From 3d4673df1f0651cc21ec2c014847b81851ee3e98 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Tue, 16 Jan 2024 09:07:37 +0100
Subject: [PATCH] net/firewall: adjust the code almost as bundled in core

One point of contention in releasing this is how npt rules
will be added from the old layout to the new if new rules
have already been added.
---
 net/firewall/Makefile                         |  3 +-
 .../OPNsense/Firewall/FilterController.php    |  1 +
 .../OPNsense/Firewall/NptController.php       |  1 -
 .../OPNsense/Firewall/SourceNatController.php |  1 +
 .../app/models/OPNsense/Firewall/ACL/ACL.xml  | 11 ++++-
 .../Firewall/FieldTypes/FilterRuleField.php   | 42 +++++++++----------
 .../FieldTypes/SourceNatRuleField.php         | 42 +++++++++----------
 .../app/models/OPNsense/Firewall/Filter.php   | 35 ++++++++++++----
 .../app/models/OPNsense/Firewall/Filter.xml   | 11 +----
 .../models/OPNsense/Firewall/Menu/Menu.xml    |  4 +-
 .../app/views/OPNsense/Firewall/filter.volt   |  2 +-
 11 files changed, 84 insertions(+), 69 deletions(-)

diff --git a/net/firewall/Makefile b/net/firewall/Makefile
index eec978a63..4b2543eaa 100644
--- a/net/firewall/Makefile
+++ b/net/firewall/Makefile
@@ -1,6 +1,5 @@
 PLUGIN_NAME=		firewall
-PLUGIN_VERSION=		1.4
-PLUGIN_REVISION=	3
+PLUGIN_VERSION=		1.5
 PLUGIN_COMMENT=		Firewall API supplemental package
 PLUGIN_OBSOLETE=	yes
 PLUGIN_MAINTAINER=	ad@opnsense.org
diff --git a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/FilterController.php b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/FilterController.php
index 461f990a5..e558fe813 100644
--- a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/FilterController.php
+++ b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/FilterController.php
@@ -32,6 +32,7 @@ class FilterController extends \OPNsense\Base\IndexController
     public function indexAction()
     {
         $this->view->pick('OPNsense/Firewall/filter');
+        $this->view->SavePointBtns = true;
         $this->view->ruleController = "filter";
         $this->view->gridFields = [
             [
diff --git a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php
index 0e69ca4fe..d701a8003 100644
--- a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php
+++ b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php
@@ -33,7 +33,6 @@ class NptController extends \OPNsense\Base\IndexController
     {
         $this->view->pick('OPNsense/Firewall/filter');
         $this->view->ruleController = "npt";
-        $this->view->hideSavePointBtns = true;
         $this->view->gridFields = [
             [
                 'id' => 'enabled', 'formatter' => 'rowtoggle' ,'width' => '6em', 'heading' => gettext('Enabled')
diff --git a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/SourceNatController.php b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/SourceNatController.php
index 7bc2c632f..9e24cc700 100644
--- a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/SourceNatController.php
+++ b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/SourceNatController.php
@@ -32,6 +32,7 @@ class SourceNatController extends \OPNsense\Base\IndexController
     public function indexAction()
     {
         $this->view->pick('OPNsense/Firewall/filter');
+        $this->view->SavePointBtns = true;
         $this->view->ruleController = "source_nat";
         $this->view->gridFields = [
             [
diff --git a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/ACL/ACL.xml b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/ACL/ACL.xml
index 070ce99e9..c8a66f358 100644
--- a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/ACL/ACL.xml
+++ b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/ACL/ACL.xml
@@ -1,16 +1,23 @@
 <acl>
     <page-filter-api>
-        <name>Firewall: Rules: API</name>
+        <name>Firewall: Automation: Filter</name>
         <patterns>
             <pattern>ui/firewall/filter/*</pattern>
             <pattern>api/firewall/filter/*</pattern>
         </patterns>
     </page-filter-api>
     <page-filter-snat-api>
-        <name>Firewall: SourceNat: API</name>
+        <name>Firewall: Automation: Source NAT</name>
         <patterns>
             <pattern>ui/firewall/source_nat/*</pattern>
             <pattern>api/firewall/source_nat/*</pattern>
         </patterns>
     </page-filter-snat-api>
+    <page-firewall-nat-npt>
+        <name>Firewall: Automation: NPTv6</name>
+        <patterns>
+            <pattern>ui/firewall/npt/*</pattern>
+            <pattern>api/firewall/npt/*</pattern>
+        </patterns>
+    </page-firewall-nat-npt>
 </acl>
diff --git a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/FilterRuleField.php b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/FilterRuleField.php
index 70996125e..a3c69c53c 100644
--- a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/FilterRuleField.php
+++ b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/FilterRuleField.php
@@ -1,31 +1,29 @@
 <?php
 
-/**
- *    Copyright (C) 2020 Deciso B.V.
+/*
+ * Copyright (C) 2020 Deciso B.V.
+ * All rights reserved.
  *
- *    All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
  *
- *    Redistribution and use in source and binary forms, with or without
- *    modification, are permitted provided that the following conditions are met:
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
  *
- *    1. Redistributions of source code must retain the above copyright notice,
- *       this list of conditions and the following disclaimer.
- *
- *    2. Redistributions in binary form must reproduce the above copyright
- *       notice, this list of conditions and the following disclaimer in the
- *       documentation and/or other materials provided with the distribution.
- *
- *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
- *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- *    POSSIBILITY OF SUCH DAMAGE.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  */
 
 namespace OPNsense\Firewall\FieldTypes;
diff --git a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/SourceNatRuleField.php b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/SourceNatRuleField.php
index de1e1ad91..b26c5d602 100644
--- a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/SourceNatRuleField.php
+++ b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/SourceNatRuleField.php
@@ -1,31 +1,29 @@
 <?php
 
-/**
- *    Copyright (C) 2020 Deciso B.V.
+/*
+ * Copyright (C) 2020 Deciso B.V.
+ * All rights reserved.
  *
- *    All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
  *
- *    Redistribution and use in source and binary forms, with or without
- *    modification, are permitted provided that the following conditions are met:
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
  *
- *    1. Redistributions of source code must retain the above copyright notice,
- *       this list of conditions and the following disclaimer.
- *
- *    2. Redistributions in binary form must reproduce the above copyright
- *       notice, this list of conditions and the following disclaimer in the
- *       documentation and/or other materials provided with the distribution.
- *
- *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
- *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- *    POSSIBILITY OF SUCH DAMAGE.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  */
 
 namespace OPNsense\Firewall\FieldTypes;
diff --git a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
index 6ca0fd4e6..03978bc45 100644
--- a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+++ b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
@@ -40,6 +40,8 @@ class Filter extends BaseModel
      */
     public function performValidation($validateFullModel = false)
     {
+        $config = Config::getInstance()->object();
+
         // standard model validations
         $messages = parent::performValidation($validateFullModel);
         foreach ([$this->rules->rule, $this->snatrules->rule] as $rules) {
@@ -95,18 +97,35 @@ class Filter extends BaseModel
                 }
             }
         }
+
         foreach ($this->npt->rule->iterateItems() as $rule) {
             if ($validateFullModel || $rule->isFieldChanged()) {
-                if (!empty((string)$rule->destination_net) && !empty((string)$rule->trackif)) {
-                    $messages->appendMessage(new Message(
-                        gettext("A track interface is only allowed without an extrenal prefix."),
-                        $rule->trackif->__reference
-                    ));
+                if (!empty((string)$rule->trackif)) {
+                    if (!empty((string)$rule->destination_net)) {
+                        $messages->appendMessage(new Message(
+                            gettext('A track interface is only allowed without an external prefix.'),
+                            $rule->trackif->__reference
+                        ));
+                    }
+
+                    if (
+                        (empty($config->interfaces->{$rule->interface}->ipaddrv6) ||
+                        $config->interfaces->{$rule->interface}->ipaddrv6 != 'dhcp6') ||
+                        empty($config->interfaces->{$rule->trackif}->{'track6-interface'}) ||
+                        $config->interfaces->{$rule->trackif}->{'track6-interface'} != (string)$rule->interface
+                    ) {
+                        $messages->appendMessage(new Message(
+                            gettext('This interface is not tracking the current rule interface.'),
+                            $rule->trackif->__reference
+                        ));
+                    }
                 }
+
                 if (!empty((string)$rule->destination_net) && !empty((string)$rule->source_net)) {
-                    $dparts = explode('/', (string)$rule->destination_net);
-                    $sparts = explode('/', (string)$rule->source_net);
-                    if (count($dparts) == 2 && count($sparts) == 2 && $dparts[1] != $sparts[1]) {
+                    /* defaults to /128 */
+                    $dparts = explode('/', (string)$rule->destination_net . '/128');
+                    $sparts = explode('/', (string)$rule->source_net . '/128');
+                    if ($dparts[1] != $sparts[1]) {
                         $messages->appendMessage(new Message(
                             gettext("External subnet should match internal subnet."),
                             $rule->destination_net->__reference
diff --git a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
index 3e93bded0..dc7399beb 100644
--- a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+++ b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
@@ -33,7 +33,6 @@
                     <Required>Y</Required>
                 </quick>
                 <interface type="InterfaceField">
-                    <Required>N</Required>
                     <Multiple>Y</Multiple>
                     <AllowDynamic>Y</AllowDynamic>
                 </interface>
@@ -67,7 +66,6 @@
                     <Required>Y</Required>
                 </source_not>
                 <source_port type="PortField">
-                    <Required>N</Required>
                     <EnableWellKnown>Y</EnableWellKnown>
                     <EnableRanges>Y</EnableRanges>
                     <EnableAlias>Y</EnableAlias>
@@ -83,14 +81,12 @@
                     <Required>Y</Required>
                 </destination_not>
                 <destination_port type="PortField">
-                    <Required>N</Required>
                     <EnableWellKnown>Y</EnableWellKnown>
                     <EnableRanges>Y</EnableRanges>
                     <EnableAlias>Y</EnableAlias>
                     <ValidationMessage>Please specify a valid portnumber, name, alias or range</ValidationMessage>
                 </destination_port>
                 <gateway type="JsonKeyValueStoreField">
-                    <Required>N</Required>
                     <ConfigdPopulateAct>interface gateways list</ConfigdPopulateAct>
                     <SourceFile>/tmp/gateway_list.json</SourceFile>
                     <ConfigdPopulateTTL>20</ConfigdPopulateTTL>
@@ -161,7 +157,6 @@
                     <Required>Y</Required>
                 </source_not>
                 <source_port type="PortField">
-                    <Required>N</Required>
                     <EnableWellKnown>Y</EnableWellKnown>
                     <EnableRanges>Y</EnableRanges>
                     <EnableAlias>Y</EnableAlias>
@@ -176,7 +171,6 @@
                     <Required>Y</Required>
                 </destination_not>
                 <destination_port type="PortField">
-                    <Required>N</Required>
                     <EnableWellKnown>Y</EnableWellKnown>
                     <EnableRanges>Y</EnableRanges>
                     <EnableAlias>Y</EnableAlias>
@@ -187,7 +181,6 @@
                     <Required>Y</Required>
                 </target>
                 <target_port type="PortField">
-                    <Required>N</Required>
                     <EnableWellKnown>Y</EnableWellKnown>
                     <EnableRanges>Y</EnableRanges>
                 </target_port>
@@ -238,12 +231,12 @@
                 <source_net type="NetworkField">
                     <Required>Y</Required>
                     <AddressFamily>ipv6</AddressFamily>
-                    <NetMaskRequired>Y</NetMaskRequired>
+                    <NetMaskRequired>N</NetMaskRequired>
                     <WildcardEnabled>N</WildcardEnabled>
                 </source_net>
                 <destination_net type="NetworkField">
                     <AddressFamily>ipv6</AddressFamily>
-                    <NetMaskRequired>Y</NetMaskRequired>
+                    <NetMaskRequired>N</NetMaskRequired>
                     <WildcardEnabled>N</WildcardEnabled>
                 </destination_net>
                 <trackif type="InterfaceField">
diff --git a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Menu/Menu.xml b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Menu/Menu.xml
index 476e1f38b..455d06546 100644
--- a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Menu/Menu.xml
+++ b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Menu/Menu.xml
@@ -1,13 +1,13 @@
 <menu>
     <Firewall>
-        <Automation order="1000" cssClass="fa fa-gear">
+        <Automation cssClass="fa fa-gear">
             <Filter order="50" url="/ui/firewall/filter/">
                 <FilterRef url="/ui/firewall/filter#*" visibility="hidden"/>
             </Filter>
             <SourceNat order="100" VisibleName="Source NAT" url="/ui/firewall/source_nat/">
                 <FilterRef url="/ui/firewall/source_nat#*" visibility="hidden"/>
             </SourceNat>
-            <Npt order="100" VisibleName="NPTv6" url="/ui/firewall/npt/">
+            <Npt order="150" VisibleName="NPTv6" url="/ui/firewall/npt/">
                 <FilterRef url="/ui/firewall/npt#*" visibility="hidden"/>
             </Npt>
         </Automation>
diff --git a/net/firewall/src/opnsense/mvc/app/views/OPNsense/Firewall/filter.volt b/net/firewall/src/opnsense/mvc/app/views/OPNsense/Firewall/filter.volt
index 717453fe9..1b3abb397 100644
--- a/net/firewall/src/opnsense/mvc/app/views/OPNsense/Firewall/filter.volt
+++ b/net/firewall/src/opnsense/mvc/app/views/OPNsense/Firewall/filter.volt
@@ -213,7 +213,7 @@
                 data-error-title="{{ lang._('Filter load error') }}"
                 type="button"
         ></button>
-{% if not hideSavePointBtns|default(false) %}
+{% if SavePointBtns is defined %}
         <div class="pull-right">
             <button class="btn" id="savepointAct"
                     data-endpoint='/api/firewall/{{ruleController}}/savepoint'