netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/firewall: adjust the code almost as bundled in core

Browse Source 
One point of contention in releasing this is how npt rules
will be added from the old layout to the new if new rules
have already been added.
This commit is contained in:
Franco Fichtner
2024-01-16 09:07:37 +01:00
parent c81fb304bb
commit 3d4673df1f
11 changed files with 84 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/firewall/Makefile
+1 -2
View File
@@ -1,6 +1,5 @@
PLUGIN_NAME= firewall
PLUGIN_VERSION= 1.4
PLUGIN_REVISION= 3
PLUGIN_VERSION= 1.5
PLUGIN_COMMENT= Firewall API supplemental package
PLUGIN_OBSOLETE= yes
PLUGIN_MAINTAINER= ad@opnsense.org
net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/FilterController.php
+1
View File
@@ -32,6 +32,7 @@ class FilterController extends \OPNsense\Base\IndexController
public function indexAction()
{
$this->view->pick('OPNsense/Firewall/filter');
$this->view->SavePointBtns = true;
$this->view->ruleController = "filter";
$this->view->gridFields = [
[
net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php
-1
View File
@@ -33,7 +33,6 @@ class NptController extends \OPNsense\Base\IndexController
{
$this->view->pick('OPNsense/Firewall/filter');
$this->view->ruleController = "npt";
$this->view->hideSavePointBtns = true;
$this->view->gridFields = [
[
'id' => 'enabled', 'formatter' => 'rowtoggle' ,'width' => '6em', 'heading' => gettext('Enabled')
net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/SourceNatController.php
+1
View File
@@ -32,6 +32,7 @@ class SourceNatController extends \OPNsense\Base\IndexController
public function indexAction()
{
$this->view->pick('OPNsense/Firewall/filter');
$this->view->SavePointBtns = true;
$this->view->ruleController = "source_nat";
$this->view->gridFields = [
[
net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/ACL/ACL.xml
+9 -2
View File
@@ -1,16 +1,23 @@
<acl>
<page-filter-api>
<name>Firewall: Rules: API</name>
<name>Firewall: Automation: Filter</name>
<patterns>
<pattern>ui/firewall/filter/*</pattern>
<pattern>api/firewall/filter/*</pattern>
</patterns>
</page-filter-api>
<page-filter-snat-api>
<name>Firewall: SourceNat: API</name>
<name>Firewall: Automation: Source NAT</name>
<patterns>
<pattern>ui/firewall/source_nat/*</pattern>
<pattern>api/firewall/source_nat/*</pattern>
</patterns>
</page-filter-snat-api>
<page-firewall-nat-npt>
<name>Firewall: Automation: NPTv6</name>
<patterns>
<pattern>ui/firewall/npt/*</pattern>
<pattern>api/firewall/npt/*</pattern>
</patterns>
</page-firewall-nat-npt>
</acl>
net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/FilterRuleField.php
+20 -22
View File
@@ -1,31 +1,29 @@
<?php
/**
* Copyright (C) 2020 Deciso B.V.
/*
* Copyright (C) 2020 Deciso B.V.
* All rights reserved.
*
* All rights reserved.
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
namespace OPNsense\Firewall\FieldTypes;
net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/SourceNatRuleField.php
+20 -22
View File
@@ -1,31 +1,29 @@
<?php
/**
* Copyright (C) 2020 Deciso B.V.
/*
* Copyright (C) 2020 Deciso B.V.
* All rights reserved.
*
* All rights reserved.
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
namespace OPNsense\Firewall\FieldTypes;
net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+27 -8
View File
@@ -40,6 +40,8 @@ class Filter extends BaseModel
*/
public function performValidation($validateFullModel = false)
{
$config = Config::getInstance()->object();
// standard model validations
$messages = parent::performValidation($validateFullModel);
foreach ([$this->rules->rule, $this->snatrules->rule] as $rules) {
@@ -95,18 +97,35 @@ class Filter extends BaseModel
}
}
}
foreach ($this->npt->rule->iterateItems() as $rule) {
if ($validateFullModel || $rule->isFieldChanged()) {
if (!empty((string)$rule->destination_net) && !empty((string)$rule->trackif)) {
$messages->appendMessage(new Message(
gettext("A track interface is only allowed without an extrenal prefix."),
$rule->trackif->__reference
));
if (!empty((string)$rule->trackif)) {
if (!empty((string)$rule->destination_net)) {
$messages->appendMessage(new Message(
gettext('A track interface is only allowed without an external prefix.'),
$rule->trackif->__reference
));
}
if (
(empty($config->interfaces->{$rule->interface}->ipaddrv6) ||
$config->interfaces->{$rule->interface}->ipaddrv6 != 'dhcp6') ||
empty($config->interfaces->{$rule->trackif}->{'track6-interface'}) ||
$config->interfaces->{$rule->trackif}->{'track6-interface'} != (string)$rule->interface
) {
$messages->appendMessage(new Message(
gettext('This interface is not tracking the current rule interface.'),
$rule->trackif->__reference
));
}
}
if (!empty((string)$rule->destination_net) && !empty((string)$rule->source_net)) {
$dparts = explode('/', (string)$rule->destination_net);
$sparts = explode('/', (string)$rule->source_net);
if (count($dparts) == 2 && count($sparts) == 2 && $dparts[1] != $sparts[1]) {
/* defaults to /128 */
$dparts = explode('/', (string)$rule->destination_net . '/128');
$sparts = explode('/', (string)$rule->source_net . '/128');
if ($dparts[1] != $sparts[1]) {
$messages->appendMessage(new Message(
gettext("External subnet should match internal subnet."),
$rule->destination_net->__reference
net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+2 -9
View File
@@ -33,7 +33,6 @@
<Required>Y</Required>
</quick>
<interface type="InterfaceField">
<Required>N</Required>
<Multiple>Y</Multiple>
<AllowDynamic>Y</AllowDynamic>
</interface>
@@ -67,7 +66,6 @@
<Required>Y</Required>
</source_not>
<source_port type="PortField">
<Required>N</Required>
<EnableWellKnown>Y</EnableWellKnown>
<EnableRanges>Y</EnableRanges>
<EnableAlias>Y</EnableAlias>
@@ -83,14 +81,12 @@
<Required>Y</Required>
</destination_not>
<destination_port type="PortField">
<Required>N</Required>
<EnableWellKnown>Y</EnableWellKnown>
<EnableRanges>Y</EnableRanges>
<EnableAlias>Y</EnableAlias>
<ValidationMessage>Please specify a valid portnumber, name, alias or range</ValidationMessage>
</destination_port>
<gateway type="JsonKeyValueStoreField">
<Required>N</Required>
<ConfigdPopulateAct>interface gateways list</ConfigdPopulateAct>
<SourceFile>/tmp/gateway_list.json</SourceFile>
<ConfigdPopulateTTL>20</ConfigdPopulateTTL>
@@ -161,7 +157,6 @@
<Required>Y</Required>
</source_not>
<source_port type="PortField">
<Required>N</Required>
<EnableWellKnown>Y</EnableWellKnown>
<EnableRanges>Y</EnableRanges>
<EnableAlias>Y</EnableAlias>
@@ -176,7 +171,6 @@
<Required>Y</Required>
</destination_not>
<destination_port type="PortField">
<Required>N</Required>
<EnableWellKnown>Y</EnableWellKnown>
<EnableRanges>Y</EnableRanges>
<EnableAlias>Y</EnableAlias>
@@ -187,7 +181,6 @@
<Required>Y</Required>
</target>
<target_port type="PortField">
<Required>N</Required>
<EnableWellKnown>Y</EnableWellKnown>
<EnableRanges>Y</EnableRanges>
</target_port>
@@ -238,12 +231,12 @@
<source_net type="NetworkField">
<Required>Y</Required>
<AddressFamily>ipv6</AddressFamily>
<NetMaskRequired>Y</NetMaskRequired>
<NetMaskRequired>N</NetMaskRequired>
<WildcardEnabled>N</WildcardEnabled>
</source_net>
<destination_net type="NetworkField">
<AddressFamily>ipv6</AddressFamily>
<NetMaskRequired>Y</NetMaskRequired>
<NetMaskRequired>N</NetMaskRequired>
<WildcardEnabled>N</WildcardEnabled>
</destination_net>
<trackif type="InterfaceField">
net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Menu/Menu.xml
+2 -2
View File
@@ -1,13 +1,13 @@
<menu>
<Firewall>
<Automation order="1000" cssClass="fa fa-gear">
<Automation cssClass="fa fa-gear">
<Filter order="50" url="/ui/firewall/filter/">
<FilterRef url="/ui/firewall/filter#*" visibility="hidden"/>
</Filter>
<SourceNat order="100" VisibleName="Source NAT" url="/ui/firewall/source_nat/">
<FilterRef url="/ui/firewall/source_nat#*" visibility="hidden"/>
</SourceNat>
<Npt order="100" VisibleName="NPTv6" url="/ui/firewall/npt/">
<Npt order="150" VisibleName="NPTv6" url="/ui/firewall/npt/">
<FilterRef url="/ui/firewall/npt#*" visibility="hidden"/>
</Npt>
</Automation>
net/firewall/src/opnsense/mvc/app/views/OPNsense/Firewall/filter.volt
+1 -1
View File
@@ -213,7 +213,7 @@
data-error-title="{{ lang._('Filter load error') }}"
type="button"
></button>
{% if not hideSavePointBtns|default(false) %}
{% if SavePointBtns is defined %}
<div class="pull-right">
<button class="btn" id="savepointAct"
data-endpoint='/api/firewall/{{ruleController}}/savepoint'