Project

General

Profile

Download (72.9 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/* $Id$ */
3
/*
4
	firewall_rules_edit.php
5
	part of pfSense (http://www.pfsense.com)
6
        Copyright (C) 2005 Scott Ullrich (sullrich@gmail.com)
7

    
8
	originally part of m0n0wall (http://m0n0.ch/wall)
9
	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
10
	All rights reserved.
11

    
12
	Redistribution and use in source and binary forms, with or without
13
	modification, are permitted provided that the following conditions are met:
14

    
15
	1. Redistributions of source code must retain the above copyright notice,
16
	   this list of conditions and the following disclaimer.
17

    
18
	2. Redistributions in binary form must reproduce the above copyright
19
	   notice, this list of conditions and the following disclaimer in the
20
	   documentation and/or other materials provided with the distribution.
21

    
22
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
23
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
24
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
26
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31
	POSSIBILITY OF SUCH DAMAGE.
32
*/
33
/*
34
	pfSense_MODULE:	filter
35
*/
36

    
37
##|+PRIV
38
##|*IDENT=page-firewall-rules-edit
39
##|*NAME=Firewall: Rules: Edit page
40
##|*DESCR=Allow access to the 'Firewall: Rules: Edit' page.
41
##|*MATCH=firewall_rules_edit.php*
42
##|-PRIV
43

    
44
require("guiconfig.inc");
45
require("filter.inc");
46
require("shaper.inc");
47

    
48
$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
49
$ifdisp = get_configured_interface_with_descr();
50
foreach ($ifdisp as $kif => $kdescr) {
51
	$specialsrcdst[] = "{$kif}";
52
	$specialsrcdst[] = "{$kif}ip";
53
}
54

    
55
if (!is_array($config['filter']['rule'])) {
56
	$config['filter']['rule'] = array();
57
}
58
filter_rules_sort();
59
$a_filter = &$config['filter']['rule'];
60

    
61
$id = $_GET['id'];
62
if (is_numeric($_POST['id']))
63
	$id = $_POST['id'];
64

    
65
$after = $_GET['after'];
66

    
67
if (isset($_POST['after']))
68
	$after = $_POST['after'];
69

    
70
if (isset($_GET['dup'])) {
71
	$id = $_GET['dup'];
72
	$after = $_GET['dup'];
73
}
74

    
75
if (isset($id) && $a_filter[$id]) {
76
	$pconfig['interface'] = $a_filter[$id]['interface'];
77

    
78
	if (isset($a_filter[$id]['id']))
79
		$pconfig['ruleid'] = $a_filter[$id]['id'];
80

    
81
	if ( isset($a_filter[$id]['created']) && is_array($a_filter[$id]['created']) )
82
		$pconfig['created'] = $a_filter[$id]['created'];
83

    
84
	if ( isset($a_filter[$id]['updated']) && is_array($a_filter[$id]['updated']) )
85
		$pconfig['updated'] = $a_filter[$id]['updated'];
86

    
87
	if (!isset($a_filter[$id]['type']))
88
		$pconfig['type'] = "pass";
89
	else
90
		$pconfig['type'] = $a_filter[$id]['type'];
91

    
92
	if (isset($a_filter[$id]['floating']) || $if == "FloatingRules") {
93
		$pconfig['floating'] = $a_filter[$id]['floating'];
94
		if (isset($a_filter[$id]['interface']) && $a_filter[$id]['interface'] <> "") 
95
			$pconfig['interface'] = $a_filter[$id]['interface'];
96
	}
97
	
98
	if (isset($a_filter['floating'])) 
99
		$pconfig['floating'] = "yes";
100

    
101
	if (isset($a_filter[$id]['direction']))
102
                $pconfig['direction'] = $a_filter[$id]['direction'];
103

    
104
	if (isset($a_filter[$id]['ipprotocol']))
105
                $pconfig['ipprotocol'] = $a_filter[$id]['ipprotocol'];
106

    
107
	if (isset($a_filter[$id]['protocol']))
108
		$pconfig['proto'] = $a_filter[$id]['protocol'];
109
	else
110
		$pconfig['proto'] = "any";
111

    
112
	if ($a_filter[$id]['protocol'] == "icmp")
113
		$pconfig['icmptype'] = $a_filter[$id]['icmptype'];
114

    
115
	address_to_pconfig($a_filter[$id]['source'], $pconfig['src'],
116
		$pconfig['srcmask'], $pconfig['srcnot'],
117
		$pconfig['srcbeginport'], $pconfig['srcendport']);
118

    
119
	if($a_filter[$id]['os'] <> "")
120
		$pconfig['os'] = $a_filter[$id]['os'];
121

    
122
	address_to_pconfig($a_filter[$id]['destination'], $pconfig['dst'],
123
		$pconfig['dstmask'], $pconfig['dstnot'],
124
		$pconfig['dstbeginport'], $pconfig['dstendport']);
125

    
126
	if ($a_filter[$id]['dscp'] <> "")
127
		$pconfig['dscp'] = $a_filter[$id]['dscp'];
128

    
129
	$pconfig['disabled'] = isset($a_filter[$id]['disabled']);
130
	$pconfig['log'] = isset($a_filter[$id]['log']);
131
	$pconfig['descr'] = $a_filter[$id]['descr'];
132

    
133
	if (isset($a_filter[$id]['tcpflags_any']))
134
		$pconfig['tcpflags_any'] = true;
135
	else {
136
		if (isset($a_filter[$id]['tcpflags1']) && $a_filter[$id]['tcpflags1'] <> "") 
137
			$pconfig['tcpflags1'] = $a_filter[$id]['tcpflags1'];
138
		if (isset($a_filter[$id]['tcpflags2']) && $a_filter[$id]['tcpflags2'] <> "") 
139
			$pconfig['tcpflags2'] = $a_filter[$id]['tcpflags2'];
140
	}
141

    
142
	if (isset($a_filter[$id]['tag']) && $a_filter[$id]['tag'] <> "") 
143
		$pconfig['tag'] = $a_filter[$id]['tag'];
144
	if (isset($a_filter[$id]['tagged']) && $a_filter[$id]['tagged'] <> "")
145
        	$pconfig['tagged'] = $a_filter[$id]['tagged'];
146
	if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick'])
147
		$pconfig['quick'] = $a_filter[$id]['quick'];
148
	if (isset($a_filter[$id]['allowopts']))
149
		$pconfig['allowopts'] = true;
150
	if (isset($a_filter[$id]['disablereplyto']))
151
		$pconfig['disablereplyto'] = true;
152

    
153
	/* advanced */
154
	$pconfig['max'] = $a_filter[$id]['max'];
155
	$pconfig['max-src-nodes'] = $a_filter[$id]['max-src-nodes'];
156
	$pconfig['max-src-conn'] = $a_filter[$id]['max-src-conn'];
157
	$pconfig['max-src-states'] = $a_filter[$id]['max-src-states'];
158
	$pconfig['statetype'] = $a_filter[$id]['statetype'];
159
	$pconfig['statetimeout'] = $a_filter[$id]['statetimeout'];
160

    
161
	/* advanced - nosync */
162
	$pconfig['nosync'] = isset($a_filter[$id]['nosync']);
163

    
164
	/* advanced - new connection per second banning*/
165
	$pconfig['max-src-conn-rate'] = $a_filter[$id]['max-src-conn-rate'];
166
	$pconfig['max-src-conn-rates'] = $a_filter[$id]['max-src-conn-rates'];
167

    
168
	/* Multi-WAN next-hop support */
169
	$pconfig['gateway'] = $a_filter[$id]['gateway'];
170
	
171
	/* Shaper support */
172
	$pconfig['defaultqueue'] = (($a_filter[$id]['ackqueue'] == "none") ? '' : $a_filter[$id]['defaultqueue']);
173
	$pconfig['ackqueue'] = (($a_filter[$id]['ackqueue'] == "none") ? '' : $a_filter[$id]['ackqueue']);
174
	$pconfig['dnpipe'] = (($a_filter[$id]['dnpipe'] == "none") ? '' : $a_filter[$id]['dnpipe']);
175
	$pconfig['pdnpipe'] = (($a_filter[$id]['pdnpipe'] == "none") ? '' : $a_filter[$id]['pdnpipe']);
176
	$pconfig['l7container'] = (($a_filter[$id]['l7container'] == "none") ? '' : $a_filter[$id]['l7container']);
177

    
178
	//schedule support
179
	$pconfig['sched'] = (($a_filter[$id]['sched'] == "none") ? '' : $a_filter[$id]['sched']);
180
	$pconfig['vlanprio'] = (($a_filter[$id]['vlanprio'] == "none") ? '' : $a_filter[$id]['vlanprio']);
181
	$pconfig['vlanprioset'] = (($a_filter[$id]['vlanprioset'] == "none") ? '' : $a_filter[$id]['vlanprioset']);
182
	if (!isset($_GET['dup']))
183
		$pconfig['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
184

    
185
} else {
186
	/* defaults */
187
	if ($_GET['if'])
188
		$pconfig['interface'] = $_GET['if'];
189
	$pconfig['type'] = "pass";
190
	$pconfig['src'] = "any";
191
	$pconfig['dst'] = "any";
192
}
193
/* Allow the FloatingRules to work */
194
$if = $pconfig['interface'];
195

    
196
if (isset($_GET['dup']))
197
	unset($id);
198

    
199
read_altq_config(); /* XXX: */
200
$qlist =& get_unique_queue_list();
201
read_dummynet_config(); /* XXX: */
202
$dnqlist =& get_unique_dnqueue_list();
203
read_layer7_config();
204
$l7clist =& get_l7_unique_list();
205

    
206
if ($_POST) {
207
	unset($input_errors);
208

    
209
	if( isset($a_filter[$id]['associated-rule-id']) ) {
210
		$_POST['proto'] = $pconfig['proto'];
211
		if ($pconfig['proto'] == "icmp")
212
			$_POST['icmptype'] = $pconfig['icmptype'];
213
	}
214

    
215
	if (($_POST['ipprotocol'] <> "") && ($_POST['gateway'] <> "")) {
216
		$a_gatewaygroups = return_gateway_groups_array();
217
		if(is_array($config['gateways']['gateway_group'])) {
218
			foreach($config['gateways']['gateway_group'] as $gw_group) {
219
				if($gw_group['name'] == $_POST['gateway']) {
220
					$family = $a_gatewaygroups[$_POST['gateway']]['ipprotocol'];
221
					if($_POST['ipprotocol'] == $family) {
222
						continue;
223
					}
224
					if(($_POST['ipprotocol'] == "inet46") && ($_POST['ipprotocol'] != $family)) {
225
						$input_errors[] = gettext("You can not assign a gateway to a rule that applies to IPv4 and IPv6");
226
					}
227
					if(($_POST['ipprotocol'] == "inet6") && ($_POST['ipprotocol'] != $family)) {
228
						$input_errors[] = gettext("You can not assign a IPv4 gateway group on IPv6 Address Family rule");
229
					}
230
					if(($_POST['ipprotocol'] == "inet") && ($_POST['ipprotocol'] != $family)) {
231
						$input_errors[] = gettext("You can not assign a IPv6 gateway group on IPv4 Address Family rule");
232
					}
233
				}
234
			}
235
		}
236
	}
237
	if (($_POST['ipprotocol'] <> "") && ($_POST['gateway'] <> "") && (is_ipaddr(lookup_gateway_ip_by_name($_POST['gateway'])))) {
238
		if(($_POST['ipprotocol'] == "inet46") && ($_POST['gateway'] <> "")) {
239
			$input_errors[] = gettext("You can not assign a gateway to a rule that applies to IPv4 and IPv6");
240
		}
241
		if(($_POST['ipprotocol'] == "inet6") && (!is_ipaddrv6(lookup_gateway_ip_by_name($_POST['gateway'])))) {
242
			$input_errors[] = gettext("You can not assign the IPv4 Gateway to a IPv6 Filter rule");
243
		}
244
		if(($_POST['ipprotocol'] == "inet") && (!is_ipaddrv4(lookup_gateway_ip_by_name($_POST['gateway'])))) {
245
			$input_errors[] = gettext("You can not assign the IPv6 Gateway to a IPv4 Filter rule");
246
		}
247
	}
248

    
249
	if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp") && ($_POST['proto'] != "icmp")) {
250
		if($_POST['ipprotocol'] == "inet46")
251
			$input_errors[] =  gettext("You can not assign a protocol other then ICMP, TCP, UDP or TCP/UDP to a rule that applies to IPv4 and IPv6");
252
	}
253
	if (($_POST['proto'] == "icmp") && ($_POST['icmptype'] <> "")){
254
		if($_POST['ipprotocol'] == "inet46")
255
			$input_errors[] =  gettext("You can not assign a ICMP type to a rule that applies to IPv4 and IPv6");
256
	}
257

    
258
	if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp")) {
259
		$_POST['srcbeginport'] = 0;
260
		$_POST['srcendport'] = 0;
261
		$_POST['dstbeginport'] = 0;
262
		$_POST['dstendport'] = 0;
263
	} else {
264
		if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport'])
265
			$_POST['srcbeginport'] = trim($_POST['srcbeginport_cust']);
266
		if ($_POST['srcendport_cust'] && !$_POST['srcendport'])
267
			$_POST['srcendport'] = trim($_POST['srcendport_cust']);
268
		if ($_POST['srcbeginport'] == "any") {
269
			$_POST['srcbeginport'] = 0;
270
			$_POST['srcendport'] = 0;
271
		} else {
272
			if (!$_POST['srcendport'])
273
				$_POST['srcendport'] = $_POST['srcbeginport'];
274
		}
275
		if ($_POST['srcendport'] == "any")
276
			$_POST['srcendport'] = $_POST['srcbeginport'];
277

    
278
		if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport'])
279
			$_POST['dstbeginport'] = trim($_POST['dstbeginport_cust']);
280
		if ($_POST['dstendport_cust'] && !$_POST['dstendport'])
281
			$_POST['dstendport'] = trim($_POST['dstendport_cust']);
282

    
283
		if ($_POST['dstbeginport'] == "any") {
284
			$_POST['dstbeginport'] = 0;
285
			$_POST['dstendport'] = 0;
286
		} else {
287
			if (!$_POST['dstendport'])
288
				$_POST['dstendport'] = $_POST['dstbeginport'];
289
		}
290
		if ($_POST['dstendport'] == "any")
291
			$_POST['dstendport'] = $_POST['dstbeginport'];
292
	}
293

    
294
	if (is_specialnet($_POST['srctype'])) {
295
		$_POST['src'] = $_POST['srctype'];
296
		$_POST['srcmask'] = 0;
297
	} else if ($_POST['srctype'] == "single") {
298
		if (is_ipaddrv6($_POST['src']))
299
			$_POST['srcmask'] = 128;
300
		else
301
			$_POST['srcmask'] = 32;
302
	}
303
	if (is_specialnet($_POST['dsttype'])) {
304
		$_POST['dst'] = $_POST['dsttype'];
305
		$_POST['dstmask'] = 0;
306
	}  else if ($_POST['dsttype'] == "single") {
307
		if (is_ipaddrv6($_POST['dst']))
308
			$_POST['dstmask'] = 128;
309
		else
310
			$_POST['dstmask'] = 32;
311
	}
312

    
313
	$pconfig = $_POST;
314

    
315
	/* input validation */
316
	$reqdfields = explode(" ", "type proto");
317
	if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
318
		$reqdfields[] = "src";
319
		$reqdfields[] = "dst";
320
	}
321
	$reqdfieldsn = explode(",", "Type,Protocol");
322
	if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
323
		$reqdfieldsn[] = "Source";
324
		$reqdfieldsn[] = "Destination";
325
	}
326

    
327
	if($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") {
328
		if( $_POST['proto'] != "tcp" )
329
			$input_errors[] = sprintf(gettext("%s is only valid with protocol tcp."),$_POST['statetype']);
330
		if(($_POST['statetype'] == "synproxy state") && ($_POST['gateway'] != ""))
331
			$input_errors[] = sprintf(gettext("%s is only valid if the gateway is set to 'default'."),$_POST['statetype']);
332
	}
333
        
334
	if ( isset($a_filter[$id]['associated-rule-id'])===false &&
335
	(!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) ) {
336
		$reqdfields[] = "srcmask";
337
		$reqdfieldsn[] = "Source bit count";
338
	}
339
	if ( isset($a_filter[$id]['associated-rule-id'])===false &&
340
	(!(is_specialnet($_POST['dsttype']) || ($_POST['dsttype'] == "single"))) ) {
341
		$reqdfields[] = "dstmask";
342
		$reqdfieldsn[] = gettext("Destination bit count");
343
	}
344

    
345
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
346

    
347
	if (!$_POST['srcbeginport']) {
348
		$_POST['srcbeginport'] = 0;
349
		$_POST['srcendport'] = 0;
350
	}
351
	if (!$_POST['dstbeginport']) {
352
		$_POST['dstbeginport'] = 0;
353
		$_POST['dstendport'] = 0;
354
	}
355

    
356
	if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport']))
357
                $input_errors[] = sprintf(gettext("%s is not a valid start source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcbeginposrt']);
358
	if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport']))
359
			$input_errors[] = sprintf(gettext("%s  is not a valid end source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcendport']);
360
	if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport']))
361
			$input_errors[] = sprintf(gettext("%s is not a valid start destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstbeginport']);
362
	if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport']))
363
			$input_errors[] = sprintf(gettext("%s is not a valid end destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstendport']);
364
	if ( !$_POST['srcbeginport_cust'] && $_POST['srcendport_cust'])
365
		if (is_alias($_POST['srcendport_cust']))
366
			$input_errors[] = 'If you put port alias in Source port range to: field you must put the same port alias in from: field';
367
	if ( $_POST['srcbeginport_cust'] && $_POST['srcendport_cust']){
368
		if (is_alias($_POST['srcendport_cust']) && is_alias($_POST['srcendport_cust']) && $_POST['srcbeginport_cust'] != $_POST['srcendport_cust'])
369
			$input_errors[] = 'The same port alias must be used in Source port range from: and to: fields';
370
		if ((is_alias($_POST['srcbeginport_cust']) && (!is_alias($_POST['srcendport_cust']) && $_POST['srcendport_cust']!='')) || 
371
		    ((!is_alias($_POST['srcbeginport_cust']) && $_POST['srcbeginport_cust']!='') && is_alias($_POST['srcendport_cust']))) 
372
			$input_errors[] = 'You cannot specify numbers and port aliases at the same time in Source port range from: and to: field';
373
	}
374
	if ( !$_POST['dstbeginport_cust'] && $_POST['dstendport_cust'])
375
		if (is_alias($_POST['dstendport_cust']))
376
			$input_errors[] = 'If you put port alias in Destination port range to: field you must put the same port alias in from: field';
377
	if ( $_POST['dstbeginport_cust'] && $_POST['dstendport_cust']){
378
		if (is_alias($_POST['dstendport_cust']) && is_alias($_POST['dstendport_cust']) && $_POST['dstbeginport_cust'] != $_POST['dstendport_cust'])
379
			$input_errors[] = 'The same port alias must be used in Destination port range from: and to: fields';
380
		if ((is_alias($_POST['dstbeginport_cust']) && (!is_alias($_POST['dstendport_cust']) && $_POST['dstendport_cust']!='')) || 
381
		    ((!is_alias($_POST['dstbeginport_cust']) && $_POST['dstbeginport_cust']!='') && is_alias($_POST['dstendport_cust']))) 
382
			$input_errors[] = 'You cannot specify numbers and port aliases at the same time in Destination port range from: and to: field';
383
	}
384

    
385
	if ($_POST['src'])
386
		$_POST['src'] = trim($_POST['src']);
387
	if ($_POST['dst'])
388
		$_POST['dst'] = trim($_POST['dst']);
389

    
390
	/* if user enters an alias and selects "network" then disallow. */
391
	if($_POST['srctype'] == "network") {
392
		if(is_alias($_POST['src']))
393
			$input_errors[] = gettext("You must specify single host or alias for alias entries.");
394
	}
395
	if($_POST['dsttype'] == "network") {
396
		if(is_alias($_POST['dst']))
397
			$input_errors[] = gettext("You must specify single host or alias for alias entries.");
398
	}
399

    
400
	if (!is_specialnet($_POST['srctype'])) {
401
		if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) {
402
			$input_errors[] = sprintf(gettext("%s is not a valid source IP address or alias."),$_POST['src']);
403
		}
404
		if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
405
			$input_errors[] = gettext("A valid source bit count must be specified.");
406
		}
407
	}
408
	if (!is_specialnet($_POST['dsttype'])) {
409
		if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) {
410
			$input_errors[] = sprintf(gettext("%s is not a valid destination IP address or alias."),$_POST['dst']);
411
		}
412
		if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
413
			$input_errors[] = gettext("A valid destination bit count must be specified.");
414
		}
415
	}
416
	if((is_ipaddr($_POST['src']) && is_ipaddr($_POST['dst']))) {
417
		if(!validate_address_family($_POST['src'], $_POST['dst']))
418
			$input_errors[] = sprintf(gettext("The Source IP address %s Address Family differs from the destination %s."), $_POST['src'], $_POST['dst']);
419
		if((is_ipaddrv6($_POST['src']) || is_ipaddrv6($_POST['dst'])) && ($_POST['ipprotocol'] == "inet"))
420
			$input_errors[] = gettext("You can not use IPv6 addresses in IPv4 rules.");
421
		if((is_ipaddrv4($_POST['src']) || is_ipaddrv4($_POST['dst'])) && ($_POST['ipprotocol'] == "inet6"))
422
			$input_errors[] = gettext("You can not use IPv4 addresses in IPv6 rules.");
423
		if((is_ipaddr($_POST['src']) || is_ipaddr($_POST['dst'])) && ($_POST['ipprotocol'] == "inet46"))
424
			$input_errors[] = gettext("You can not use a IPv4 or IPv6 address in combined IPv4 + IPv6 rules.");
425

    
426
	}
427

    
428
	if ($_POST['srcbeginport'] > $_POST['srcendport']) {
429
		/* swap */
430
		$tmp = $_POST['srcendport'];
431
		$_POST['srcendport'] = $_POST['srcbeginport'];
432
		$_POST['srcbeginport'] = $tmp;
433
	}
434
	if ($_POST['dstbeginport'] > $_POST['dstendport']) {
435
		/* swap */
436
		$tmp = $_POST['dstendport'];
437
		$_POST['dstendport'] = $_POST['dstbeginport'];
438
		$_POST['dstbeginport'] = $tmp;
439
	}
440
	if ($_POST['os'])
441
		if( $_POST['proto'] != "tcp" )
442
			$input_errors[] = gettext("OS detection is only valid with protocol tcp.");
443

    
444
	if ($_POST['ackqueue'] != "") {
445
		if ($_POST['defaultqueue'] == "" )
446
			$input_errors[] = gettext("You have to select a queue when you select an acknowledge queue too.");
447
		else if ($_POST['ackqueue'] == $_POST['defaultqueue'])
448
			$input_errors[] = gettext("Acknowledge queue and Queue cannot be the same.");		
449
	}
450
	if (isset($_POST['floating']) && $_POST['pdnpipe'] != "" && (empty($_POST['direction']) || $_POST['direction'] == "any"))
451
		$input_errors[] = gettext("You can not use limiters in Floating rules without choosing a direction.");
452
	if (isset($_POST['floating']) && $_POST['gateway'] != "" && (empty($_POST['direction']) || $_POST['direction'] == "any"))
453
		$input_errors[] = gettext("You can not use gateways in Floating rules without choosing a direction.");
454
	if ($_POST['pdnpipe'] && $_POST['pdnpipe'] != "") {
455
		if ($_POST['dnpipe'] == "" )
456
			$input_errors[] = gettext("You must select a queue for the In direction before selecting one for Out too.");
457
		else if ($_POST['pdnpipe'] == $_POST['dnpipe'])
458
			$input_errors[] = gettext("In and Out Queue cannot be the same.");
459
		else if ($dnqlist[$_POST['pdnpipe']][0] == "?" && $dnqlist[$_POST['dnpipe']][0] <> "?")
460
			$input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.");
461
		else if ($dnqlist[$_POST['dnpipe']][0] == "?" && $dnqlist[$_POST['pdnpipe']][0] <> "?")                       
462
			$input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.");
463
		if ($_POST['direction'] == "out" && empty($_POST['gateway']))
464
			$input_errors[] = gettext("Please select a gateway, normaly the interface selected gateway, so the limiters work correctly");
465
	}
466
	if( !empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid']))
467
		$input_errors[] = gettext('ID must be an integer');
468
	if($_POST['l7container'] && $_POST['l7container'] != "") {
469
		if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp"))
470
			$input_errors[] = gettext("You can only select a layer7 container for TCP and/or UDP protocols");
471
		if ($_POST['type'] <> "pass")
472
			$input_errors[] = gettext("You can only select a layer7 container for Pass type rules.");
473
	}
474

    
475
	if (!$_POST['tcpflags_any']) {
476
		$settcpflags = array();
477
		$outoftcpflags = array();
478
		foreach ($tcpflags as $tcpflag) {
479
			if ($_POST['tcpflags1_' . $tcpflag] == "on")
480
				$settcpflags[] = $tcpflag;
481
			if ($_POST['tcpflags2_' . $tcpflag] == "on")
482
				$outoftcpflags[] = $tcpflag;
483
		}
484
		if (empty($outoftcpflags) && !empty($settcpflags))
485
			$input_errors[] = gettext("If you specify TCP flags that should be set you should specify out of which flags as well.");
486
	}
487

    
488
	// Allow extending of the firewall edit page and include custom input validation 
489
	pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/input_validation");
490

    
491
	if (!$input_errors) {
492
		$filterent = array();
493
		$filterent['id'] = $_POST['ruleid']>0?$_POST['ruleid']:'';
494
		$filterent['type'] = $_POST['type'];
495
		if (isset($_POST['interface'] ))
496
			$filterent['interface'] = $_POST['interface'];
497

    
498
		if (isset($_POST['ipprotocol'] ))
499
			$filterent['ipprotocol'] = $_POST['ipprotocol'];
500

    
501
		if ($_POST['tcpflags_any']) {
502
			$filterent['tcpflags_any'] = true;
503
		} else {
504
			$settcpflags = array();
505
			$outoftcpflags = array();
506
			foreach ($tcpflags as $tcpflag) {
507
				if ($_POST['tcpflags1_' . $tcpflag] == "on")
508
					$settcpflags[] = $tcpflag;
509
				if ($_POST['tcpflags2_' . $tcpflag] == "on")
510
					$outoftcpflags[] = $tcpflag;
511
			}
512
			if (!empty($outoftcpflags)) {
513
				$filterent['tcpflags2'] = join(",", $outoftcpflags);
514
				if (!empty($settcpflags))
515
					$filterent['tcpflags1'] = join(",", $settcpflags);
516
			}
517
		}
518

    
519
		if (isset($_POST['tag']))
520
			$filterent['tag'] = $_POST['tag'];
521
		if (isset($_POST['tagged']))
522
			$filterent['tagged'] = $_POST['tagged'];
523
		if ($if == "FloatingRules" || isset($_POST['floating'])) {
524
			$filterent['direction'] = $_POST['direction'];
525
			if (isset($_POST['quick']) && $_POST['quick'] <> "")
526
				$filterent['quick'] = $_POST['quick'];
527
			$filterent['floating'] = "yes";
528
			if (isset($_POST['interface']) && count($_POST['interface']) > 0)  {
529
				$filterent['interface'] = implode(",", $_POST['interface']);
530
			}
531
		}
532

    
533
		/* Advanced options */
534
		if ($_POST['allowopts'] == "yes")
535
			$filterent['allowopts'] = true;
536
		else
537
			unset($filterent['allowopts']);
538
		if ($_POST['disablereplyto'] == "yes")
539
			$filterent['disablereplyto'] = true;
540
		else
541
			unset($filterent['disablereplyto']);
542
		$filterent['max'] = $_POST['max'];
543
		$filterent['max-src-nodes'] = $_POST['max-src-nodes'];
544
		$filterent['max-src-conn'] = $_POST['max-src-conn'];
545
		$filterent['max-src-states'] = $_POST['max-src-states'];
546
		$filterent['statetimeout'] = $_POST['statetimeout'];
547
		$filterent['statetype'] = $_POST['statetype'];
548
		$filterent['os'] = $_POST['os'];
549

    
550
		/* Nosync directive - do not xmlrpc sync this item */
551
		if($_POST['nosync'] <> "")
552
			$filterent['nosync'] = true;
553
		else
554
			unset($filterent['nosync']);
555

    
556
		/* unless both values are provided, unset the values - ticket #650 */
557
		if($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] <> "") {
558
			$filterent['max-src-conn-rate'] = $_POST['max-src-conn-rate'];
559
			$filterent['max-src-conn-rates'] = $_POST['max-src-conn-rates'];
560
		} else {
561
			unset($filterent['max-src-conn-rate']);
562
			unset($filterent['max-src-conn-rates']);
563
		}
564

    
565
		if ($_POST['proto'] != "any")
566
			$filterent['protocol'] = $_POST['proto'];
567
		else
568
			unset($filterent['protocol']);
569

    
570
		if ($_POST['proto'] == "icmp" && $_POST['icmptype'])
571
			$filterent['icmptype'] = $_POST['icmptype'];
572
		else
573
			unset($filterent['icmptype']);
574

    
575
		pconfig_to_address($filterent['source'], $_POST['src'],
576
			$_POST['srcmask'], $_POST['srcnot'],
577
			$_POST['srcbeginport'], $_POST['srcendport']);
578

    
579
		pconfig_to_address($filterent['destination'], $_POST['dst'],
580
			$_POST['dstmask'], $_POST['dstnot'],
581
			$_POST['dstbeginport'], $_POST['dstendport']);
582

    
583
		if ($_POST['disabled'])
584
			$filterent['disabled'] = true;
585
		else
586
			unset($filterent['disabled']);
587

    
588
		if ($_POST['dscp'])
589
			$filterent['dscp'] = $_POST['dscp'];
590

    
591
		if ($_POST['log'])
592
			$filterent['log'] = true;
593
		else
594
			unset($filterent['log']);
595
		strncpy($filterent['descr'], $_POST['descr'], 52);
596

    
597
		if ($_POST['gateway'] != "") {
598
			$filterent['gateway'] = $_POST['gateway'];
599
		}
600
		
601
		if ($_POST['defaultqueue'] != "") {
602
			$filterent['defaultqueue'] = $_POST['defaultqueue'];
603
			if ($_POST['ackqueue'] != "")
604
				$filterent['ackqueue'] = $_POST['ackqueue'];
605
		}
606

    
607
		if ($_POST['dnpipe'] != "") {
608
			$filterent['dnpipe'] = $_POST['dnpipe'];
609
			if ($_POST['pdnpipe'] != "")
610
				$filterent['pdnpipe'] = $_POST['pdnpipe'];
611
		}
612

    
613
		if ($_POST['l7container'] != "") {
614
			$filterent['l7container'] = $_POST['l7container'];
615
		}
616
		
617
		if ($_POST['sched'] != "") {
618
			$filterent['sched'] = $_POST['sched'];
619
		}
620

    
621
		if ($_POST['vlanprio'] != "") {
622
			$filterent['vlanprio'] = $_POST['vlanprio'];
623
		}
624
		if ($_POST['vlanprioset'] != "") {
625
			$filterent['vlanprioset'] = $_POST['vlanprioset'];
626
		}
627

    
628
		// If we have an associated nat rule, make sure the source and destination doesn't change
629
		if( isset($a_filter[$id]['associated-rule-id']) ) {
630
			$filterent['interface'] = $a_filter[$id]['interface'];
631
			if (isset($a_filter[$id]['protocol']))
632
				$filterent['protocol'] = $a_filter[$id]['protocol'];
633
			else if (isset($filterent['protocol']))
634
				unset($filterent['protocol']);
635
			if ($a_filter[$id]['protocol'] == "icmp" && $a_filter[$id]['icmptype'])
636
				$filterent['icmptype'] = $a_filter[$id]['icmptype'];
637
			else if (isset($filterent['icmptype']))
638
				unset($filterent['icmptype']);
639

    
640
			$filterent['source'] = $a_filter[$id]['source'];
641
			$filterent['destination'] = $a_filter[$id]['destination'];
642
			$filterent['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
643
		}
644

    
645
		if ( isset($a_filter[$id]['created']) && is_array($a_filter[$id]['created']) )
646
			$filterent['created'] = $a_filter[$id]['created'];
647

    
648
		$filterent['updated'] = make_config_revision_entry();
649

    
650
		// Allow extending of the firewall edit page and include custom input validation 
651
		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_write_config");
652

    
653
		if (isset($id) && $a_filter[$id])
654
			$a_filter[$id] = $filterent;
655
		else {
656
			$filterent['created'] = make_config_revision_entry();
657
			if (is_numeric($after))
658
				array_splice($a_filter, $after+1, 0, array($filterent));
659
			else
660
				$a_filter[] = $filterent;
661
		}
662

    
663
		filter_rules_sort();
664

    
665
		if (write_config())
666
			mark_subsystem_dirty('filter');
667

    
668
		if (isset($_POST['floating']))
669
			header("Location: firewall_rules.php?if=FloatingRules");
670
		else
671
			header("Location: firewall_rules.php?if=" . htmlspecialchars($_POST['interface']));
672
		exit;
673
	}
674
}
675

    
676
$pgtitle = array(gettext("Firewall"),gettext("Rules"),gettext("Edit"));
677
$shortcut_section = "firewall";
678

    
679
$closehead = false;
680

    
681
$page_filename = "firewall_rules_edit.php";
682
include("head.inc");
683

    
684
?>
685
<link rel="stylesheet" href="/javascript/chosen/chosen.css" />
686
</head>
687

    
688
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
689
<script type="text/javascript" src="/javascript/jquery.ipv4v6ify.js"></script>
690
<script src="/javascript/chosen/chosen.jquery.js" type="text/javascript"></script>
691
<?php include("fbegin.inc"); ?>
692
<?php pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_input_errors"); ?>
693
<?php if ($input_errors) print_input_errors($input_errors); ?>
694

    
695
<form action="firewall_rules_edit.php" method="post" name="iform" id="iform">
696
<input type='hidden' name="ruleid" value="<?=(isset($pconfig['ruleid'])&&$pconfig['ruleid']>0)?htmlspecialchars($pconfig['ruleid']):''?>" />
697

    
698
	<table width="100%" border="0" cellpadding="6" cellspacing="0" summary="firewall rules edit">
699
		<tr>
700
			<td colspan="2" valign="top" class="listtopic"><?=gettext("Edit Firewall rule");?></td>
701
		</tr>	
702
<?php
703
		// Allow extending of the firewall edit page and include custom input validation 
704
		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/htmlphpearly");
705
?>
706
    	<tr>
707
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Action");?></td>
708
			<td width="78%" class="vtable">
709
				<select name="type" class="formselect">
710
					<?php $types = explode(" ", "Pass Block Reject"); foreach ($types as $type): ?>
711
					<option value="<?=strtolower($type);?>" <?php if (strtolower($type) == strtolower($pconfig['type'])) echo "selected=\"selected\""; ?>>
712
					<?=htmlspecialchars($type);?>
713
					</option>
714
					<?php endforeach; ?>
715
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
716
					<option value="match" <?php if ("match" == strtolower($pconfig['type'])) echo "selected=\"selected\""; ?>>Match</option>
717
<?php endif; ?>
718
				</select>
719
				<br/>
720
				<span class="vexpl">
721
					<?=gettext("Choose what to do with packets that match the criteria specified below.");?> <br/>
722
					<?=gettext("Hint: the difference between block and reject is that with reject, a packet (TCP RST or ICMP port unreachable for UDP) is returned to the sender, whereas with block the packet is dropped silently. In either case, the original packet is discarded.");?> 
723
				</span>
724
			</td>
725
		</tr>
726
		<tr>
727
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Disabled");?></td>
728
			<td width="78%" class="vtable">
729
				<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked=\"checked\""; ?> />
730
				<strong><?=gettext("Disable this rule");?></strong><br />
731
				<span class="vexpl"><?=gettext("Set this option to disable this rule without removing it from the list.");?></span>
732
			</td>
733
		</tr>
734
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
735
		<tr>
736
			<td width="22%" valign="top" class="vncellreq">
737
				<?=gettext("Quick");?>
738
			</td>
739
			<td width="78%" class="vtable">
740
				<input name="quick" type="checkbox" id="quick" value="yes" <?php if ($pconfig['quick']) echo "checked=\"checked\""; ?> />
741
				<strong><?=gettext("Apply the action immediately on match.");?></strong><br />
742
				<span class="vexpl"><?=gettext("Set this option if you need to apply this action to traffic that matches this rule immediately.");?></span>
743
			</td>
744
		</tr>
745
<?php endif; ?>
746
<?php $edit_disabled = ""; ?>
747
<?php if( isset($pconfig['associated-rule-id']) ): ?>
748
		<tr>
749
			<td width="22%" valign="top" class="vncell"><?=gettext("Associated filter rule");?></td>
750
			<td width="78%" class="vtable">
751
				<span class="red"><strong><?=gettext("Note: ");?></strong></span><?=gettext("This is associated to a NAT rule.");?><br />
752
				<?=gettext("You cannot edit the interface, protocol, source, or destination of associated filter rules.");?><br />
753
				<br />
754
				<?php
755
					$edit_disabled = "disabled";
756
					if (is_array($config['nat']['rule'])) {
757
						foreach( $config['nat']['rule'] as $index => $nat_rule ) {
758
							if( isset($nat_rule['associated-rule-id']) && $nat_rule['associated-rule-id']==$pconfig['associated-rule-id'] ) {
759
								echo "<a href=\"firewall_nat_edit.php?id={$index}\">" . gettext("View the NAT rule") . "</a><br/>";
760
								break;
761
							}
762
						}
763
					}
764
					echo "<input name='associated-rule-id' id='associated-rule-id' type='hidden' value='{$pconfig['associated-rule-id']}' />";
765
					if (!empty($pconfig['interface']))
766
						echo "<input name='interface' id='interface' type='hidden' value='{$pconfig['interface']}' />";
767
				?>
768
				<script type="text/javascript">
769
				editenabled = 0;
770
				</script>
771
			</td>
772
		</tr>
773
<?php endif; ?>
774
		<tr>
775
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Interface");?></td>
776
			<td width="78%" class="vtable">
777
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
778
				<select name="interface[]" title="Select interfaces..." multiple="multiple" style="width:350px;" class="chzn-select" tabindex="2" <?=$edit_disabled;?>>
779
<?php else: ?>
780
				<select name="interface" class="formselect" <?=$edit_disabled;?>>
781
<?php
782
   endif;
783
				/* add group interfaces */
784
				if (is_array($config['ifgroups']['ifgroupentry']))
785
					foreach($config['ifgroups']['ifgroupentry'] as $ifgen)
786
						if (have_ruleint_access($ifgen['ifname']))
787
							$interfaces[$ifgen['ifname']] = $ifgen['ifname'];
788
				$ifdescs = get_configured_interface_with_descr();
789
				// Allow extending of the firewall edit page and include custom input validation 
790
				pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_interfaces_edit");
791
				foreach ($ifdescs as $ifent => $ifdesc)
792
					if(have_ruleint_access($ifent))
793
							$interfaces[$ifent] = $ifdesc;
794
					if ($config['l2tp']['mode'] == "server")
795
						if(have_ruleint_access("l2tp"))
796
							$interfaces['l2tp'] = "L2TP VPN";
797
					if ($config['pptpd']['mode'] == "server")
798
						if(have_ruleint_access("pptp")) 
799
							$interfaces['pptp'] = "PPTP VPN";
800
					
801
					if (is_pppoe_server_enabled() && have_ruleint_access("pppoe"))
802
						$interfaces['pppoe'] = "PPPoE VPN";
803
					/* add ipsec interfaces */
804
					if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable']))
805
						if(have_ruleint_access("enc0")) 
806
							$interfaces["enc0"] = "IPsec";
807
					/* add openvpn/tun interfaces */
808
					if  ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
809
						$interfaces["openvpn"] = "OpenVPN";
810
					if (is_array($pconfig['interface']))
811
						$pconfig['interface'] = implode(",", $pconfig['interface']);
812
					$selected_interfaces = explode(",", $pconfig['interface']);
813
					foreach ($interfaces as $iface => $ifacename): ?>
814
						<option value="<?=$iface;?>" <?php if ($pconfig['interface'] <> "" && ( strcasecmp($pconfig['interface'], $iface) == 0 || in_array($iface, $selected_interfaces) )) echo "selected=\"selected\""; ?>><?=$ifacename?></option>
815
<?php 				endforeach; ?>
816
				</select>
817
				<br />
818
				<span class="vexpl"><?=gettext("Choose on which interface packets must come in to match this rule.");?></span>
819
			</td>
820
		</tr>
821
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
822
		<tr>
823
			<td width="22%" valign="top" class="vncellreq">
824
				<?=gettext("Direction");?>
825
			</td>
826
			<td width="78%" class="vtable">
827
				<select name="direction" class="formselect">
828
					<?php      $directions = array('any','in','out');
829
				foreach ($directions as $direction): ?>
830
				<option value="<?=$direction;?>"
831
					<?php if ($direction == $pconfig['direction']): ?>
832
						selected="selected" 
833
					<?php endif; ?>
834
					><?=$direction;?></option>
835
				<?php endforeach; ?>      
836
				</select>
837
				<input type="hidden" id="floating" name="floating" value="floating" />
838
			</td>
839
		<tr>
840
<?php endif; ?>
841
		<tr>
842
			<td width="22%" valign="top" class="vncellreq"><?=gettext("TCP/IP Version");?></td>
843
			<td width="78%" class="vtable">
844
				<select name="ipprotocol" class="formselect">
845
					<?php      $ipproto = array('inet' => 'IPv4','inet6' => 'IPv6', 'inet46' => 'IPv4+IPv6' );
846
				foreach ($ipproto as $proto => $name): ?>
847
				<option value="<?=$proto;?>"
848
					<?php if ($proto == $pconfig['ipprotocol']): ?>
849
						selected="selected" 
850
					<?php endif; ?>
851
					><?=$name;?></option>
852
				<?php endforeach; ?>      
853
				</select>
854
				<strong><?=gettext("Select the Internet Protocol version this rule applies to");?></strong><br />
855
			</td>
856
		</tr>
857
		<tr>
858
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Protocol");?></td>
859
			<td width="78%" class="vtable">
860
				<select <?=$edit_disabled;?> name="proto" class="formselect" onchange="proto_change()">
861
<?php
862
				$protocols = explode(" ", "TCP UDP TCP/UDP ICMP ESP AH GRE IGMP OSPF any carp pfsync");
863
				foreach ($protocols as $proto): ?>
864
					<option value="<?=strtolower($proto);?>" <?php if (strtolower($proto) == $pconfig['proto']) echo "selected=\"selected\""; ?>><?=htmlspecialchars($proto);?></option>
865
<?php 			endforeach; ?>
866
				</select>
867
				<br />
868
				<span class="vexpl"><?=gettext("Choose which IP protocol this rule should match.");?> <br /> <?=gettext("Hint: in most cases, you should specify ");?><em>TCP</em> &nbsp;<?=gettext("here.");?></span>
869
			</td>
870
		</tr>
871
		<tr id="icmpbox">
872
			<td valign="top" class="vncell"><?=gettext("ICMP type");?></td>
873
			<td class="vtable">
874
				<select <?=$edit_disabled;?> name="icmptype" class="formselect">
875
<?php
876
				$icmptypes = array(
877
				"" => gettext("any"),
878
				"echoreq" => gettext("Echo request"),
879
				"echorep" => gettext("Echo reply"),
880
				"unreach" => gettext("Destination unreachable"),
881
				"squench" => gettext("Source quench"),
882
				"redir" => gettext("Redirect"),
883
				"althost" => gettext("Alternate Host"),
884
				"routeradv" => gettext("Router advertisement"),
885
				"routersol" => gettext("Router solicitation"),
886
				"timex" => gettext("Time exceeded"),
887
				"paramprob" => gettext("Invalid IP header"),
888
				"timereq" => gettext("Timestamp"),
889
				"timerep" => gettext("Timestamp reply"),
890
				"inforeq" => gettext("Information request"),
891
				"inforep" => gettext("Information reply"),
892
				"maskreq" => gettext("Address mask request"),
893
				"maskrep" => gettext("Address mask reply")
894
				);
895

    
896
				foreach ($icmptypes as $icmptype => $descr): ?>
897
					<option value="<?=$icmptype;?>" <?php if ($icmptype == $pconfig['icmptype']) echo "selected=\"selected\""; ?>><?=htmlspecialchars($descr);?></option>
898
<?php 			endforeach; ?>
899
			</select>
900
			<br />
901
			<span class="vexpl"><?=gettext("If you selected ICMP for the protocol above, you may specify an ICMP type here.");?></span>
902
		</td>
903
		</tr>
904
		<tr>
905
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Source");?></td>
906
			<td width="78%" class="vtable">
907
				<input <?=$edit_disabled;?> name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked=\"checked\""; ?> />
908
				<strong><?=gettext("not");?></strong>
909
				<br />
910
				<?=gettext("Use this option to invert the sense of the match.");?>
911
				<br />
912
				<br />
913
				<table border="0" cellspacing="0" cellpadding="0">
914
					<tr>
915
						<td><?=gettext("Type:");?>&nbsp;&nbsp;</td>
916
						<td>
917
							<select <?=$edit_disabled;?> name="srctype" class="formselect" onchange="typesel_change()">
918
<?php
919
								$sel = is_specialnet($pconfig['src']); ?>
920
								<option value="any"     <?php if ($pconfig['src'] == "any") { echo "selected=\"selected\""; } ?>><?=gettext("any");?></option>
921
								<option value="single"
922
						<?php  if (!$sel &&
923
							    ((is_ipaddrv6($pconfig['src']) && $pconfig['srcmask'] == 128) ||
924
							    (is_ipaddrv4($pconfig['src']) && $pconfig['srcmask'] == 32) || is_alias($pconfig['src'])))
925
								{ echo "selected=\"selected\""; $sel = 1; } 
926
						?>
927
								> <?=gettext("Single host or alias");?></option>
928
								<option value="network" <?php if (!$sel) echo "selected=\"selected\""; ?>><?=gettext("Network");?></option>
929
								<?php if(have_ruleint_access("pptp")): ?>
930
								<option value="pptp"    <?php if ($pconfig['src'] == "pptp") { echo "selected=\"selected\""; } ?>><?=gettext("PPTP clients");?></option>
931
								<?php endif; ?>
932
								<?php if(have_ruleint_access("pppoe")): ?>
933
								<option value="pppoe"   <?php if ($pconfig['src'] == "pppoe") { echo "selected=\"selected\""; } ?>><?=gettext("PPPoE clients");?></option>
934
								<?php endif; ?>								
935
								 <?php if(have_ruleint_access("l2tp")): ?>
936
                                                                <option value="l2tp"   <?php if ($pconfig['src'] == "l2tp") { echo "selected=\"selected\""; } ?>><?=gettext("L2TP clients");?></option>
937
                                                                <?php endif; ?>
938
<?php
939
								foreach ($ifdisp as $ifent => $ifdesc): ?>
940
								<?php if(have_ruleint_access($ifent)): ?>
941
									<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected=\"selected\""; } ?>><?=htmlspecialchars($ifdesc);?><?=gettext(" subnet");?></option>
942
									<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] ==  $ifent . "ip") { echo "selected=\"selected\""; } ?>>
943
										<?=$ifdesc?> <?=gettext("address");?>
944
									</option>
945
								<?php endif; ?>
946
<?php 							endforeach; ?>
947
							</select>
948
						</td>
949
					</tr>
950
					<tr>
951
						<td><?=gettext("Address:");?>&nbsp;&nbsp;</td>
952
						<td>
953
							<input <?=$edit_disabled;?> autocomplete='off' name="src" type="text" class="formfldalias ipv4v6" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>" /> /
954
							<select <?=$edit_disabled;?> name="srcmask" class="formselect ipv4v6" id="srcmask">
955
<?php						for ($i = 127; $i > 0; $i--): ?>
956
								<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected=\"selected\""; ?>><?=$i;?></option>
957
<?php 						endfor; ?>
958
							</select>
959
						</td>
960
					</tr>
961
				</table>
962
				<div id="showadvancedboxspr">
963
					<p>
964
					<input <?=$edit_disabled;?> type="button" onclick="show_source_port_range()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show source port range");?>
965
					</p>
966
				</div>
967
			</td>
968
		</tr>
969
		<tr style="display:none" id="sprtable">
970
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Source port range");?></td>
971
			<td width="78%" class="vtable">
972
				<table border="0" cellspacing="0" cellpadding="0">
973
					<tr>
974
						<td><?=gettext("from:");?>&nbsp;&nbsp;</td>
975
						<td>
976
							<select <?=$edit_disabled;?> name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()">
977
								<option value="">(<?=gettext("other"); ?>)</option>
978
								<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected=\"selected\""; $bfound = 1; } ?>><?=gettext("any");?></option>
979
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
980
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected=\"selected\""; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
981
<?php 							endforeach; ?>
982
							</select>
983
							<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo htmlspecialchars($pconfig['srcbeginport']); ?>" />
984
						</td>
985
					</tr>
986
					<tr>
987
						<td><?=gettext("to:");?></td>
988
						<td>
989
							<select <?=$edit_disabled;?> name="srcendport" class="formselect" onchange="ext_change()">
990
								<option value="">(<?=gettext("other"); ?>)</option>
991
								<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected=\"selected\""; $bfound = 1; } ?>><?=gettext("any");?></option>
992
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
993
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected=\"selected\""; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
994
<?php							endforeach; ?>
995
							</select>
996
							<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo htmlspecialchars($pconfig['srcendport']); ?>" />
997
						</td>
998
					</tr>
999
				</table>
1000
				<br />
1001
				<span class="vexpl"><?=gettext("Specify the source port or port range for this rule."); ?> <b><?=gettext("This is usually"); ?> <em><?=gettext("random"); ?></em> <?=gettext("and almost never equal to the destination port range (and should usually be"); ?> &quot;<?=gettext("any"); ?>&quot;).</b><br /><?=gettext("Hint: you can leave the"); ?> <em><?=gettext("'to'"); ?></em> <?=gettext("field empty if you only want to filter a single port.");?></span><br/>
1002
			</td>
1003
		</tr>
1004
		<tr>
1005
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Destination");?></td>
1006
			<td width="78%" class="vtable">
1007
				<input <?=$edit_disabled;?> name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked=\"checked\""; ?> />
1008
				<strong><?=gettext("not");?></strong>
1009
					<br />
1010
				<?=gettext("Use this option to invert the sense of the match.");?>
1011
					<br />
1012
					<br />
1013
				<table border="0" cellspacing="0" cellpadding="0">
1014
					<tr>
1015
						<td><?=gettext("Type:");?>&nbsp;&nbsp;</td>
1016
						<td>
1017
							<select <?=$edit_disabled;?> name="dsttype" class="formselect" onchange="typesel_change()">
1018
<?php
1019
								$sel = is_specialnet($pconfig['dst']); ?>
1020
								<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected=\"selected\""; } ?>><?=gettext("any");?></option>
1021
								<option value="single"
1022
								<?php  if (!$sel &&
1023
									    ((is_ipaddrv6($pconfig['dst']) && $pconfig['dstmask'] == 128) ||
1024
									    (is_ipaddrv4($pconfig['dst']) && $pconfig['dstmask'] == 32) || is_alias($pconfig['dst'])))
1025
										{ echo "selected=\"selected\""; $sel = 1; }
1026
								?>
1027
								><?=gettext("Single host or alias");?></option>
1028
								<option value="network" <?php if (!$sel) echo "selected=\"selected\""; ?>><?=gettext("Network");?></option>
1029
								<?php if(have_ruleint_access("pptp")): ?>
1030
								<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected=\"selected\""; } ?>><?=gettext("PPTP clients");?></option>
1031
								<?php endif; ?>
1032
								<?php if(have_ruleint_access("pppoe")): ?>
1033
								<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected=\"selected\""; } ?>><?=gettext("PPPoE clients");?></option>
1034
								<?php endif; ?>								
1035
								<?php if(have_ruleint_access("l2tp")): ?>
1036
                                                                <option value="l2tp" <?php if ($pconfig['dst'] == "l2tp") { echo "selected=\"selected\""; } ?>><?=gettext("L2TP clients");?></option>
1037
                                                                <?php endif; ?>
1038

    
1039
<?php 							foreach ($ifdisp as $if => $ifdesc): ?>
1040
								<?php if(have_ruleint_access($if)): ?>
1041
									<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected=\"selected\""; } ?>><?=htmlspecialchars($ifdesc);?> <?=gettext("subnet");?></option>
1042
									<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected=\"selected\""; } ?>>
1043
										<?=$ifdesc;?> <?=gettext("address");?>
1044
									</option>
1045
								<?php endif; ?>
1046
<?php 							endforeach; ?>
1047
							</select>
1048
						</td>
1049
					</tr>
1050
					<tr>
1051
						<td><?=gettext("Address:");?>&nbsp;&nbsp;</td>
1052
						<td>
1053
							<input <?=$edit_disabled;?> autocomplete='off' name="dst" type="text" class="formfldalias ipv4v6" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>" />
1054
							/
1055
							<select <?=$edit_disabled;?> name="dstmask" class="formselect ipv4v6" id="dstmask">
1056
<?php
1057
							for ($i = 127; $i > 0; 
1058
$i--): ?>
1059
								<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected=\"selected\""; ?>><?=$i;?></option>
1060
<?php						endfor; ?>
1061
							</select>
1062
						</td>
1063
					</tr>
1064
				</table>
1065
			</td>
1066
		</tr>
1067
		<tr id="dprtr">
1068
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Destination port range ");?></td>
1069
			<td width="78%" class="vtable">
1070
				<table border="0" cellspacing="0" cellpadding="0">
1071
					<tr>
1072
						<td><?=gettext("from:");?>&nbsp;&nbsp;</td>
1073
						<td>
1074
							<select <?=$edit_disabled;?> name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()">
1075
								<option value="">(<?=gettext("other"); ?>)</option>
1076
								<option value="any" <?php $bfound = 0; if ($pconfig['dstbeginport'] == "any") { echo "selected=\"selected\""; $bfound = 1; } ?>><?=gettext("any");?></option>
1077
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
1078
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected=\"selected\""; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
1079
<?php 							endforeach; ?>
1080
							</select>
1081
							<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo htmlspecialchars($pconfig['dstbeginport']); ?>" />
1082
						</td>
1083
					</tr>
1084
					<tr>
1085
						<td><?=gettext("to:");?></td>
1086
						<td>
1087
							<select <?=$edit_disabled;?> name="dstendport" class="formselect" onchange="ext_change()">
1088
								<option value="">(<?=gettext("other"); ?>)</option>
1089
								<option value="any" <?php $bfound = 0; if ($pconfig['dstendport'] == "any") { echo "selected=\"selected\""; $bfound = 1; } ?>><?=gettext("any");?></option>
1090
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
1091
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected=\"selected\""; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
1092
<?php 							endforeach; ?>
1093
							</select>
1094
								<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo htmlspecialchars($pconfig['dstendport']); ?>" />
1095
						</td>
1096
					</tr>
1097
				</table>
1098
				<br />
1099
				<span class="vexpl">
1100
					<?=gettext("Specify the port or port range for the destination of the packet for this rule.");?>
1101
					<br />
1102
					<?=gettext("Hint: you can leave the"); ?> <em><?=gettext("'to'"); ?></em> <?=gettext("field empty if you only want to filter a single port");?>
1103
				</span>
1104
			</td>
1105
		</tr>
1106
		<tr>
1107
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Log");?></td>
1108
			<td width="78%" class="vtable">
1109
				<input name="log" type="checkbox" id="log" value="yes" <?php if ($pconfig['log']) echo "checked=\"checked\""; ?> />
1110
				<strong><?=gettext("Log packets that are handled by this rule");?></strong>
1111
				<br />
1112
				<span class="vexpl"><?=gettext("Hint: the firewall has limited local log space. Don't turn on logging for everything. If you want to do a lot of logging, consider using a remote syslog server"); ?> (<?=gettext("see the"); ?> <a href="diag_logs_settings.php"><?=gettext("Diagnostics: System logs: Settings"); ?></a> <?=gettext("page"); ?>).</span>
1113
			</td>
1114
		</tr>
1115
		<tr>
1116
			<td width="22%" valign="top" class="vncell"><?=gettext("Description");?></td>
1117
			<td width="78%" class="vtable">
1118
				<input name="descr" type="text" class="formfld unknown" id="descr" size="52" maxlength="52" value="<?=htmlspecialchars($pconfig['descr']);?>" />
1119
				<br />
1120
				<span class="vexpl"><?=gettext("You may enter a description here for your reference.");?></span>
1121
			</td>
1122
		</tr>
1123
<?php		if (!isset($id) || !($a_filter[$id] && firewall_check_for_advanced_options($a_filter[$id]) <> "")): ?>
1124
		<tr>
1125
			<td width="22%" valign="top">&nbsp;</td>
1126
			<td width="78%">
1127
				&nbsp;<br/>&nbsp;
1128
				<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" />  <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()" />
1129
<?php			if (isset($id) && $a_filter[$id]): ?>
1130
					<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
1131
<?php 			endif; ?>
1132
				<input name="after" type="hidden" value="<?=htmlspecialchars($after);?>" />
1133
			</td>
1134
		</tr>
1135
<?php		endif; ?>
1136
		<tr>
1137
			<td>&nbsp;</td>
1138
		</tr>
1139
		<tr>
1140
			<td colspan="2" valign="top" class="listtopic"><?=gettext("Advanced features");?></td>
1141
		</tr>	
1142
		<tr>
1143
			<td width="22%" valign="top" class="vncell"><?=gettext("Source OS");?></td>
1144
			<td width="78%" class="vtable">
1145
				<div id="showadvsourceosbox" <?php if ($pconfig['os']) echo "style='display:none'"; ?>>
1146
					<input type="button" onclick="show_advanced_sourceos()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1147
				</div>
1148
				<div id="showsourceosadv" <?php if (empty($pconfig['os'])) echo "style='display:none'"; ?>>
1149
					<?=gettext("OS Type:");?>&nbsp;
1150
					<select name="os" id="os" class="formselect">
1151
<?php
1152
						$ostypes = array(
1153
							 "" => gettext("any"),
1154
							"AIX" => "AIX",
1155
							"Linux" => "Linux",
1156
							"FreeBSD" => "FreeBSD",
1157
							"NetBSD" => "NetBSD",
1158
							"OpenBSD" => "OpenBSD",
1159
							"Solaris" => "Solaris",
1160
							"MacOS" => "MacOS",
1161
							"Windows" => "Windows",
1162
							"Novell" => "Novell",
1163
							"NMAP" => "NMAP"
1164
			           );
1165
						foreach ($ostypes as $ostype => $descr): ?>
1166
							<option value="<?=$ostype;?>" <?php if ($ostype == $pconfig['os']) echo "selected=\"selected\""; ?>><?=htmlspecialchars($descr);?></option>
1167
<?php
1168
					endforeach; 
1169
?>
1170
					</select>
1171
					<br />
1172
					<?=gettext("Note: this only works for TCP rules");?>
1173
				</div>
1174
			</td>
1175
		</tr>
1176
		<tr>
1177
			<td width="22%" valign="top" class="vncell"><?=gettext("Diffserv Code Point");?></td>
1178
			<td width="78%" class="vtable">
1179
				<div id="dsadv" <?php if ($pconfig['dscp']) echo "style='display:none'"; ?>>
1180
					<input type="button" onclick="show_dsdiv();" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1181
				</div>
1182
				<div id="dsdivmain" <?php if (empty($pconfig['dscp'])) echo "style='display:none'"; ?>>
1183
					<select name="dscp" id="dscp">
1184
						<option value=""></option>
1185
						<?php foreach($firewall_rules_dscp_types as $frdt): ?>
1186
							<option value="<?=$frdt?>"<?php if($pconfig['dscp'] == $frdt) echo " selected=\"selected\""; ?>><?=$frdt?></option>
1187
						<?php endforeach; ?>
1188
					</select>
1189
				</div>
1190
			</td>
1191
		</tr>
1192
		<tr>
1193
			<td width="22%" valign="top" class="vncell"><?=gettext("Advanced Options");?></td>
1194
			<td width="78%" class="vtable">
1195
			<div id="aoadv">
1196
				<input type="button" onclick="show_aodiv();" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1197
			</div>
1198
			<div id="aodivmain" style="display:none">
1199
				<input type="checkbox" id="allowopts" value="yes" name="allowopts"<?php if($pconfig['allowopts'] == true) echo " checked=\"checked\""; ?> />
1200
				<br/><span class="vexpl"><?=gettext("This allows packets with IP options to pass. Otherwise they are blocked by default. This is usually only seen with multicast traffic.");?>
1201
				</span><p>
1202
				<input type="checkbox" id="disablereplyto" value="yes" name="disablereplyto"<?php if($pconfig['disablereplyto'] == true) echo " checked=\"checked\""; ?> />
1203
				<br/><span class="vexpl"><?=gettext("This will disable auto generated reply-to for this rule.");?>
1204
				</span></p><p>
1205
				<input name="tag" id="tag" value="<?=htmlspecialchars($pconfig['tag']);?>" />
1206
				<br /><span class="vexpl"><?=gettext("You can mark a packet matching this rule and use this mark to match on other NAT/filter rules. It is called"); ?> <b><?=gettext("Policy filtering"); ?></b>
1207
				</span></p><p>
1208
				<input name="tagged" id="tagged" value="<?=htmlspecialchars($pconfig['tagged']);?>" />
1209
				<br /><span class="vexpl"><?=gettext("You can match packet on a mark placed before on another rule.")?>
1210
				</span></p><p>
1211
				<input name="max" id="max" value="<?php echo htmlspecialchars($pconfig['max']) ?>" /><br/><?=gettext(" Maximum state entries this rule can create");?></p><p>
1212
				<input name="max-src-nodes" id="max-src-nodes" value="<?php echo htmlspecialchars($pconfig['max-src-nodes']) ?>" /><br/><?=gettext(" Maximum number of unique source hosts");?></p><p>
1213
				<input name="max-src-conn" id="max-src-conn" value="<?php echo htmlspecialchars($pconfig['max-src-conn']) ?>" /><br/><?=gettext(" Maximum number of established connections per host");?></p><p>
1214
				<input name="max-src-states" id="max-src-states" value="<?php echo htmlspecialchars($pconfig['max-src-states']) ?>" /><br/><?=gettext(" Maximum state entries per host");?></p><p>
1215
				<input name="max-src-conn-rate" id="max-src-conn-rate" value="<?php echo htmlspecialchars($pconfig['max-src-conn-rate']) ?>" /> /
1216
				<select name="max-src-conn-rates" id="max-src-conn-rates">
1217
					<option value=""<?php if(intval($pconfig['max-src-conn-rates']) < 1) echo " selected=\"selected\""; ?>></option>
1218
<?php				for($x=1; $x<255; $x++) {
1219
						if($x == $pconfig['max-src-conn-rates']) $selected = " selected=\"selected\""; else $selected = "";
1220
						echo "<option value=\"{$x}\"{$selected}>{$x}</option>\n";
1221
					} ?>
1222
				</select><br />
1223
				<?=gettext("Maximum new connections / per second(s)");?>
1224
				</p><p>
1225
				<input name="statetimeout" value="<?php echo htmlspecialchars($pconfig['statetimeout']) ?>" /><br/>
1226
				<?=gettext("State Timeout in seconds");?>
1227
				</p>
1228
				<p><strong><?=gettext("Note: Leave fields blank to disable that feature.");?></strong></p>
1229
			  </div>
1230
			</td>
1231
		</tr>
1232
		<tr id="tcpflags"> 
1233
			<td width="22%" valign="top" class="vncell"><?=gettext("TCP flags");?></td>
1234
			<td width="78%" class="vtable">
1235
			<div id="showtcpflagsbox" <?php if ($pconfig['tcpflags_any'] || $pconfig['tcpflags1'] || $pconfig['tcpflags2']) echo "style='display:none'"; ?>>
1236
                        	<input type="button" onclick="show_advanced_tcpflags()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1237
                        </div>
1238
                        <div id="showtcpflagsadv" <?php if (empty($pconfig['tcpflags_any']) && empty($pconfig['tcpflags1']) && empty($pconfig['tcpflags2'])) echo "style='display:none'"; ?>>
1239
			<div id="tcpheader" align="center">
1240
			<table border="0" cellspacing="0" cellpadding="0">
1241
			<?php 
1242
				$setflags = explode(",", $pconfig['tcpflags1']);
1243
				$outofflags = explode(",", $pconfig['tcpflags2']);
1244
				$header = "<td width='40' class='nowrap'></td>";
1245
				$tcpflags1 = "<td width='40' class='nowrap'>set</td>";
1246
				$tcpflags2 = "<td width='40' class='nowrap'>out of</td>";
1247
				foreach ($tcpflags as $tcpflag) {
1248
					$header .= "<td  width='40' class='nowrap'><strong>" . strtoupper($tcpflag) . "</strong></td>\n";
1249
					$tcpflags1 .= "<td  width='40' class='nowrap'> <input type='checkbox' name='tcpflags1_{$tcpflag}' value='on' ";
1250
					if (array_search($tcpflag, $setflags) !== false)
1251
						$tcpflags1 .= "checked=\"checked\"";
1252
					$tcpflags1 .= " /></td>\n";
1253
					$tcpflags2 .= "<td  width='40' class='nowrap'> <input type='checkbox' name='tcpflags2_{$tcpflag}' value='on' ";
1254
					if (array_search($tcpflag, $outofflags) !== false)
1255
						$tcpflags2 .= "checked=\"checked\"";
1256
					$tcpflags2 .= " /></td>\n";
1257
				}
1258
				echo "<tr id='tcpheader'>{$header}</tr>\n";
1259
				echo "<tr id='tcpflags1'>{$tcpflags1}</tr>\n";
1260
				echo "<tr id='tcpflags2'>{$tcpflags2}</tr>\n";
1261
			?>
1262
			</table>
1263
			</div>
1264
			<br/><center>
1265
			<input onclick='tcpflags_anyclick(this);' type='checkbox' name='tcpflags_any' value='on' <?php if ($pconfig['tcpflags_any']) echo "checked=\"checked\""; ?> /><strong><?=gettext("Any flags.");?></strong><br/></center>
1266
			<br/>
1267
			<span class="vexpl"><?=gettext("Use this to choose TCP flags that must ". 
1268
			"be set or cleared for this rule to match.");?></span>
1269
			</div>
1270
			</td>
1271
		</tr>
1272
		<tr>
1273
			<td width="22%" valign="top" class="vncell"><?=gettext("State Type");?></td>
1274
			<td width="78%" class="vtable">
1275
				<div id="showadvstatebox" <?php if (!empty($pconfig['statetype']) && $pconfig['statetype'] != "keep state") echo "style='display:none'"; ?>>
1276
					<input type="button" onclick="show_advanced_state()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1277
				</div>
1278
				<div id="showstateadv" <?php if (empty($pconfig['statetype']) || $pconfig['statetype'] == "keep state") echo "style='display:none'"; ?>>
1279
					<select name="statetype">
1280
						<option value="keep state" <?php if(!isset($pconfig['statetype']) or $pconfig['statetype'] == "keep state") echo "selected=\"selected\""; ?>><?=gettext("keep state");?></option>
1281
						<option value="sloppy state" <?php if($pconfig['statetype'] == "sloppy state") echo "selected=\"selected\""; ?>><?=gettext("sloppy state");?></option>
1282
						<option value="synproxy state"<?php if($pconfig['statetype'] == "synproxy state")  echo "selected=\"selected\""; ?>><?=gettext("synproxy state");?></option>
1283
						<option value="none"<?php if($pconfig['statetype'] == "none") echo "selected=\"selected\""; ?>><?=gettext("none");?></option>
1284
					</select><br/><?=gettext("Hint: Select which type of state tracking mechanism you would like to use.  If in doubt, use keep state.");?>
1285
					<table width="90%">
1286
						<tr><td width="25%"><ul><li><?=gettext("keep state");?></li></ul></td><td><?=gettext("Works with all IP protocols.");?></td></tr>
1287
						<tr><td width="25%"><ul><li><?=gettext("sloppy state");?></li></ul></td><td><?=gettext("Works with all IP protocols.");?></td></tr>
1288
						<tr><td width="25%"><ul><li><?=gettext("synproxy state");?></li></ul></td><td><?=gettext("Proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods. This option includes the functionality of keep state and modulate state combined.");?></td></tr>
1289
						<tr><td width="25%"><ul><li><?=gettext("none");?></li></ul></td><td><?=gettext("Do not use state mechanisms to keep track.  This is only useful if you're doing advanced queueing in certain situations.  Please check the documentation.");?></td></tr>
1290
					</table>
1291
			  </div>
1292
			</td>
1293
		</tr>
1294
		<tr>
1295
			<td width="22%" valign="top" class="vncell"><?=gettext("No XMLRPC Sync");?></td>
1296
			<td width="78%" class="vtable">
1297
				<div id="showadvnoxmlrpcsyncbox" <?php if ($pconfig['nosync']) echo "style='display:none'"; ?>>
1298
					<input type="button" onclick="show_advanced_noxmlrpc()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1299
				</div>
1300
				<div id="shownoxmlrpcadv" <?php if (empty($pconfig['nosync'])) echo "style='display:none'"; ?>>
1301
					<input type="checkbox" name="nosync"<?php if($pconfig['nosync']) echo " checked=\"checked\""; ?> /><br/>
1302
					<?=gettext("Hint: This prevents the rule on Master from automatically syncing to other CARP members. This does NOT prevent the rule from being overwritten on Slave.");?>
1303
				</div>
1304
			</td>
1305
		</tr>
1306
		<tr>
1307
			<td width="22%" valign="top" class="vncell"><?=gettext("802.1p");?></td>
1308
			<td width="78%" class="vtable">
1309
				<div id="showadvvlanpriobox" <?php if (!empty($pconfig['vlanprio'])) echo "style='display:none'"; ?>>
1310
					<input type="button" onclick="show_advanced_vlanprio()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1311
				</div>
1312
				<div id="showvlanprioadv" <?php if (empty($pconfig['vlanprio'])) echo "style='display:none'"; ?>>
1313
					<?php $vlanprio = array("none", "be", "bk", "ee", "ca", "vi", "vo", "ic", "nc"); ?>
1314
<?php
1315
					$opts = "";
1316
					foreach($vlanprio as $vprio) {
1317
						if ($vprio == $pconfig['vlanprio'])
1318
							$selected = " selected=\"selected\"";
1319
						else
1320
							$selected = "";
1321
						if ($vprio == "none")
1322
							$opts .= "<option value=\"\">{$vprio}</option>\n";
1323
						else
1324
							$opts .= "<option value=\"{$vprio}\" {$selected}>" . strtoupper($vprio) . "</option>\n";
1325
					}
1326
?>
1327
					<select name='vlanprio'>
1328
					<?php echo $opts; ?>
1329
					</select>
1330
					<p><?=gettext("Choose 802.1p priority to match on");?></p>
1331
					<select name='vlanprioset'>
1332
					<?php echo $opts; ?>
1333
					</select>
1334
					<p><?=gettext("Choose 802.1p priority to apply");?></p>
1335
				</div>
1336
			</td>
1337
		</tr>
1338
		<?php
1339
			//build list of schedules
1340
			$schedules = array();
1341
			$schedules[] = "none";//leave none to leave rule enabled all the time
1342
			if(is_array($config['schedules']['schedule'])) {
1343
				foreach ($config['schedules']['schedule'] as $schedule) {
1344
					if ($schedule['name'] <> "")
1345
						$schedules[] = $schedule['name'];
1346
				}
1347
			}
1348
		?>
1349
		<tr>
1350
			<td width="22%" valign="top" class="vncell"><?=gettext("Schedule");?></td>
1351
			<td width="78%" class="vtable">
1352
				<div id="showadvschedulebox" <?php if (!empty($pconfig['sched'])) echo "style='display:none'"; ?>>
1353
					<input type="button" onclick="show_advanced_schedule()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1354
				</div>
1355
				<div id="showscheduleadv" <?php if (empty($pconfig['sched'])) echo "style='display:none'"; ?>>
1356
					<select name='sched'>
1357
<?php
1358
					foreach($schedules as $schedule) {
1359
						if($schedule == $pconfig['sched']) {
1360
							$selected = " selected=\"selected\"";
1361
						} else {
1362
							$selected = "";
1363
						}
1364
						if ($schedule == "none") {
1365
							echo "<option value=\"\" {$selected}>{$schedule}</option>\n";
1366
						} else {
1367
							echo "<option value=\"{$schedule}\" {$selected}>{$schedule}</option>\n";
1368
						}
1369
					}
1370
?>
1371
					</select>
1372
					<p><?=gettext("Leave as 'none' to leave the rule enabled all the time.");?></p>
1373
				</div>
1374
			</td>
1375
		</tr>
1376
		<tr>
1377
			<td width="22%" valign="top" class="vncell"><?=gettext("Gateway");?></td>
1378
			<td width="78%" class="vtable">
1379
				<div id="showadvgatewaybox" <?php if (!empty($pconfig['gateway'])) echo "style='display:none'"; ?>>
1380
					<input type="button" onclick="show_advanced_gateway()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1381
				</div>
1382
				<div id="showgatewayadv" <?php if (empty($pconfig['gateway'])) echo "style='display:none'"; ?>>
1383
					<select name='gateway'>
1384
					<option value="" ><?=gettext("default");?></option>
1385
<?php
1386
					/* build a list of gateways */
1387
					$gateways = return_gateways_array();
1388
					// add statically configured gateways to list
1389
					foreach($gateways as $gwname => $gw) {
1390
						if(($pconfig['ipprotocol'] == "inet46"))
1391
							continue;
1392
						if(($pconfig['ipprotocol'] == "inet6") && !(($gw['ipprotocol'] == "inet6") || (is_ipaddrv6($gw['gateway']))))
1393
							continue;
1394
						if(($pconfig['ipprotocol'] == "inet") && !(($gw['ipprotocol'] == "inet") || (is_ipaddrv4($gw['gateway']))))
1395
							continue;
1396
						if($gw == "") 
1397
							continue;
1398
						if($gwname == $pconfig['gateway']) {
1399
							$selected = " selected=\"selected\"";
1400
						} else {
1401
							$selected = "";
1402
						}
1403
						echo "<option value=\"{$gwname}\" {$selected}>{$gw['name']} - {$gw['gateway']}</option>\n";
1404
					}
1405
					/* add gateway groups to the list */
1406
					if (is_array($config['gateways']['gateway_group'])) {
1407
						foreach($config['gateways']['gateway_group'] as $gw_group) {
1408
							$af = explode("|", $gw_group['item'][0]);
1409
							if(($pconfig['ipprotocol'] == "inet46"))
1410
								continue;
1411
							if(($pconfig['ipprotocol'] == "inet6") && !is_ipaddrv6(lookup_gateway_ip_by_name($af[0])))
1412
								continue;
1413
							if(($pconfig['ipprotocol'] == "inet") && !is_ipaddrv4(lookup_gateway_ip_by_name($af[0])))
1414
								continue;
1415
							if($gw_group['name'] == "")
1416
								continue;
1417
							if($pconfig['gateway'] == $gw_group['name']) {
1418
								$selected = " selected=\"selected\"";
1419
							} else {
1420
								$selected = "";
1421
							}
1422
							echo "<option value=\"{$gw_group['name']}\" $selected>{$gw_group['name']}</option>\n";
1423
						}
1424
					}
1425
?>
1426
					</select>
1427
					<p><?=gettext("Leave as 'default' to use the system routing table.  Or choose a gateway to utilize policy based routing.");?></p>
1428
				</div>
1429
			</td>
1430
		</tr>
1431
		<tr>
1432
			<td width="22%" valign="top" class="vncell"><?=gettext("In/Out");?></td>
1433
			<td width="78%" class="vtable">
1434
				<div id="showadvinoutbox" <?php if (!empty($pconfig['dnpipe'])) echo "style='display:none'"; ?>>
1435
					<input type="button" onclick="show_advanced_inout()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1436
				</div>
1437
				<div id="showinoutadv" <?php if (empty($pconfig['dnpipe'])) echo "style='display:none'"; ?>>
1438
					<select name="dnpipe">
1439
<?php
1440
		if (!is_array($dnqlist))
1441
			$dnqlist = array();
1442
		echo "<option value=\"\"";
1443
		if (!$dnqselected) echo " selected=\"selected\"";
1444
		echo " >none</option>";
1445
		foreach ($dnqlist as $dnq => $dnqkey) {
1446
			if($dnq == "")
1447
				continue;
1448
			echo "<option value=\"$dnq\"";
1449
			if ($dnq == $pconfig['dnpipe']) {
1450
				$dnqselected = 1;
1451
				echo " selected=\"selected\"";
1452
			}
1453
			echo ">{$dnq}</option>"; 
1454
		}
1455
?>
1456
			</select> / 			
1457
			<select name="pdnpipe">
1458
<?php
1459
		$dnqselected = 0;
1460
		echo "<option value=\"\"";
1461
		if (!$dnqselected) echo " selected=\"selected\"";
1462
		echo " >none</option>";
1463
		foreach ($dnqlist as $dnq => $dnqkey) {
1464
			if($dnq == "")
1465
				continue;
1466
			echo "<option value=\"$dnq\"";
1467
			if ($dnq == $pconfig['pdnpipe']) {
1468
				$dnqselected = 1;
1469
				echo " selected=\"selected\"";
1470
			}
1471
			echo ">{$dnq}</option>"; 
1472
		}
1473
?>
1474
				</select>
1475
				<br />
1476
				<span class="vexpl"><?=gettext("Choose the Out queue/Virtual interface only if you have also selected In.")."<br/>".gettext("The Out selection is applied to traffic leaving the interface where the rule is created, In is applied to traffic coming into the chosen interface.")."<br/>".gettext("If you are creating a floating rule, if the direction is In then the same rules apply, if the direction is out the selections are reverted Out is for incoming and In is for outgoing.");?></span>
1477
				</div>
1478
			</td>
1479
		</tr>
1480

    
1481
		<tr>
1482
			<td width="22%" valign="top" class="vncell"><?=gettext("Ackqueue/Queue");?></td>
1483
			<td width="78%" class="vtable">
1484
			<div id="showadvackqueuebox" <?php if (!empty($pconfig['defaultqueue'])) echo "style='display:none'"; ?>>
1485
				<input type="button" onclick="show_advanced_ackqueue()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1486
			</div>
1487
			<div id="showackqueueadv" <?php if (empty($pconfig['defaultqueue'])) echo "style='display:none'"; ?>>
1488
				<select name="ackqueue">
1489
<?php
1490
			if (!is_array($qlist))
1491
				$qlist = array();
1492
			echo "<option value=\"\"";
1493
			if (!$qselected) echo " selected=\"selected\"";
1494
			echo " >none</option>";
1495
			foreach ($qlist as $q => $qkey) {
1496
				if($q == "")
1497
					continue;
1498
				echo "<option value=\"$q\"";
1499
				if ($q == $pconfig['ackqueue']) {
1500
					$qselected = 1;
1501
					echo " selected=\"selected\"";
1502
				}
1503
				if (isset($ifdisp[$q]))
1504
					echo ">{$ifdisp[$q]}</option>";
1505
				else
1506
					echo ">{$q}</option>"; 
1507
			}
1508
?>
1509
				</select> / 			
1510
				<select name="defaultqueue">
1511
<?php
1512
			$qselected = 0;
1513
			echo "<option value=\"\"";
1514
			if (!$qselected) echo " selected=\"selected\"";
1515
			echo " >none</option>";
1516
			foreach ($qlist as $q => $qkey) {
1517
				if($q == "")
1518
					continue;
1519
				echo "<option value=\"$q\"";
1520
				if ($q == $pconfig['defaultqueue']) {
1521
					$qselected = 1;
1522
					echo " selected=\"selected\"";
1523
				}
1524
				if (isset($ifdisp[$q]))
1525
					echo ">{$ifdisp[$q]}</option>";
1526
				else
1527
					echo ">{$q}</option>"; 
1528
			}
1529
?>
1530
				</select>
1531
					<br />
1532
					<span class="vexpl"><?=gettext("Choose the Acknowledge Queue only if you have selected Queue.");?></span>
1533
					</div>
1534
				</td>
1535
			</tr>
1536
			<tr>
1537
				<td width="22%" valign="top" class="vncell"><?=gettext("Layer7");?></td>
1538
				<td width="78%" class="vtable">
1539
					<div id="showadvlayer7box" <?php if (!empty($pconfig['l7container'])) echo "style='display:none'"; ?>>
1540
						<input type="button" onclick="show_advanced_layer7()" value="<?=gettext("Advanced"); ?>" /> - <?=gettext("Show advanced option");?>
1541
					</div>
1542
					<div id="showlayer7adv" <?php if (empty($pconfig['l7container'])) echo "style='display:none'"; ?>>
1543
				<select name="l7container">
1544
<?php
1545
					if (!is_array($l7clist))
1546
						$l7clist = array();
1547
					echo "<option value=\"\"";
1548
					echo " >none</option>";
1549
					foreach ($l7clist as $l7ckey) {
1550
						echo "<option value=\"{$l7ckey}\"";
1551
						if ($l7ckey == $pconfig['l7container']) {
1552
							echo " selected=\"selected\"";
1553
						}
1554
						echo ">{$l7ckey}</option>"; 
1555
					}
1556
?>
1557
				</select>			
1558
				<br/>
1559
				<span class="vexpl">
1560
					<?=gettext("Choose a Layer7 container to apply application protocol inspection rules. " .
1561
					"These are valid for TCP and UDP protocols only.");?>
1562
				</span>
1563
			  </div>
1564
			</td>
1565
		</tr>
1566
<?php
1567
		// Allow extending of the firewall edit page and include custom input validation 
1568
		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/htmlphplate");
1569
?>
1570
<?php
1571
$has_created_time = (isset($a_filter[$id]['created']) && is_array($a_filter[$id]['created']));
1572
$has_updated_time = (isset($a_filter[$id]['updated']) && is_array($a_filter[$id]['updated']));
1573
?>
1574
		<?php if ($has_created_time || $has_updated_time): ?>
1575
		<tr>
1576
			<td>&nbsp;</td>
1577
		</tr>
1578
		<tr>
1579
			<td colspan="2" valign="top" class="listtopic"><?=gettext("Rule Information");?></td>
1580
		</tr>
1581
		<?php if ($has_created_time): ?>
1582
		<tr>
1583
			<td width="22%" valign="top" class="vncell"><?=gettext("Created");?></td>
1584
			<td width="78%" class="vtable">
1585
				<?= date(gettext("n/j/y H:i:s"), $a_filter[$id]['created']['time']) ?> <?= gettext("by") ?> <strong><?= $a_filter[$id]['created']['username'] ?></strong>
1586
			</td>
1587
		</tr>
1588
		<?php endif; ?>
1589
		<?php if ($has_updated_time): ?>
1590
		<tr>
1591
			<td width="22%" valign="top" class="vncell"><?=gettext("Updated");?></td>
1592
			<td width="78%" class="vtable">
1593
				<?= date(gettext("n/j/y H:i:s"), $a_filter[$id]['updated']['time']) ?> <?= gettext("by") ?> <strong><?= $a_filter[$id]['updated']['username'] ?></strong>
1594
			</td>
1595
		</tr>
1596
		<?php endif; ?>
1597
		<?php endif; ?>
1598
		<tr>
1599
			<td width="22%" valign="top">&nbsp;</td>
1600
			<td width="78%">
1601
				&nbsp;<br/>&nbsp;
1602
				<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" />  <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()" />
1603
<?php			if (isset($id) && $a_filter[$id]): ?>
1604
					<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
1605
<?php 			endif; ?>
1606
				<input name="after" type="hidden" value="<?=htmlspecialchars($after);?>" />
1607
			</td>
1608
		</tr>
1609
	</table>
1610
</form>
1611
<script type="text/javascript">
1612
//<![CDATA[
1613
	ext_change();
1614
	typesel_change();
1615
	proto_change();
1616
	<?php if ( (!empty($pconfig['srcbeginport']) && $pconfig['srcbeginport'] != "any") || (!empty($pconfig['srcendport']) && $pconfig['srcendport'] != "any") ): ?>
1617
	show_source_port_range();
1618
	<?php endif; ?>
1619

    
1620
	var addressarray = <?= json_encode(get_alias_list(array("host", "network", "openvpn", "urltable"))) ?>;
1621
	var customarray  = <?= json_encode(get_alias_list("port")) ?>;
1622

    
1623
	var oTextbox1 = new AutoSuggestControl(document.getElementById("src"), new StateSuggestions(addressarray));
1624
        var oTextbox2 = new AutoSuggestControl(document.getElementById("srcbeginport_cust"), new StateSuggestions(customarray));
1625
        var oTextbox3 = new AutoSuggestControl(document.getElementById("srcendport_cust"), new StateSuggestions(customarray));
1626
        var oTextbox4 = new AutoSuggestControl(document.getElementById("dst"), new StateSuggestions(addressarray));
1627
        var oTextbox5 = new AutoSuggestControl(document.getElementById("dstbeginport_cust"), new StateSuggestions(customarray));
1628
        var oTextbox6 = new AutoSuggestControl(document.getElementById("dstendport_cust"), new StateSuggestions(customarray));
1629
//]]>
1630
</script>
1631
<?php include("fend.inc"); ?>
1632
</body>
1633
</html>
(70-70/246)