Project

General

Profile

Download (14 KB) Statistics
| Branch: | Tag: | Revision:
1 7ed0e844 Warren Baker
<?php
2
/* $Id$ */
3
/*
4
	services_unbound_acls.php
5 c7281770 Chris Buechler
	part of pfSense (https://www.pfsense.org/)
6 7ed0e844 Warren Baker
7
	Copyright (C) 2011 Warren Baker <warren@decoy.co.za>
8 6317d31d Phil Davis
	Copyright (C) 2013-2015 Electric Sheep Fencing, LP
9 7ed0e844 Warren Baker
	All rights reserved.
10
11
	Redistribution and use in source and binary forms, with or without
12
	modification, are permitted provided that the following conditions are met:
13
14
	1. Redistributions of source code must retain the above copyright notice,
15
	   this list of conditions and the following disclaimer.
16
17
	2. Redistributions in binary form must reproduce the above copyright
18
	   notice, this list of conditions and the following disclaimer in the
19
	   documentation and/or other materials provided with the distribution.
20
21
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
22
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
23
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
25
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30
	POSSIBILITY OF SUCH DAMAGE.
31
*/
32
33
require("guiconfig.inc");
34
require("unbound.inc");
35
36 62424bdb Renato Botelho
$referer = (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '/services_unbound_acls.php');
37
38 be11b6f1 Warren Baker
if (!is_array($config['unbound']['acls'])) {
39 2783e408 Renato Botelho
	$config['unbound']['acls'] = array();
40 be11b6f1 Warren Baker
}
41 7ed0e844 Warren Baker
42
$a_acls = &$config['unbound']['acls'];
43
44
$id = $_GET['id'];
45 be11b6f1 Warren Baker
if (isset($_POST['aclid'])) {
46 2783e408 Renato Botelho
	$id = $_POST['aclid'];
47 be11b6f1 Warren Baker
}
48 7ed0e844 Warren Baker
49 033663df jim-p
if (!empty($id) && !is_numeric($id)) {
50
	pfSenseHeader("services_unbound_acls.php");
51
	exit;
52
}
53
54 7ed0e844 Warren Baker
$act = $_GET['act'];
55 be11b6f1 Warren Baker
if (isset($_POST['act'])) {
56 2783e408 Renato Botelho
	$act = $_POST['act'];
57 be11b6f1 Warren Baker
}
58 7ed0e844 Warren Baker
59
if ($act == "del") {
60 2783e408 Renato Botelho
	if (!$a_acls[$id]) {
61
		pfSenseHeader("services_unbound_acls.php");
62
		exit;
63
	}
64
65
	unset($a_acls[$id]);
66
	write_config();
67
	mark_subsystem_dirty('unbound');
68 7ed0e844 Warren Baker
}
69
70
if ($act == "new") {
71 2783e408 Renato Botelho
	$id = unbound_get_next_id();
72 7ed0e844 Warren Baker
}
73
74
if ($act == "edit") {
75 2783e408 Renato Botelho
	if (isset($id) && $a_acls[$id]) {
76
		$pconfig = $a_acls[$id];
77
		$networkacl = $a_acls[$id]['row'];
78
	}
79 7ed0e844 Warren Baker
}
80
81
if ($_POST) {
82 2783e408 Renato Botelho
	unset($input_errors);
83
	$pconfig = $_POST;
84
85
	if ($_POST['apply']) {
86
		$retval = services_unbound_configure();
87
		$savemsg = get_std_save_message($retval);
88
		if ($retval == 0)
89
			clear_subsystem_dirty('unbound');
90
	} else {
91
92
		// input validation - only allow 50 entries in a single ACL
93
		for($x=0; $x<50; $x++) {
94
			if (isset($pconfig["acl_network{$x}"])) {
95
				$networkacl[$x] = array();
96
				$networkacl[$x]['acl_network'] = $pconfig["acl_network{$x}"];
97
				$networkacl[$x]['mask'] = $pconfig["mask{$x}"];
98
				$networkacl[$x]['description'] = $pconfig["description{$x}"];
99
				if (!is_ipaddr($networkacl[$x]['acl_network'])) {
100 f72fce18 Chris Buechler
					$input_errors[] = gettext("You must enter a valid IP address for each row under Networks.");
101 fe9d4894 Renato Botelho
				}
102 f7e6c49a Renato Botelho
103 2783e408 Renato Botelho
				if (is_ipaddr($networkacl[$x]['acl_network'])) {
104
					if (!is_subnet($networkacl[$x]['acl_network']."/".$networkacl[$x]['mask'])) {
105 f72fce18 Chris Buechler
						$input_errors[] = gettext("You must enter a valid IPv4 netmask for each IPv4 row under Networks.");
106 fe9d4894 Renato Botelho
					}
107 2783e408 Renato Botelho
				} else if (function_exists("is_ipaddrv6")) {
108
					if (!is_ipaddrv6($networkacl[$x]['acl_network'])) {
109
						$input_errors[] = gettext("You must enter a valid IPv6 address for {$networkacl[$x]['acl_network']}.");
110 fe9d4894 Renato Botelho
					} else if (!is_subnetv6($networkacl[$x]['acl_network']."/".$networkacl[$x]['mask'])) {
111 f72fce18 Chris Buechler
						$input_errors[] = gettext("You must enter a valid IPv6 netmask for each IPv6 row under Networks.");
112 fe9d4894 Renato Botelho
					}
113 2783e408 Renato Botelho
				} else {
114 f72fce18 Chris Buechler
					$input_errors[] = gettext("You must enter a valid IP address for each row under Networks.");
115 fe9d4894 Renato Botelho
				}
116 2783e408 Renato Botelho
			} else if (isset($networkacl[$x])) {
117
				unset($networkacl[$x]);
118 fe9d4894 Renato Botelho
			}
119 2783e408 Renato Botelho
		}
120
121
		if (!$input_errors) {
122
			if ($pconfig['Submit'] == gettext("Save")) {
123
				$acl_entry = array();
124
				$acl_entry['aclid'] = $pconfig['aclid'];
125
				$acl_entry['aclname'] = $pconfig['aclname'];
126
				$acl_entry['aclaction'] = $pconfig['aclaction'];
127
				$acl_entry['description'] = $pconfig['description'];
128
				$acl_entry['aclid'] = $pconfig['aclid'];
129
				$acl_entry['row'] = array();
130
				foreach ($networkacl as $acl) {
131
					$acl_entry['row'][] = $acl;
132 fe9d4894 Renato Botelho
				}
133 f7e6c49a Renato Botelho
134 2783e408 Renato Botelho
				if (isset($id) && $a_acls[$id]) {
135
					$a_acls[$id] = $acl_entry;
136 fe9d4894 Renato Botelho
				} else {
137 2783e408 Renato Botelho
					$a_acls[] = $acl_entry;
138 fe9d4894 Renato Botelho
				}
139 f7e6c49a Renato Botelho
140 2783e408 Renato Botelho
				mark_subsystem_dirty("unbound");
141
				write_config();
142 f7e6c49a Renato Botelho
143 2783e408 Renato Botelho
				pfSenseHeader("/services_unbound_acls.php");
144
				exit;
145
			}
146 f7e6c49a Renato Botelho
147 2783e408 Renato Botelho
		}
148
	}
149 7ed0e844 Warren Baker
}
150
151 f6543a41 Colin Fleming
$closehead = false;
152 7ed0e844 Warren Baker
$pgtitle = "Services: DNS Resolver: Access Lists";
153 8f6875de Phil Davis
$shortcut_section = "resolver";
154 7ed0e844 Warren Baker
include("head.inc");
155
156
?>
157
158 dbf81496 Renato Botelho
<script type="text/javascript" src="/javascript/jquery.ipv4v6ify.js"></script>
159
<script type="text/javascript" src="/javascript/row_helper.js"></script>
160 7ed0e844 Warren Baker
161
<script type="text/javascript">
162 2783e408 Renato Botelho
//<![CDATA[
163
	rowname[0] = "acl_network";
164
	rowtype[0] = "textbox,ipv4v6";
165
	rowsize[0] = "30";
166
167
	rowname[1] = "mask";
168
	rowtype[1] = "select,ipv4v6";
169
	rowsize[1] = "1";
170
171
	rowname[2] = "description";
172
	rowtype[2] = "textbox";
173
	rowsize[2] = "40";
174
//]]>
175 7ed0e844 Warren Baker
</script>
176 f6543a41 Colin Fleming
</head>
177 7ed0e844 Warren Baker
178 9961044a Warren Baker
<body>
179 7ed0e844 Warren Baker
180
<?php include("fbegin.inc"); ?>
181
<form action="services_unbound_acls.php" method="post" name="iform" id="iform">
182 1b436de1 Warren Baker
<?php if ($input_errors) print_input_errors($input_errors); ?>
183
<?php if ($savemsg) print_info_box($savemsg); ?>
184
<?php if (is_subsystem_dirty('unbound')): ?><br/>
185 2783e408 Renato Botelho
<?php print_info_box_np(gettext("The configuration of the DNS Resolver, has been changed") . ".<br />" . gettext("You must apply the changes in order for them to take effect."));?><br />
186 1b436de1 Warren Baker
<?php endif; ?>
187 7ed0e844 Warren Baker
188 9961044a Warren Baker
<table width="100%" border="0" cellpadding="0" cellspacing="0" summary="services unbound acls">
189 2783e408 Renato Botelho
	<tbody>
190
		<tr>
191
			<td class="tabnavtbl">
192
				<?php
193
					$tab_array = array();
194
					$tab_array[] = array(gettext("General Settings"), false, "/services_unbound.php");
195
					$tab_array[] = array(gettext("Advanced settings"), false, "services_unbound_advanced.php");
196
					$tab_array[] = array(gettext("Access Lists"), true, "/services_unbound_acls.php");
197
					display_top_tabs($tab_array, true);
198
				?>
199
			</td>
200
		</tr>
201
		<tr>
202
			<td id="mainarea">
203
				<div class="tabcont">
204
					<?php if($act=="new" || $act=="edit"): ?>
205
						<input name="aclid" type="hidden" value="<?=$id;?>" />
206
						<input name="act" type="hidden" value="<?=$act;?>" />
207
208
					<table width="100%" border="0" cellpadding="6" cellspacing="0" summary="main area">
209
						<tr>
210
							<td colspan="2" valign="top" class="listtopic"><?=ucwords(sprintf(gettext("%s Access List"),$act));?></td>
211
						</tr>
212
						<tr>
213
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Access List name");?></td>
214
							<td width="78%" class="vtable">
215
								<input name="aclname" type="text" class="formfld" id="aclname" size="30" maxlength="30" value="<?=htmlspecialchars($pconfig['aclname']);?>" />
216
								<br />
217
								<span class="vexpl"><?=gettext("Provide an Access List name.");?></span>
218
							</td>
219
						</tr>
220
						<tr>
221
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Action");?></td>
222
							<td width="78%" class="vtable">
223
								<select name="aclaction" class="formselect">
224
									<?php $types = explode(",", "Allow,Deny,Refuse,Allow Snoop"); foreach ($types as $type): ?>
225
									<option value="<?=strtolower($type);?>" <?php if (strtolower($type) == strtolower($pconfig['aclaction'])) echo "selected=\"selected\""; ?>>
226
									<?=htmlspecialchars($type);?>
227
									</option>
228
									<?php endforeach; ?>
229
								</select>
230
								<br />
231 9961044a Warren Baker
								<span class="vexpl">
232 8cd558b6 ayvis
									<?=gettext("Choose what to do with DNS requests that match the criteria specified below.");?> <br />
233 2783e408 Renato Botelho
									<?=gettext("<b>Deny:</b> This action stops queries from hosts within the netblock defined below.");?> <br />
234
									<?=gettext("<b>Refuse:</b> This action also stops queries from hosts within the netblock defined below, but sends a DNS rcode REFUSED error message back to the client.");?> <br />
235
									<?=gettext("<b>Allow:</b> This action allows queries from hosts within the netblock defined below.");?> <br />
236
									<?=gettext("<b>Allow Snoop:</b> This action allows recursive and nonrecursive access from hosts within the netblock defined below. Used for cache snooping and ideally should only be configured for your administrative host.");?> <br />
237 9961044a Warren Baker
								</span>
238 2783e408 Renato Botelho
							</td>
239
						</tr>
240
						<tr>
241
						<td width="22%" valign="top" class="vncellreq"><?=gettext("Networks");?></td>
242
						<td width="78%" class="vtable">
243
							<table id="maintable" summary="networks">
244
								<tbody>
245
									<tr>
246
										<td><div id="onecolumn"><?=gettext("Network");?></div></td>
247
										<td><div id="twocolumn"><?=gettext("CIDR");?></div></td>
248
										<td><div id="threecolumn"><?=gettext("Description");?></div></td>
249
									</tr>
250
									<?php $counter = 0; ?>
251
									<?php
252
										if($networkacl)
253
											foreach($networkacl as $item):
254
									?>
255
											<?php
256
												$network = $item['acl_network'];
257
												$cidr = $item['mask'];
258
												$description = $item['description'];
259
											?>
260
									<tr>
261
										<td>
262
											<input name="acl_network<?=$counter;?>" type="text" class="formfld unknown ipv4v6" id="acl_network<?=$counter;?>" size="30" value="<?=htmlspecialchars($network);?>" />
263
										</td>
264
										<td>
265
											<select name="mask<?=$counter;?>" class="formselect ipv4v6" id="mask<?=$counter;?>">
266
											<?php
267
												for ($i = 128; $i > 0; $i--) {
268
													echo "<option value=\"$i\" ";
269
													if ($i == $cidr) echo "selected=\"selected\"";
270
													echo ">" . $i . "</option>";
271
												}
272
											?>
273
											</select>
274
										</td>
275
										<td>
276
											<input name="description<?=$counter;?>" type="text" class="formfld unknown" id="description<?=$counter;?>" size="40" value="<?=htmlspecialchars($description);?>" />
277
										</td>
278
										<td>
279
											<a onclick="removeRow(this); return false;" href="#"><img border="0" src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" alt="delete" /></a>
280
										</td>
281
									</tr>
282
									<?php $counter++; ?>
283
									<?php endforeach; ?>
284
								</tbody>
285
							</table>
286
							<a onclick="javascript:addRowTo('maintable', 'formfldalias'); return false;" href="#">
287
								<img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" alt="" title="<?=gettext("add another entry");?>" />
288
							</a>
289
							<script type="text/javascript">
290
							//<![CDATA[
291
								field_counter_js = 3;
292
								rows = 1;
293
								totalrows = <?php echo $counter; ?>;
294
								loaded = <?php echo $counter; ?>;
295
							//]]>
296
							</script>
297
298
							</td>
299
						</tr>
300
301
						<tr>
302
							<td width="22%" valign="top" class="vncell"><?=gettext("Description");?></td>
303
							<td width="78%" class="vtable">
304
								<input name="description" type="text" class="formfld unknown" id="description" size="52" maxlength="52" value="<?=htmlspecialchars($pconfig['description']);?>" />
305
								<br />
306
								<span class="vexpl"><?=gettext("You may enter a description here for your reference.");?></span>
307
							</td>
308
						</tr>
309
						<tr>
310
							<td>&nbsp;</td>
311
						</tr>
312
						<tr>
313
							<td width="22%" valign="top">&nbsp;</td>
314
							<td width="78%">
315
								&nbsp;<br />&nbsp;
316
								<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" />
317
								<input type="button" class="formbtn" value="<?=gettext("Cancel");?>" onclick="window.location.href='<?=$referer;?>'" />
318
							</td>
319
						</tr>
320
					</table>
321
322
				<?php else: ?>
323
324
				<table class="sortable" width="100%" border="0" cellpadding="0" cellspacing="0" summary="results">
325
					<thead>
326
						<tr>
327
							<td width="25%" class="listhdrr"><?=gettext("Access List Name"); ?></td>
328
							<td width="25%" class="listhdrr"><?=gettext("Action"); ?></td>
329
							<td width="45%" class="listhdr"><?=gettext("Description"); ?></td>
330
							<td width="5%" class="list">&nbsp;</td>
331
						</tr>
332
					</thead>
333
					<tfoot>
334
						<tr>
335
							<td class="list" colspan="3">&nbsp;</td>
336
							<td class="list">
337
								<table border="0" cellspacing="0" cellpadding="1" summary="icons">
338
									<tr>
339
										<td width="17">&nbsp;</td>
340
										<td valign="middle"><a href="services_unbound_acls.php?act=new">
341
											<img src="./themes/<?=$g['theme'];?>/images/icons/icon_plus.gif" title="<?=gettext("Add new Access List"); ?>" border="0" alt="add" />
342
										</a></td>
343
									</tr>
344
								</table>
345
							</td>
346
						</tr>
347
						<tr>
348
							<td colspan="4">
349
								<p>
350
									<?=gettext("Access Lists to control access to the DNS Resolver can be defined here.");?>
351
								</p>
352
							</td>
353
						</tr>
354
					</tfoot>
355
					<tbody>
356
					<?php
357
						$i = 0;
358
						foreach($a_acls as $acl):
359
					?>
360
						<tr ondblclick="document.location='services_unbound_acls.php?act=edit&amp;id=<?=$i;?>'">
361
							<td class="listlr">
362
								<?=htmlspecialchars($acl['aclname']);?>
363
							</td>
364
							<td class="listr">
365
								<?=htmlspecialchars($acl['aclaction']);?>
366
							</td>
367
							<td class="listbg">
368
								<?=htmlspecialchars($acl['description']);?>
369
							</td>
370
							<td valign="middle" class="list nowrap">
371
								<table border="0" cellspacing="0" cellpadding="1" summary="icons">
372
									<tr>
373
										<td valign="middle"><a href="services_unbound_acls.php?act=edit&amp;id=<?=$i;?>">
374
											<img src="./themes/<?=$g['theme'];?>/images/icons/icon_e.gif" title="<?=gettext("edit access list"); ?>" width="17" height="17" border="0" alt="edit" />
375
										</a></td>
376
										<td valign="middle"><a href="services_unbound_acls.php?act=del&amp;id=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this access list?"); ?>')">
377
											<img src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" title="<?=gettext("delete access list"); ?>" width="17" height="17" border="0" alt="delete" />
378
										</a></td>
379
									</tr>
380
								</table>
381
							</td>
382
						</tr>
383
					<?php
384
						$i++;
385
						endforeach;
386
					?>
387
					<tr style="display:none"><td></td></tr>
388
					</tbody>
389
				</table>
390
			<?php endif; ?>
391
			</div>
392
			</td>
393
		</tr>
394
	</tbody>
395 7ed0e844 Warren Baker
</table>
396 f6543a41 Colin Fleming
</form>
397 9961044a Warren Baker
398 7ed0e844 Warren Baker
<?php include("fend.inc"); ?>
399 9961044a Warren Baker
</body>
400 f6543a41 Colin Fleming
</html>