?>
|
219 |
|
|
</select>
|
220 |
8cd558b6
|
ayvis
|
<br />
|
221 |
9961044a
|
Warren Baker
|
<span class="vexpl">
|
222 |
8cd558b6
|
ayvis
|
<?=gettext("Choose what to do with DNS requests that match the criteria specified below.");?> <br />
|
223 |
|
|
<?=gettext("<b>Deny:</b> This action stops queries from hosts within the netblock defined below.");?> <br />
|
224 |
|
|
<?=gettext("<b>Refuse:</b> This action also stops queries from hosts within the netblock defined below, but sends a DNS rcode REFUSED error message back to the client.");?> <br />
|
225 |
|
|
<?=gettext("<b>Allow:</b> This action allows queries from hosts within the netblock defined below.");?> <br />
|
226 |
|
|
<?=gettext("<b>Allow Snoop:</b> This action allows recursive and nonrecursive access from hosts within the netblock defined below. Used for cache snooping and ideally should only be configured for your administrative host.");?> <br />
|
227 |
9961044a
|
Warren Baker
|
</span>
|
228 |
|
|
</td>
|
229 |
|
|
</tr>
|
230 |
|
|
<tr>
|
231 |
|
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Networks");?></td>
|
232 |
|
|
<td width="78%" class="vtable">
|
233 |
|
|
<table id="maintable">
|
234 |
|
|
<tbody>
|
235 |
|
|
<tr>
|
236 |
|
|
<td><div id="onecolumn"><?=gettext("Network");?></div></td>
|
237 |
|
|
<td><div id="twocolumn"><?=gettext("CIDR");?></div></td>
|
238 |
|
|
<td><div id="threecolumn"><?=gettext("Description");?></div></td>
|
239 |
|
|
</tr>
|
240 |
|
|
<?php $counter = 0; ?>
|
241 |
|
|
<?php
|
242 |
|
|
if($networkacl)
|
243 |
|
|
foreach($networkacl as $item):
|
244 |
|
|
?>
|
245 |
|
|
<?php
|
246 |
|
|
$network = $item['acl_network'];
|
247 |
|
|
$cidr = $item['mask'];
|
248 |
|
|
$description = $item['description'];
|
249 |
|
|
?>
|
250 |
|
|
<tr>
|
251 |
|
|
<td>
|
252 |
|
|
<input autocomplete="off" name="acl_network<?=$counter;?>" type="text" class="formfld unknown" id="acl_network<?=$counter;?>" size="40" value="<?=htmlspecialchars($network);?>" />
|
253 |
|
|
</td>
|
254 |
|
|
<td>
|
255 |
|
|
<select name="mask<?=$counter;?>" class="formselect" id="mask<?=$counter;?>">
|
256 |
|
|
<?php
|
257 |
|
|
for ($i = 128; $i > 0; $i--) {
|
258 |
|
|
echo "<option value=\"$i\" ";
|
259 |
|
|
if ($i == $cidr) echo "selected";
|
260 |
|
|
echo ">" . $i . "</option>";
|
261 |
|
|
}
|
262 |
|
|
?>
|
263 |
|
|
</select>
|
264 |
|
|
</td>
|
265 |
|
|
<td>
|
266 |
|
|
<input autocomplete="off" name="description<?=$counter;?>" type="text" class="listbg" id="description<?=$counter;?>" size="40" value="<?=htmlspecialchars($description);?>" />
|
267 |
|
|
</td>
|
268 |
|
|
<td>
|
269 |
|
|
<a onclick="removeRow(this); return false;" href="#"><img border="0" src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" /></a>
|
270 |
|
|
</td>
|
271 |
|
|
</tr>
|
272 |
|
|
<?php $counter++; ?>
|
273 |
|
|
<?php endforeach; ?>
|
274 |
|
|
</tbody>
|
275 |
|
|
<tfoot>
|
276 |
|
|
</tfoot>
|
277 |
|
|
</table>
|
278 |
|
|
<a onclick="javascript:addRowTo('maintable', 'formfldalias'); return false;" href="#">
|
279 |
|
|
<img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" alt="" title="<?=gettext("add another entry");?>" />
|
280 |
|
|
</a>
|
281 |
|
|
<script type="text/javascript">
|
282 |
|
|
field_counter_js = 3;
|
283 |
|
|
rows = 1;
|
284 |
|
|
totalrows = <?php echo $counter; ?>;
|
285 |
|
|
loaded = <?php echo $counter; ?>;
|
286 |
|
|
</script>
|
287 |
|
|
|
288 |
|
|
</td>
|
289 |
|
|
</tr>
|
290 |
|
|
|
291 |
|
|
<tr>
|
292 |
|
|
<td width="22%" valign="top" class="vncell"><?=gettext("Description");?></td>
|
293 |
|
|
<td width="78%" class="vtable">
|
294 |
|
|
<input name="description" type="text" class="formfld unknown" id="description" size="52" maxlength="52" value="<?=htmlspecialchars($pconfig['description']);?>">
|
295 |
|
|
<br />
|
296 |
|
|
<span class="vexpl"><?=gettext("You may enter a description here for your reference.");?></span>
|
297 |
|
|
</td>
|
298 |
|
|
</tr>
|
299 |
|
|
<tr>
|
300 |
|
|
<td> </td>
|
301 |
|
|
</tr>
|
302 |
|
|
<tr>
|
303 |
|
|
<td width="22%" valign="top"> </td>
|
304 |
|
|
<td width="78%">
|
305 |
8cd558b6
|
ayvis
|
<br />
|
306 |
9961044a
|
Warren Baker
|
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
|
307 |
|
|
</td>
|
308 |
|
|
</tr>
|
309 |
|
|
</table>
|
310 |
|
|
</form>
|
311 |
|
|
|
312 |
|
|
<?php else: ?>
|
313 |
|
|
|
314 |
|
|
<table class="sortable" width="100%" border="0" cellpadding="0" cellspacing="0">
|
315 |
|
|
<thead>
|
316 |
|
|
<tr>
|
317 |
|
|
<td width="25%" class="listhdrr"><?=gettext("Access List Name"); ?></td>
|
318 |
|
|
<td width="25%" class="listhdrr"><?=gettext("Action"); ?></td>
|
319 |
|
|
<td width="40%" class="listhdrr"><?=gettext("Description"); ?></td>
|
320 |
|
|
<td width="10%" class="list"></td>
|
321 |
|
|
</tr>
|
322 |
|
|
</thead>
|
323 |
|
|
<tbody>
|
324 |
|
|
<?php
|
325 |
|
|
$i = 0;
|
326 |
|
|
foreach($a_acls as $acl):
|
327 |
|
|
?>
|
328 |
|
|
<tr ondblclick="document.location='services_unbound_acls.php?act=edit&id=<?=$i;?>'">
|
329 |
|
|
<td class="listlr">
|
330 |
|
|
<?=$acl['aclname'];?>
|
331 |
|
|
</td>
|
332 |
|
|
<td class="listr">
|
333 |
|
|
<?=htmlspecialchars($acl['aclaction']);?>
|
334 |
|
|
</td>
|
335 |
|
|
<td class="listbg">
|
336 |
|
|
<?=htmlspecialchars($acl['description']);?>
|
337 |
|
|
</td>
|
338 |
|
|
<td valign="middle" nowrap class="list">
|
339 |
|
|
<a href="services_unbound_acls.php?act=edit&id=<?=$i;?>">
|
340 |
|
|
<img src="./themes/<?=$g['theme'];?>/images/icons/icon_e.gif" title="<?=gettext("edit access list"); ?>" width="17" height="17" border="0">
|
341 |
|
|
</a>
|
342 |
|
|
|
343 |
|
|
<a href="services_unbound_acls.php?act=del&id=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this access list?"); ?>')">
|
344 |
|
|
<img src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" title="<?=gettext("delete access list"); ?>" width="17" height="17" border="0">
|
345 |
|
|
</a>
|
346 |
|
|
</td>
|
347 |
|
|
</tr>
|
348 |
|
|
<?php
|
349 |
|
|
$i++;
|
350 |
|
|
endforeach;
|
351 |
|
|
?>
|
352 |
|
|
</tbody>
|
353 |
|
|
<tfoot>
|
354 |
|
|
<tr>
|
355 |
|
|
<td class="list" colspan="4"></td>
|
356 |
|
|
<td class="list">
|
357 |
|
|
<a href="services_unbound_acls.php?act=new">
|
358 |
|
|
<img src="./themes/<?=$g['theme'];?>/images/icons/icon_plus.gif" title="<?=gettext("Add new Access List"); ?>" border="0">
|
359 |
|
|
</a>
|
360 |
|
|
</td>
|
361 |
|
|
</tr>
|
362 |
|
|
<tr>
|
363 |
|
|
<td colspan="4">
|
364 |
|
|
<p>
|
365 |
|
|
<?=gettext("Access Lists to control access to the DNS Resolver can be defined here.");?>
|
366 |
|
|
</p>
|
367 |
|
|
</td>
|
368 |
|
|
</tr>
|
369 |
|
|
</tfoot>
|
370 |
|
|
</table>
|
371 |
7ed0e844
|
Warren Baker
|
<?php endif; ?>
|
372 |
9961044a
|
Warren Baker
|
</td>
|
373 |
|
|
</tr>
|
374 |
|
|
</tbody>
|
375 |
7ed0e844
|
Warren Baker
|
</table>
|
376 |
9961044a
|
Warren Baker
|
|
377 |
7ed0e844
|
Warren Baker
|
<?php include("fend.inc"); ?>
|
378 |
9961044a
|
Warren Baker
|
</body>
|
379 |
|
|
</html>
|