Project

General

Profile

Download (65.1 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/* $Id$ */
3
/*
4
	firewall_rules_edit.php
5
	part of pfSense (http://www.pfsense.com)
6
        Copyright (C) 2005 Scott Ullrich (sullrich@gmail.com)
7

    
8
	originally part of m0n0wall (http://m0n0.ch/wall)
9
	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
10
	All rights reserved.
11

    
12
	Redistribution and use in source and binary forms, with or without
13
	modification, are permitted provided that the following conditions are met:
14

    
15
	1. Redistributions of source code must retain the above copyright notice,
16
	   this list of conditions and the following disclaimer.
17

    
18
	2. Redistributions in binary form must reproduce the above copyright
19
	   notice, this list of conditions and the following disclaimer in the
20
	   documentation and/or other materials provided with the distribution.
21

    
22
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
23
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
24
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
26
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31
	POSSIBILITY OF SUCH DAMAGE.
32
*/
33
/*
34
	pfSense_MODULE:	filter
35
*/
36

    
37
##|+PRIV
38
##|*IDENT=page-firewall-rules-edit
39
##|*NAME=Firewall: Rules: Edit page
40
##|*DESCR=Allow access to the 'Firewall: Rules: Edit' page.
41
##|*MATCH=firewall_rules_edit.php*
42
##|-PRIV
43

    
44
require("guiconfig.inc");
45
require("filter.inc");
46
require("shaper.inc");
47

    
48
$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
49
$ifdisp = get_configured_interface_with_descr();
50
foreach ($ifdisp as $kif => $kdescr) {
51
	$specialsrcdst[] = "{$kif}";
52
	$specialsrcdst[] = "{$kif}ip";
53
}
54

    
55
if (!is_array($config['filter']['rule'])) {
56
	$config['filter']['rule'] = array();
57
}
58
filter_rules_sort();
59
$a_filter = &$config['filter']['rule'];
60

    
61
$id = $_GET['id'];
62
if (is_numeric($_POST['id']))
63
	$id = $_POST['id'];
64

    
65
$after = $_GET['after'];
66

    
67
if (isset($_POST['after']))
68
	$after = $_POST['after'];
69

    
70
if (isset($_GET['dup'])) {
71
	$id = $_GET['dup'];
72
	$after = $_GET['dup'];
73
}
74

    
75
if (isset($id) && $a_filter[$id]) {
76
	$pconfig['interface'] = $a_filter[$id]['interface'];
77

    
78
	if (isset($a_filter[$id]['id']))
79
		$pconfig['ruleid'] = $a_filter[$id]['id'];
80

    
81
	if (!isset($a_filter[$id]['type']))
82
		$pconfig['type'] = "pass";
83
	else
84
		$pconfig['type'] = $a_filter[$id]['type'];
85

    
86
	if (isset($a_filter[$id]['floating']) || $if == "FloatingRules") {
87
		$pconfig['floating'] = $a_filter[$id]['floating'];
88
		if (isset($a_filter[$id]['interface']) && $a_filter[$id]['interface'] <> "") 
89
			$pconfig['interface'] = $a_filter[$id]['interface'];
90
	}
91
	
92
	if (isset($a_filter['floating'])) 
93
		$pconfig['floating'] = "yes";
94

    
95
	if (isset($a_filter[$id]['direction']))
96
                $pconfig['direction'] = $a_filter[$id]['direction'];
97

    
98
	if (isset($a_filter[$id]['ipprotocol']))
99
                $pconfig['ipprotocol'] = $a_filter[$id]['ipprotocol'];
100

    
101
	if (isset($a_filter[$id]['protocol']))
102
		$pconfig['proto'] = $a_filter[$id]['protocol'];
103
	else
104
		$pconfig['proto'] = "any";
105

    
106
	if ($a_filter[$id]['protocol'] == "icmp")
107
		$pconfig['icmptype'] = $a_filter[$id]['icmptype'];
108

    
109
	address_to_pconfig($a_filter[$id]['source'], $pconfig['src'],
110
		$pconfig['srcmask'], $pconfig['srcnot'],
111
		$pconfig['srcbeginport'], $pconfig['srcendport']);
112

    
113
	if($a_filter[$id]['os'] <> "")
114
		$pconfig['os'] = $a_filter[$id]['os'];
115

    
116
	address_to_pconfig($a_filter[$id]['destination'], $pconfig['dst'],
117
		$pconfig['dstmask'], $pconfig['dstnot'],
118
		$pconfig['dstbeginport'], $pconfig['dstendport']);
119

    
120
	if ($a_filter[$id]['dscp'] <> "")
121
		$pconfig['dscp'] = $a_filter[$id]['dscp'];
122

    
123
	$pconfig['disabled'] = isset($a_filter[$id]['disabled']);
124
	$pconfig['log'] = isset($a_filter[$id]['log']);
125
	$pconfig['descr'] = $a_filter[$id]['descr'];
126

    
127
	if (isset($a_filter[$id]['tcpflags_any']))
128
		$pconfig['tcpflags_any'] = true;
129
	else {
130
		if (isset($a_filter[$id]['tcpflags1']) && $a_filter[$id]['tcpflags1'] <> "") 
131
			$pconfig['tcpflags1'] = $a_filter[$id]['tcpflags1'];
132
		if (isset($a_filter[$id]['tcpflags2']) && $a_filter[$id]['tcpflags2'] <> "") 
133
			$pconfig['tcpflags2'] = $a_filter[$id]['tcpflags2'];
134
	}
135

    
136
	if (isset($a_filter[$id]['tag']) && $a_filter[$id]['tag'] <> "") 
137
		$pconfig['tag'] = $a_filter[$id]['tag'];
138
	if (isset($a_filter[$id]['tagged']) && $a_filter[$id]['tagged'] <> "")
139
        	$pconfig['tagged'] = $a_filter[$id]['tagged'];
140
	if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick'])
141
		$pconfig['quick'] = $a_filter[$id]['quick'];
142
	if (isset($a_filter[$id]['allowopts']))
143
		$pconfig['allowopts'] = true;
144
	if (isset($a_filter[$id]['disablereplyto']))
145
		$pconfig['disablereplyto'] = true;
146

    
147
	/* advanced */
148
	$pconfig['max'] = $a_filter[$id]['max'];
149
	$pconfig['max-src-nodes'] = $a_filter[$id]['max-src-nodes'];
150
	$pconfig['max-src-conn'] = $a_filter[$id]['max-src-conn'];
151
	$pconfig['max-src-states'] = $a_filter[$id]['max-src-states'];
152
	$pconfig['statetype'] = $a_filter[$id]['statetype'];
153
	$pconfig['statetimeout'] = $a_filter[$id]['statetimeout'];
154

    
155
	/* advanced - nosync */
156
	$pconfig['nosync'] = isset($a_filter[$id]['nosync']);
157

    
158
	/* advanced - new connection per second banning*/
159
	$pconfig['max-src-conn-rate'] = $a_filter[$id]['max-src-conn-rate'];
160
	$pconfig['max-src-conn-rates'] = $a_filter[$id]['max-src-conn-rates'];
161

    
162
	/* Multi-WAN next-hop support */
163
	$pconfig['gateway'] = $a_filter[$id]['gateway'];
164
	
165
	/* Shaper support */
166
	$pconfig['defaultqueue'] = $a_filter[$id]['defaultqueue'];
167
	$pconfig['ackqueue'] = $a_filter[$id]['ackqueue'];
168
	$pconfig['dnpipe'] = $a_filter[$id]['dnpipe'];
169
	$pconfig['pdnpipe'] = $a_filter[$id]['pdnpipe'];
170
	$pconfig['l7container'] = $a_filter[$id]['l7container'];
171

    
172
	//schedule support
173
	$pconfig['sched'] = $a_filter[$id]['sched'];
174
	if (!isset($_GET['dup']))
175
		$pconfig['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
176

    
177
} else {
178
	/* defaults */
179
	if ($_GET['if'])
180
		$pconfig['interface'] = $_GET['if'];
181
	$pconfig['type'] = "pass";
182
	$pconfig['src'] = "any";
183
	$pconfig['dst'] = "any";
184
}
185
/* Allow the FlotingRules to work */
186
$if = $pconfig['interface'];
187

    
188
if (isset($_GET['dup']))
189
	unset($id);
190

    
191
if ($_POST) {
192

    
193
	if( isset($a_filter[$id]['associated-rule-id']) ) {
194
		$_POST['proto'] = $pconfig['proto'];
195
		if ($pconfig['proto'] == "icmp")
196
			$_POST['icmptype'] = $pconfig['icmptype'];
197
	}
198

    
199
	if ($_POST['type'] == "reject" && $_POST['proto'] <> "tcp")
200
		$input_errors[] = gettext("Reject type rules only works when the protocol is set to TCP.");
201

    
202
	if ($_POST['type'] == "match" && $_POST['defaultqueue'] == "none")
203
		$input_errors[] = gettext("Queue type rules only work with queues.");
204

    
205
	if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp")) {
206
		$_POST['srcbeginport'] = 0;
207
		$_POST['srcendport'] = 0;
208
		$_POST['dstbeginport'] = 0;
209
		$_POST['dstendport'] = 0;
210
	} else {
211

    
212
		if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport'])
213
			$_POST['srcbeginport'] = $_POST['srcbeginport_cust'];
214
		if ($_POST['srcendport_cust'] && !$_POST['srcendport'])
215
			$_POST['srcendport'] = $_POST['srcendport_cust'];
216

    
217
		if ($_POST['srcbeginport'] == "any") {
218
			$_POST['srcbeginport'] = 0;
219
			$_POST['srcendport'] = 0;
220
		} else {
221
			if (!$_POST['srcendport'])
222
				$_POST['srcendport'] = $_POST['srcbeginport'];
223
		}
224
		if ($_POST['srcendport'] == "any")
225
			$_POST['srcendport'] = $_POST['srcbeginport'];
226

    
227
		if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport'])
228
			$_POST['dstbeginport'] = $_POST['dstbeginport_cust'];
229
		if ($_POST['dstendport_cust'] && !$_POST['dstendport'])
230
			$_POST['dstendport'] = $_POST['dstendport_cust'];
231

    
232
		if ($_POST['dstbeginport'] == "any") {
233
			$_POST['dstbeginport'] = 0;
234
			$_POST['dstendport'] = 0;
235
		} else {
236
			if (!$_POST['dstendport'])
237
				$_POST['dstendport'] = $_POST['dstbeginport'];
238
		}
239
		if ($_POST['dstendport'] == "any")
240
			$_POST['dstendport'] = $_POST['dstbeginport'];
241
	}
242

    
243
	if (is_specialnet($_POST['srctype'])) {
244
		$_POST['src'] = $_POST['srctype'];
245
		$_POST['srcmask'] = 0;
246
	} else if ($_POST['srctype'] == "single") {
247
		$_POST['srcmask'] = 32;
248
	}
249
	if (is_specialnet($_POST['dsttype'])) {
250
		$_POST['dst'] = $_POST['dsttype'];
251
		$_POST['dstmask'] = 0;
252
	}  else if ($_POST['dsttype'] == "single") {
253
		$_POST['dstmask'] = 32;
254
	}
255

    
256
	unset($input_errors);
257
	$pconfig = $_POST;
258

    
259
	/* input validation */
260
	$reqdfields = explode(" ", "type proto");
261
	if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
262
		$reqdfields[] = "src";
263
		$reqdfields[] = "dst";
264
	}
265
	$reqdfieldsn = explode(",", "Type,Protocol");
266
	if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
267
		$reqdfieldsn[] = "Source";
268
		$reqdfieldsn[] = "Destination";
269
	}
270

    
271
	if($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") {
272
		if( $_POST['proto'] != "tcp" )
273
			$input_errors[] = sprintf(gettext("%s is only valid with protocol tcp."),$_POST['statetype']);
274
		if(($_POST['statetype'] == "synproxy state") && ($_POST['gateway'] != ""))
275
			$input_errors[] = sprintf(gettext("%s is only valid if the gateway is set to 'default'."),$_POST['statetype']);
276
	}
277
        
278
	if ( isset($a_filter[$id]['associated-rule-id'])===false &&
279
	(!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) ) {
280
		$reqdfields[] = "srcmask";
281
		$reqdfieldsn[] = "Source bit count";
282
	}
283
	if ( isset($a_filter[$id]['associated-rule-id'])===false &&
284
	(!(is_specialnet($_POST['dsttype']) || ($_POST['dsttype'] == "single"))) ) {
285
		$reqdfields[] = "dstmask";
286
		$reqdfieldsn[] = gettext("Destination bit count");
287
	}
288

    
289
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
290

    
291
	if (!$_POST['srcbeginport']) {
292
		$_POST['srcbeginport'] = 0;
293
		$_POST['srcendport'] = 0;
294
	}
295
	if (!$_POST['dstbeginport']) {
296
		$_POST['dstbeginport'] = 0;
297
		$_POST['dstendport'] = 0;
298
	}
299

    
300
	if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport']))
301
                $input_errors[] = sprintf(gettext("%s is not a valid start source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcbeginposrt']);
302
        if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport']))
303
                $input_errors[] = sprintf(gettext("%s  is not a valid end source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcendport']);
304
        if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport']))
305
                $input_errors[] = sprintf(gettext("%s is not a valid start destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstbeginport']);
306
        if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport']))
307
                $input_errors[] = sprintf(gettext("%s is not a valid end destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstendport']);
308
	if ( !$_POST['srcbeginport_cust'] && $_POST['srcendport_cust'])
309
		if (is_alias($_POST['srcendport_cust']))
310
			$input_errors[] = 'If you put port alias in Source port range to: field you must put the same port alias in from: field';
311
	if ( $_POST['srcbeginport_cust'] && $_POST['srcendport_cust']){
312
		if (is_alias($_POST['srcendport_cust']) && is_alias($_POST['srcendport_cust']) && $_POST['srcbeginport_cust'] != $_POST['srcendport_cust'])
313
			$input_errors[] = 'The same port alias must be used in Source port range from: and to: fields';
314
		if ((is_alias($_POST['srcbeginport_cust']) && (!is_alias($_POST['srcendport_cust']) && $_POST['srcendport_cust']!='')) || 
315
		    ((!is_alias($_POST['srcbeginport_cust']) && $_POST['srcbeginport_cust']!='') && is_alias($_POST['srcendport_cust']))) 
316
			$input_errors[] = 'You cannot specify numbers and port aliases at the same time in Source port range from: and to: field';
317
	}
318
	if ( !$_POST['dstbeginport_cust'] && $_POST['dstendport_cust'])
319
		if (is_alias($_POST['dstendport_cust']))
320
			$input_errors[] = 'If you put port alias in Destination port range to: field you must put the same port alias in from: field';
321
	if ( $_POST['dstbeginport_cust'] && $_POST['dstendport_cust']){
322
		if (is_alias($_POST['dstendport_cust']) && is_alias($_POST['dstendport_cust']) && $_POST['dstbeginport_cust'] != $_POST['dstendport_cust'])
323
			$input_errors[] = 'The same port alias must be used in Destination port range from: and to: fields';
324
		if ((is_alias($_POST['dstbeginport_cust']) && (!is_alias($_POST['dstendport_cust']) && $_POST['dstendport_cust']!='')) || 
325
		    ((!is_alias($_POST['dstbeginport_cust']) && $_POST['dstbeginport_cust']!='') && is_alias($_POST['dstendport_cust']))) 
326
			$input_errors[] = 'You cannot specify numbers and port aliases at the same time in Destination port range from: and to: field';
327
	}
328

    
329
	/* if user enters an alias and selects "network" then disallow. */
330
	if($_POST['srctype'] == "network") {
331
		if(is_alias($_POST['src']))
332
			$input_errors[] = gettext("You must specify single host or alias for alias entries.");
333
	}
334
	if($_POST['dsttype'] == "network") {
335
		if(is_alias($_POST['dst']))
336
			$input_errors[] = gettext("You must specify single host or alias for alias entries.");
337
	}
338

    
339
	if (!is_specialnet($_POST['srctype'])) {
340
		if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) {
341
			$input_errors[] = sprintf(gettext("%s is not a valid source IP address or alias."),$_POST['src']);
342
		}
343
		if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
344
			$input_errors[] = gettext("A valid source bit count must be specified.");
345
		}
346
	}
347
	if (!is_specialnet($_POST['dsttype'])) {
348
		if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) {
349
			$input_errors[] = sprintf(gettext("%s is not a valid destination IP address or alias."),$_POST['dst']);
350
		}
351
		if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
352
			$input_errors[] = gettext("A valid destination bit count must be specified.");
353
		}
354
	}
355

    
356
	if ($_POST['srcbeginport'] > $_POST['srcendport']) {
357
		/* swap */
358
		$tmp = $_POST['srcendport'];
359
		$_POST['srcendport'] = $_POST['srcbeginport'];
360
		$_POST['srcbeginport'] = $tmp;
361
	}
362
	if ($_POST['dstbeginport'] > $_POST['dstendport']) {
363
		/* swap */
364
		$tmp = $_POST['dstendport'];
365
		$_POST['dstendport'] = $_POST['dstbeginport'];
366
		$_POST['dstbeginport'] = $tmp;
367
	}
368
	if ($_POST['os'])
369
		if( $_POST['proto'] != "tcp" )
370
			$input_errors[] = gettext("OS detection is only valid with protocol tcp.");
371

    
372
	if ($_POST['ackqueue'] && $_POST['ackqueue'] != "none") {
373
		if ($_POST['defaultqueue'] == "none" )
374
			$input_errors[] = gettext("You have to select a queue when you select an acknowledge queue too.");
375
		else if ($_POST['ackqueue'] == $_POST['defaultqueue'])
376
			$input_errors[] = gettext("Acknowledge queue and Queue cannot be the same.");		
377
	}
378
	if (isset($_POST['floating']) && $_POST['pdnpipe'] != "none" && (empty($_POST['direction']) || $_POST['direction'] == "any"))
379
		$input_errors[] = gettext("You can not use limiters in Floating rules without choosing a direction.");
380
	if (isset($_POST['floating']) && $_POST['gateway'] != "" && (empty($_POST['direction']) || $_POST['direction'] == "any"))
381
		$input_errors[] = gettext("You can not use gateways in Floating rules without choosing a direction.");
382
	if ($_POST['pdnpipe'] && $_POST['pdnpipe'] != "none") {
383
		if ($_POST['dnpipe'] == "none" )
384
			$input_errors[] = gettext("You must select a queue for the In direction before selecting one for Out too.");
385
		else if ($_POST['pdnpipe'] == $_POST['dnpipe'])
386
			$input_errors[] = gettext("In and Out Queue cannot be the same.");
387
		else if ($pdnpipe[0] == "?" && $dnpipe[0] <> "?")
388
			$input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.");
389
		else if ($dnpipe[0] == "?" && $pdnpipe[0] <> "?")			
390
			$input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.");
391
	}
392
	if( !empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid']))
393
		$input_errors[] = gettext('ID must be an integer');
394
	if($_POST['l7container'] && $_POST['l7container'] != "none") {
395
		if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp"))
396
			$input_errors[] = gettext("You can only select a layer7 container for TCP and/or UDP protocols");
397
		if ($_POST['type'] <> "pass")
398
			$input_errors[] = gettext("You can only select a layer7 container for Pass type rules.");
399
	}
400

    
401
	if (!$_POST['tcpflags_any']) {
402
		$settcpflags = array();
403
		$outoftcpflags = array();
404
		foreach ($tcpflags as $tcpflag) {
405
			if ($_POST['tcpflags1_' . $tcpflag] == "on")
406
				$settcpflags[] = $tcpflag;
407
			if ($_POST['tcpflags2_' . $tcpflag] == "on")
408
				$outoftcpflags[] = $tcpflag;
409
		}
410
		if (empty($outoftcpflags) && !empty($settcpflags))
411
			$input_errors[] = gettext("If you specify TCP flags that should be set you should specify out of which flags as well.");
412
	}
413

    
414
	// Allow extending of the firewall edit page and include custom input validation 
415
	pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/input_validation");
416

    
417
	if (!$input_errors) {
418
		$filterent = array();
419
		$filterent['id'] = $_POST['ruleid']>0?$_POST['ruleid']:'';
420
		$filterent['type'] = $_POST['type'];
421
		if (isset($_POST['interface'] ))
422
			$filterent['interface'] = $_POST['interface'];
423

    
424
		if (isset($_POST['ipprotocol'] ))
425
			$filterent['ipprotocol'] = $_POST['ipprotocol'];
426

    
427
		if ($_POST['tcpflags_any']) {
428
			$filterent['tcpflags_any'] = true;
429
		} else {
430
			$settcpflags = array();
431
			$outoftcpflags = array();
432
			foreach ($tcpflags as $tcpflag) {
433
				if ($_POST['tcpflags1_' . $tcpflag] == "on")
434
					$settcpflags[] = $tcpflag;
435
				if ($_POST['tcpflags2_' . $tcpflag] == "on")
436
					$outoftcpflags[] = $tcpflag;
437
			}
438
			if (!empty($outoftcpflags)) {
439
				$filterent['tcpflags2'] = join(",", $outoftcpflags);
440
				if (!empty($settcpflags))
441
					$filterent['tcpflags1'] = join(",", $settcpflags);
442
			}
443
		}
444

    
445
		if (isset($_POST['tag']))
446
			$filterent['tag'] = $_POST['tag'];
447
		if (isset($_POST['tagged']))
448
			$filterent['tagged'] = $_POST['tagged'];
449
		if ($if == "FloatingRules" || isset($_POST['floating'])) {
450
			$filterent['direction'] = $_POST['direction'];
451
			if (isset($_POST['quick']) && $_POST['quick'] <> "")
452
				$filterent['quick'] = $_POST['quick'];
453
			$filterent['floating'] = "yes";
454
			if (isset($_POST['interface']) && count($_POST['interface']) > 0)  {
455
				$filterent['interface'] = implode(",", $_POST['interface']);
456
			}
457
		}
458

    
459
		/* Advanced options */
460
		if ($_POST['allowopts'] == "yes")
461
			$filterent['allowopts'] = true;
462
		else
463
			unset($filterent['allowopts']);
464
		if ($_POST['disablereplyto'] == "yes")
465
			$filterent['disablereplyto'] = true;
466
		else
467
			unset($filterent['disablereplyto']);
468
		$filterent['max'] = $_POST['max'];
469
		$filterent['max-src-nodes'] = $_POST['max-src-nodes'];
470
		$filterent['max-src-conn'] = $_POST['max-src-conn'];
471
		$filterent['max-src-states'] = $_POST['max-src-states'];
472
		$filterent['statetimeout'] = $_POST['statetimeout'];
473
		$filterent['statetype'] = $_POST['statetype'];
474
		$filterent['os'] = $_POST['os'];
475

    
476
		/* Nosync directive - do not xmlrpc sync this item */
477
		if($_POST['nosync'] <> "")
478
			$filterent['nosync'] = true;
479
		else
480
			unset($filterent['nosync']);
481

    
482
		/* unless both values are provided, unset the values - ticket #650 */
483
		if($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] <> "") {
484
			$filterent['max-src-conn-rate'] = $_POST['max-src-conn-rate'];
485
			$filterent['max-src-conn-rates'] = $_POST['max-src-conn-rates'];
486
		} else {
487
			unset($filterent['max-src-conn-rate']);
488
			unset($filterent['max-src-conn-rates']);
489
		}
490

    
491
		if ($_POST['proto'] != "any")
492
			$filterent['protocol'] = $_POST['proto'];
493
		else
494
			unset($filterent['protocol']);
495

    
496
		if ($_POST['proto'] == "icmp" && $_POST['icmptype'])
497
			$filterent['icmptype'] = $_POST['icmptype'];
498
		else
499
			unset($filterent['icmptype']);
500

    
501
		pconfig_to_address($filterent['source'], $_POST['src'],
502
			$_POST['srcmask'], $_POST['srcnot'],
503
			$_POST['srcbeginport'], $_POST['srcendport']);
504

    
505
		pconfig_to_address($filterent['destination'], $_POST['dst'],
506
			$_POST['dstmask'], $_POST['dstnot'],
507
			$_POST['dstbeginport'], $_POST['dstendport']);
508

    
509
		if ($_POST['disabled'])
510
			$filterent['disabled'] = true;
511
		else
512
			unset($filterent['disabled']);
513

    
514
		if ($_POST['dscp'])
515
			$filterent['dscp'] = $_POST['dscp'];
516

    
517
		if ($_POST['log'])
518
			$filterent['log'] = true;
519
		else
520
			unset($filterent['log']);
521
		strncpy($filterent['descr'], $_POST['descr'], 52);
522

    
523
		if ($_POST['gateway'] != "") {
524
			$filterent['gateway'] = $_POST['gateway'];
525
		}
526
		
527
		if (isset($_POST['defaultqueue']) && $_POST['defaultqueue'] != "none") {
528
			$filterent['defaultqueue'] = $_POST['defaultqueue'];
529
			if (isset($_POST['ackqueue']) && $_POST['ackqueue'] != "none")
530
				$filterent['ackqueue'] = $_POST['ackqueue'];
531
		}
532

    
533
		if (isset($_POST['dnpipe']) && $_POST['dnpipe'] != "none") {
534
			$filterent['dnpipe'] = $_POST['dnpipe'];
535
			if (isset($_POST['pdnpipe']) && $_POST['pdnpipe'] != "none")
536
				$filterent['pdnpipe'] = $_POST['pdnpipe'];
537
		}
538

    
539
		if (isset($_POST['l7container']) && $_POST['l7container'] != "none") {
540
			$filterent['l7container'] = $_POST['l7container'];
541
		}
542
		
543
		if ($_POST['sched'] != "") {
544
			$filterent['sched'] = $_POST['sched'];
545
		}
546

    
547
		// If we have an associated nat rule, make sure the source and destination doesn't change
548
		if( isset($a_filter[$id]['associated-rule-id']) ) {
549
			$filterent['interface'] = $a_filter[$id]['interface'];
550
			if (isset($a_filter[$id]['protocol']))
551
				$filterent['protocol'] = $a_filter[$id]['protocol'];
552
			else if (isset($filterent['protocol']))
553
				unset($filterent['protocol']);
554
			if ($a_filter[$id]['protocol'] == "icmp" && $a_filter[$id]['icmptype'])
555
				$filterent['icmptype'] = $a_filter[$id]['icmptype'];
556
			else if (isset($filterent['icmptype']))
557
				unset($filterent['icmptype']);
558

    
559
			$filterent['source'] = $a_filter[$id]['source'];
560
			$filterent['destination'] = $a_filter[$id]['destination'];
561
			$filterent['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
562
		}
563

    
564
		// Allow extending of the firewall edit page and include custom input validation 
565
		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_write_config");
566

    
567
		if (isset($id) && $a_filter[$id])
568
			$a_filter[$id] = $filterent;
569
		else {
570
			if (is_numeric($after))
571
				array_splice($a_filter, $after+1, 0, array($filterent));
572
			else
573
				$a_filter[] = $filterent;
574
		}
575

    
576
		filter_rules_sort();
577

    
578
		write_config();
579
		mark_subsystem_dirty('filter');
580

    
581
		if (isset($_POST['floating']))
582
			header("Location: firewall_rules.php?if=FloatingRules");
583
		else
584
			header("Location: firewall_rules.php?if=" . $_POST['interface']);
585
		exit;
586
	}
587
}
588

    
589
read_altq_config(); /* XXX: */
590
$qlist =& get_unique_queue_list();
591
read_dummynet_config(); /* XXX: */
592
$dnqlist =& get_unique_dnqueue_list();
593
read_layer7_config();
594
$l7clist =& get_l7_unique_list();
595

    
596
$pgtitle = array(gettext("Firewall"),gettext("Rules"),gettext("Edit"));
597
$statusurl = "status_filter_reload.php";
598
$logurl = "diag_logs_filter.php";
599

    
600
$closehead = false;
601

    
602
$page_filename = "firewall_rules_edit.php";
603
include("head.inc");
604

    
605
?>
606
<link rel="stylesheet" href="/javascript/chosen/chosen.css" />
607
</head>
608

    
609
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
610
<script src="/javascript/chosen/chosen.proto.js" type="text/javascript"></script>
611
<?php include("fbegin.inc"); ?>
612
<?php pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_input_errors"); ?>
613
<?php if ($input_errors) print_input_errors($input_errors); ?>
614

    
615
<form action="firewall_rules_edit.php" method="post" name="iform" id="iform">
616
<input type='hidden' name="ruleid" value="<?=(isset($pconfig['ruleid'])&&$pconfig['ruleid']>0)?htmlspecialchars($pconfig['ruleid']):''?>">
617

    
618
	<table width="100%" border="0" cellpadding="6" cellspacing="0">
619
		<tr>
620
			<td colspan="2" valign="top" class="listtopic"><?=gettext("Edit Firewall rule");?></td>
621
		</tr>	
622
<?php
623
		// Allow extending of the firewall edit page and include custom input validation 
624
		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/htmlphpearly");
625
?>
626
    	<tr>
627
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Action");?></td>
628
			<td width="78%" class="vtable">
629
				<select name="type" class="formselect">
630
					<?php $types = explode(" ", "Pass Block Reject"); foreach ($types as $type): ?>
631
					<option value="<?=strtolower($type);?>" <?php if (strtolower($type) == strtolower($pconfig['type'])) echo "selected"; ?>>
632
					<?=htmlspecialchars($type);?>
633
					</option>
634
					<?php endforeach; ?>
635
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
636
					<option value="match" <?php if ("match" == strtolower($pconfig['type'])) echo "selected"; ?>>Queue</option>
637
<?php endif; ?>
638
				</select>
639
				<br/>
640
				<span class="vexpl">
641
					<?=gettext("Choose what to do with packets that match the criteria specified below.");?> <br/>
642
					<?=gettext("Hint: the difference between block and reject is that with reject, a packet (TCP RST or ICMP port unreachable for UDP) is returned to the sender, whereas with block the packet is dropped silently. In either case, the original packet is discarded.");?> 
643
				</span>
644
			</td>
645
		</tr>
646
		<tr>
647
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Disabled");?></td>
648
			<td width="78%" class="vtable">
649
				<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked"; ?>>
650
				<strong><?=gettext("Disable this rule");?></strong><br />
651
				<span class="vexpl"><?=gettext("Set this option to disable this rule without removing it from the list.");?></span>
652
			</td>
653
		</tr>
654
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
655
		<tr>
656
			<td width="22%" valign="top" class="vncellreq">
657
				<?=gettext("Quick");?>
658
			</td>
659
			<td width="78%" class="vtable">
660
				<input name="quick" type="checkbox" id="quick" value="yes" <?php if ($pconfig['quick']) echo "checked=\"checked\""; ?> />
661
				<strong><?=gettext("Apply the action immediately on match.");?></strong><br />
662
				<span class="vexpl"><?=gettext("Set this option if you need to apply this action to traffic that matches this rule immediately.");?></span>
663
			</td>
664
		</tr>
665
<?php endif; ?>
666
<?php $edit_disabled = ""; ?>
667
<?php if( isset($pconfig['associated-rule-id']) ): ?>
668
		<tr>
669
			<td width="22%" valign="top" class="vncell"><?=gettext("Associated filter rule");?></td>
670
			<td width="78%" class="vtable">
671
				<span class="red"><strong><?=gettext("Note: ");?></strong></span><?=gettext("This is associated to a NAT rule.");?><br />
672
				<?=gettext("You cannot edit the interface, protocol, source, or destination of associated filter rules.");?><br />
673
				<br />
674
				<?php
675
					$edit_disabled = "disabled";
676
					if (is_array($config['nat']['rule'])) {
677
						foreach( $config['nat']['rule'] as $index => $nat_rule ) {
678
							if( isset($nat_rule['associated-rule-id']) && $nat_rule['associated-rule-id']==$pconfig['associated-rule-id'] ) {
679
								echo "<a href=\"firewall_nat_edit.php?id={$index}\">" . gettext("View the NAT rule") . "</a><br>";
680
								break;
681
							}
682
						}
683
					}
684
					echo "<input name='associated-rule-id' id='associated-rule-id' type='hidden' value='{$pconfig['associated-rule-id']}' >";
685
					if (!empty($pconfig['interface']))
686
						echo "<input name='interface' id='interface' type='hidden' value='{$pconfig['interface']}' >";
687
				?>
688
				<script type="text/javascript">
689
				editenabled = 0;
690
				</script>
691
			</td>
692
		</tr>
693
<?php endif; ?>
694
		<tr>
695
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Interface");?></td>
696
			<td width="78%" class="vtable">
697
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
698
				<select name="interface[]" title="Select interfaces..." multiple style="width:350px;" class="chzn-select" tabindex="2" <?=$edit_disabled;?>>
699
<?php else: ?>
700
				<select name="interface" class="formselect" <?=$edit_disabled;?>>
701
<?php
702
   endif;
703
				/* add group interfaces */
704
				if (is_array($config['ifgroups']['ifgroupentry']))
705
					foreach($config['ifgroups']['ifgroupentry'] as $ifgen)
706
						if (have_ruleint_access($ifgen['ifname']))
707
							$interfaces[$ifgen['ifname']] = $ifgen['ifname'];
708
				$ifdescs = get_configured_interface_with_descr();
709
				// Allow extending of the firewall edit page and include custom input validation 
710
				pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_interfaces_edit");
711
				foreach ($ifdescs as $ifent => $ifdesc)
712
					if(have_ruleint_access($ifent))
713
							$interfaces[$ifent] = $ifdesc;
714
					if ($config['l2tp']['mode'] == "server")
715
						if(have_ruleint_access("l2tp"))
716
							$interfaces['l2tp'] = "L2TP VPN";
717
					if ($config['pptpd']['mode'] == "server")
718
						if(have_ruleint_access("pptp")) 
719
							$interfaces['pptp'] = "PPTP VPN";
720
					
721
					if (is_pppoe_server_enabled() && have_ruleint_access("pppoe"))
722
						$interfaces['pppoe'] = "PPPoE VPN";
723
					/* add ipsec interfaces */
724
					if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable']))
725
						if(have_ruleint_access("enc0")) 
726
							$interfaces["enc0"] = "IPsec";
727
					/* add openvpn/tun interfaces */
728
					if  ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
729
						$interfaces["openvpn"] = "OpenVPN";
730
					$selected_interfaces = explode(",", $pconfig['interface']);
731
					foreach ($interfaces as $iface => $ifacename): ?>
732
						<option value="<?=$iface;?>" <?php if ($pconfig['interface'] <> "" && ( strcasecmp($pconfig['interface'], $iface) == 0 || in_array($iface, $selected_interfaces) )) echo "selected"; ?>><?=$ifacename?></option>
733
<?php 				endforeach; ?>
734
				</select>
735
				<br />
736
				<span class="vexpl"><?=gettext("Choose on which interface packets must come in to match this rule.");?></span>
737
			</td>
738
		</tr>
739
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
740
		<tr>
741
			<td width="22%" valign="top" class="vncellreq">
742
				<?=gettext("Direction");?>
743
			</td>
744
			<td width="78%" class="vtable">
745
				<select name="direction" class="formselect">
746
					<?php      $directions = array('any','in','out');
747
				foreach ($directions as $direction): ?>
748
				<option value="<?=$direction;?>"
749
					<?php if ($direction == $pconfig['direction']): ?>
750
						selected="selected" 
751
					<?php endif; ?>
752
					><?=$direction;?></option>
753
				<?php endforeach; ?>      
754
				</select>
755
				<input type="hidden" id="floating" name="floating" value="floating">
756
			</td>
757
		<tr>
758
<?php endif; ?>
759
		<tr>
760
			<td width="22%" valign="top" class="vncellreq"><?=gettext("TCP/IP Version");?></td>
761
			<td width="78%" class="vtable">
762
				<select name="ipprotocol" class="formselect">
763
					<?php      $ipproto = array('inet' => 'IPv4','inet6' => 'IPv6');
764
				foreach ($ipproto as $proto => $name): ?>
765
				<option value="<?=$proto;?>"
766
					<?php if ($proto == $pconfig['ipprotocol']): ?>
767
						selected="selected" 
768
					<?php endif; ?>
769
					><?=$name;?></option>
770
				<?php endforeach; ?>      
771
				</select>
772
				<strong><?=gettext("Select the Internet Protocol version this rule applies to");?></strong><br />
773
			</td>
774
		</tr>
775
		<tr>
776
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Protocol");?></td>
777
			<td width="78%" class="vtable">
778
				<select <?=$edit_disabled;?> name="proto" class="formselect" onchange="proto_change()">
779
<?php
780
				$protocols = explode(" ", "TCP UDP TCP/UDP ICMP ESP AH GRE IGMP OSPF any carp pfsync");
781
				foreach ($protocols as $proto): ?>
782
					<option value="<?=strtolower($proto);?>" <?php if (strtolower($proto) == $pconfig['proto']) echo "selected"; ?>><?=htmlspecialchars($proto);?></option>
783
<?php 			endforeach; ?>
784
				</select>
785
				<br />
786
				<span class="vexpl"><?=gettext("Choose which IP protocol this rule should match.");?> <br /> <?=gettext("Hint: in most cases, you should specify ");?><em>TCP</em> &nbsp;<?=gettext("here.");?></span>
787
			</td>
788
		</tr>
789
		<tr id="icmpbox" name="icmpbox">
790
			<td valign="top" class="vncell"><?=gettext("ICMP type");?></td>
791
			<td class="vtable">
792
				<select <?=$edit_disabled;?> name="icmptype" class="formselect">
793
<?php
794
				$icmptypes = array(
795
				"" => gettext("any"),
796
				"echoreq" => gettext("Echo request"),
797
				"echorep" => gettext("Echo reply"),
798
				"unreach" => gettext("Destination unreachable"),
799
				"squench" => gettext("Source quench"),
800
				"redir" => gettext("Redirect"),
801
				"althost" => gettext("Alternate Host"),
802
				"routeradv" => gettext("Router advertisement"),
803
				"routersol" => gettext("Router solicitation"),
804
				"timex" => gettext("Time exceeded"),
805
				"paramprob" => gettext("Invalid IP header"),
806
				"timereq" => gettext("Timestamp"),
807
				"timerep" => gettext("Timestamp reply"),
808
				"inforeq" => gettext("Information request"),
809
				"inforep" => gettext("Information reply"),
810
				"maskreq" => gettext("Address mask request"),
811
				"maskrep" => gettext("Address mask reply")
812
				);
813

    
814
				foreach ($icmptypes as $icmptype => $descr): ?>
815
					<option value="<?=$icmptype;?>" <?php if ($icmptype == $pconfig['icmptype']) echo "selected"; ?>><?=htmlspecialchars($descr);?></option>
816
<?php 			endforeach; ?>
817
			</select>
818
			<br />
819
			<span class="vexpl"><?=gettext("If you selected ICMP for the protocol above, you may specify an ICMP type here.");?></span>
820
		</td>
821
		</tr>
822
		<tr>
823
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Source");?></td>
824
			<td width="78%" class="vtable">
825
				<input <?=$edit_disabled;?> name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>>
826
				<strong><?=gettext("not");?></strong>
827
				<br />
828
				<?=gettext("Use this option to invert the sense of the match.");?>
829
				<br />
830
				<br />
831
				<table border="0" cellspacing="0" cellpadding="0">
832
					<tr>
833
						<td><?=gettext("Type:");?>&nbsp;&nbsp;</td>
834
						<td>
835
							<select <?=$edit_disabled;?> name="srctype" class="formselect" onChange="typesel_change()">
836
<?php
837
								$sel = is_specialnet($pconfig['src']); ?>
838
								<option value="any"     <?php if ($pconfig['src'] == "any") { echo "selected"; } ?>><?=gettext("any");?></option>
839
								<option value="single"  <?php if (($pconfig['srcmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>><?=gettext("Single host or alias");?></option>
840
								<option value="network" <?php if (!$sel) echo "selected"; ?>><?=gettext("Network");?></option>
841
								<?php if(have_ruleint_access("pptp")): ?>
842
								<option value="pptp"    <?php if ($pconfig['src'] == "pptp") { echo "selected"; } ?>><?=gettext("PPTP clients");?></option>
843
								<?php endif; ?>
844
								<?php if(have_ruleint_access("pppoe")): ?>
845
								<option value="pppoe"   <?php if ($pconfig['src'] == "pppoe") { echo "selected"; } ?>><?=gettext("PPPoE clients");?></option>
846
								<?php endif; ?>								
847
								 <?php if(have_ruleint_access("l2tp")): ?>
848
                                                                <option value="l2tp"   <?php if ($pconfig['src'] == "l2tp") { echo "selected"; } ?>><?=gettext("L2TP clients");?></option>
849
                                                                <?php endif; ?>
850
<?php
851
								foreach ($ifdisp as $ifent => $ifdesc): ?>
852
								<?php if(have_ruleint_access($ifent)): ?>
853
									<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?><?=gettext(" subnet");?></option>
854
									<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] ==  $ifent . "ip") { echo "selected"; } ?>>
855
										<?=$ifdesc?> <?=gettext("address");?>
856
									</option>
857
								<?php endif; ?>
858
<?php 							endforeach; ?>
859
							</select>
860
						</td>
861
					</tr>
862
					<tr>
863
						<td><?=gettext("Address:");?>&nbsp;&nbsp;</td>
864
						<td>
865
							<input <?=$edit_disabled;?> autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
866
							<select <?=$edit_disabled;?> name="srcmask" class="formselect" id="srcmask">
867
<?php						for ($i = 127; $i > 0; $i--): ?>
868
								<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option>
869
<?php 						endfor; ?>
870
							</select>
871
						</td>
872
					</tr>
873
				</table>
874
				<div id="showadvancedboxspr">
875
					<p>
876
					<input <?=$edit_disabled;?> type="button" onClick="show_source_port_range()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show source port range");?></a>
877
				</div>
878
			</td>
879
		</tr>
880
		<tr style="display:none" id="sprtable" name="sprtable">
881
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Source port range");?></td>
882
			<td width="78%" class="vtable">
883
				<table border="0" cellspacing="0" cellpadding="0">
884
					<tr>
885
						<td><?=gettext("from:");?>&nbsp;&nbsp;</td>
886
						<td>
887
							<select <?=$edit_disabled;?> name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()">
888
								<option value="">(<?=gettext("other"); ?>)</option>
889
								<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any");?></option>
890
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
891
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
892
<?php 							endforeach; ?>
893
							</select>
894
							<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo htmlspecialchars($pconfig['srcbeginport']); ?>">
895
						</td>
896
					</tr>
897
					<tr>
898
						<td><?=gettext("to:");?></td>
899
						<td>
900
							<select <?=$edit_disabled;?> name="srcendport" class="formselect" onchange="ext_change()">
901
								<option value="">(<?=gettext("other"); ?>)</option>
902
								<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any");?></option>
903
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
904
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
905
<?php							endforeach; ?>
906
							</select>
907
							<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo htmlspecialchars($pconfig['srcendport']); ?>">
908
						</td>
909
					</tr>
910
				</table>
911
				<br />
912
				<span class="vexpl"><?=gettext("Specify the source port or port range for this rule."); ?> <b><?=gettext("This is usually"); ?> <em><?=gettext("random"); ?></em> <?=gettext("and almost never equal to the destination port range (and should usually be"); ?> &quot;<?=gettext("any"); ?>&quot;).</b><br /><?=gettext("Hint: you can leave the"); ?> <em><?=gettext("'to'"); ?></em> <?=gettext("field empty if you only want to filter a single port.");?></span><br/>
913
			</td>
914
		</tr>
915
		<tr>
916
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Destination");?></td>
917
			<td width="78%" class="vtable">
918
				<input <?=$edit_disabled;?> name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked"; ?>>
919
				<strong><?=gettext("not");?></strong>
920
					<br />
921
				<?=gettext("Use this option to invert the sense of the match.");?>
922
					<br />
923
					<br />
924
				<table border="0" cellspacing="0" cellpadding="0">
925
					<tr>
926
						<td><?=gettext("Type:");?>&nbsp;&nbsp;</td>
927
						<td>
928
							<select <?=$edit_disabled;?> name="dsttype" class="formselect" onChange="typesel_change()">
929
<?php
930
								$sel = is_specialnet($pconfig['dst']); ?>
931
								<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>><?=gettext("any");?></option>
932
								<option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>><?=gettext("Single host or alias");?></option>
933
								<option value="network" <?php if (!$sel) echo "selected"; ?>><?=gettext("Network");?></option>
934
								<?php if(have_ruleint_access("pptp")): ?>
935
								<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>><?=gettext("PPTP clients");?></option>
936
								<?php endif; ?>
937
								<?php if(have_ruleint_access("pppoe")): ?>
938
								<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected"; } ?>><?=gettext("PPPoE clients");?></option>
939
								<?php endif; ?>								
940
								<?php if(have_ruleint_access("l2tp")): ?>
941
                                                                <option value="l2tp" <?php if ($pconfig['dst'] == "l2tp") { echo "selected"; } ?>><?=gettext("L2TP clients");?></option>
942
                                                                <?php endif; ?>
943

    
944
<?php 							foreach ($ifdisp as $if => $ifdesc): ?>
945
								<?php if(have_ruleint_access($if)): ?>
946
									<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> <?=gettext("subnet");?></option>
947
									<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
948
										<?=$ifdesc;?> <?=gettext("address");?>
949
									</option>
950
								<?php endif; ?>
951
<?php 							endforeach; ?>
952
							</select>
953
						</td>
954
					</tr>
955
					<tr>
956
						<td><?=gettext("Address:");?>&nbsp;&nbsp;</td>
957
						<td>
958
							<input <?=$edit_disabled;?> autocomplete='off' name="dst" type="text" class="formfldalias" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>">
959
							/
960
							<select <?=$edit_disabled;?> name="dstmask" class="formselect" id="dstmask">
961
<?php
962
							for ($i = 127; $i > 0; 
963
$i--): ?>
964
								<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected"; ?>><?=$i;?></option>
965
<?php						endfor; ?>
966
							</select>
967
						</td>
968
					</tr>
969
				</table>
970
			</td>
971
		</tr>
972
		<tr id="dprtr" name="dprtr">
973
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Destination port range ");?></td>
974
			<td width="78%" class="vtable">
975
				<table border="0" cellspacing="0" cellpadding="0">
976
					<tr>
977
						<td><?=gettext("from:");?>&nbsp;&nbsp;</td>
978
						<td>
979
							<select <?=$edit_disabled;?> name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()">
980
								<option value="">(<?=gettext("other"); ?>)</option>
981
								<option value="any" <?php $bfound = 0; if ($pconfig['dstbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any");?></option>
982
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
983
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
984
<?php 							endforeach; ?>
985
							</select>
986
							<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo htmlspecialchars($pconfig['dstbeginport']); ?>">
987
						</td>
988
					</tr>
989
					<tr>
990
						<td><?=gettext("to:");?></td>
991
						<td>
992
							<select <?=$edit_disabled;?> name="dstendport" class="formselect" onchange="ext_change()">
993
								<option value="">(<?=gettext("other"); ?>)</option>
994
								<option value="any" <?php $bfound = 0; if ($pconfig['dstendport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any");?></option>
995
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
996
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
997
<?php 							endforeach; ?>
998
							</select>
999
								<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo htmlspecialchars($pconfig['dstendport']); ?>">
1000
						</td>
1001
					</tr>
1002
				</table>
1003
				<br />
1004
				<span class="vexpl">
1005
					<?=gettext("Specify the port or port range for the destination of the packet for this rule.");?>
1006
					<br />
1007
					<?=gettext("Hint: you can leave the"); ?> <em><?=gettext("'to'"); ?></em> <?=gettext("field empty if you only want to filter a single port");?>
1008
				</span>
1009
			</td>
1010
		</tr>
1011
		<tr>
1012
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Log");?></td>
1013
			<td width="78%" class="vtable">
1014
				<input name="log" type="checkbox" id="log" value="yes" <?php if ($pconfig['log']) echo "checked"; ?>>
1015
				<strong><?=gettext("Log packets that are handled by this rule");?></strong>
1016
				<br />
1017
				<span class="vexpl"><?=gettext("Hint: the firewall has limited local log space. Don't turn on logging for everything. If you want to do a lot of logging, consider using a remote syslog server"); ?> (<?=gettext("see the"); ?> <a href="diag_logs_settings.php"><?=gettext("Diagnostics: System logs: Settings"); ?></a> <?=gettext("page"); ?>).</span>
1018
			</td>
1019
		</tr>
1020
		<tr>
1021
			<td width="22%" valign="top" class="vncell"><?=gettext("Description");?></td>
1022
			<td width="78%" class="vtable">
1023
				<input name="descr" type="text" class="formfld unknown" id="descr" size="52" maxlength="52" value="<?=htmlspecialchars($pconfig['descr']);?>">
1024
				<br />
1025
				<span class="vexpl"><?=gettext("You may enter a description here for your reference.");?></span>
1026
			</td>
1027
		</tr>
1028
<?php		if (!isset($id) || !($a_filter[$id] && firewall_check_for_advanced_options($a_filter[$id]) <> "")): ?>
1029
		<tr>
1030
			<td width="22%" valign="top">&nbsp;</td>
1031
			<td width="78%">
1032
				&nbsp;<br>&nbsp;
1033
				<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>">  <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
1034
<?php			if (isset($id) && $a_filter[$id]): ?>
1035
					<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
1036
<?php 			endif; ?>
1037
				<input name="after" type="hidden" value="<?=htmlspecialchars($after);?>">
1038
			</td>
1039
		</tr>
1040
<?php		endif; ?>
1041
		<tr>
1042
			<td>&nbsp;</td>
1043
		</tr>
1044
		<tr>
1045
			<td colspan="2" valign="top" class="listtopic"><?=gettext("Advanced features");?></td>
1046
		</tr>	
1047
		<tr>
1048
			<td width="22%" valign="top" class="vncell"><?=gettext("Source OS");?></td>
1049
			<td width="78%" class="vtable">
1050
				<div id="showadvsourceosbox" <?php if ($pconfig['os']) echo "style='display:none'"; ?>>
1051
					<input type="button" onClick="show_advanced_sourceos()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1052
				</div>
1053
				<div id="showsourceosadv" <?php if (empty($pconfig['os'])) echo "style='display:none'"; ?>>
1054
					<?=gettext("OS Type:");?>&nbsp;
1055
					<select name="os" id="os" class="formselect">
1056
<?php
1057
						$ostypes = array(
1058
							 "" => gettext("any"),
1059
							"AIX" => "AIX",
1060
							"Linux" => "Linux",
1061
							"FreeBSD" => "FreeBSD",
1062
							"NetBSD" => "NetBSD",
1063
							"OpenBSD" => "OpenBSD",
1064
							"Solaris" => "Solaris",
1065
							"MacOS" => "MacOS",
1066
							"Windows" => "Windows",
1067
							"Novell" => "Novell",
1068
							"NMAP" => "NMAP"
1069
			           );
1070
						foreach ($ostypes as $ostype => $descr): ?>
1071
							<option value="<?=$ostype;?>" <?php if ($ostype == $pconfig['os']) echo "selected"; ?>><?=htmlspecialchars($descr);?></option>
1072
<?php
1073
					endforeach; 
1074
?>
1075
					</select>
1076
					<br />
1077
					<?=gettext("Note: this only works for TCP rules");?>
1078
				</div>
1079
			</td>
1080
		</tr>
1081
		<tr>
1082
			<td width="22%" valign="top" class="vncell"><?=gettext("Diffserv Code Point");?></td>
1083
			<td width="78%" class="vtable">
1084
				<div id="dsadv" name="dsadv" <?php if ($pconfig['dscp']) echo "style='display:none'"; ?>>
1085
					<input type="button" onClick="show_dsdiv();" value="<?=gettext("Advanced"); ?>"> - <?=gettext("Show advanced option");?>
1086
				</div>
1087
				<div id="dsdivmain" name="dsdivmain" <?php if (empty($pconfig['dscp'])) echo "style='display:none'"; ?>>
1088
					<select name="dscp" id="dscp">
1089
						<option value=""></option>
1090
						<?php foreach($firewall_rules_dscp_types as $frdt): ?>
1091
							<option value="<?=$frdt?>"<?php if($pconfig['dscp'] == $frdt) echo " SELECTED"; ?>><?=$frdt?></option>
1092
						<?php endforeach; ?>
1093
					</select>
1094
				</div>
1095
			</td>
1096
		</tr>
1097
		<tr>
1098
			<td width="22%" valign="top" class="vncell"><?=gettext("Advanced Options");?></td>
1099
			<td width="78%" class="vtable">
1100
			<div id="aoadv" name="aoadv">
1101
				<input type="button" onClick="show_aodiv();" value="<?=gettext("Advanced"); ?>"> - <?=gettext("Show advanced option");?>
1102
			</div>
1103
			<div id="aodivmain" name="aodivmain" style="display:none">
1104
				<input type="checkbox" id="allowopts" value="yes" name="allowopts"<?php if($pconfig['allowopts'] == true) echo " checked"; ?>>
1105
				<br/><span class="vexpl"><?=gettext("This allows packets with IP options to pass. Otherwise they are blocked by default. This is usually only seen with multicast traffic.");?>
1106
				</span><p>
1107
				<input type="checkbox" id="disablereplyto" value="yes" name="disablereplyto"<?php if($pconfig['disablereplyto'] == true) echo " checked"; ?>>
1108
				<br/><span class="vexpl"><?=gettext("This will disable auto generated reply-to for this rule.");?>
1109
				</span><p>
1110
				<input name="tag" id="tag" value="<?=htmlspecialchars($pconfig['tag']);?>">
1111
				<br /><span class="vexpl"><?=gettext("You can mark a packet matching this rule and use this mark to match on other NAT/filter rules. It is called"); ?> <b><?=gettext("Policy filtering"); ?></b>
1112
				</span><p>
1113
				<input name="tagged" id="tagged" value="<?=htmlspecialchars($pconfig['tagged']);?>">
1114
				<br /><span class="vexpl"><?=gettext("You can match packet on a mark placed before on another rule.")?>
1115
				</span> <p>
1116
				<input name="max" id="max" value="<?php echo htmlspecialchars($pconfig['max']) ?>"><br><?=gettext(" Maximum state entries this rule can create");?></p><p>
1117
				<input name="max-src-nodes" id="max-src-nodes" value="<?php echo htmlspecialchars($pconfig['max-src-nodes']) ?>"><br><?=gettext(" Maximum number of unique source hosts");?></p><p>
1118
				<input name="max-src-conn" id="max-src-conn" value="<?php echo htmlspecialchars($pconfig['max-src-conn']) ?>"><br><?=gettext(" Maximum number of established connections per host");?></p><p>
1119
				<input name="max-src-states" id="max-src-states" value="<?php echo htmlspecialchars($pconfig['max-src-states']) ?>"><br><?=gettext(" Maximum state entries per host");?></p><p>
1120
				<input name="max-src-conn-rate" id="max-src-conn-rate" value="<?php echo htmlspecialchars($pconfig['max-src-conn-rate']) ?>"> /
1121
				<select name="max-src-conn-rates" id="max-src-conn-rates">
1122
					<option value=""<?php if(intval($pconfig['max-src-conn-rates']) < 1) echo " selected"; ?>></option>
1123
<?php				for($x=1; $x<255; $x++) {
1124
						if($x == $pconfig['max-src-conn-rates']) $selected = " selected"; else $selected = "";
1125
						echo "<option value=\"{$x}\"{$selected}>{$x}</option>\n";
1126
					} ?>
1127
				</select><br />
1128
				<?=gettext("Maximum new connections / per second(s)");?>
1129
				</p><p>
1130

    
1131
				<input name="statetimeout" value="<?php echo htmlspecialchars($pconfig['statetimeout']) ?>"><br>
1132
				<?=gettext("State Timeout in seconds");?>
1133
				</p>
1134

    
1135
				<p><strong><?=gettext("Note: Leave fields blank to disable that feature.");?></strong></p>
1136
			  </div>
1137
			</td>
1138
		</tr>
1139
		<tr id="tcpflags" name="tcpflags"> 
1140
			<td width="22%" valign="top" class="vncell"><?=gettext("TCP flags");?></td>
1141
			<td width="78%" class="vtable">
1142
			<div id="showtcpflagsbox" <?php if ($pconfig['tcpflags_any'] || $pconfig['tcpflags1'] || $pconfig['tcpflags2']) echo "style='display:none'"; ?>>
1143
                        	<input type="button" onClick="show_advanced_tcpflags()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1144
                        </div>
1145
                        <div id="showtcpflagsadv" <?php if (empty($pconfig['tcpflags_any']) && empty($pconfig['tcpflags1']) && empty($pconfig['tcpflags2'])) echo "style='display:none'"; ?>>
1146
			<div id="tcpheader" name="tcpheader">
1147
			<center>
1148
			<table border="0" cellspacing="0" cellpadding="0">
1149
			<?php 
1150
				$setflags = explode(",", $pconfig['tcpflags1']);
1151
				$outofflags = explode(",", $pconfig['tcpflags2']);
1152
				$header = "<td width='40' nowrap></td>";
1153
				$tcpflags1 = "<td width='40' nowrap>set</td>";
1154
				$tcpflags2 = "<td width='40' nowrap>out of</td>";
1155
				foreach ($tcpflags as $tcpflag) {
1156
					$header .= "<td  width='40' nowrap><strong>" . strtoupper($tcpflag) . "</strong></td>\n";
1157
					$tcpflags1 .= "<td  width='40' nowrap> <input type='checkbox' name='tcpflags1_{$tcpflag}' value='on' ";
1158
					if (array_search($tcpflag, $setflags) !== false)
1159
						$tcpflags1 .= "checked";
1160
					$tcpflags1 .= "></td>\n";
1161
					$tcpflags2 .= "<td  width='40' nowrap> <input type='checkbox' name='tcpflags2_{$tcpflag}' value='on' ";
1162
					if (array_search($tcpflag, $outofflags) !== false)
1163
						$tcpflags2 .= "checked";
1164
					$tcpflags2 .= "></td>\n";
1165
				}
1166
				echo "<tr id='tcpheader' name='tcpheader'>{$header}</tr>\n";
1167
				echo "<tr id='tcpflags1' name='tcpflags1'>{$tcpflags1}</tr>\n";
1168
				echo "<tr id='tcpflags2' name='tcpflags2'>{$tcpflags2}</tr>\n";
1169
			?>
1170
			</table>
1171
			<center>
1172
			</div>
1173
			<br/><center>
1174
			<input onClick='tcpflags_anyclick(this);' type='checkbox' name='tcpflags_any' value='on' <?php if ($pconfig['tcpflags_any']) echo "checked"; ?>><strong><?=gettext("Any flags.");?></strong><br/></center>
1175
			<br/>
1176
			<span class="vexpl"><?=gettext("Use this to choose TCP flags that must ". 
1177
			"be set or cleared for this rule to match.");?></span>
1178
			</div>
1179
			</td>
1180
		</tr>
1181
		<tr>
1182
			<td width="22%" valign="top" class="vncell"><?=gettext("State Type");?></td>
1183
			<td width="78%" class="vtable">
1184
				<div id="showadvstatebox" <?php if (!empty($pconfig['statetype']) && $pconfig['statetype'] != "keep state") echo "style='display:none'"; ?>>
1185
					<input type="button" onClick="show_advanced_state()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1186
				</div>
1187
				<div id="showstateadv" <?php if (empty($pconfig['statetype']) || $pconfig['statetype'] == "keep state") echo "style='display:none'"; ?>>
1188
					<select name="statetype">
1189
						<option value="keep state" <?php if(!isset($pconfig['statetype']) or $pconfig['statetype'] == "keep state") echo "selected"; ?>><?=gettext("keep state");?></option>
1190
						<option value="sloppy state" <?php if($pconfig['statetype'] == "sloppy state") echo "selected"; ?>><?=gettext("sloppy state");?></option>
1191
						<option value="synproxy state"<?php if($pconfig['statetype'] == "synproxy state")  echo "selected"; ?>><?=gettext("synproxy state");?></option>
1192
						<option value="none"<?php if($pconfig['statetype'] == "none") echo "selected"; ?>><?=gettext("none");?></option>
1193
					</select><br><?=gettext("Hint: Select which type of state tracking mechanism you would like to use.  If in doubt, use keep state.");?>
1194
					<p>
1195
					<table width="90%">
1196
						<tr><td width="25%"><ul><li><?=gettext("keep state");?></li></ul></td><td><?=gettext("Works with all IP protocols.");?></td></tr>
1197
						<tr><td width="25%"><ul><li><?=gettext("sloppy state");?></li></ul></td><td><?=gettext("Works with all IP protocols.");?></td></tr>
1198
						<tr><td width="25%"><ul><li><?=gettext("synproxy state");?></li></ul></td><td><?=gettext("Proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods. This option includes the functionality of keep state and modulate state combined.");?></td></tr>
1199
						<tr><td width="25%"><ul><li><?=gettext("none");?></li></ul></td><td><?=gettext("Do not use state mechanisms to keep track.  This is only useful if you're doing advanced queueing in certain situations.  Please check the documentation.");?></td></tr>
1200
					</table>
1201
					</p>
1202
			  </div>
1203
			</td>
1204
		</tr>
1205
		<tr>
1206
			<td width="22%" valign="top" class="vncell"><?=gettext("No XMLRPC Sync");?></td>
1207
			<td width="78%" class="vtable">
1208
				<div id="showadvnoxmlrpcsyncbox" <?php if ($pconfig['nosync']) echo "style='display:none'"; ?>>
1209
					<input type="button" onClick="show_advanced_noxmlrpc()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1210
				</div>
1211
				<div id="shownoxmlrpcadv" <?php if (empty($pconfig['nosync'])) echo "style='display:none'"; ?>>
1212
					<input type="checkbox" name="nosync"<?php if($pconfig['nosync']) echo " CHECKED"; ?>><br>
1213
					<?=gettext("Hint: This prevents the rule from automatically syncing to other CARP members.");?>
1214
				</div>
1215
			</td>
1216
		</tr>
1217
		<?php
1218
			//build list of schedules
1219
			$schedules = array();
1220
			$schedules[] = "none";//leave none to leave rule enabled all the time
1221
			if(is_array($config['schedules']['schedule'])) {
1222
				foreach ($config['schedules']['schedule'] as $schedule) {
1223
					if ($schedule['name'] <> "")
1224
						$schedules[] = $schedule['name'];
1225
				}
1226
			}
1227
		?>
1228
		<tr>
1229
			<td width="22%" valign="top" class="vncell"><?=gettext("Schedule");?></td>
1230
			<td width="78%" class="vtable">
1231
				<div id="showadvschedulebox" <?php if (!empty($pconfig['sched'])) echo "style='display:none'"; ?>>
1232
					<input type="button" onClick="show_advanced_schedule()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1233
				</div>
1234
				<div id="showscheduleadv" <?php if (empty($pconfig['sched'])) echo "style='display:none'"; ?>>
1235
					<select name='sched'>
1236
<?php
1237
					foreach($schedules as $schedule) {
1238
						if($schedule == $pconfig['sched']) {
1239
							$selected = " SELECTED";
1240
						} else {
1241
							$selected = "";
1242
						}
1243
						if ($schedule == "none") {
1244
							echo "<option value=\"\" {$selected}>{$schedule}</option>\n";
1245
						} else {
1246
							echo "<option value=\"{$schedule}\" {$selected}>{$schedule}</option>\n";
1247
						}
1248
					}
1249
?>
1250
					</select>
1251
					<p><?=gettext("Leave as 'none' to leave the rule enabled all the time.");?></p>
1252
				</div>
1253
			</td>
1254
		</tr>
1255
		<tr>
1256
			<td width="22%" valign="top" class="vncell"><?=gettext("Gateway");?></td>
1257
			<td width="78%" class="vtable">
1258
				<div id="showadvgatewaybox" <?php if (!empty($pconfig['gateway'])) echo "style='display:none'"; ?>>
1259
					<input type="button" onClick="show_advanced_gateway()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1260
				</div>
1261
				<div id="showgatewayadv" <?php if (empty($pconfig['gateway'])) echo "style='display:none'"; ?>>
1262
					<select name='gateway'>
1263
					<option value="" ><?=gettext("default");?></option>
1264
<?php
1265
					/* build a list of gateways */
1266
					$gateways = return_gateways_array();
1267
					// add statically configured gateways to list
1268
					foreach($gateways as $gwname => $gw) {
1269
						if($gw == "") 
1270
							continue;
1271
						if($gwname == $pconfig['gateway']) {
1272
							$selected = " SELECTED";
1273
						} else {
1274
							$selected = "";
1275
						}
1276
						echo "<option value=\"{$gwname}\" {$selected}>{$gw['name']} - {$gw['gateway']}</option>\n";
1277
					}
1278
					/* add gateway groups to the list */
1279
					if (is_array($config['gateways']['gateway_group'])) {
1280
						foreach($config['gateways']['gateway_group'] as $gw_group) {
1281
							if($gw_group['name'] == "")
1282
								continue;
1283
							if($pconfig['gateway'] == $gw_group['name']) {
1284
								echo "<option value=\"{$gw_group['name']}\" SELECTED>{$gw_group['name']}</option>\n";
1285
							} else {
1286
								echo "<option value=\"{$gw_group['name']}\">{$gw_group['name']}</option>\n";
1287
							}
1288
						}
1289
					}
1290
?>
1291
					</select>
1292
					<p><?=gettext("Leave as 'default' to use the system routing table.  Or choose a gateway to utilize policy based routing.");?></p>
1293
				</div>
1294
			</td>
1295
		</tr>
1296
		<tr>
1297
			<td width="22%" valign="top" class="vncell"><?=gettext("In/Out");?></td>
1298
			<td width="78%" class="vtable">
1299
				<div id="showadvinoutbox" <?php if (!empty($pconfig['dnpipe'])) echo "style='display:none'"; ?>>
1300
					<input type="button" onClick="show_advanced_inout()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1301
				</div>
1302
				<div id="showinoutadv" <?php if (empty($pconfig['dnpipe'])) echo "style='display:none'"; ?>>
1303
					<select name="dnpipe">
1304
<?php
1305
		if (!is_array($dnqlist))
1306
			$dnqlist = array();
1307
		echo "<option value=\"none\"";
1308
		if (!$dnqselected) echo " SELECTED";
1309
		echo " >none</option>";
1310
		foreach ($dnqlist as $dnq => $dnqkey) {
1311
			if($dnq == "")
1312
				continue;
1313
			echo "<option value=\"$dnqkey\"";
1314
			if ($dnqkey == $pconfig['dnpipe']) {
1315
				$dnqselected = 1;
1316
				echo " SELECTED";
1317
			}
1318
			echo ">{$dnq}</option>"; 
1319
		}
1320
?>
1321
			</select> / 			
1322
			<select name="pdnpipe">
1323
<?php
1324
		$dnqselected = 0;
1325
		echo "<option value=\"none\"";
1326
		if (!$dnqselected) echo " SELECTED";
1327
		echo " >none</option>";
1328
		foreach ($dnqlist as $dnq => $dnqkey) {
1329
			if($dnq == "")
1330
				continue;
1331
			echo "<option value=\"$dnqkey\"";
1332
			if ($dnqkey == $pconfig['pdnpipe']) {
1333
				$dnqselected = 1;
1334
				echo " SELECTED";
1335
			}
1336
			echo ">{$dnq}</option>"; 
1337
		}
1338
?>
1339
				</select>
1340
				<br />
1341
				<span class="vexpl"><?=gettext("Choose the Out queue/Virtual interface only if you have also selected In.")."<br/>".gettext("The Out selection is applied to traffic leaving the interface where the rule is created, In is applied to traffic coming into the chosen interface.")."<br/>".gettext("If you are creating a floating rule, if the direction is In then the same rules apply, if the direction is out the selections are reverted Out is for incoming and In is for outgoing.");?></span>
1342
				</div>
1343
			</td>
1344
		</tr>
1345

    
1346
		<tr>
1347
			<td width="22%" valign="top" class="vncell"><?=gettext("Ackqueue/Queue");?></td>
1348
			<td width="78%" class="vtable">
1349
			<div id="showadvackqueuebox" <?php if (!empty($pconfig['defaultqueue'])) echo "style='display:none'"; ?>>
1350
				<input type="button" onClick="show_advanced_ackqueue()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1351
			</div>
1352
			<div id="showackqueueadv" <?php if (empty($pconfig['defaultqueue'])) echo "style='display:none'"; ?>>
1353
				<select name="ackqueue">
1354
<?php
1355
			if (!is_array($qlist))
1356
				$qlist = array();
1357
			echo "<option value=\"none\"";
1358
			if (!$qselected) echo " SELECTED";
1359
			echo " >none</option>";
1360
			foreach ($qlist as $q => $qkey) {
1361
				if($q == "")
1362
					continue;
1363
				echo "<option value=\"$q\"";
1364
				if ($q == $pconfig['ackqueue']) {
1365
					$qselected = 1;
1366
					echo " SELECTED";
1367
				}
1368
				if (isset($ifdisp[$q]))
1369
					echo ">{$ifdisp[$q]}</option>";
1370
				else
1371
					echo ">{$q}</option>"; 
1372
			}
1373
?>
1374
				</select> / 			
1375
				<select name="defaultqueue">
1376
<?php
1377
			$qselected = 0;
1378
			echo "<option value=\"none\"";
1379
			if (!$qselected) echo " SELECTED";
1380
			echo " >none</option>";
1381
			foreach ($qlist as $q => $qkey) {
1382
				if($q == "")
1383
					continue;
1384
				echo "<option value=\"$q\"";
1385
				if ($q == $pconfig['defaultqueue']) {
1386
					$qselected = 1;
1387
					echo " SELECTED";
1388
				}
1389
				if (isset($ifdisp[$q]))
1390
					echo ">{$ifdisp[$q]}</option>";
1391
				else
1392
					echo ">{$q}</option>"; 
1393
			}
1394
?>
1395
				</select>
1396
					<br />
1397
					<span class="vexpl"><?=gettext("Choose the Acknowledge Queue only if you have selected Queue.");?></span>
1398
				</td>
1399
			</tr>
1400
			<tr>
1401
				<td width="22%" valign="top" class="vncell"><?=gettext("Layer7");?></td>
1402
				<td width="78%" class="vtable">
1403
					<div id="showadvlayer7box" <?php if (!empty($pconfig['l7container'])) echo "style='display:none'"; ?>>
1404
						<input type="button" onClick="show_advanced_layer7()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show advanced option");?></a>
1405
					</div>
1406
					<div id="showlayer7adv" <?php if (empty($pconfig['l7container'])) echo "style='display:none'"; ?>>
1407
				<select name="l7container">
1408
<?php
1409
					if (!is_array($l7clist))
1410
						$l7clist = array();
1411
					echo "<option value=\"none\"";
1412
					echo " >none</option>";
1413
					foreach ($l7clist as $l7ckey) {
1414
						echo "<option value=\"{$l7ckey}\"";
1415
						if ($l7ckey == $pconfig['l7container']) {
1416
							echo " SELECTED";
1417
						}
1418
						echo ">{$l7ckey}</option>"; 
1419
					}
1420
?>
1421
				</select>			
1422
				<br/>
1423
				<span class="vexpl">
1424
					<?=gettext("Choose a Layer7 container to apply application protocol inspection rules. " .
1425
					"These are valid for TCP and UDP protocols only.");?>
1426
				</span>
1427
			  </div>
1428
			</td>
1429
		</tr>
1430
<?php
1431
		// Allow extending of the firewall edit page and include custom input validation 
1432
		pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/htmlphplate");
1433
?>
1434
		<tr>
1435
			<td width="22%" valign="top">&nbsp;</td>
1436
			<td width="78%">
1437
				&nbsp;<br>&nbsp;
1438
				<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>">  <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
1439
<?php			if (isset($id) && $a_filter[$id]): ?>
1440
					<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
1441
<?php 			endif; ?>
1442
				<input name="after" type="hidden" value="<?=htmlspecialchars($after);?>">
1443
			</td>
1444
		</tr>
1445
	</table>
1446
</form>
1447
<script language="JavaScript">
1448
<!--
1449
	ext_change();
1450
	typesel_change();
1451
	proto_change();
1452
	<?php if ( (!empty($pconfig['srcbeginport']) && $pconfig['srcbeginport'] != "any") || (!empty($pconfig['srcendport']) && $pconfig['srcendport'] != "any") ): ?>
1453
	show_source_port_range();
1454
	<?php endif; ?>
1455

    
1456
<?php
1457
	$isfirst = 0;
1458
	$aliases = "";
1459
	$addrisfirst = 0;
1460
	$aliasesaddr = "";
1461
	if($config['aliases']['alias'] <> "" and is_array($config['aliases']['alias']))
1462
		foreach($config['aliases']['alias'] as $alias_name) {
1463
			switch ($alias_name['type']) {
1464
			case "port":
1465
				if($isfirst == 1) $portaliases .= ",";
1466
				$portaliases .= "'" . $alias_name['name'] . "'";
1467
				$isfirst = 1;
1468
				break;
1469
			case "host":
1470
			case "network":
1471
			case "openvpn":
1472
			case "urltable":
1473
				if($addrisfirst == 1) $aliasesaddr .= ",";
1474
				$aliasesaddr .= "'" . $alias_name['name'] . "'";
1475
				$addrisfirst = 1;
1476
				break;
1477
			default:
1478
				break;
1479
			}
1480
		}
1481
?>
1482

    
1483
	var addressarray=new Array(<?php echo $aliasesaddr; ?>);
1484
	var customarray=new Array(<?php echo $portaliases; ?>);
1485

    
1486
	var oTextbox1 = new AutoSuggestControl(document.getElementById("src"), new StateSuggestions(addressarray));
1487
        var oTextbox2 = new AutoSuggestControl(document.getElementById("srcbeginport_cust"), new StateSuggestions(customarray));
1488
        var oTextbox3 = new AutoSuggestControl(document.getElementById("srcendport_cust"), new StateSuggestions(customarray));
1489
        var oTextbox4 = new AutoSuggestControl(document.getElementById("dst"), new StateSuggestions(addressarray));
1490
        var oTextbox5 = new AutoSuggestControl(document.getElementById("dstbeginport_cust"), new StateSuggestions(customarray));
1491
        var oTextbox6 = new AutoSuggestControl(document.getElementById("dstendport_cust"), new StateSuggestions(customarray));
1492
//-->
1493
</script>
1494
<?php include("fend.inc"); ?>
1495
</body>
1496
</html>
(64-64/232)