| 1 |
5ba18897
|
Scott Ullrich
|
<?php
|
| 2 |
b46bfcf5
|
Bill Marquette
|
/* $Id$ */
|
| 3 |
5b237745
|
Scott Ullrich
|
/*
|
| 4 |
bdb7d6e7
|
Scott Ullrich
|
firewall_rules_edit.php
|
| 5 |
e4cabb75
|
Scott Ullrich
|
part of pfSense (http://www.pfsense.com)
|
| 6 |
|
|
Copyright (C) 2005 Scott Ullrich (sullrich@gmail.com)
|
| 7 |
5ba18897
|
Scott Ullrich
|
|
| 8 |
e4cabb75
|
Scott Ullrich
|
originally part of m0n0wall (http://m0n0.ch/wall)
|
| 9 |
bdb7d6e7
|
Scott Ullrich
|
Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
|
| 10 |
|
|
All rights reserved.
|
| 11 |
5ba18897
|
Scott Ullrich
|
|
| 12 |
bdb7d6e7
|
Scott Ullrich
|
Redistribution and use in source and binary forms, with or without
|
| 13 |
|
|
modification, are permitted provided that the following conditions are met:
|
| 14 |
5ba18897
|
Scott Ullrich
|
|
| 15 |
bdb7d6e7
|
Scott Ullrich
|
1. Redistributions of source code must retain the above copyright notice,
|
| 16 |
|
|
this list of conditions and the following disclaimer.
|
| 17 |
5ba18897
|
Scott Ullrich
|
|
| 18 |
bdb7d6e7
|
Scott Ullrich
|
2. Redistributions in binary form must reproduce the above copyright
|
| 19 |
|
|
notice, this list of conditions and the following disclaimer in the
|
| 20 |
|
|
documentation and/or other materials provided with the distribution.
|
| 21 |
5ba18897
|
Scott Ullrich
|
|
| 22 |
bdb7d6e7
|
Scott Ullrich
|
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
| 23 |
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
| 24 |
|
|
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
| 25 |
|
|
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
| 26 |
|
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
| 27 |
|
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
| 28 |
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
| 29 |
|
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
| 30 |
|
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
| 31 |
|
|
POSSIBILITY OF SUCH DAMAGE.
|
| 32 |
5b237745
|
Scott Ullrich
|
*/
|
| 33 |
7ac5a4cb
|
Scott Ullrich
|
/*
|
| 34 |
|
|
pfSense_MODULE: filter
|
| 35 |
|
|
*/
|
| 36 |
5b237745
|
Scott Ullrich
|
|
| 37 |
6b07c15a
|
Matthew Grooms
|
##|+PRIV
|
| 38 |
|
|
##|*IDENT=page-firewall-rules-edit
|
| 39 |
|
|
##|*NAME=Firewall: Rules: Edit page
|
| 40 |
|
|
##|*DESCR=Allow access to the 'Firewall: Rules: Edit' page.
|
| 41 |
|
|
##|*MATCH=firewall_rules_edit.php*
|
| 42 |
|
|
##|-PRIV
|
| 43 |
|
|
|
| 44 |
5b237745
|
Scott Ullrich
|
require("guiconfig.inc");
|
| 45 |
1a03cf69
|
Scott Ullrich
|
require("filter.inc");
|
| 46 |
|
|
require("shaper.inc");
|
| 47 |
5b237745
|
Scott Ullrich
|
|
| 48 |
e5e5ba51
|
Vinicius Coque
|
$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
|
| 49 |
3331a640
|
Ermal Lu?i
|
$ifdisp = get_configured_interface_with_descr();
|
| 50 |
679d21bb
|
Ermal Lu?i
|
foreach ($ifdisp as $kif => $kdescr) {
|
| 51 |
3331a640
|
Ermal Lu?i
|
$specialsrcdst[] = "{$kif}";
|
| 52 |
|
|
$specialsrcdst[] = "{$kif}ip";
|
| 53 |
679d21bb
|
Ermal Lu?i
|
}
|
| 54 |
5b237745
|
Scott Ullrich
|
|
| 55 |
|
|
if (!is_array($config['filter']['rule'])) {
|
| 56 |
|
|
$config['filter']['rule'] = array();
|
| 57 |
|
|
}
|
| 58 |
|
|
filter_rules_sort();
|
| 59 |
|
|
$a_filter = &$config['filter']['rule'];
|
| 60 |
|
|
|
| 61 |
|
|
$id = $_GET['id'];
|
| 62 |
|
|
if (is_numeric($_POST['id']))
|
| 63 |
|
|
$id = $_POST['id'];
|
| 64 |
5ba18897
|
Scott Ullrich
|
|
| 65 |
5b237745
|
Scott Ullrich
|
$after = $_GET['after'];
|
| 66 |
|
|
|
| 67 |
|
|
if (isset($_POST['after']))
|
| 68 |
|
|
$after = $_POST['after'];
|
| 69 |
|
|
|
| 70 |
|
|
if (isset($_GET['dup'])) {
|
| 71 |
|
|
$id = $_GET['dup'];
|
| 72 |
|
|
$after = $_GET['dup'];
|
| 73 |
|
|
}
|
| 74 |
|
|
|
| 75 |
|
|
if (isset($id) && $a_filter[$id]) {
|
| 76 |
|
|
$pconfig['interface'] = $a_filter[$id]['interface'];
|
| 77 |
5ba18897
|
Scott Ullrich
|
|
| 78 |
b9e28d57
|
unknown
|
if (isset($a_filter[$id]['id']))
|
| 79 |
|
|
$pconfig['ruleid'] = $a_filter[$id]['id'];
|
| 80 |
|
|
|
| 81 |
5b237745
|
Scott Ullrich
|
if (!isset($a_filter[$id]['type']))
|
| 82 |
|
|
$pconfig['type'] = "pass";
|
| 83 |
|
|
else
|
| 84 |
|
|
$pconfig['type'] = $a_filter[$id]['type'];
|
| 85 |
5ba18897
|
Scott Ullrich
|
|
| 86 |
4633edc2
|
Ermal Luçi
|
if (isset($a_filter[$id]['floating']) || $if == "FloatingRules") {
|
| 87 |
661aed33
|
Ermal Luçi
|
$pconfig['floating'] = $a_filter[$id]['floating'];
|
| 88 |
|
|
if (isset($a_filter[$id]['interface']) && $a_filter[$id]['interface'] <> "")
|
| 89 |
|
|
$pconfig['interface'] = $a_filter[$id]['interface'];
|
| 90 |
|
|
}
|
| 91 |
|
|
|
| 92 |
|
|
if (isset($a_filter['floating']))
|
| 93 |
|
|
$pconfig['floating'] = "yes";
|
| 94 |
|
|
|
| 95 |
|
|
if (isset($a_filter[$id]['direction']))
|
| 96 |
|
|
$pconfig['direction'] = $a_filter[$id]['direction'];
|
| 97 |
|
|
|
| 98 |
5b237745
|
Scott Ullrich
|
if (isset($a_filter[$id]['protocol']))
|
| 99 |
|
|
$pconfig['proto'] = $a_filter[$id]['protocol'];
|
| 100 |
|
|
else
|
| 101 |
|
|
$pconfig['proto'] = "any";
|
| 102 |
5ba18897
|
Scott Ullrich
|
|
| 103 |
5b237745
|
Scott Ullrich
|
if ($a_filter[$id]['protocol'] == "icmp")
|
| 104 |
|
|
$pconfig['icmptype'] = $a_filter[$id]['icmptype'];
|
| 105 |
5ba18897
|
Scott Ullrich
|
|
| 106 |
5b237745
|
Scott Ullrich
|
address_to_pconfig($a_filter[$id]['source'], $pconfig['src'],
|
| 107 |
|
|
$pconfig['srcmask'], $pconfig['srcnot'],
|
| 108 |
|
|
$pconfig['srcbeginport'], $pconfig['srcendport']);
|
| 109 |
5ba18897
|
Scott Ullrich
|
|
| 110 |
8be60f21
|
Scott Ullrich
|
if($a_filter[$id]['os'] <> "")
|
| 111 |
|
|
$pconfig['os'] = $a_filter[$id]['os'];
|
| 112 |
e33c8694
|
Bill Marquette
|
|
| 113 |
5b237745
|
Scott Ullrich
|
address_to_pconfig($a_filter[$id]['destination'], $pconfig['dst'],
|
| 114 |
|
|
$pconfig['dstmask'], $pconfig['dstnot'],
|
| 115 |
|
|
$pconfig['dstbeginport'], $pconfig['dstendport']);
|
| 116 |
|
|
|
| 117 |
c5fc1b2e
|
Ermal Luçi
|
if ($a_filter[$id]['dscp'] <> "")
|
| 118 |
|
|
$pconfig['dscp'] = $a_filter[$id]['dscp'];
|
| 119 |
|
|
|
| 120 |
5b237745
|
Scott Ullrich
|
$pconfig['disabled'] = isset($a_filter[$id]['disabled']);
|
| 121 |
|
|
$pconfig['log'] = isset($a_filter[$id]['log']);
|
| 122 |
|
|
$pconfig['descr'] = $a_filter[$id]['descr'];
|
| 123 |
8c84fe43
|
Scott Ullrich
|
|
| 124 |
b8ed2a11
|
Ermal
|
if (isset($a_filter[$id]['tcpflags_any']))
|
| 125 |
|
|
$pconfig['tcpflags_any'] = true;
|
| 126 |
|
|
else {
|
| 127 |
|
|
if (isset($a_filter[$id]['tcpflags1']) && $a_filter[$id]['tcpflags1'] <> "")
|
| 128 |
|
|
$pconfig['tcpflags1'] = $a_filter[$id]['tcpflags1'];
|
| 129 |
|
|
if (isset($a_filter[$id]['tcpflags2']) && $a_filter[$id]['tcpflags2'] <> "")
|
| 130 |
|
|
$pconfig['tcpflags2'] = $a_filter[$id]['tcpflags2'];
|
| 131 |
|
|
}
|
| 132 |
|
|
|
| 133 |
5c1f5584
|
Ermal Luçi
|
if (isset($a_filter[$id]['tag']) && $a_filter[$id]['tag'] <> "")
|
| 134 |
661aed33
|
Ermal Luçi
|
$pconfig['tag'] = $a_filter[$id]['tag'];
|
| 135 |
b6494651
|
Ermal Lu?i
|
if (isset($a_filter[$id]['tagged']) && $a_filter[$id]['tagged'] <> "")
|
| 136 |
661aed33
|
Ermal Luçi
|
$pconfig['tagged'] = $a_filter[$id]['tagged'];
|
| 137 |
|
|
if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick'])
|
| 138 |
|
|
$pconfig['quick'] = $a_filter[$id]['quick'];
|
| 139 |
775ccea3
|
Ermal Luci
|
if (isset($a_filter[$id]['allowopts']))
|
| 140 |
|
|
$pconfig['allowopts'] = true;
|
| 141 |
19757916
|
Ermal Lu?i
|
if (isset($a_filter[$id]['disablereplyto']))
|
| 142 |
|
|
$pconfig['disablereplyto'] = true;
|
| 143 |
661aed33
|
Ermal Luçi
|
|
| 144 |
ed08ef3e
|
Scott Ullrich
|
/* advanced */
|
| 145 |
a56b2fa0
|
pierrepomes
|
$pconfig['max'] = $a_filter[$id]['max'];
|
| 146 |
f1c49ff4
|
Scott Ullrich
|
$pconfig['max-src-nodes'] = $a_filter[$id]['max-src-nodes'];
|
| 147 |
26dd6a54
|
pierrepomes
|
$pconfig['max-src-conn'] = $a_filter[$id]['max-src-conn'];
|
| 148 |
f1c49ff4
|
Scott Ullrich
|
$pconfig['max-src-states'] = $a_filter[$id]['max-src-states'];
|
| 149 |
|
|
$pconfig['statetype'] = $a_filter[$id]['statetype'];
|
| 150 |
5ba18897
|
Scott Ullrich
|
$pconfig['statetimeout'] = $a_filter[$id]['statetimeout'];
|
| 151 |
8c84fe43
|
Scott Ullrich
|
|
| 152 |
f1c49ff4
|
Scott Ullrich
|
/* advanced - nosync */
|
| 153 |
8c84fe43
|
Scott Ullrich
|
$pconfig['nosync'] = isset($a_filter[$id]['nosync']);
|
| 154 |
10f21e70
|
Scott Ullrich
|
|
| 155 |
ed08ef3e
|
Scott Ullrich
|
/* advanced - new connection per second banning*/
|
| 156 |
|
|
$pconfig['max-src-conn-rate'] = $a_filter[$id]['max-src-conn-rate'];
|
| 157 |
|
|
$pconfig['max-src-conn-rates'] = $a_filter[$id]['max-src-conn-rates'];
|
| 158 |
5ba18897
|
Scott Ullrich
|
|
| 159 |
e5980370
|
Scott Ullrich
|
/* Multi-WAN next-hop support */
|
| 160 |
c98ddde2
|
Bill Marquette
|
$pconfig['gateway'] = $a_filter[$id]['gateway'];
|
| 161 |
615b27bc
|
Scott Dale
|
|
| 162 |
197bfe96
|
Ermal Luçi
|
/* Shaper support */
|
| 163 |
|
|
$pconfig['defaultqueue'] = $a_filter[$id]['defaultqueue'];
|
| 164 |
|
|
$pconfig['ackqueue'] = $a_filter[$id]['ackqueue'];
|
| 165 |
a5fd67e1
|
Ermal Luçi
|
$pconfig['dnpipe'] = $a_filter[$id]['dnpipe'];
|
| 166 |
|
|
$pconfig['pdnpipe'] = $a_filter[$id]['pdnpipe'];
|
| 167 |
7e50413c
|
Ermal Luçi
|
$pconfig['l7container'] = $a_filter[$id]['l7container'];
|
| 168 |
197bfe96
|
Ermal Luçi
|
|
| 169 |
615b27bc
|
Scott Dale
|
//schedule support
|
| 170 |
|
|
$pconfig['sched'] = $a_filter[$id]['sched'];
|
| 171 |
35c9cd44
|
Erik Fonnesbeck
|
if (!isset($_GET['dup']))
|
| 172 |
|
|
$pconfig['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
|
| 173 |
c98ddde2
|
Bill Marquette
|
|
| 174 |
5b237745
|
Scott Ullrich
|
} else {
|
| 175 |
|
|
/* defaults */
|
| 176 |
a23d7248
|
Scott Ullrich
|
if ($_GET['if'])
|
| 177 |
|
|
$pconfig['interface'] = $_GET['if'];
|
| 178 |
e5e5ba51
|
Vinicius Coque
|
$pconfig['type'] = "pass";
|
| 179 |
|
|
$pconfig['src'] = "any";
|
| 180 |
|
|
$pconfig['dst'] = "any";
|
| 181 |
5b237745
|
Scott Ullrich
|
}
|
| 182 |
72320b88
|
Ermal Luçi
|
/* Allow the FlotingRules to work */
|
| 183 |
|
|
$if = $pconfig['interface'];
|
| 184 |
5b237745
|
Scott Ullrich
|
|
| 185 |
|
|
if (isset($_GET['dup']))
|
| 186 |
|
|
unset($id);
|
| 187 |
|
|
|
| 188 |
|
|
if ($_POST) {
|
| 189 |
87f0be87
|
Chris Buechler
|
|
| 190 |
48a27d4f
|
Erik Fonnesbeck
|
if( isset($a_filter[$id]['associated-rule-id']) ) {
|
| 191 |
|
|
$_POST['proto'] = $pconfig['proto'];
|
| 192 |
|
|
if ($pconfig['proto'] == "icmp")
|
| 193 |
|
|
$_POST['icmptype'] = $pconfig['icmptype'];
|
| 194 |
|
|
}
|
| 195 |
|
|
|
| 196 |
87f0be87
|
Chris Buechler
|
if ($_POST['type'] == "reject" && $_POST['proto'] <> "tcp")
|
| 197 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("Reject type rules only works when the protocol is set to TCP.");
|
| 198 |
28f9e493
|
Scott Ullrich
|
|
| 199 |
5b237745
|
Scott Ullrich
|
if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp")) {
|
| 200 |
|
|
$_POST['srcbeginport'] = 0;
|
| 201 |
|
|
$_POST['srcendport'] = 0;
|
| 202 |
|
|
$_POST['dstbeginport'] = 0;
|
| 203 |
|
|
$_POST['dstendport'] = 0;
|
| 204 |
|
|
} else {
|
| 205 |
5ba18897
|
Scott Ullrich
|
|
| 206 |
5b237745
|
Scott Ullrich
|
if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport'])
|
| 207 |
|
|
$_POST['srcbeginport'] = $_POST['srcbeginport_cust'];
|
| 208 |
|
|
if ($_POST['srcendport_cust'] && !$_POST['srcendport'])
|
| 209 |
|
|
$_POST['srcendport'] = $_POST['srcendport_cust'];
|
| 210 |
5ba18897
|
Scott Ullrich
|
|
| 211 |
5b237745
|
Scott Ullrich
|
if ($_POST['srcbeginport'] == "any") {
|
| 212 |
|
|
$_POST['srcbeginport'] = 0;
|
| 213 |
|
|
$_POST['srcendport'] = 0;
|
| 214 |
5ba18897
|
Scott Ullrich
|
} else {
|
| 215 |
5b237745
|
Scott Ullrich
|
if (!$_POST['srcendport'])
|
| 216 |
|
|
$_POST['srcendport'] = $_POST['srcbeginport'];
|
| 217 |
|
|
}
|
| 218 |
|
|
if ($_POST['srcendport'] == "any")
|
| 219 |
|
|
$_POST['srcendport'] = $_POST['srcbeginport'];
|
| 220 |
5ba18897
|
Scott Ullrich
|
|
| 221 |
5b237745
|
Scott Ullrich
|
if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport'])
|
| 222 |
|
|
$_POST['dstbeginport'] = $_POST['dstbeginport_cust'];
|
| 223 |
|
|
if ($_POST['dstendport_cust'] && !$_POST['dstendport'])
|
| 224 |
|
|
$_POST['dstendport'] = $_POST['dstendport_cust'];
|
| 225 |
5ba18897
|
Scott Ullrich
|
|
| 226 |
5b237745
|
Scott Ullrich
|
if ($_POST['dstbeginport'] == "any") {
|
| 227 |
|
|
$_POST['dstbeginport'] = 0;
|
| 228 |
|
|
$_POST['dstendport'] = 0;
|
| 229 |
5ba18897
|
Scott Ullrich
|
} else {
|
| 230 |
5b237745
|
Scott Ullrich
|
if (!$_POST['dstendport'])
|
| 231 |
|
|
$_POST['dstendport'] = $_POST['dstbeginport'];
|
| 232 |
|
|
}
|
| 233 |
|
|
if ($_POST['dstendport'] == "any")
|
| 234 |
5ba18897
|
Scott Ullrich
|
$_POST['dstendport'] = $_POST['dstbeginport'];
|
| 235 |
5b237745
|
Scott Ullrich
|
}
|
| 236 |
5ba18897
|
Scott Ullrich
|
|
| 237 |
5b237745
|
Scott Ullrich
|
if (is_specialnet($_POST['srctype'])) {
|
| 238 |
|
|
$_POST['src'] = $_POST['srctype'];
|
| 239 |
|
|
$_POST['srcmask'] = 0;
|
| 240 |
|
|
} else if ($_POST['srctype'] == "single") {
|
| 241 |
|
|
$_POST['srcmask'] = 32;
|
| 242 |
|
|
}
|
| 243 |
|
|
if (is_specialnet($_POST['dsttype'])) {
|
| 244 |
|
|
$_POST['dst'] = $_POST['dsttype'];
|
| 245 |
|
|
$_POST['dstmask'] = 0;
|
| 246 |
|
|
} else if ($_POST['dsttype'] == "single") {
|
| 247 |
|
|
$_POST['dstmask'] = 32;
|
| 248 |
|
|
}
|
| 249 |
5ba18897
|
Scott Ullrich
|
|
| 250 |
5b237745
|
Scott Ullrich
|
unset($input_errors);
|
| 251 |
|
|
$pconfig = $_POST;
|
| 252 |
|
|
|
| 253 |
ef2a753c
|
Scott Ullrich
|
/* run through $_POST items encoding HTML entties so that the user
|
| 254 |
|
|
* cannot think he is slick and perform a XSS attack on the unwilling
|
| 255 |
|
|
*/
|
| 256 |
21eff66f
|
Scott Ullrich
|
foreach ($_POST as $key => $value) {
|
| 257 |
08825acc
|
smos
|
$temp = str_replace(">", "", $value);
|
| 258 |
|
|
|
| 259 |
661aed33
|
Ermal Luçi
|
if (isset($_POST['floating']) && $key == "interface")
|
| 260 |
|
|
continue;
|
| 261 |
21eff66f
|
Scott Ullrich
|
$newpost = htmlentities($temp);
|
| 262 |
5157927f
|
Scott Ullrich
|
if($newpost <> $temp)
|
| 263 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("Invalid characters detected (%s). Please remove invalid characters and save again."),$temp);
|
| 264 |
ef2a753c
|
Scott Ullrich
|
}
|
| 265 |
|
|
|
| 266 |
5b237745
|
Scott Ullrich
|
/* input validation */
|
| 267 |
1122a892
|
Erik Fonnesbeck
|
$reqdfields = explode(" ", "type proto");
|
| 268 |
|
|
if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
|
| 269 |
48a27d4f
|
Erik Fonnesbeck
|
$reqdfields[] = "src";
|
| 270 |
|
|
$reqdfields[] = "dst";
|
| 271 |
1122a892
|
Erik Fonnesbeck
|
}
|
| 272 |
|
|
$reqdfieldsn = explode(",", "Type,Protocol");
|
| 273 |
|
|
if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
|
| 274 |
|
|
$reqdfieldsn[] = "Source";
|
| 275 |
473d0ff0
|
pierrepomes
|
$reqdfieldsn[] = "Destination";
|
| 276 |
1122a892
|
Erik Fonnesbeck
|
}
|
| 277 |
5b237745
|
Scott Ullrich
|
|
| 278 |
452ade89
|
Bill Marquette
|
if($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") {
|
| 279 |
c22767b1
|
Bill Marquette
|
if( $_POST['proto'] != "tcp" )
|
| 280 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("%s is only valid with protocol tcp."),$_POST['statetype']);
|
| 281 |
452ade89
|
Bill Marquette
|
if(($_POST['statetype'] == "synproxy state") && ($_POST['gateway'] != ""))
|
| 282 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("%s is only valid if the gateway is set to 'default'."),$_POST['statetype']);
|
| 283 |
452ade89
|
Bill Marquette
|
}
|
| 284 |
10f7933f
|
Chris Buechler
|
|
| 285 |
1122a892
|
Erik Fonnesbeck
|
if ( isset($a_filter[$id]['associated-rule-id'])===false &&
|
| 286 |
|
|
(!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) ) {
|
| 287 |
5b237745
|
Scott Ullrich
|
$reqdfields[] = "srcmask";
|
| 288 |
|
|
$reqdfieldsn[] = "Source bit count";
|
| 289 |
|
|
}
|
| 290 |
9b16b834
|
Ermal Lu?i
|
if ( isset($a_filter[$id]['associated-rule-id'])===false &&
|
| 291 |
473d0ff0
|
pierrepomes
|
(!(is_specialnet($_POST['dsttype']) || ($_POST['dsttype'] == "single"))) ) {
|
| 292 |
5b237745
|
Scott Ullrich
|
$reqdfields[] = "dstmask";
|
| 293 |
11d2c529
|
Rafael Lucas
|
$reqdfieldsn[] = gettext("Destination bit count");
|
| 294 |
5b237745
|
Scott Ullrich
|
}
|
| 295 |
5ba18897
|
Scott Ullrich
|
|
| 296 |
5b237745
|
Scott Ullrich
|
do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
|
| 297 |
5ba18897
|
Scott Ullrich
|
|
| 298 |
5b237745
|
Scott Ullrich
|
if (!$_POST['srcbeginport']) {
|
| 299 |
|
|
$_POST['srcbeginport'] = 0;
|
| 300 |
|
|
$_POST['srcendport'] = 0;
|
| 301 |
|
|
}
|
| 302 |
|
|
if (!$_POST['dstbeginport']) {
|
| 303 |
|
|
$_POST['dstbeginport'] = 0;
|
| 304 |
|
|
$_POST['dstendport'] = 0;
|
| 305 |
|
|
}
|
| 306 |
5ba18897
|
Scott Ullrich
|
|
| 307 |
9b45f821
|
Ermal Lu?i
|
if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport']))
|
| 308 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("%s is not a valid start source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcbeginposrt']);
|
| 309 |
9b45f821
|
Ermal Lu?i
|
if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport']))
|
| 310 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("%s is not a valid end source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcendport']);
|
| 311 |
9b45f821
|
Ermal Lu?i
|
if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport']))
|
| 312 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("%s is not a valid start destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstbeginport']);
|
| 313 |
9b45f821
|
Ermal Lu?i
|
if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport']))
|
| 314 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("%s is not a valid end destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstendport']);
|
| 315 |
5ba18897
|
Scott Ullrich
|
|
| 316 |
0e5ddcd9
|
Scott Ullrich
|
/* if user enters an alias and selects "network" then disallow. */
|
| 317 |
|
|
if($_POST['srctype'] == "network") {
|
| 318 |
|
|
if(is_alias($_POST['src']))
|
| 319 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("You must specify single host or alias for alias entries.");
|
| 320 |
0e5ddcd9
|
Scott Ullrich
|
}
|
| 321 |
|
|
if($_POST['dsttype'] == "network") {
|
| 322 |
|
|
if(is_alias($_POST['dst']))
|
| 323 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("You must specify single host or alias for alias entries.");
|
| 324 |
0e5ddcd9
|
Scott Ullrich
|
}
|
| 325 |
|
|
|
| 326 |
5b237745
|
Scott Ullrich
|
if (!is_specialnet($_POST['srctype'])) {
|
| 327 |
1e578a7f
|
Ermal Lu?i
|
if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) {
|
| 328 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("%s is not a valid source IP address or alias."),$_POST['src']);
|
| 329 |
5b237745
|
Scott Ullrich
|
}
|
| 330 |
|
|
if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
|
| 331 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("A valid source bit count must be specified.");
|
| 332 |
5b237745
|
Scott Ullrich
|
}
|
| 333 |
|
|
}
|
| 334 |
|
|
if (!is_specialnet($_POST['dsttype'])) {
|
| 335 |
1e578a7f
|
Ermal Lu?i
|
if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) {
|
| 336 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = sprintf(gettext("%s is not a valid destination IP address or alias."),$_POST['dst']);
|
| 337 |
5b237745
|
Scott Ullrich
|
}
|
| 338 |
|
|
if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
|
| 339 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("A valid destination bit count must be specified.");
|
| 340 |
5b237745
|
Scott Ullrich
|
}
|
| 341 |
|
|
}
|
| 342 |
5ba18897
|
Scott Ullrich
|
|
| 343 |
5b237745
|
Scott Ullrich
|
if ($_POST['srcbeginport'] > $_POST['srcendport']) {
|
| 344 |
|
|
/* swap */
|
| 345 |
|
|
$tmp = $_POST['srcendport'];
|
| 346 |
|
|
$_POST['srcendport'] = $_POST['srcbeginport'];
|
| 347 |
|
|
$_POST['srcbeginport'] = $tmp;
|
| 348 |
|
|
}
|
| 349 |
|
|
if ($_POST['dstbeginport'] > $_POST['dstendport']) {
|
| 350 |
|
|
/* swap */
|
| 351 |
|
|
$tmp = $_POST['dstendport'];
|
| 352 |
|
|
$_POST['dstendport'] = $_POST['dstbeginport'];
|
| 353 |
|
|
$_POST['dstbeginport'] = $tmp;
|
| 354 |
|
|
}
|
| 355 |
e33c8694
|
Bill Marquette
|
if ($_POST['os'])
|
| 356 |
|
|
if( $_POST['proto'] != "tcp" )
|
| 357 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("OS detection is only valid with protocol tcp.");
|
| 358 |
5b237745
|
Scott Ullrich
|
|
| 359 |
197bfe96
|
Ermal Luçi
|
if ($_POST['ackqueue'] && $_POST['ackqueue'] != "none") {
|
| 360 |
|
|
if ($_POST['defaultqueue'] == "none" )
|
| 361 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("You have to select a queue when you select an acknowledge queue too.");
|
| 362 |
197bfe96
|
Ermal Luçi
|
else if ($_POST['ackqueue'] == $_POST['defaultqueue'])
|
| 363 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("Acknowledge queue and Queue cannot be the same.");
|
| 364 |
197bfe96
|
Ermal Luçi
|
}
|
| 365 |
02d7e4a4
|
Ermal
|
if (isset($_POST['floating']) && $_POST['pdnpipe'] && (empty($_POST['direction']) || $_POST['direction'] == "any"))
|
| 366 |
|
|
$input_errors[] = gettext("You can not use limiters in Floating rules without choosing a direction.");
|
| 367 |
a5fd67e1
|
Ermal Luçi
|
if ($_POST['pdnpipe'] && $_POST['pdnpipe'] != "none") {
|
| 368 |
|
|
if ($_POST['dnpipe'] == "none" )
|
| 369 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("You must select a queue for the In direction before selecting one for Out too.");
|
| 370 |
a5fd67e1
|
Ermal Luçi
|
else if ($_POST['pdnpipe'] == $_POST['dnpipe'])
|
| 371 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("In and Out Queue cannot be the same.");
|
| 372 |
a5fd67e1
|
Ermal Luçi
|
else if ($pdnpipe[0] == "?" && $dnpipe[0] <> "?")
|
| 373 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.");
|
| 374 |
|
|
else if ($dnpipe[0] == "?" && $pdnpipe[0] <> "?")
|
| 375 |
|
|
$input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.");
|
| 376 |
a5fd67e1
|
Ermal Luçi
|
}
|
| 377 |
b9e28d57
|
unknown
|
if( !empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid']))
|
| 378 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext('ID must be an integer');
|
| 379 |
7e50413c
|
Ermal Luçi
|
if($_POST['l7container'] && $_POST['l7container'] != "none") {
|
| 380 |
|
|
if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp"))
|
| 381 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("You can only select a layer7 container for TCP and/or UDP protocols");
|
| 382 |
3b184ca5
|
Ermal Lu?i
|
if ($_POST['type'] <> "pass")
|
| 383 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("You can only select a layer7 container for Pass type rules.");
|
| 384 |
7e50413c
|
Ermal Luçi
|
}
|
| 385 |
197bfe96
|
Ermal Luçi
|
|
| 386 |
b8ed2a11
|
Ermal
|
if (!$_POST['tcpflags_any']) {
|
| 387 |
|
|
$settcpflags = array();
|
| 388 |
|
|
$outoftcpflags = array();
|
| 389 |
|
|
foreach ($tcpflags as $tcpflag) {
|
| 390 |
|
|
if ($_POST['tcpflags1_' . $tcpflag] == "on")
|
| 391 |
|
|
$settcpflags[] = $tcpflag;
|
| 392 |
|
|
if ($_POST['tcpflags2_' . $tcpflag] == "on")
|
| 393 |
|
|
$outoftcpflags[] = $tcpflag;
|
| 394 |
|
|
}
|
| 395 |
|
|
if (empty($outoftcpflags) && !empty($settcpflags))
|
| 396 |
11d2c529
|
Rafael Lucas
|
$input_errors[] = gettext("If you specify TCP flags that should be set you should specify out of which flags as well.");
|
| 397 |
b8ed2a11
|
Ermal
|
}
|
| 398 |
|
|
|
| 399 |
5b237745
|
Scott Ullrich
|
if (!$input_errors) {
|
| 400 |
|
|
$filterent = array();
|
| 401 |
b9e28d57
|
unknown
|
$filterent['id'] = $_POST['ruleid']>0?$_POST['ruleid']:'';
|
| 402 |
5b237745
|
Scott Ullrich
|
$filterent['type'] = $_POST['type'];
|
| 403 |
661aed33
|
Ermal Luçi
|
if (isset($_POST['interface'] ))
|
| 404 |
|
|
$filterent['interface'] = $_POST['interface'];
|
| 405 |
|
|
|
| 406 |
b8ed2a11
|
Ermal
|
if ($_POST['tcpflags_any']) {
|
| 407 |
|
|
$filterent['tcpflags_any'] = true;
|
| 408 |
|
|
} else {
|
| 409 |
|
|
$settcpflags = array();
|
| 410 |
|
|
$outoftcpflags = array();
|
| 411 |
|
|
foreach ($tcpflags as $tcpflag) {
|
| 412 |
|
|
if ($_POST['tcpflags1_' . $tcpflag] == "on")
|
| 413 |
|
|
$settcpflags[] = $tcpflag;
|
| 414 |
|
|
if ($_POST['tcpflags2_' . $tcpflag] == "on")
|
| 415 |
|
|
$outoftcpflags[] = $tcpflag;
|
| 416 |
|
|
}
|
| 417 |
|
|
if (!empty($outoftcpflags)) {
|
| 418 |
|
|
$filterent['tcpflags2'] = join(",", $outoftcpflags);
|
| 419 |
|
|
if (!empty($settcpflags))
|
| 420 |
|
|
$filterent['tcpflags1'] = join(",", $settcpflags);
|
| 421 |
|
|
}
|
| 422 |
|
|
}
|
| 423 |
|
|
|
| 424 |
fd9ba7c0
|
Ermal
|
if (isset($_POST['tag']))
|
| 425 |
|
|
$filterent['tag'] = $_POST['tag'];
|
| 426 |
|
|
if (isset($_POST['tagged']))
|
| 427 |
|
|
$filterent['tagged'] = $_POST['tagged'];
|
| 428 |
661aed33
|
Ermal Luçi
|
if ($if == "FloatingRules" || isset($_POST['floating'])) {
|
| 429 |
|
|
$filterent['direction'] = $_POST['direction'];
|
| 430 |
|
|
if (isset($_POST['quick']) && $_POST['quick'] <> "")
|
| 431 |
|
|
$filterent['quick'] = $_POST['quick'];
|
| 432 |
|
|
$filterent['floating'] = "yes";
|
| 433 |
|
|
if (isset($_POST['interface']) && count($_POST['interface']) > 0) {
|
| 434 |
f1602cc4
|
sullrich
|
$filterent['interface'] = implode(",", $_POST['interface']);
|
| 435 |
661aed33
|
Ermal Luçi
|
}
|
| 436 |
|
|
}
|
| 437 |
d59874c1
|
Scott Ullrich
|
|
| 438 |
bdb7d6e7
|
Scott Ullrich
|
/* Advanced options */
|
| 439 |
775ccea3
|
Ermal Luci
|
if ($_POST['allowopts'] == "yes")
|
| 440 |
|
|
$filterent['allowopts'] = true;
|
| 441 |
|
|
else
|
| 442 |
|
|
unset($filterent['allowopts']);
|
| 443 |
19757916
|
Ermal Lu?i
|
if ($_POST['disablereplyto'] == "yes")
|
| 444 |
|
|
$filterent['disablereplyto'] = true;
|
| 445 |
|
|
else
|
| 446 |
|
|
unset($filterent['disablereplyto']);
|
| 447 |
a56b2fa0
|
pierrepomes
|
$filterent['max'] = $_POST['max'];
|
| 448 |
bdb7d6e7
|
Scott Ullrich
|
$filterent['max-src-nodes'] = $_POST['max-src-nodes'];
|
| 449 |
26dd6a54
|
pierrepomes
|
$filterent['max-src-conn'] = $_POST['max-src-conn'];
|
| 450 |
bdb7d6e7
|
Scott Ullrich
|
$filterent['max-src-states'] = $_POST['max-src-states'];
|
| 451 |
5ba18897
|
Scott Ullrich
|
$filterent['statetimeout'] = $_POST['statetimeout'];
|
| 452 |
fa9af164
|
Scott Ullrich
|
$filterent['statetype'] = $_POST['statetype'];
|
| 453 |
e33c8694
|
Bill Marquette
|
$filterent['os'] = $_POST['os'];
|
| 454 |
10f21e70
|
Scott Ullrich
|
|
| 455 |
|
|
/* Nosync directive - do not xmlrpc sync this item */
|
| 456 |
8c84fe43
|
Scott Ullrich
|
if($_POST['nosync'] <> "")
|
| 457 |
10f21e70
|
Scott Ullrich
|
$filterent['nosync'] = true;
|
| 458 |
|
|
else
|
| 459 |
|
|
unset($filterent['nosync']);
|
| 460 |
|
|
|
| 461 |
3f00c1dc
|
Scott Ullrich
|
/* unless both values are provided, unset the values - ticket #650 */
|
| 462 |
|
|
if($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] <> "") {
|
| 463 |
|
|
$filterent['max-src-conn-rate'] = $_POST['max-src-conn-rate'];
|
| 464 |
|
|
$filterent['max-src-conn-rates'] = $_POST['max-src-conn-rates'];
|
| 465 |
|
|
} else {
|
| 466 |
|
|
unset($filterent['max-src-conn-rate']);
|
| 467 |
|
|
unset($filterent['max-src-conn-rates']);
|
| 468 |
|
|
}
|
| 469 |
5ba18897
|
Scott Ullrich
|
|
| 470 |
5b237745
|
Scott Ullrich
|
if ($_POST['proto'] != "any")
|
| 471 |
|
|
$filterent['protocol'] = $_POST['proto'];
|
| 472 |
|
|
else
|
| 473 |
|
|
unset($filterent['protocol']);
|
| 474 |
5ba18897
|
Scott Ullrich
|
|
| 475 |
5b237745
|
Scott Ullrich
|
if ($_POST['proto'] == "icmp" && $_POST['icmptype'])
|
| 476 |
|
|
$filterent['icmptype'] = $_POST['icmptype'];
|
| 477 |
|
|
else
|
| 478 |
|
|
unset($filterent['icmptype']);
|
| 479 |
5ba18897
|
Scott Ullrich
|
|
| 480 |
5b237745
|
Scott Ullrich
|
pconfig_to_address($filterent['source'], $_POST['src'],
|
| 481 |
|
|
$_POST['srcmask'], $_POST['srcnot'],
|
| 482 |
|
|
$_POST['srcbeginport'], $_POST['srcendport']);
|
| 483 |
5ba18897
|
Scott Ullrich
|
|
| 484 |
5b237745
|
Scott Ullrich
|
pconfig_to_address($filterent['destination'], $_POST['dst'],
|
| 485 |
|
|
$_POST['dstmask'], $_POST['dstnot'],
|
| 486 |
|
|
$_POST['dstbeginport'], $_POST['dstendport']);
|
| 487 |
5ba18897
|
Scott Ullrich
|
|
| 488 |
f1602cc4
|
sullrich
|
if ($_POST['disabled'])
|
| 489 |
|
|
$filterent['disabled'] = true;
|
| 490 |
|
|
else
|
| 491 |
|
|
unset($filterent['disabled']);
|
| 492 |
|
|
|
| 493 |
c5fc1b2e
|
Ermal Luçi
|
if ($_POST['dscp'])
|
| 494 |
|
|
$filterent['dscp'] = $_POST['dscp'];
|
| 495 |
|
|
|
| 496 |
f1602cc4
|
sullrich
|
if ($_POST['log'])
|
| 497 |
|
|
$filterent['log'] = true;
|
| 498 |
|
|
else
|
| 499 |
|
|
unset($filterent['log']);
|
| 500 |
c68fc1e7
|
Bill Marquette
|
strncpy($filterent['descr'], $_POST['descr'], 52);
|
| 501 |
5ba18897
|
Scott Ullrich
|
|
| 502 |
c98ddde2
|
Bill Marquette
|
if ($_POST['gateway'] != "") {
|
| 503 |
|
|
$filterent['gateway'] = $_POST['gateway'];
|
| 504 |
|
|
}
|
| 505 |
197bfe96
|
Ermal Luçi
|
|
| 506 |
|
|
if (isset($_POST['defaultqueue']) && $_POST['defaultqueue'] != "none") {
|
| 507 |
|
|
$filterent['defaultqueue'] = $_POST['defaultqueue'];
|
| 508 |
|
|
if (isset($_POST['ackqueue']) && $_POST['ackqueue'] != "none")
|
| 509 |
|
|
$filterent['ackqueue'] = $_POST['ackqueue'];
|
| 510 |
|
|
}
|
| 511 |
c98ddde2
|
Bill Marquette
|
|
| 512 |
a5fd67e1
|
Ermal Luçi
|
if (isset($_POST['dnpipe']) && $_POST['dnpipe'] != "none") {
|
| 513 |
|
|
$filterent['dnpipe'] = $_POST['dnpipe'];
|
| 514 |
|
|
if (isset($_POST['pdnpipe']) && $_POST['pdnpipe'] != "none")
|
| 515 |
|
|
$filterent['pdnpipe'] = $_POST['pdnpipe'];
|
| 516 |
|
|
}
|
| 517 |
|
|
|
| 518 |
7e50413c
|
Ermal Luçi
|
if (isset($_POST['l7container']) && $_POST['l7container'] != "none") {
|
| 519 |
|
|
$filterent['l7container'] = $_POST['l7container'];
|
| 520 |
|
|
}
|
| 521 |
|
|
|
| 522 |
615b27bc
|
Scott Dale
|
if ($_POST['sched'] != "") {
|
| 523 |
|
|
$filterent['sched'] = $_POST['sched'];
|
| 524 |
|
|
}
|
| 525 |
|
|
|
| 526 |
1122a892
|
Erik Fonnesbeck
|
// If we have an associated nat rule, make sure the source and destination doesn't change
|
| 527 |
9b16b834
|
Ermal Lu?i
|
if( isset($a_filter[$id]['associated-rule-id']) ) {
|
| 528 |
0bfd0f79
|
Erik Fonnesbeck
|
$filterent['interface'] = $a_filter[$id]['interface'];
|
| 529 |
48a27d4f
|
Erik Fonnesbeck
|
if (isset($a_filter[$id]['protocol']))
|
| 530 |
|
|
$filterent['protocol'] = $a_filter[$id]['protocol'];
|
| 531 |
|
|
else if (isset($filterent['protocol']))
|
| 532 |
|
|
unset($filterent['protocol']);
|
| 533 |
|
|
if ($a_filter[$id]['protocol'] == "icmp" && $a_filter[$id]['icmptype'])
|
| 534 |
|
|
$filterent['icmptype'] = $a_filter[$id]['icmptype'];
|
| 535 |
|
|
else if (isset($filterent['icmptype']))
|
| 536 |
|
|
unset($filterent['icmptype']);
|
| 537 |
1122a892
|
Erik Fonnesbeck
|
$filterent['source'] = $a_filter[$id]['source'];
|
| 538 |
473d0ff0
|
pierrepomes
|
$filterent['destination'] = $a_filter[$id]['destination'];
|
| 539 |
9b16b834
|
Ermal Lu?i
|
$filterent['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
|
| 540 |
473d0ff0
|
pierrepomes
|
}
|
| 541 |
|
|
|
| 542 |
5b237745
|
Scott Ullrich
|
if (isset($id) && $a_filter[$id])
|
| 543 |
|
|
$a_filter[$id] = $filterent;
|
| 544 |
|
|
else {
|
| 545 |
|
|
if (is_numeric($after))
|
| 546 |
|
|
array_splice($a_filter, $after+1, 0, array($filterent));
|
| 547 |
|
|
else
|
| 548 |
|
|
$a_filter[] = $filterent;
|
| 549 |
|
|
}
|
| 550 |
f4e2a352
|
Scott Ullrich
|
|
| 551 |
ea57ccb8
|
Erik Fonnesbeck
|
filter_rules_sort();
|
| 552 |
5b237745
|
Scott Ullrich
|
write_config();
|
| 553 |
a368a026
|
Ermal Lu?i
|
mark_subsystem_dirty('filter');
|
| 554 |
5ba18897
|
Scott Ullrich
|
|
| 555 |
661aed33
|
Ermal Luçi
|
if (isset($_POST['floating']))
|
| 556 |
|
|
header("Location: firewall_rules.php?if=FloatingRules");
|
| 557 |
|
|
else
|
| 558 |
|
|
header("Location: firewall_rules.php?if=" . $_POST['interface']);
|
| 559 |
5b237745
|
Scott Ullrich
|
exit;
|
| 560 |
|
|
}
|
| 561 |
c60824d2
|
Scott Ullrich
|
}
|
| 562 |
|
|
|
| 563 |
37c53a0d
|
Ermal Lu?i
|
read_altq_config(); /* XXX: */
|
| 564 |
|
|
$qlist =& get_unique_queue_list();
|
| 565 |
|
|
read_dummynet_config(); /* XXX: */
|
| 566 |
|
|
$dnqlist =& get_unique_dnqueue_list();
|
| 567 |
|
|
read_layer7_config();
|
| 568 |
|
|
$l7clist =& get_l7_unique_list();
|
| 569 |
|
|
|
| 570 |
11d2c529
|
Rafael Lucas
|
$pgtitle = array(gettext("Firewall"),gettext("Rules"),gettext("Edit"));
|
| 571 |
3cceb5d5
|
jim-p
|
$statusurl = "status_filter_reload.php";
|
| 572 |
|
|
$logurl = "diag_logs_filter.php";
|
| 573 |
|
|
|
| 574 |
a1357fe0
|
Bill Marquette
|
$closehead = false;
|
| 575 |
8ab3e9ed
|
Erik Kristensen
|
|
| 576 |
|
|
$page_filename = "firewall_rules_edit.php";
|
| 577 |
da7ae7ef
|
Bill Marquette
|
include("head.inc");
|
| 578 |
c60824d2
|
Scott Ullrich
|
|
| 579 |
5b237745
|
Scott Ullrich
|
?>
|
| 580 |
da7ae7ef
|
Bill Marquette
|
|
| 581 |
5b237745
|
Scott Ullrich
|
</head>
|
| 582 |
|
|
|
| 583 |
|
|
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
|
| 584 |
|
|
<?php include("fbegin.inc"); ?>
|
| 585 |
|
|
<?php if ($input_errors) print_input_errors($input_errors); ?>
|
| 586 |
8ab3e9ed
|
Erik Kristensen
|
|
| 587 |
|
|
<form action="firewall_rules_edit.php" method="post" name="iform" id="iform">
|
| 588 |
6eac9b90
|
Scott Ullrich
|
<input type='hidden' name="ruleid" value="<?=(isset($pconfig['ruleid'])&&$pconfig['ruleid']>0)?htmlspecialchars($pconfig['ruleid']):''?>">
|
| 589 |
|
|
|
| 590 |
8ab3e9ed
|
Erik Kristensen
|
<table width="100%" border="0" cellpadding="6" cellspacing="0">
|
| 591 |
e091cb45
|
Scott Ullrich
|
<tr>
|
| 592 |
11d2c529
|
Rafael Lucas
|
<td colspan="2" valign="top" class="listtopic"><?=gettext("Edit Firewall rule");?></td>
|
| 593 |
e091cb45
|
Scott Ullrich
|
</tr>
|
| 594 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 595 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Action");?></td>
|
| 596 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 597 |
b5c78501
|
Seth Mos
|
<select name="type" class="formselect">
|
| 598 |
e5e5ba51
|
Vinicius Coque
|
<?php $types = explode(" ", "Pass Block Reject"); foreach ($types as $type): ?>
|
| 599 |
8ab3e9ed
|
Erik Kristensen
|
<option value="<?=strtolower($type);?>" <?php if (strtolower($type) == strtolower($pconfig['type'])) echo "selected"; ?>>
|
| 600 |
|
|
<?=htmlspecialchars($type);?>
|
| 601 |
|
|
</option>
|
| 602 |
|
|
<?php endforeach; ?>
|
| 603 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 604 |
8ab3e9ed
|
Erik Kristensen
|
<br/>
|
| 605 |
|
|
<span class="vexpl">
|
| 606 |
11d2c529
|
Rafael Lucas
|
<?=gettext("Choose what to do with packets that match the criteria specified below.");?> <br/>
|
| 607 |
|
|
<?=gettext("Hint: the difference between block and reject is that with reject, a packet (TCP RST or ICMP port unreachable for UDP) is returned to the sender, whereas with block the packet is dropped silently. In either case, the original packet is discarded.");?>
|
| 608 |
8ab3e9ed
|
Erik Kristensen
|
</span>
|
| 609 |
|
|
</td>
|
| 610 |
|
|
</tr>
|
| 611 |
|
|
<tr>
|
| 612 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Disabled");?></td>
|
| 613 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 614 |
|
|
<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked"; ?>>
|
| 615 |
11d2c529
|
Rafael Lucas
|
<strong><?=gettext("Disable this rule");?></strong><br />
|
| 616 |
|
|
<span class="vexpl"><?=gettext("Set this option to disable this rule without removing it from the list.");?></span>
|
| 617 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 618 |
|
|
</tr>
|
| 619 |
661aed33
|
Ermal Luçi
|
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
|
| 620 |
|
|
<tr>
|
| 621 |
f1602cc4
|
sullrich
|
<td width="22%" valign="top" class="vncellreq">
|
| 622 |
|
|
<?=gettext("Quick");?>
|
| 623 |
|
|
</td>
|
| 624 |
|
|
<td width="78%" class="vtable">
|
| 625 |
|
|
<input name="quick" type="checkbox" id="quick" value="yes" <?php if ($pconfig['quick']) echo "checked=\"checked\""; ?> />
|
| 626 |
|
|
<strong><?=gettext("Apply the action immediately on match.");?></strong><br />
|
| 627 |
|
|
<span class="vexpl"><?=gettext("Set this option if you need to apply this action to traffic that matches this rule immediately.");?></span>
|
| 628 |
|
|
</td>
|
| 629 |
|
|
</tr>
|
| 630 |
e73b001e
|
Renato Botelho
|
<?php endif; ?>
|
| 631 |
48a27d4f
|
Erik Fonnesbeck
|
<?php $edit_disabled = ""; ?>
|
| 632 |
|
|
<?php if( isset($pconfig['associated-rule-id']) ): ?>
|
| 633 |
|
|
<tr>
|
| 634 |
|
|
<td width="22%" valign="top" class="vncell"><?=gettext("Associated filter rule");?></td>
|
| 635 |
|
|
<td width="78%" class="vtable">
|
| 636 |
|
|
<span class="red"><strong><?=gettext("NOTE: ");?></strong></span><?=gettext("This is associated to a NAT rule.");?><br />
|
| 637 |
|
|
<?=gettext("You cannot edit the interface, protocol, source, or destination of associated filter rules.");?><br />
|
| 638 |
|
|
<br />
|
| 639 |
|
|
<?php
|
| 640 |
|
|
$edit_disabled = "disabled";
|
| 641 |
|
|
if (is_array($config['nat']['rule'])) {
|
| 642 |
|
|
foreach( $config['nat']['rule'] as $index => $nat_rule ) {
|
| 643 |
|
|
if( isset($nat_rule['associated-rule-id']) && $nat_rule['associated-rule-id']==$pconfig['associated-rule-id'] ) {
|
| 644 |
|
|
echo "<a href=\"firewall_nat_edit.php?id={$index}\">" . gettext("View the NAT rule") . "</a><br>";
|
| 645 |
|
|
break;
|
| 646 |
|
|
}
|
| 647 |
|
|
}
|
| 648 |
|
|
}
|
| 649 |
|
|
echo "<input name='associated-rule-id' id='associated-rule-id' type='hidden' value='{$pconfig['associated-rule-id']}' >";
|
| 650 |
|
|
if (!empty($pconfig['interface']))
|
| 651 |
|
|
echo "<input name='interface' id='interface' type='hidden' value='{$pconfig['interface']}' >";
|
| 652 |
|
|
?>
|
| 653 |
|
|
<script type="text/javascript">
|
| 654 |
|
|
editenabled = 0;
|
| 655 |
|
|
</script>
|
| 656 |
|
|
</td>
|
| 657 |
|
|
</tr>
|
| 658 |
ee9933b6
|
Renato Botelho
|
<?php endif; ?>
|
| 659 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 660 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Interface");?></td>
|
| 661 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 662 |
48a27d4f
|
Erik Fonnesbeck
|
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
|
| 663 |
|
|
<select name="interface[]" multiple="true" class="formselect" size="3" <?=$edit_disabled;?>>
|
| 664 |
ee9933b6
|
Renato Botelho
|
<?php else: ?>
|
| 665 |
48a27d4f
|
Erik Fonnesbeck
|
<select name="interface" class="formselect" <?=$edit_disabled;?>>
|
| 666 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 667 |
661aed33
|
Ermal Luçi
|
endif;
|
| 668 |
a7782099
|
Ermal Lu?i
|
/* add group interfaces */
|
| 669 |
f1602cc4
|
sullrich
|
if (is_array($config['ifgroups']['ifgroupentry']))
|
| 670 |
a7782099
|
Ermal Lu?i
|
foreach($config['ifgroups']['ifgroupentry'] as $ifgen)
|
| 671 |
|
|
if (have_ruleint_access($ifgen['ifname']))
|
| 672 |
|
|
$interfaces[$ifgen['ifname']] = $ifgen['ifname'];
|
| 673 |
b7391125
|
Ermal Luçi
|
$ifdescs = get_configured_interface_with_descr();
|
| 674 |
5335811d
|
Ermal Luçi
|
foreach ($ifdescs as $ifent => $ifdesc)
|
| 675 |
|
|
if(have_ruleint_access($ifent))
|
| 676 |
f1602cc4
|
sullrich
|
$interfaces[$ifent] = $ifdesc;
|
| 677 |
617f8d25
|
Ermal Lu?i
|
if ($config['l2tp']['mode'] == "server")
|
| 678 |
f1602cc4
|
sullrich
|
if(have_ruleint_access("l2tp"))
|
| 679 |
|
|
$interfaces['l2tp'] = "L2TP VPN";
|
| 680 |
b6742927
|
Scott Ullrich
|
if ($config['pptpd']['mode'] == "server")
|
| 681 |
|
|
if(have_ruleint_access("pptp"))
|
| 682 |
|
|
$interfaces['pptp'] = "PPTP VPN";
|
| 683 |
|
|
|
| 684 |
|
|
if ($config['pppoe']['mode'] == "server")
|
| 685 |
|
|
if(have_ruleint_access("pppoe"))
|
| 686 |
|
|
$interfaces['pppoe'] = "PPPoE VPN";
|
| 687 |
|
|
/* add ipsec interfaces */
|
| 688 |
|
|
if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable']))
|
| 689 |
|
|
if(have_ruleint_access("enc0"))
|
| 690 |
0f266b2e
|
Chris Buechler
|
$interfaces["enc0"] = "IPsec";
|
| 691 |
bfb60ac8
|
Ermal Luçi
|
/* add openvpn/tun interfaces */
|
| 692 |
d799787e
|
Matthew Grooms
|
if ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
|
| 693 |
d030c9de
|
Erik Fonnesbeck
|
$interfaces["openvpn"] = "OpenVPN";
|
| 694 |
|
|
$selected_interfaces = explode(",", $pconfig['interface']);
|
| 695 |
8ab3e9ed
|
Erik Kristensen
|
foreach ($interfaces as $iface => $ifacename): ?>
|
| 696 |
74aff49c
|
Renato Botelho
|
<option value="<?=$iface;?>" <?php if ($pconfig['interface'] <> "" && ( strcasecmp($pconfig['interface'], $iface) == 0 || in_array($iface, $selected_interfaces) )) echo "selected"; ?>><?=$ifacename?></option>
|
| 697 |
8ab3e9ed
|
Erik Kristensen
|
<?php endforeach; ?>
|
| 698 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 699 |
8ab3e9ed
|
Erik Kristensen
|
<br />
|
| 700 |
11d2c529
|
Rafael Lucas
|
<span class="vexpl"><?=gettext("Choose on which interface packets must come in to match this rule.");?></span>
|
| 701 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 702 |
|
|
</tr>
|
| 703 |
661aed33
|
Ermal Luçi
|
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
|
| 704 |
f1602cc4
|
sullrich
|
<tr>
|
| 705 |
|
|
<td width="22%" valign="top" class="vncellreq">
|
| 706 |
|
|
<?=gettext("Direction");?>
|
| 707 |
|
|
</td>
|
| 708 |
|
|
<td width="78%" class="vtable">
|
| 709 |
|
|
<select name="direction" class="formselect">
|
| 710 |
e5e5ba51
|
Vinicius Coque
|
<?php $directions = array('any','in','out');
|
| 711 |
f1602cc4
|
sullrich
|
foreach ($directions as $direction): ?>
|
| 712 |
|
|
<option value="<?=$direction;?>"
|
| 713 |
|
|
<?php if ($direction == $pconfig['direction']): ?>
|
| 714 |
|
|
selected="selected"
|
| 715 |
|
|
<?php endif; ?>
|
| 716 |
|
|
><?=$direction;?></option>
|
| 717 |
|
|
<?php endforeach; ?>
|
| 718 |
|
|
</select>
|
| 719 |
|
|
<input type="hidden" id="floating" name="floating" value="floating">
|
| 720 |
|
|
</td>
|
| 721 |
|
|
<tr>
|
| 722 |
661aed33
|
Ermal Luçi
|
<?php endif; ?>
|
| 723 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 724 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Protocol");?></td>
|
| 725 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 726 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="proto" class="formselect" onchange="proto_change()">
|
| 727 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 728 |
e5e5ba51
|
Vinicius Coque
|
$protocols = explode(" ", "TCP UDP TCP/UDP ICMP ESP AH GRE IGMP any carp pfsync");
|
| 729 |
8ab3e9ed
|
Erik Kristensen
|
foreach ($protocols as $proto): ?>
|
| 730 |
|
|
<option value="<?=strtolower($proto);?>" <?php if (strtolower($proto) == $pconfig['proto']) echo "selected"; ?>><?=htmlspecialchars($proto);?></option>
|
| 731 |
|
|
<?php endforeach; ?>
|
| 732 |
|
|
</select>
|
| 733 |
|
|
<br />
|
| 734 |
11d2c529
|
Rafael Lucas
|
<span class="vexpl"><?=gettext("Choose which IP protocol this rule should match.");?> <br /> <?=gettext("Hint: in most cases, you should specify ");?><em>TCP</em> <?=gettext("here.");?></span>
|
| 735 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 736 |
|
|
</tr>
|
| 737 |
3de8af0e
|
Scott Ullrich
|
<tr id="icmpbox" name="icmpbox">
|
| 738 |
11d2c529
|
Rafael Lucas
|
<td valign="top" class="vncell"><?=gettext("ICMP type");?></td>
|
| 739 |
8ab3e9ed
|
Erik Kristensen
|
<td class="vtable">
|
| 740 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="icmptype" class="formselect">
|
| 741 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 742 |
|
|
$icmptypes = array(
|
| 743 |
abd67a31
|
Carlos Eduardo Ramos
|
"" => gettext("any"),
|
| 744 |
|
|
"echorep" => gettext("Echo reply"),
|
| 745 |
|
|
"unreach" => gettext("Destination unreachable"),
|
| 746 |
|
|
"squench" => gettext("Source quench"),
|
| 747 |
|
|
"redir" => gettext("Redirect"),
|
| 748 |
|
|
"althost" => gettext("Alternate Host"),
|
| 749 |
|
|
"echoreq" => gettext("Echo"),
|
| 750 |
|
|
"routeradv" => gettext("Router advertisement"),
|
| 751 |
|
|
"routersol" => gettext("Router solicitation"),
|
| 752 |
|
|
"timex" => gettext("Time exceeded"),
|
| 753 |
|
|
"paramprob" => gettext("Invalid IP header"),
|
| 754 |
|
|
"timereq" => gettext("Timestamp"),
|
| 755 |
|
|
"timerep" => gettext("Timestamp reply"),
|
| 756 |
|
|
"inforeq" => gettext("Information request"),
|
| 757 |
|
|
"inforep" => gettext("Information reply"),
|
| 758 |
|
|
"maskreq" => gettext("Address mask request"),
|
| 759 |
|
|
"maskrep" => gettext("Address mask reply")
|
| 760 |
8ab3e9ed
|
Erik Kristensen
|
);
|
| 761 |
|
|
|
| 762 |
|
|
foreach ($icmptypes as $icmptype => $descr): ?>
|
| 763 |
|
|
<option value="<?=$icmptype;?>" <?php if ($icmptype == $pconfig['icmptype']) echo "selected"; ?>><?=htmlspecialchars($descr);?></option>
|
| 764 |
|
|
<?php endforeach; ?>
|
| 765 |
|
|
</select>
|
| 766 |
|
|
<br />
|
| 767 |
11d2c529
|
Rafael Lucas
|
<span class="vexpl"><?=gettext("If you selected ICMP for the protocol above, you may specify an ICMP type here.");?></span>
|
| 768 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 769 |
|
|
</tr>
|
| 770 |
|
|
<tr>
|
| 771 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Source");?></td>
|
| 772 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 773 |
48a27d4f
|
Erik Fonnesbeck
|
<input <?=$edit_disabled;?> name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>>
|
| 774 |
11d2c529
|
Rafael Lucas
|
<strong><?=gettext("not");?></strong>
|
| 775 |
8ab3e9ed
|
Erik Kristensen
|
<br />
|
| 776 |
11d2c529
|
Rafael Lucas
|
<?=gettext("Use this option to invert the sense of the match.");?>
|
| 777 |
8ab3e9ed
|
Erik Kristensen
|
<br />
|
| 778 |
|
|
<br />
|
| 779 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 780 |
|
|
<tr>
|
| 781 |
21600ab1
|
Vinicius Coque
|
<td><?=gettext("Type:");?> </td>
|
| 782 |
8ab3e9ed
|
Erik Kristensen
|
<td>
|
| 783 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="srctype" class="formselect" onChange="typesel_change()">
|
| 784 |
87f0be87
|
Chris Buechler
|
<?php
|
| 785 |
|
|
$sel = is_specialnet($pconfig['src']); ?>
|
| 786 |
11d2c529
|
Rafael Lucas
|
<option value="any" <?php if ($pconfig['src'] == "any") { echo "selected"; } ?>><?=gettext("any");?></option>
|
| 787 |
|
|
<option value="single" <?php if (($pconfig['srcmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>><?=gettext("Single host or alias");?></option>
|
| 788 |
|
|
<option value="network" <?php if (!$sel) echo "selected"; ?>><?=gettext("Network");?></option>
|
| 789 |
99ea4439
|
Scott Ullrich
|
<?php if(have_ruleint_access("pptp")): ?>
|
| 790 |
11d2c529
|
Rafael Lucas
|
<option value="pptp" <?php if ($pconfig['src'] == "pptp") { echo "selected"; } ?>><?=gettext("PPTP clients");?></option>
|
| 791 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 792 |
|
|
<?php if(have_ruleint_access("pppoe")): ?>
|
| 793 |
11d2c529
|
Rafael Lucas
|
<option value="pppoe" <?php if ($pconfig['src'] == "pppoe") { echo "selected"; } ?>><?=gettext("PPPoE clients");?></option>
|
| 794 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 795 |
8a6bc505
|
Ermal Lu?i
|
<?php if(have_ruleint_access("l2tp")): ?>
|
| 796 |
11d2c529
|
Rafael Lucas
|
<option value="l2tp" <?php if ($pconfig['src'] == "l2tp") { echo "selected"; } ?>><?=gettext("L2TP clients");?></option>
|
| 797 |
8a6bc505
|
Ermal Lu?i
|
<?php endif; ?>
|
| 798 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 799 |
5335811d
|
Ermal Luçi
|
foreach ($ifdisp as $ifent => $ifdesc): ?>
|
| 800 |
|
|
<?php if(have_ruleint_access($ifent)): ?>
|
| 801 |
11d2c529
|
Rafael Lucas
|
<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?><?=gettext(" subnet");?></option>
|
| 802 |
5335811d
|
Ermal Luçi
|
<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] == $ifent . "ip") { echo "selected"; } ?>>
|
| 803 |
11d2c529
|
Rafael Lucas
|
<?=$ifdesc?> <?=gettext("address");?>
|
| 804 |
e30a5970
|
Scott Ullrich
|
</option>
|
| 805 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 806 |
b7391125
|
Ermal Luçi
|
<?php endforeach; ?>
|
| 807 |
8ab3e9ed
|
Erik Kristensen
|
</select>
|
| 808 |
|
|
</td>
|
| 809 |
|
|
</tr>
|
| 810 |
|
|
<tr>
|
| 811 |
21600ab1
|
Vinicius Coque
|
<td><?=gettext("Address:");?> </td>
|
| 812 |
8ab3e9ed
|
Erik Kristensen
|
<td>
|
| 813 |
48a27d4f
|
Erik Fonnesbeck
|
<input <?=$edit_disabled;?> autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
|
| 814 |
|
|
<select <?=$edit_disabled;?> name="srcmask" class="formselect" id="srcmask">
|
| 815 |
8ab3e9ed
|
Erik Kristensen
|
<?php for ($i = 31; $i > 0; $i--): ?>
|
| 816 |
|
|
<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option>
|
| 817 |
|
|
<?php endfor; ?>
|
| 818 |
|
|
</select>
|
| 819 |
bdb7d6e7
|
Scott Ullrich
|
</td>
|
| 820 |
8ab3e9ed
|
Erik Kristensen
|
</tr>
|
| 821 |
|
|
</table>
|
| 822 |
22abf2ef
|
Scott Ullrich
|
<div id="showadvancedboxspr">
|
| 823 |
|
|
<p>
|
| 824 |
48a27d4f
|
Erik Fonnesbeck
|
<input <?=$edit_disabled;?> type="button" onClick="show_source_port_range()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show source port range");?></a>
|
| 825 |
22abf2ef
|
Scott Ullrich
|
</div>
|
| 826 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 827 |
e33c8694
|
Bill Marquette
|
</tr>
|
| 828 |
3de8af0e
|
Scott Ullrich
|
<tr style="display:none" id="sprtable" name="sprtable">
|
| 829 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Source port range");?></td>
|
| 830 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 831 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 832 |
|
|
<tr>
|
| 833 |
21600ab1
|
Vinicius Coque
|
<td><?=gettext("from:");?> </td>
|
| 834 |
8ab3e9ed
|
Erik Kristensen
|
<td>
|
| 835 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()">
|
| 836 |
abd67a31
|
Carlos Eduardo Ramos
|
<option value="">(<?=gettext("other"); ?>)</option>
|
| 837 |
11d2c529
|
Rafael Lucas
|
<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any");?></option>
|
| 838 |
8ab3e9ed
|
Erik Kristensen
|
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 839 |
|
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
| 840 |
|
|
<?php endforeach; ?>
|
| 841 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 842 |
dd5bf424
|
Scott Ullrich
|
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo htmlspecialchars($pconfig['srcbeginport']); ?>">
|
| 843 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 844 |
|
|
</tr>
|
| 845 |
|
|
<tr>
|
| 846 |
21600ab1
|
Vinicius Coque
|
<td><?=gettext("to:");?></td>
|
| 847 |
8ab3e9ed
|
Erik Kristensen
|
<td>
|
| 848 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="srcendport" class="formselect" onchange="ext_change()">
|
| 849 |
abd67a31
|
Carlos Eduardo Ramos
|
<option value="">(<?=gettext("other"); ?>)</option>
|
| 850 |
11d2c529
|
Rafael Lucas
|
<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any");?></option>
|
| 851 |
8ab3e9ed
|
Erik Kristensen
|
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 852 |
|
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
| 853 |
|
|
<?php endforeach; ?>
|
| 854 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 855 |
dd5bf424
|
Scott Ullrich
|
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo htmlspecialchars($pconfig['srcendport']); ?>">
|
| 856 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 857 |
|
|
</tr>
|
| 858 |
|
|
</table>
|
| 859 |
|
|
<br />
|
| 860 |
87000ded
|
Erik Fonnesbeck
|
<span class="vexpl"><?=gettext("Specify the source port or port range for this rule."); ?> <b><?=gettext("This is usually"); ?> <em><?=gettext("random"); ?></em> <?=gettext("and almost never equal to the destination port range (and should usually be"); ?> "<?=gettext("any"); ?>").</b><br /><?=gettext("Hint: you can leave the"); ?> <em><?=gettext("'to'"); ?></em> <?=gettext("field empty if you only want to filter a single port.");?></span><br/>
|
| 861 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 862 |
8c84fe43
|
Scott Ullrich
|
</tr>
|
| 863 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 864 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Destination");?></td>
|
| 865 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 866 |
48a27d4f
|
Erik Fonnesbeck
|
<input <?=$edit_disabled;?> name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked"; ?>>
|
| 867 |
11d2c529
|
Rafael Lucas
|
<strong><?=gettext("not");?></strong>
|
| 868 |
8ab3e9ed
|
Erik Kristensen
|
<br />
|
| 869 |
11d2c529
|
Rafael Lucas
|
<?=gettext("Use this option to invert the sense of the match.");?>
|
| 870 |
8ab3e9ed
|
Erik Kristensen
|
<br />
|
| 871 |
|
|
<br />
|
| 872 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 873 |
|
|
<tr>
|
| 874 |
21600ab1
|
Vinicius Coque
|
<td><?=gettext("Type:");?> </td>
|
| 875 |
8ab3e9ed
|
Erik Kristensen
|
<td>
|
| 876 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="dsttype" class="formselect" onChange="typesel_change()">
|
| 877 |
87f0be87
|
Chris Buechler
|
<?php
|
| 878 |
|
|
$sel = is_specialnet($pconfig['dst']); ?>
|
| 879 |
11d2c529
|
Rafael Lucas
|
<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>><?=gettext("any");?></option>
|
| 880 |
|
|
<option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>><?=gettext("Single host or alias");?></option>
|
| 881 |
|
|
<option value="network" <?php if (!$sel) echo "selected"; ?>><?=gettext("Network");?></option>
|
| 882 |
99ea4439
|
Scott Ullrich
|
<?php if(have_ruleint_access("pptp")): ?>
|
| 883 |
11d2c529
|
Rafael Lucas
|
<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>><?=gettext("PPTP clients");?></option>
|
| 884 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 885 |
|
|
<?php if(have_ruleint_access("pppoe")): ?>
|
| 886 |
11d2c529
|
Rafael Lucas
|
<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected"; } ?>><?=gettext("PPPoE clients");?></option>
|
| 887 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 888 |
3331a640
|
Ermal Lu?i
|
<?php if(have_ruleint_access("l2tp")): ?>
|
| 889 |
11d2c529
|
Rafael Lucas
|
<option value="l2tp" <?php if ($pconfig['dst'] == "l2tp") { echo "selected"; } ?>><?=gettext("L2TP clients");?></option>
|
| 890 |
3331a640
|
Ermal Lu?i
|
<?php endif; ?>
|
| 891 |
b7391125
|
Ermal Luçi
|
|
| 892 |
|
|
<?php foreach ($ifdisp as $if => $ifdesc): ?>
|
| 893 |
|
|
<?php if(have_ruleint_access($if)): ?>
|
| 894 |
11d2c529
|
Rafael Lucas
|
<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> <?=gettext("subnet");?></option>
|
| 895 |
b7391125
|
Ermal Luçi
|
<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
|
| 896 |
11d2c529
|
Rafael Lucas
|
<?=$ifdesc;?> <?=gettext("address");?>
|
| 897 |
cbff71a1
|
Scott Ullrich
|
</option>
|
| 898 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 899 |
b7391125
|
Ermal Luçi
|
<?php endforeach; ?>
|
| 900 |
8ab3e9ed
|
Erik Kristensen
|
</select>
|
| 901 |
|
|
</td>
|
| 902 |
|
|
</tr>
|
| 903 |
|
|
<tr>
|
| 904 |
21600ab1
|
Vinicius Coque
|
<td><?=gettext("Address:");?> </td>
|
| 905 |
8ab3e9ed
|
Erik Kristensen
|
<td>
|
| 906 |
48a27d4f
|
Erik Fonnesbeck
|
<input <?=$edit_disabled;?> name="dst" type="text" class="formfldalias" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>">
|
| 907 |
8ab3e9ed
|
Erik Kristensen
|
/
|
| 908 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="dstmask" class="formselect" id="dstmask">
|
| 909 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 910 |
|
|
for ($i = 31; $i > 0; $i--): ?>
|
| 911 |
|
|
<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected"; ?>><?=$i;?></option>
|
| 912 |
|
|
<?php endfor; ?>
|
| 913 |
|
|
</select>
|
| 914 |
|
|
</td>
|
| 915 |
|
|
</tr>
|
| 916 |
|
|
</table>
|
| 917 |
|
|
</td>
|
| 918 |
|
|
</tr>
|
| 919 |
3de8af0e
|
Scott Ullrich
|
<tr id="dprtr" name="dprtr">
|
| 920 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Destination port range ");?></td>
|
| 921 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 922 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 923 |
|
|
<tr>
|
| 924 |
21600ab1
|
Vinicius Coque
|
<td><?=gettext("from:");?> </td>
|
| 925 |
8ab3e9ed
|
Erik Kristensen
|
<td>
|
| 926 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()">
|
| 927 |
abd67a31
|
Carlos Eduardo Ramos
|
<option value="">(<?=gettext("other"); ?>)</option>
|
| 928 |
11d2c529
|
Rafael Lucas
|
<option value="any" <?php $bfound = 0; if ($pconfig['dstbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any");?></option>
|
| 929 |
8ab3e9ed
|
Erik Kristensen
|
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 930 |
|
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
|
| 931 |
3deb92f7
|
Renato Botelho
|
<?php endforeach; ?>
|
| 932 |
8ab3e9ed
|
Erik Kristensen
|
</select>
|
| 933 |
dd5bf424
|
Scott Ullrich
|
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo htmlspecialchars($pconfig['dstbeginport']); ?>">
|
| 934 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 935 |
|
|
</tr>
|
| 936 |
|
|
<tr>
|
| 937 |
21600ab1
|
Vinicius Coque
|
<td><?=gettext("to:");?></td>
|
| 938 |
8ab3e9ed
|
Erik Kristensen
|
<td>
|
| 939 |
48a27d4f
|
Erik Fonnesbeck
|
<select <?=$edit_disabled;?> name="dstendport" class="formselect" onchange="ext_change()">
|
| 940 |
abd67a31
|
Carlos Eduardo Ramos
|
<option value="">(<?=gettext("other"); ?>)</option>
|
| 941 |
11d2c529
|
Rafael Lucas
|
<option value="any" <?php $bfound = 0; if ($pconfig['dstendport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any");?></option>
|
| 942 |
8ab3e9ed
|
Erik Kristensen
|
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 943 |
|
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
| 944 |
|
|
<?php endforeach; ?>
|
| 945 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 946 |
dd5bf424
|
Scott Ullrich
|
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo htmlspecialchars($pconfig['dstendport']); ?>">
|
| 947 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 948 |
|
|
</tr>
|
| 949 |
|
|
</table>
|
| 950 |
|
|
<br />
|
| 951 |
|
|
<span class="vexpl">
|
| 952 |
11d2c529
|
Rafael Lucas
|
<?=gettext("Specify the port or port range for the destination of the packet for this rule.");?>
|
| 953 |
adb633a0
|
sullrich
|
<br />
|
| 954 |
345b9715
|
Carlos Eduardo Ramos
|
<?=gettext("Hint: you can leave the"); ?> <em><?=gettext("'to'"); ?></em> <?=gettext("field empty if you only want to filter a single port");?>
|
| 955 |
8ab3e9ed
|
Erik Kristensen
|
</span>
|
| 956 |
|
|
</td>
|
| 957 |
|
|
</tr>
|
| 958 |
|
|
<tr>
|
| 959 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncellreq"><?=gettext("Log");?></td>
|
| 960 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 961 |
|
|
<input name="log" type="checkbox" id="log" value="yes" <?php if ($pconfig['log']) echo "checked"; ?>>
|
| 962 |
11d2c529
|
Rafael Lucas
|
<strong><?=gettext("Log packets that are handled by this rule");?></strong>
|
| 963 |
adb633a0
|
sullrich
|
<br />
|
| 964 |
0fb885bc
|
Carlos Eduardo Ramos
|
<span class="vexpl"><?=gettext("Hint: the firewall has limited local log space. Don't turn on logging for everything. If you want to do a lot of logging, consider using a remote syslog server"); ?> (<?=gettext("see the"); ?> <a href="diag_logs_settings.php"><?=gettext("Diagnostics: System logs: Settings"); ?></a> <?=gettext("page"); ?>).</span>
|
| 965 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 966 |
|
|
</tr>
|
| 967 |
151eb2a9
|
sullrich
|
<tr>
|
| 968 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("Description");?></td>
|
| 969 |
151eb2a9
|
sullrich
|
<td width="78%" class="vtable">
|
| 970 |
|
|
<input name="descr" type="text" class="formfld unknown" id="descr" size="52" maxlength="52" value="<?=htmlspecialchars($pconfig['descr']);?>">
|
| 971 |
|
|
<br />
|
| 972 |
11d2c529
|
Rafael Lucas
|
<span class="vexpl"><?=gettext("You may enter a description here for your reference.");?></span>
|
| 973 |
151eb2a9
|
sullrich
|
</td>
|
| 974 |
|
|
</tr>
|
| 975 |
8e0c3760
|
Ermal
|
<?php if (!isset($id) || !($a_filter[$id] && firewall_check_for_advanced_options($a_filter[$id]) <> "")): ?>
|
| 976 |
151eb2a9
|
sullrich
|
<tr>
|
| 977 |
|
|
<td width="22%" valign="top"> </td>
|
| 978 |
|
|
<td width="78%">
|
| 979 |
|
|
<br>
|
| 980 |
157a6919
|
Carlos Eduardo Ramos
|
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
|
| 981 |
151eb2a9
|
sullrich
|
<?php if (isset($id) && $a_filter[$id]): ?>
|
| 982 |
225a2f0b
|
Scott Ullrich
|
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
|
| 983 |
151eb2a9
|
sullrich
|
<?php endif; ?>
|
| 984 |
225a2f0b
|
Scott Ullrich
|
<input name="after" type="hidden" value="<?=htmlspecialchars($after);?>">
|
| 985 |
151eb2a9
|
sullrich
|
</td>
|
| 986 |
|
|
</tr>
|
| 987 |
8e0c3760
|
Ermal
|
<?php endif; ?>
|
| 988 |
151eb2a9
|
sullrich
|
<tr>
|
| 989 |
|
|
<td> </td>
|
| 990 |
|
|
</tr>
|
| 991 |
|
|
<tr>
|
| 992 |
11d2c529
|
Rafael Lucas
|
<td colspan="2" valign="top" class="listtopic"><?=gettext("Advanced features");?></td>
|
| 993 |
151eb2a9
|
sullrich
|
</tr>
|
| 994 |
f1602cc4
|
sullrich
|
<tr>
|
| 995 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("Source OS");?></td>
|
| 996 |
e265d9f5
|
sullrich
|
<td width="78%" class="vtable">
|
| 997 |
ee9933b6
|
Renato Botelho
|
<div id="showadvsourceosbox" <?php if ($pconfig['os']) echo "style='display:none'"; ?>>
|
| 998 |
157a6919
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_sourceos()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 999 |
adb633a0
|
sullrich
|
</div>
|
| 1000 |
ee9933b6
|
Renato Botelho
|
<div id="showsourceosadv" <?php if (empty($pconfig['os'])) echo "style='display:none'"; ?>>
|
| 1001 |
21600ab1
|
Vinicius Coque
|
<?=gettext("OS Type:");?>
|
| 1002 |
adb633a0
|
sullrich
|
<select name="os" id="os" class="formselect">
|
| 1003 |
f1602cc4
|
sullrich
|
<?php
|
| 1004 |
adb633a0
|
sullrich
|
$ostypes = array(
|
| 1005 |
abd67a31
|
Carlos Eduardo Ramos
|
"" => gettext("any"),
|
| 1006 |
adb633a0
|
sullrich
|
"AIX" => "AIX",
|
| 1007 |
|
|
"Linux" => "Linux",
|
| 1008 |
|
|
"FreeBSD" => "FreeBSD",
|
| 1009 |
|
|
"NetBSD" => "NetBSD",
|
| 1010 |
|
|
"OpenBSD" => "OpenBSD",
|
| 1011 |
|
|
"Solaris" => "Solaris",
|
| 1012 |
|
|
"MacOS" => "MacOS",
|
| 1013 |
|
|
"Windows" => "Windows",
|
| 1014 |
|
|
"Novell" => "Novell",
|
| 1015 |
|
|
"NMAP" => "NMAP"
|
| 1016 |
|
|
);
|
| 1017 |
|
|
foreach ($ostypes as $ostype => $descr): ?>
|
| 1018 |
|
|
<option value="<?=$ostype;?>" <?php if ($ostype == $pconfig['os']) echo "selected"; ?>><?=htmlspecialchars($descr);?></option>
|
| 1019 |
|
|
<?php
|
| 1020 |
|
|
endforeach;
|
| 1021 |
|
|
?>
|
| 1022 |
|
|
</select>
|
| 1023 |
|
|
<br />
|
| 1024 |
11d2c529
|
Rafael Lucas
|
<?=gettext("Note: this only works for TCP rules");?>
|
| 1025 |
adb633a0
|
sullrich
|
</div>
|
| 1026 |
f1602cc4
|
sullrich
|
</td>
|
| 1027 |
|
|
</tr>
|
| 1028 |
30c4ae8a
|
sullrich
|
<tr>
|
| 1029 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("Diffserv Code Point");?></td>
|
| 1030 |
30c4ae8a
|
sullrich
|
<td width="78%" class="vtable">
|
| 1031 |
ee9933b6
|
Renato Botelho
|
<div id="dsadv" name="dsadv" <?php if ($pconfig['dscp']) echo "style='display:none'"; ?>>
|
| 1032 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_dsdiv();" value="<?=gettext("Advanced"); ?>"> - <?=gettext("Show advanced option");?>
|
| 1033 |
30c4ae8a
|
sullrich
|
</div>
|
| 1034 |
ee9933b6
|
Renato Botelho
|
<div id="dsdivmain" name="dsdivmain" <?php if (empty($pconfig['dscp'])) echo "style='display:none'"; ?>>
|
| 1035 |
30c4ae8a
|
sullrich
|
<select name="dscp" id="dscp">
|
| 1036 |
|
|
<option value=""></option>
|
| 1037 |
|
|
<?php foreach($firewall_rules_dscp_types as $frdt): ?>
|
| 1038 |
|
|
<option value="<?=$frdt?>"<?php if($pconfig['dscp'] == $frdt) echo " SELECTED"; ?>><?=$frdt?></option>
|
| 1039 |
|
|
<?php endforeach; ?>
|
| 1040 |
|
|
</select>
|
| 1041 |
|
|
</div>
|
| 1042 |
|
|
</td>
|
| 1043 |
|
|
</tr>
|
| 1044 |
661aed33
|
Ermal Luçi
|
<tr>
|
| 1045 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("Advanced Options");?></td>
|
| 1046 |
e6db3f58
|
Ermal Luçi
|
<td width="78%" class="vtable">
|
| 1047 |
|
|
<div id="aoadv" name="aoadv">
|
| 1048 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_aodiv();" value="<?=gettext("Advanced"); ?>"> - <?=gettext("Show advanced option");?>
|
| 1049 |
e6db3f58
|
Ermal Luçi
|
</div>
|
| 1050 |
|
|
<div id="aodivmain" name="aodivmain" style="display:none">
|
| 1051 |
f1602cc4
|
sullrich
|
<input type="checkbox" id="allowopts" value="yes" name="allowopts"<?php if($pconfig['allowopts'] == true) echo " checked"; ?>>
|
| 1052 |
a29dc11b
|
Chris Buechler
|
<br/><span class="vexpl"><?=gettext("This allows packets with IP options to pass. Otherwise they are blocked by default. This is usually only seen with multicast traffic.");?>
|
| 1053 |
f1602cc4
|
sullrich
|
</span><p>
|
| 1054 |
19757916
|
Ermal Lu?i
|
<input type="checkbox" id="disablereplyto" value="yes" name="disablereplyto"<?php if($pconfig['disablereplyto'] == true) echo " checked"; ?>>
|
| 1055 |
|
|
<br/><span class="vexpl"><?=gettext("This will disable auto generated reply-to for this rule.");?>
|
| 1056 |
|
|
</span><p>
|
| 1057 |
f1602cc4
|
sullrich
|
<input name="tag" id="tag" value="<?=htmlspecialchars($pconfig['tag']);?>">
|
| 1058 |
345b9715
|
Carlos Eduardo Ramos
|
<br /><span class="vexpl"><?=gettext("You can mark a packet matching this rule and use this mark to match on other NAT/filter rules. It is called"); ?> <b><?=gettext("Policy filtering"); ?></b>
|
| 1059 |
775ccea3
|
Ermal Luci
|
</span><p>
|
| 1060 |
f1602cc4
|
sullrich
|
<input name="tagged" id="tagged" value="<?=htmlspecialchars($pconfig['tagged']);?>">
|
| 1061 |
|
|
<br /><span class="vexpl"><?=gettext("You can match packet on a mark placed before on another rule.")?>
|
| 1062 |
|
|
</span> <p>
|
| 1063 |
dd5bf424
|
Scott Ullrich
|
<input name="max" id="max" value="<?php echo htmlspecialchars($pconfig['max']) ?>"><br><?=gettext(" Maximum state entries this rule can create");?></p><p>
|
| 1064 |
|
|
<input name="max-src-nodes" id="max-src-nodes" value="<?php echo htmlspecialchars($pconfig['max-src-nodes']) ?>"><br><?=gettext(" Maximum number of unique source hosts");?></p><p>
|
| 1065 |
|
|
<input name="max-src-conn" id="max-src-conn" value="<?php echo htmlspecialchars($pconfig['max-src-conn']) ?>"><br><?=gettext(" Maximum number of established connections per host");?></p><p>
|
| 1066 |
|
|
<input name="max-src-states" id="max-src-states" value="<?php echo htmlspecialchars($pconfig['max-src-states']) ?>"><br><?=gettext(" Maximum state entries per host");?></p><p>
|
| 1067 |
|
|
<input name="max-src-conn-rate" id="max-src-conn-rate" value="<?php echo htmlspecialchars($pconfig['max-src-conn-rate']) ?>"> /
|
| 1068 |
8ab3e9ed
|
Erik Kristensen
|
<select name="max-src-conn-rates" id="max-src-conn-rates">
|
| 1069 |
|
|
<option value=""<?php if(intval($pconfig['max-src-conn-rates']) < 1) echo " selected"; ?>></option>
|
| 1070 |
|
|
<?php for($x=1; $x<255; $x++) {
|
| 1071 |
|
|
if($x == $pconfig['max-src-conn-rates']) $selected = " selected"; else $selected = "";
|
| 1072 |
|
|
echo "<option value=\"{$x}\"{$selected}>{$x}</option>\n";
|
| 1073 |
|
|
} ?>
|
| 1074 |
47042140
|
Scott Ullrich
|
</select><br />
|
| 1075 |
11d2c529
|
Rafael Lucas
|
<?=gettext("Maximum new connections / per second(s)");?>
|
| 1076 |
e4d79ab0
|
Ermal
|
</p><p>
|
| 1077 |
47042140
|
Scott Ullrich
|
|
| 1078 |
dd5bf424
|
Scott Ullrich
|
<input name="statetimeout" value="<?php echo htmlspecialchars($pconfig['statetimeout']) ?>"><br>
|
| 1079 |
11d2c529
|
Rafael Lucas
|
<?=gettext("State Timeout in seconds");?>
|
| 1080 |
e4d79ab0
|
Ermal
|
</p>
|
| 1081 |
47042140
|
Scott Ullrich
|
|
| 1082 |
e4d79ab0
|
Ermal
|
<p><strong><?=gettext("NOTE: Leave fields blank to disable that feature.");?></strong></p>
|
| 1083 |
197b2a47
|
Scott Ullrich
|
</div>
|
| 1084 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 1085 |
|
|
</tr>
|
| 1086 |
b8ed2a11
|
Ermal
|
<tr id="tcpflags" name="tcpflags">
|
| 1087 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("TCP flags");?></td>
|
| 1088 |
b8ed2a11
|
Ermal
|
<td width="78%" class="vtable">
|
| 1089 |
ee9933b6
|
Renato Botelho
|
<div id="showtcpflagsbox" <?php if ($pconfig['tcpflags_any'] || $pconfig['tcpflags1'] || $pconfig['tcpflags2']) echo "style='display:none'"; ?>>
|
| 1090 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_tcpflags()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 1091 |
b8ed2a11
|
Ermal
|
</div>
|
| 1092 |
ee9933b6
|
Renato Botelho
|
<div id="showtcpflagsadv" <?php if (empty($pconfig['tcpflags_any']) && empty($pconfig['tcpflags1']) && empty($pconfig['tcpflags2'])) echo "style='display:none'"; ?>>
|
| 1093 |
b8ed2a11
|
Ermal
|
<div id="tcpheader" name="tcpheader">
|
| 1094 |
|
|
<center>
|
| 1095 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 1096 |
|
|
<?php
|
| 1097 |
|
|
$setflags = explode(",", $pconfig['tcpflags1']);
|
| 1098 |
|
|
$outofflags = explode(",", $pconfig['tcpflags2']);
|
| 1099 |
|
|
$header = "<td width='40' nowrap></td>";
|
| 1100 |
|
|
$tcpflags1 = "<td width='40' nowrap>set</td>";
|
| 1101 |
|
|
$tcpflags2 = "<td width='40' nowrap>out of</td>";
|
| 1102 |
|
|
foreach ($tcpflags as $tcpflag) {
|
| 1103 |
|
|
$header .= "<td width='40' nowrap><strong>" . strtoupper($tcpflag) . "</strong></td>\n";
|
| 1104 |
|
|
$tcpflags1 .= "<td width='40' nowrap> <input type='checkbox' name='tcpflags1_{$tcpflag}' value='on' ";
|
| 1105 |
|
|
if (array_search($tcpflag, $setflags) !== false)
|
| 1106 |
|
|
$tcpflags1 .= "checked";
|
| 1107 |
|
|
$tcpflags1 .= "></td>\n";
|
| 1108 |
|
|
$tcpflags2 .= "<td width='40' nowrap> <input type='checkbox' name='tcpflags2_{$tcpflag}' value='on' ";
|
| 1109 |
|
|
if (array_search($tcpflag, $outofflags) !== false)
|
| 1110 |
|
|
$tcpflags2 .= "checked";
|
| 1111 |
|
|
$tcpflags2 .= "></td>\n";
|
| 1112 |
|
|
}
|
| 1113 |
|
|
echo "<tr id='tcpheader' name='tcpheader'>{$header}</tr>\n";
|
| 1114 |
|
|
echo "<tr id='tcpflags1' name='tcpflags1'>{$tcpflags1}</tr>\n";
|
| 1115 |
|
|
echo "<tr id='tcpflags2' name='tcpflags2'>{$tcpflags2}</tr>\n";
|
| 1116 |
|
|
?>
|
| 1117 |
|
|
</table>
|
| 1118 |
|
|
<center>
|
| 1119 |
|
|
</div>
|
| 1120 |
|
|
<br/><center>
|
| 1121 |
11d2c529
|
Rafael Lucas
|
<input onClick='tcpflags_anyclick(this);' type='checkbox' name='tcpflags_any' value='on' <?php if ($pconfig['tcpflags_any']) echo "checked"; ?>><strong><?=gettext("Any flags.");?></strong><br/></center>
|
| 1122 |
b8ed2a11
|
Ermal
|
<br/>
|
| 1123 |
11d2c529
|
Rafael Lucas
|
<span class="vexpl"><?=gettext("Use this to choose TCP flags that must".
|
| 1124 |
|
|
"be set or cleared for this rule to match.");?></span>
|
| 1125 |
b8ed2a11
|
Ermal
|
</div>
|
| 1126 |
|
|
</td>
|
| 1127 |
|
|
</tr>
|
| 1128 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 1129 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("State Type");?></td>
|
| 1130 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 1131 |
ee9933b6
|
Renato Botelho
|
<div id="showadvstatebox" <?php if (!empty($pconfig['statetype']) && $pconfig['statetype'] != "keep state") echo "style='display:none'"; ?>>
|
| 1132 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_state()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 1133 |
f6970b2f
|
Scott Ullrich
|
</div>
|
| 1134 |
ee9933b6
|
Renato Botelho
|
<div id="showstateadv" <?php if (empty($pconfig['statetype']) || $pconfig['statetype'] == "keep state") echo "style='display:none'"; ?>>
|
| 1135 |
f6970b2f
|
Scott Ullrich
|
<select name="statetype">
|
| 1136 |
11d2c529
|
Rafael Lucas
|
<option value="keep state" <?php if(!isset($pconfig['statetype']) or $pconfig['statetype'] == "keep state") echo "selected"; ?>><?=gettext("keep state");?></option>
|
| 1137 |
|
|
<option value="sloppy state" <?php if($pconfig['statetype'] == "sloppy state") echo "selected"; ?>><?=gettext("sloppy state");?></option>
|
| 1138 |
|
|
<option value="synproxy state"<?php if($pconfig['statetype'] == "synproxy state") echo "selected"; ?>><?=gettext("synproxy state");?></option>
|
| 1139 |
|
|
<option value="none"<?php if($pconfig['statetype'] == "none") echo "selected"; ?>><?=gettext("none");?></option>
|
| 1140 |
|
|
</select><br><?=gettext("HINT: Select which type of state tracking mechanism you would like to use. If in doubt, use keep state.");?>
|
| 1141 |
f6970b2f
|
Scott Ullrich
|
<p>
|
| 1142 |
|
|
<table width="90%">
|
| 1143 |
67300ce5
|
Ermal
|
<tr><td width="25%"><ul><li><?=gettext("keep state");?></li></ul></td><td><?=gettext("Works with all IP protocols.");?></td></tr>
|
| 1144 |
|
|
<tr><td width="25%"><ul><li><?=gettext("sloppy state");?></li></ul></td><td><?=gettext("Works with all IP protocols.");?></td></tr>
|
| 1145 |
|
|
<tr><td width="25%"><ul><li><?=gettext("synproxy state");?></li></ul></td><td><?=gettext("Proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods. This option includes the functionality of keep state and modulate state combined.");?></td></tr>
|
| 1146 |
|
|
<tr><td width="25%"><ul><li><?=gettext("none");?></li></ul></td><td><?=gettext("Do not use state mechanisms to keep track. This is only useful if you're doing advanced queueing in certain situations. Please check the documentation.");?></td></tr>
|
| 1147 |
f6970b2f
|
Scott Ullrich
|
</table>
|
| 1148 |
|
|
</p>
|
| 1149 |
|
|
</div>
|
| 1150 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 1151 |
|
|
</tr>
|
| 1152 |
10f21e70
|
Scott Ullrich
|
<tr>
|
| 1153 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("No XMLRPC Sync");?></td>
|
| 1154 |
10f21e70
|
Scott Ullrich
|
<td width="78%" class="vtable">
|
| 1155 |
ee9933b6
|
Renato Botelho
|
<div id="showadvnoxmlrpcsyncbox" <?php if ($pconfig['nosync']) echo "style='display:none'"; ?>>
|
| 1156 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_noxmlrpc()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 1157 |
0239d8ee
|
sullrich
|
</div>
|
| 1158 |
ee9933b6
|
Renato Botelho
|
<div id="shownoxmlrpcadv" <?php if (empty($pconfig['nosync'])) echo "style='display:none'"; ?>>
|
| 1159 |
0239d8ee
|
sullrich
|
<input type="checkbox" name="nosync"<?php if($pconfig['nosync']) echo " CHECKED"; ?>><br>
|
| 1160 |
11d2c529
|
Rafael Lucas
|
<?=gettext("HINT: This prevents the rule from automatically syncing to other CARP members.");?>
|
| 1161 |
0239d8ee
|
sullrich
|
</div>
|
| 1162 |
10f21e70
|
Scott Ullrich
|
</td>
|
| 1163 |
8c84fe43
|
Scott Ullrich
|
</tr>
|
| 1164 |
615b27bc
|
Scott Dale
|
<?php
|
| 1165 |
|
|
//build list of schedules
|
| 1166 |
|
|
$schedules = array();
|
| 1167 |
|
|
$schedules[] = "none";//leave none to leave rule enabled all the time
|
| 1168 |
a60fd0cb
|
Scott Ullrich
|
if(is_array($config['schedules']['schedule'])) {
|
| 1169 |
|
|
foreach ($config['schedules']['schedule'] as $schedule) {
|
| 1170 |
|
|
if ($schedule['name'] <> "")
|
| 1171 |
|
|
$schedules[] = $schedule['name'];
|
| 1172 |
|
|
}
|
| 1173 |
|
|
}
|
| 1174 |
615b27bc
|
Scott Dale
|
?>
|
| 1175 |
|
|
<tr>
|
| 1176 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("Schedule");?></td>
|
| 1177 |
615b27bc
|
Scott Dale
|
<td width="78%" class="vtable">
|
| 1178 |
ee9933b6
|
Renato Botelho
|
<div id="showadvschedulebox" <?php if (!empty($pconfig['sched'])) echo "style='display:none'"; ?>>
|
| 1179 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_schedule()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 1180 |
0239d8ee
|
sullrich
|
</div>
|
| 1181 |
ee9933b6
|
Renato Botelho
|
<div id="showscheduleadv" <?php if (empty($pconfig['sched'])) echo "style='display:none'"; ?>>
|
| 1182 |
0239d8ee
|
sullrich
|
<select name='sched'>
|
| 1183 |
615b27bc
|
Scott Dale
|
<?php
|
| 1184 |
0239d8ee
|
sullrich
|
foreach($schedules as $schedule) {
|
| 1185 |
|
|
if($schedule == $pconfig['sched']) {
|
| 1186 |
|
|
$selected = " SELECTED";
|
| 1187 |
|
|
} else {
|
| 1188 |
|
|
$selected = "";
|
| 1189 |
|
|
}
|
| 1190 |
|
|
if ($schedule == "none") {
|
| 1191 |
|
|
echo "<option value=\"\" {$selected}>{$schedule}</option>\n";
|
| 1192 |
|
|
} else {
|
| 1193 |
|
|
echo "<option value=\"{$schedule}\" {$selected}>{$schedule}</option>\n";
|
| 1194 |
|
|
}
|
| 1195 |
615b27bc
|
Scott Dale
|
}
|
| 1196 |
0239d8ee
|
sullrich
|
?>
|
| 1197 |
|
|
</select>
|
| 1198 |
11d2c529
|
Rafael Lucas
|
<p><?=gettext("Leave as 'none' to leave the rule enabled all the time.");?></p>
|
| 1199 |
0239d8ee
|
sullrich
|
</div>
|
| 1200 |
615b27bc
|
Scott Dale
|
</td>
|
| 1201 |
|
|
</tr>
|
| 1202 |
82628210
|
Scott Ullrich
|
<tr>
|
| 1203 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("Gateway");?></td>
|
| 1204 |
8ab3e9ed
|
Erik Kristensen
|
<td width="78%" class="vtable">
|
| 1205 |
ee9933b6
|
Renato Botelho
|
<div id="showadvgatewaybox" <?php if (!empty($pconfig['gateway'])) echo "style='display:none'"; ?>>
|
| 1206 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_gateway()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 1207 |
0239d8ee
|
sullrich
|
</div>
|
| 1208 |
ee9933b6
|
Renato Botelho
|
<div id="showgatewayadv" <?php if (empty($pconfig['gateway'])) echo "style='display:none'"; ?>>
|
| 1209 |
0239d8ee
|
sullrich
|
<select name='gateway'>
|
| 1210 |
11d2c529
|
Rafael Lucas
|
<option value="" ><?=gettext("default");?></option>
|
| 1211 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 1212 |
1b38ac36
|
Ermal
|
/* build a list of gateways */
|
| 1213 |
|
|
$gateways = return_gateways_array();
|
| 1214 |
106804a2
|
Chris Buechler
|
// add statically configured gateways to list
|
| 1215 |
1b38ac36
|
Ermal
|
foreach($gateways as $gwname => $gw) {
|
| 1216 |
0239d8ee
|
sullrich
|
if($gw == "")
|
| 1217 |
0581660c
|
Scott Ullrich
|
continue;
|
| 1218 |
1b38ac36
|
Ermal
|
if($gwname == $pconfig['gateway']) {
|
| 1219 |
4443d4d6
|
Scott Ullrich
|
$selected = " SELECTED";
|
| 1220 |
1fda0968
|
Scott Ullrich
|
} else {
|
| 1221 |
|
|
$selected = "";
|
| 1222 |
|
|
}
|
| 1223 |
1b38ac36
|
Ermal
|
echo "<option value=\"{$gwname}\" {$selected}>{$gw['name']} - {$gw['gateway']}</option>\n";
|
| 1224 |
106804a2
|
Chris Buechler
|
}
|
| 1225 |
0239d8ee
|
sullrich
|
/* add gateway groups to the list */
|
| 1226 |
|
|
if (is_array($config['gateways']['gateway_group'])) {
|
| 1227 |
|
|
foreach($config['gateways']['gateway_group'] as $gw_group) {
|
| 1228 |
|
|
if($gw_group['name'] == "")
|
| 1229 |
|
|
continue;
|
| 1230 |
|
|
if($pconfig['gateway'] == $gw_group['name']) {
|
| 1231 |
|
|
echo "<option value=\"{$gw_group['name']}\" SELECTED>{$gw_group['name']}</option>\n";
|
| 1232 |
|
|
} else {
|
| 1233 |
|
|
echo "<option value=\"{$gw_group['name']}\">{$gw_group['name']}</option>\n";
|
| 1234 |
|
|
}
|
| 1235 |
|
|
}
|
| 1236 |
|
|
}
|
| 1237 |
8ab3e9ed
|
Erik Kristensen
|
?>
|
| 1238 |
0239d8ee
|
sullrich
|
</select>
|
| 1239 |
11d2c529
|
Rafael Lucas
|
<p><strong><?=gettext("Leave as 'default' to use the system routing table. Or choose a gateway to utilize policy based routing.");?></strong></p>
|
| 1240 |
0239d8ee
|
sullrich
|
</div>
|
| 1241 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 1242 |
|
|
</tr>
|
| 1243 |
a5fd67e1
|
Ermal Luçi
|
<tr>
|
| 1244 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("In/Out");?></td>
|
| 1245 |
a5fd67e1
|
Ermal Luçi
|
<td width="78%" class="vtable">
|
| 1246 |
ee9933b6
|
Renato Botelho
|
<div id="showadvinoutbox" <?php if (!empty($pconfig['dnpipe'])) echo "style='display:none'"; ?>>
|
| 1247 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_inout()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 1248 |
4c263f57
|
sullrich
|
</div>
|
| 1249 |
ee9933b6
|
Renato Botelho
|
<div id="showinoutadv" <?php if (empty($pconfig['dnpipe'])) echo "style='display:none'"; ?>>
|
| 1250 |
4c263f57
|
sullrich
|
<select name="dnpipe">
|
| 1251 |
a5fd67e1
|
Ermal Luçi
|
<?php
|
| 1252 |
|
|
if (!is_array($dnqlist))
|
| 1253 |
|
|
$dnqlist = array();
|
| 1254 |
|
|
echo "<option value=\"none\"";
|
| 1255 |
|
|
if (!$dnqselected) echo " SELECTED";
|
| 1256 |
|
|
echo " >none</option>";
|
| 1257 |
|
|
foreach ($dnqlist as $dnq => $dnqkey) {
|
| 1258 |
|
|
if($dnq == "")
|
| 1259 |
|
|
continue;
|
| 1260 |
|
|
echo "<option value=\"$dnqkey\"";
|
| 1261 |
|
|
if ($dnqkey == $pconfig['dnpipe']) {
|
| 1262 |
|
|
$dnqselected = 1;
|
| 1263 |
|
|
echo " SELECTED";
|
| 1264 |
|
|
}
|
| 1265 |
|
|
echo ">{$dnq}</option>";
|
| 1266 |
|
|
}
|
| 1267 |
|
|
?>
|
| 1268 |
|
|
</select> /
|
| 1269 |
|
|
<select name="pdnpipe">
|
| 1270 |
|
|
<?php
|
| 1271 |
|
|
$dnqselected = 0;
|
| 1272 |
|
|
echo "<option value=\"none\"";
|
| 1273 |
|
|
if (!$dnqselected) echo " SELECTED";
|
| 1274 |
|
|
echo " >none</option>";
|
| 1275 |
|
|
foreach ($dnqlist as $dnq => $dnqkey) {
|
| 1276 |
|
|
if($dnq == "")
|
| 1277 |
|
|
continue;
|
| 1278 |
|
|
echo "<option value=\"$dnqkey\"";
|
| 1279 |
|
|
if ($dnqkey == $pconfig['pdnpipe']) {
|
| 1280 |
|
|
$dnqselected = 1;
|
| 1281 |
|
|
echo " SELECTED";
|
| 1282 |
|
|
}
|
| 1283 |
|
|
echo ">{$dnq}</option>";
|
| 1284 |
|
|
}
|
| 1285 |
|
|
?>
|
| 1286 |
4c263f57
|
sullrich
|
</select>
|
| 1287 |
a5fd67e1
|
Ermal Luçi
|
<br />
|
| 1288 |
456d0175
|
Vinicius Coque
|
<span class="vexpl"><?=gettext("Choose the Out queue/Virtual interface only if you have selected In too.")."<br/>".gettext("The Out selection is applied to traffic going out the interface the rule is created, In is the incoming one.")."<br/>".gettext("If you are creating a rule on the Floating tab if the direction is In then the same rules apply, if the direction is out the selections are reverted Out is for incoming and In is for outgoing and if you do not select any direction use only the In since the Out selection does not make sense in there to prevent oddities.");?></span>
|
| 1289 |
4c263f57
|
sullrich
|
</div>
|
| 1290 |
a5fd67e1
|
Ermal Luçi
|
</td>
|
| 1291 |
|
|
</tr>
|
| 1292 |
|
|
|
| 1293 |
197bfe96
|
Ermal Luçi
|
<tr>
|
| 1294 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("Ackqueue/Queue");?></td>
|
| 1295 |
197bfe96
|
Ermal Luçi
|
<td width="78%" class="vtable">
|
| 1296 |
ee9933b6
|
Renato Botelho
|
<div id="showadvackqueuebox" <?php if (!empty($pconfig['defaultqueue'])) echo "style='display:none'"; ?>>
|
| 1297 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_ackqueue()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 1298 |
0239d8ee
|
sullrich
|
</div>
|
| 1299 |
ee9933b6
|
Renato Botelho
|
<div id="showackqueueadv" <?php if (empty($pconfig['defaultqueue'])) echo "style='display:none'"; ?>>
|
| 1300 |
0239d8ee
|
sullrich
|
<select name="ackqueue">
|
| 1301 |
197bfe96
|
Ermal Luçi
|
<?php
|
| 1302 |
0239d8ee
|
sullrich
|
if (!is_array($qlist))
|
| 1303 |
|
|
$qlist = array();
|
| 1304 |
|
|
echo "<option value=\"none\"";
|
| 1305 |
|
|
if (!$qselected) echo " SELECTED";
|
| 1306 |
|
|
echo " >none</option>";
|
| 1307 |
|
|
foreach ($qlist as $q => $qkey) {
|
| 1308 |
|
|
if($q == "")
|
| 1309 |
|
|
continue;
|
| 1310 |
|
|
echo "<option value=\"$q\"";
|
| 1311 |
|
|
if ($q == $pconfig['ackqueue']) {
|
| 1312 |
|
|
$qselected = 1;
|
| 1313 |
|
|
echo " SELECTED";
|
| 1314 |
|
|
}
|
| 1315 |
|
|
echo ">{$q}</option>";
|
| 1316 |
197bfe96
|
Ermal Luçi
|
}
|
| 1317 |
|
|
?>
|
| 1318 |
0239d8ee
|
sullrich
|
</select> /
|
| 1319 |
|
|
<select name="defaultqueue">
|
| 1320 |
197bfe96
|
Ermal Luçi
|
<?php
|
| 1321 |
0239d8ee
|
sullrich
|
$qselected = 0;
|
| 1322 |
|
|
echo "<option value=\"none\"";
|
| 1323 |
|
|
if (!$qselected) echo " SELECTED";
|
| 1324 |
|
|
echo " >none</option>";
|
| 1325 |
|
|
foreach ($qlist as $q => $qkey) {
|
| 1326 |
|
|
if($q == "")
|
| 1327 |
|
|
continue;
|
| 1328 |
|
|
echo "<option value=\"$q\"";
|
| 1329 |
|
|
if ($q == $pconfig['defaultqueue']) {
|
| 1330 |
|
|
$qselected = 1;
|
| 1331 |
|
|
echo " SELECTED";
|
| 1332 |
|
|
}
|
| 1333 |
|
|
echo ">{$q}</option>";
|
| 1334 |
197bfe96
|
Ermal Luçi
|
}
|
| 1335 |
|
|
?>
|
| 1336 |
0239d8ee
|
sullrich
|
</select>
|
| 1337 |
|
|
<br />
|
| 1338 |
11d2c529
|
Rafael Lucas
|
<span class="vexpl"><?=gettext("Choose the Acknowledge Queue only if you have selected Queue.");?></span>
|
| 1339 |
0239d8ee
|
sullrich
|
</td>
|
| 1340 |
|
|
</tr>
|
| 1341 |
|
|
<tr>
|
| 1342 |
11d2c529
|
Rafael Lucas
|
<td width="22%" valign="top" class="vncell"><?=gettext("Layer7");?></td>
|
| 1343 |
0239d8ee
|
sullrich
|
<td width="78%" class="vtable">
|
| 1344 |
ee9933b6
|
Renato Botelho
|
<div id="showadvlayer7box" <?php if (!empty($pconfig['l7container'])) echo "style='display:none'"; ?>>
|
| 1345 |
0fb885bc
|
Carlos Eduardo Ramos
|
<input type="button" onClick="show_advanced_layer7()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
|
| 1346 |
4c263f57
|
sullrich
|
</div>
|
| 1347 |
ee9933b6
|
Renato Botelho
|
<div id="showlayer7adv" <?php if (empty($pconfig['l7container'])) echo "style='display:none'"; ?>>
|
| 1348 |
0239d8ee
|
sullrich
|
<select name="l7container">
|
| 1349 |
7e50413c
|
Ermal Luçi
|
<?php
|
| 1350 |
0239d8ee
|
sullrich
|
if (!is_array($l7clist))
|
| 1351 |
06e2a55d
|
thompsa
|
$l7clist = array();
|
| 1352 |
0239d8ee
|
sullrich
|
echo "<option value=\"none\"";
|
| 1353 |
|
|
echo " >none</option>";
|
| 1354 |
|
|
foreach ($l7clist as $l7ckey) {
|
| 1355 |
|
|
echo "<option value=\"{$l7ckey}\"";
|
| 1356 |
|
|
if ($l7ckey == $pconfig['l7container']) {
|
| 1357 |
|
|
echo " SELECTED";
|
| 1358 |
|
|
}
|
| 1359 |
|
|
echo ">{$l7ckey}</option>";
|
| 1360 |
|
|
}
|
| 1361 |
7e50413c
|
Ermal Luçi
|
?>
|
| 1362 |
0239d8ee
|
sullrich
|
</select>
|
| 1363 |
7e50413c
|
Ermal Luçi
|
<br/>
|
| 1364 |
0239d8ee
|
sullrich
|
<span class="vexpl">
|
| 1365 |
4fe84f51
|
Carlos Eduardo Ramos
|
<?=gettext("Choose a Layer7 container to apply application protocol inspection rules. " .
|
| 1366 |
|
|
"These are valid for TCP and UDP protocols only.");?>
|
| 1367 |
0239d8ee
|
sullrich
|
</span>
|
| 1368 |
|
|
</div>
|
| 1369 |
7e50413c
|
Ermal Luçi
|
</td>
|
| 1370 |
|
|
</tr>
|
| 1371 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 1372 |
|
|
<td width="22%" valign="top"> </td>
|
| 1373 |
|
|
<td width="78%">
|
| 1374 |
151eb2a9
|
sullrich
|
<br>
|
| 1375 |
157a6919
|
Carlos Eduardo Ramos
|
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
|
| 1376 |
8ab3e9ed
|
Erik Kristensen
|
<?php if (isset($id) && $a_filter[$id]): ?>
|
| 1377 |
225a2f0b
|
Scott Ullrich
|
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
|
| 1378 |
8ab3e9ed
|
Erik Kristensen
|
<?php endif; ?>
|
| 1379 |
225a2f0b
|
Scott Ullrich
|
<input name="after" type="hidden" value="<?=htmlspecialchars($after);?>">
|
| 1380 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 1381 |
82628210
|
Scott Ullrich
|
</tr>
|
| 1382 |
8ab3e9ed
|
Erik Kristensen
|
</table>
|
| 1383 |
5b237745
|
Scott Ullrich
|
</form>
|
| 1384 |
|
|
<script language="JavaScript">
|
| 1385 |
|
|
<!--
|
| 1386 |
8ab3e9ed
|
Erik Kristensen
|
ext_change();
|
| 1387 |
|
|
typesel_change();
|
| 1388 |
|
|
proto_change();
|
| 1389 |
3e74107e
|
Erik Fonnesbeck
|
<?php if ( (!empty($pconfig['srcbeginport']) && $pconfig['srcbeginport'] != "any") || (!empty($pconfig['srcendport']) && $pconfig['srcendport'] != "any") ): ?>
|
| 1390 |
|
|
show_source_port_range();
|
| 1391 |
|
|
<?php endif; ?>
|
| 1392 |
19757279
|
Scott Ullrich
|
|
| 1393 |
|
|
<?php
|
| 1394 |
8ab3e9ed
|
Erik Kristensen
|
$isfirst = 0;
|
| 1395 |
|
|
$aliases = "";
|
| 1396 |
|
|
$addrisfirst = 0;
|
| 1397 |
|
|
$aliasesaddr = "";
|
| 1398 |
|
|
if($config['aliases']['alias'] <> "" and is_array($config['aliases']['alias']))
|
| 1399 |
|
|
foreach($config['aliases']['alias'] as $alias_name) {
|
| 1400 |
72cb5baf
|
Ermal Lu?i
|
switch ($alias_name['type']) {
|
| 1401 |
|
|
case "port":
|
| 1402 |
|
|
if($isfirst == 1) $portaliases .= ",";
|
| 1403 |
|
|
$portaliases .= "'" . $alias_name['name'] . "'";
|
| 1404 |
8ab3e9ed
|
Erik Kristensen
|
$isfirst = 1;
|
| 1405 |
72cb5baf
|
Ermal Lu?i
|
break;
|
| 1406 |
|
|
case "host":
|
| 1407 |
|
|
case "network":
|
| 1408 |
|
|
case "openvpn":
|
| 1409 |
c7de8be4
|
jim-p
|
case "urltable":
|
| 1410 |
8ab3e9ed
|
Erik Kristensen
|
if($addrisfirst == 1) $aliasesaddr .= ",";
|
| 1411 |
|
|
$aliasesaddr .= "'" . $alias_name['name'] . "'";
|
| 1412 |
|
|
$addrisfirst = 1;
|
| 1413 |
72cb5baf
|
Ermal Lu?i
|
break;
|
| 1414 |
|
|
default:
|
| 1415 |
|
|
break;
|
| 1416 |
8ab3e9ed
|
Erik Kristensen
|
}
|
| 1417 |
092ac49d
|
Scott Ullrich
|
}
|
| 1418 |
19757279
|
Scott Ullrich
|
?>
|
| 1419 |
|
|
|
| 1420 |
8ab3e9ed
|
Erik Kristensen
|
var addressarray=new Array(<?php echo $aliasesaddr; ?>);
|
| 1421 |
72cb5baf
|
Ermal Lu?i
|
var customarray=new Array(<?php echo $portaliases; ?>);
|
| 1422 |
19757279
|
Scott Ullrich
|
|
| 1423 |
9eb60dcc
|
Ermal Lu?i
|
var oTextbox1 = new AutoSuggestControl(document.getElementById("src"), new StateSuggestions(addressarray));
|
| 1424 |
|
|
var oTextbox2 = new AutoSuggestControl(document.getElementById("srcbeginport_cust"), new StateSuggestions(customarray));
|
| 1425 |
|
|
var oTextbox3 = new AutoSuggestControl(document.getElementById("srcendport_cust"), new StateSuggestions(customarray));
|
| 1426 |
|
|
var oTextbox4 = new AutoSuggestControl(document.getElementById("dst"), new StateSuggestions(addressarray));
|
| 1427 |
|
|
var oTextbox5 = new AutoSuggestControl(document.getElementById("dstbeginport_cust"), new StateSuggestions(customarray));
|
| 1428 |
|
|
var oTextbox6 = new AutoSuggestControl(document.getElementById("dstendport_cust"), new StateSuggestions(customarray));
|
| 1429 |
5b237745
|
Scott Ullrich
|
//-->
|
| 1430 |
|
|
</script>
|
| 1431 |
|
|
<?php include("fend.inc"); ?>
|
| 1432 |
|
|
</body>
|
| 1433 |
9b45f821
|
Ermal Lu?i
|
</html>
|