Project

General

Profile

Download (13.9 KB) Statistics
| Branch: | Tag: | Revision:
1 7ed0e844 Warren Baker
<?php
2
/* $Id$ */
3
/*
4
	services_unbound_acls.php
5 c7281770 Chris Buechler
	part of pfSense (https://www.pfsense.org/)
6 7ed0e844 Warren Baker
7
	Copyright (C) 2011 Warren Baker <warren@decoy.co.za>
8 29aef6c4 Jim Thompson
        Copyright (C) 2013-2014 Electric Sheep Fencing, LP
9 7ed0e844 Warren Baker
	All rights reserved.
10
11
	Redistribution and use in source and binary forms, with or without
12
	modification, are permitted provided that the following conditions are met:
13
14
	1. Redistributions of source code must retain the above copyright notice,
15
	   this list of conditions and the following disclaimer.
16
17
	2. Redistributions in binary form must reproduce the above copyright
18
	   notice, this list of conditions and the following disclaimer in the
19
	   documentation and/or other materials provided with the distribution.
20
21
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
22
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
23
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
25
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30
	POSSIBILITY OF SUCH DAMAGE.
31
*/
32
33
require("guiconfig.inc");
34
require("unbound.inc");
35
36 62424bdb Renato Botelho
$referer = (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '/services_unbound_acls.php');
37
38 be11b6f1 Warren Baker
if (!is_array($config['unbound']['acls'])) {
39 2783e408 Renato Botelho
	$config['unbound']['acls'] = array();
40 be11b6f1 Warren Baker
}
41 7ed0e844 Warren Baker
42
$a_acls = &$config['unbound']['acls'];
43
44
$id = $_GET['id'];
45 be11b6f1 Warren Baker
if (isset($_POST['aclid'])) {
46 2783e408 Renato Botelho
	$id = $_POST['aclid'];
47 be11b6f1 Warren Baker
}
48 7ed0e844 Warren Baker
49
$act = $_GET['act'];
50 be11b6f1 Warren Baker
if (isset($_POST['act'])) {
51 2783e408 Renato Botelho
	$act = $_POST['act'];
52 be11b6f1 Warren Baker
}
53 7ed0e844 Warren Baker
54
if ($act == "del") {
55 2783e408 Renato Botelho
	if (!$a_acls[$id]) {
56
		pfSenseHeader("services_unbound_acls.php");
57
		exit;
58
	}
59
60
	unset($a_acls[$id]);
61
	write_config();
62
	mark_subsystem_dirty('unbound');
63 7ed0e844 Warren Baker
}
64
65
if ($act == "new") {
66 2783e408 Renato Botelho
	$id = unbound_get_next_id();
67 7ed0e844 Warren Baker
}
68
69
if ($act == "edit") {
70 2783e408 Renato Botelho
	if (isset($id) && $a_acls[$id]) {
71
		$pconfig = $a_acls[$id];
72
		$networkacl = $a_acls[$id]['row'];
73
	}
74 7ed0e844 Warren Baker
}
75
76
if ($_POST) {
77 2783e408 Renato Botelho
	unset($input_errors);
78
	$pconfig = $_POST;
79
80
	if ($_POST['apply']) {
81
		$retval = services_unbound_configure();
82
		$savemsg = get_std_save_message($retval);
83
		if ($retval == 0)
84
			clear_subsystem_dirty('unbound');
85
	} else {
86
87
		// input validation - only allow 50 entries in a single ACL
88
		for($x=0; $x<50; $x++) {
89
			if (isset($pconfig["acl_network{$x}"])) {
90
				$networkacl[$x] = array();
91
				$networkacl[$x]['acl_network'] = $pconfig["acl_network{$x}"];
92
				$networkacl[$x]['mask'] = $pconfig["mask{$x}"];
93
				$networkacl[$x]['description'] = $pconfig["description{$x}"];
94
				if (!is_ipaddr($networkacl[$x]['acl_network'])) {
95 f72fce18 Chris Buechler
					$input_errors[] = gettext("You must enter a valid IP address for each row under Networks.");
96 fe9d4894 Renato Botelho
				}
97 f7e6c49a Renato Botelho
98 2783e408 Renato Botelho
				if (is_ipaddr($networkacl[$x]['acl_network'])) {
99
					if (!is_subnet($networkacl[$x]['acl_network']."/".$networkacl[$x]['mask'])) {
100 f72fce18 Chris Buechler
						$input_errors[] = gettext("You must enter a valid IPv4 netmask for each IPv4 row under Networks.");
101 fe9d4894 Renato Botelho
					}
102 2783e408 Renato Botelho
				} else if (function_exists("is_ipaddrv6")) {
103
					if (!is_ipaddrv6($networkacl[$x]['acl_network'])) {
104
						$input_errors[] = gettext("You must enter a valid IPv6 address for {$networkacl[$x]['acl_network']}.");
105 fe9d4894 Renato Botelho
					} else if (!is_subnetv6($networkacl[$x]['acl_network']."/".$networkacl[$x]['mask'])) {
106 f72fce18 Chris Buechler
						$input_errors[] = gettext("You must enter a valid IPv6 netmask for each IPv6 row under Networks.");
107 fe9d4894 Renato Botelho
					}
108 2783e408 Renato Botelho
				} else {
109 f72fce18 Chris Buechler
					$input_errors[] = gettext("You must enter a valid IP address for each row under Networks.");
110 fe9d4894 Renato Botelho
				}
111 2783e408 Renato Botelho
			} else if (isset($networkacl[$x])) {
112
				unset($networkacl[$x]);
113 fe9d4894 Renato Botelho
			}
114 2783e408 Renato Botelho
		}
115
116
		if (!$input_errors) {
117
			if ($pconfig['Submit'] == gettext("Save")) {
118
				$acl_entry = array();
119
				$acl_entry['aclid'] = $pconfig['aclid'];
120
				$acl_entry['aclname'] = $pconfig['aclname'];
121
				$acl_entry['aclaction'] = $pconfig['aclaction'];
122
				$acl_entry['description'] = $pconfig['description'];
123
				$acl_entry['aclid'] = $pconfig['aclid'];
124
				$acl_entry['row'] = array();
125
				foreach ($networkacl as $acl) {
126
					$acl_entry['row'][] = $acl;
127 fe9d4894 Renato Botelho
				}
128 f7e6c49a Renato Botelho
129 2783e408 Renato Botelho
				if (isset($id) && $a_acls[$id]) {
130
					$a_acls[$id] = $acl_entry;
131 fe9d4894 Renato Botelho
				} else {
132 2783e408 Renato Botelho
					$a_acls[] = $acl_entry;
133 fe9d4894 Renato Botelho
				}
134 f7e6c49a Renato Botelho
135 2783e408 Renato Botelho
				mark_subsystem_dirty("unbound");
136
				write_config();
137 f7e6c49a Renato Botelho
138 2783e408 Renato Botelho
				pfSenseHeader("/services_unbound_acls.php");
139
				exit;
140
			}
141 f7e6c49a Renato Botelho
142 2783e408 Renato Botelho
		}
143
	}
144 7ed0e844 Warren Baker
}
145
146 f6543a41 Colin Fleming
$closehead = false;
147 7ed0e844 Warren Baker
$pgtitle = "Services: DNS Resolver: Access Lists";
148
include("head.inc");
149
150
?>
151
152 dbf81496 Renato Botelho
<script type="text/javascript" src="/javascript/jquery.ipv4v6ify.js"></script>
153
<script type="text/javascript" src="/javascript/row_helper.js"></script>
154 7ed0e844 Warren Baker
155
<script type="text/javascript">
156 2783e408 Renato Botelho
//<![CDATA[
157
	rowname[0] = "acl_network";
158
	rowtype[0] = "textbox,ipv4v6";
159
	rowsize[0] = "30";
160
161
	rowname[1] = "mask";
162
	rowtype[1] = "select,ipv4v6";
163
	rowsize[1] = "1";
164
165
	rowname[2] = "description";
166
	rowtype[2] = "textbox";
167
	rowsize[2] = "40";
168
//]]>
169 7ed0e844 Warren Baker
</script>
170 f6543a41 Colin Fleming
</head>
171 7ed0e844 Warren Baker
172 9961044a Warren Baker
<body>
173 7ed0e844 Warren Baker
174
<?php include("fbegin.inc"); ?>
175
<form action="services_unbound_acls.php" method="post" name="iform" id="iform">
176 1b436de1 Warren Baker
<?php if ($input_errors) print_input_errors($input_errors); ?>
177
<?php if ($savemsg) print_info_box($savemsg); ?>
178
<?php if (is_subsystem_dirty('unbound')): ?><br/>
179 2783e408 Renato Botelho
<?php print_info_box_np(gettext("The configuration of the DNS Resolver, has been changed") . ".<br />" . gettext("You must apply the changes in order for them to take effect."));?><br />
180 1b436de1 Warren Baker
<?php endif; ?>
181 7ed0e844 Warren Baker
182 9961044a Warren Baker
<table width="100%" border="0" cellpadding="0" cellspacing="0" summary="services unbound acls">
183 2783e408 Renato Botelho
	<tbody>
184
		<tr>
185
			<td class="tabnavtbl">
186
				<?php
187
					$tab_array = array();
188
					$tab_array[] = array(gettext("General Settings"), false, "/services_unbound.php");
189
					$tab_array[] = array(gettext("Advanced settings"), false, "services_unbound_advanced.php");
190
					$tab_array[] = array(gettext("Access Lists"), true, "/services_unbound_acls.php");
191
					display_top_tabs($tab_array, true);
192
				?>
193
			</td>
194
		</tr>
195
		<tr>
196
			<td id="mainarea">
197
				<div class="tabcont">
198
					<?php if($act=="new" || $act=="edit"): ?>
199
						<input name="aclid" type="hidden" value="<?=$id;?>" />
200
						<input name="act" type="hidden" value="<?=$act;?>" />
201
202
					<table width="100%" border="0" cellpadding="6" cellspacing="0" summary="main area">
203
						<tr>
204
							<td colspan="2" valign="top" class="listtopic"><?=ucwords(sprintf(gettext("%s Access List"),$act));?></td>
205
						</tr>
206
						<tr>
207
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Access List name");?></td>
208
							<td width="78%" class="vtable">
209
								<input name="aclname" type="text" class="formfld" id="aclname" size="30" maxlength="30" value="<?=htmlspecialchars($pconfig['aclname']);?>" />
210
								<br />
211
								<span class="vexpl"><?=gettext("Provide an Access List name.");?></span>
212
							</td>
213
						</tr>
214
						<tr>
215
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Action");?></td>
216
							<td width="78%" class="vtable">
217
								<select name="aclaction" class="formselect">
218
									<?php $types = explode(",", "Allow,Deny,Refuse,Allow Snoop"); foreach ($types as $type): ?>
219
									<option value="<?=strtolower($type);?>" <?php if (strtolower($type) == strtolower($pconfig['aclaction'])) echo "selected=\"selected\""; ?>>
220
									<?=htmlspecialchars($type);?>
221
									</option>
222
									<?php endforeach; ?>
223
								</select>
224
								<br />
225 9961044a Warren Baker
								<span class="vexpl">
226 8cd558b6 ayvis
									<?=gettext("Choose what to do with DNS requests that match the criteria specified below.");?> <br />
227 2783e408 Renato Botelho
									<?=gettext("<b>Deny:</b> This action stops queries from hosts within the netblock defined below.");?> <br />
228
									<?=gettext("<b>Refuse:</b> This action also stops queries from hosts within the netblock defined below, but sends a DNS rcode REFUSED error message back to the client.");?> <br />
229
									<?=gettext("<b>Allow:</b> This action allows queries from hosts within the netblock defined below.");?> <br />
230
									<?=gettext("<b>Allow Snoop:</b> This action allows recursive and nonrecursive access from hosts within the netblock defined below. Used for cache snooping and ideally should only be configured for your administrative host.");?> <br />
231 9961044a Warren Baker
								</span>
232 2783e408 Renato Botelho
							</td>
233
						</tr>
234
						<tr>
235
						<td width="22%" valign="top" class="vncellreq"><?=gettext("Networks");?></td>
236
						<td width="78%" class="vtable">
237
							<table id="maintable" summary="networks">
238
								<tbody>
239
									<tr>
240
										<td><div id="onecolumn"><?=gettext("Network");?></div></td>
241
										<td><div id="twocolumn"><?=gettext("CIDR");?></div></td>
242
										<td><div id="threecolumn"><?=gettext("Description");?></div></td>
243
									</tr>
244
									<?php $counter = 0; ?>
245
									<?php
246
										if($networkacl)
247
											foreach($networkacl as $item):
248
									?>
249
											<?php
250
												$network = $item['acl_network'];
251
												$cidr = $item['mask'];
252
												$description = $item['description'];
253
											?>
254
									<tr>
255
										<td>
256
											<input name="acl_network<?=$counter;?>" type="text" class="formfld unknown ipv4v6" id="acl_network<?=$counter;?>" size="30" value="<?=htmlspecialchars($network);?>" />
257
										</td>
258
										<td>
259
											<select name="mask<?=$counter;?>" class="formselect ipv4v6" id="mask<?=$counter;?>">
260
											<?php
261
												for ($i = 128; $i > 0; $i--) {
262
													echo "<option value=\"$i\" ";
263
													if ($i == $cidr) echo "selected=\"selected\"";
264
													echo ">" . $i . "</option>";
265
												}
266
											?>
267
											</select>
268
										</td>
269
										<td>
270
											<input name="description<?=$counter;?>" type="text" class="formfld unknown" id="description<?=$counter;?>" size="40" value="<?=htmlspecialchars($description);?>" />
271
										</td>
272
										<td>
273
											<a onclick="removeRow(this); return false;" href="#"><img border="0" src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" alt="delete" /></a>
274
										</td>
275
									</tr>
276
									<?php $counter++; ?>
277
									<?php endforeach; ?>
278
								</tbody>
279
							</table>
280
							<a onclick="javascript:addRowTo('maintable', 'formfldalias'); return false;" href="#">
281
								<img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" alt="" title="<?=gettext("add another entry");?>" />
282
							</a>
283
							<script type="text/javascript">
284
							//<![CDATA[
285
								field_counter_js = 3;
286
								rows = 1;
287
								totalrows = <?php echo $counter; ?>;
288
								loaded = <?php echo $counter; ?>;
289
							//]]>
290
							</script>
291
292
							</td>
293
						</tr>
294
295
						<tr>
296
							<td width="22%" valign="top" class="vncell"><?=gettext("Description");?></td>
297
							<td width="78%" class="vtable">
298
								<input name="description" type="text" class="formfld unknown" id="description" size="52" maxlength="52" value="<?=htmlspecialchars($pconfig['description']);?>" />
299
								<br />
300
								<span class="vexpl"><?=gettext("You may enter a description here for your reference.");?></span>
301
							</td>
302
						</tr>
303
						<tr>
304
							<td>&nbsp;</td>
305
						</tr>
306
						<tr>
307
							<td width="22%" valign="top">&nbsp;</td>
308
							<td width="78%">
309
								&nbsp;<br />&nbsp;
310
								<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" />
311
								<input type="button" class="formbtn" value="<?=gettext("Cancel");?>" onclick="window.location.href='<?=$referer;?>'" />
312
							</td>
313
						</tr>
314
					</table>
315
316
				<?php else: ?>
317
318
				<table class="sortable" width="100%" border="0" cellpadding="0" cellspacing="0" summary="results">
319
					<thead>
320
						<tr>
321
							<td width="25%" class="listhdrr"><?=gettext("Access List Name"); ?></td>
322
							<td width="25%" class="listhdrr"><?=gettext("Action"); ?></td>
323
							<td width="45%" class="listhdr"><?=gettext("Description"); ?></td>
324
							<td width="5%" class="list">&nbsp;</td>
325
						</tr>
326
					</thead>
327
					<tfoot>
328
						<tr>
329
							<td class="list" colspan="3">&nbsp;</td>
330
							<td class="list">
331
								<table border="0" cellspacing="0" cellpadding="1" summary="icons">
332
									<tr>
333
										<td width="17">&nbsp;</td>
334
										<td valign="middle"><a href="services_unbound_acls.php?act=new">
335
											<img src="./themes/<?=$g['theme'];?>/images/icons/icon_plus.gif" title="<?=gettext("Add new Access List"); ?>" border="0" alt="add" />
336
										</a></td>
337
									</tr>
338
								</table>
339
							</td>
340
						</tr>
341
						<tr>
342
							<td colspan="4">
343
								<p>
344
									<?=gettext("Access Lists to control access to the DNS Resolver can be defined here.");?>
345
								</p>
346
							</td>
347
						</tr>
348
					</tfoot>
349
					<tbody>
350
					<?php
351
						$i = 0;
352
						foreach($a_acls as $acl):
353
					?>
354
						<tr ondblclick="document.location='services_unbound_acls.php?act=edit&amp;id=<?=$i;?>'">
355
							<td class="listlr">
356
								<?=htmlspecialchars($acl['aclname']);?>
357
							</td>
358
							<td class="listr">
359
								<?=htmlspecialchars($acl['aclaction']);?>
360
							</td>
361
							<td class="listbg">
362
								<?=htmlspecialchars($acl['description']);?>
363
							</td>
364
							<td valign="middle" class="list nowrap">
365
								<table border="0" cellspacing="0" cellpadding="1" summary="icons">
366
									<tr>
367
										<td valign="middle"><a href="services_unbound_acls.php?act=edit&amp;id=<?=$i;?>">
368
											<img src="./themes/<?=$g['theme'];?>/images/icons/icon_e.gif" title="<?=gettext("edit access list"); ?>" width="17" height="17" border="0" alt="edit" />
369
										</a></td>
370
										<td valign="middle"><a href="services_unbound_acls.php?act=del&amp;id=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this access list?"); ?>')">
371
											<img src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" title="<?=gettext("delete access list"); ?>" width="17" height="17" border="0" alt="delete" />
372
										</a></td>
373
									</tr>
374
								</table>
375
							</td>
376
						</tr>
377
					<?php
378
						$i++;
379
						endforeach;
380
					?>
381
					<tr style="display:none"><td></td></tr>
382
					</tbody>
383
				</table>
384
			<?php endif; ?>
385
			</div>
386
			</td>
387
		</tr>
388
	</tbody>
389 7ed0e844 Warren Baker
</table>
390 f6543a41 Colin Fleming
</form>
391 9961044a Warren Baker
392 7ed0e844 Warren Baker
<?php include("fend.inc"); ?>
393 9961044a Warren Baker
</body>
394 f6543a41 Colin Fleming
</html>