From ab8853c434d85563c6807437a36f59fd490b9eb9 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Thu, 4 Jan 2024 11:59:31 +0100
Subject: [PATCH] net/firewall - NPTv6 add track interface and validations for
 https://github.com/opnsense/core/issues/6383

---
 .../OPNsense/Firewall/Api/NptController.php    |  2 +-
 .../OPNsense/Firewall/NptController.php        |  3 +++
 .../OPNsense/Firewall/forms/dialogNptRule.xml  | 13 +++++++++++++
 .../app/models/OPNsense/Firewall/Filter.php    | 18 +++++++++++++-----
 .../app/models/OPNsense/Firewall/Filter.xml    |  6 ++++++
 5 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/NptController.php b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/NptController.php
index 1f8f4819e..9b04139d2 100644
--- a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/NptController.php
+++ b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/NptController.php
@@ -39,7 +39,7 @@ class NptController extends FilterBaseController
         };
         return $this->searchBase(
             "npt.rule",
-            ['enabled', 'sequence', 'source_net', 'destination_net', 'description'],
+            ['enabled', 'sequence', 'source_net', 'destination_net', 'trackif', 'description'],
             "sequence",
             $filter_funct
         );
diff --git a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php
index 50661eaae..0e69ca4fe 100644
--- a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php
+++ b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php
@@ -47,6 +47,9 @@ class NptController extends \OPNsense\Base\IndexController
             [
                 'id' => 'destination_net', 'heading' => gettext('External IPv6 Prefix')
             ],
+            [
+                'id' => 'trackif', 'heading' => gettext('Track if')
+            ],
             [
                 'id' => 'description', 'heading' => gettext('Description')
             ]
diff --git a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
index 051dc4061..4c68b0e40 100644
--- a/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+++ b/net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
@@ -10,6 +10,12 @@
         <label>Sequence</label>
         <type>text</type>
     </field>
+    <field>
+        <id>rule.log</id>
+        <label>Log</label>
+        <type>checkbox</type>
+        <help>Log packets that are handled by this rule</help>
+    </field>
     <field>
         <id>rule.interface</id>
         <label>Interface</label>
@@ -24,6 +30,13 @@
         <id>rule.destination_net</id>
         <label>External IPv6 Prefix (target)</label>
         <type>text</type>
+        <help>Enter the external IPv6 prefix for this network prefix translation. Leave empty to auto-detect the prefix address using the specified tracking interface instead. The prefix size specified for the internal prefix will also be applied to the external prefix.</help>
+    </field>
+    <field>
+        <id>rule.trackif</id>
+        <label>Track interface</label>
+        <type>dropdown</type>
+        <help>Use prefix defined on the selected interface instead of the interface this rule applies to when target prefix is not provided.</help>
     </field>
     <field>
         <id>rule.categories</id>
diff --git a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
index 310a65a23..6ca0fd4e6 100644
--- a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+++ b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
@@ -97,14 +97,22 @@ class Filter extends BaseModel
         }
         foreach ($this->npt->rule->iterateItems() as $rule) {
             if ($validateFullModel || $rule->isFieldChanged()) {
-                $src_is_addr = Util::isSubnet($rule->source_net) || Util::isIpAddress($rule->source_net);
-                $src_proto = strpos($rule->source_net, ':') === false ? "inet" : "inet6";
-                if ($src_is_addr && $src_proto != 'inet6') {
+                if (!empty((string)$rule->destination_net) && !empty((string)$rule->trackif)) {
                     $messages->appendMessage(new Message(
-                        gettext("You can not use IPv4 addresses in IPv6 rules."),
-                        $rule->source_net->__reference
+                        gettext("A track interface is only allowed without an extrenal prefix."),
+                        $rule->trackif->__reference
                     ));
                 }
+                if (!empty((string)$rule->destination_net) && !empty((string)$rule->source_net)) {
+                    $dparts = explode('/', (string)$rule->destination_net);
+                    $sparts = explode('/', (string)$rule->source_net);
+                    if (count($dparts) == 2 && count($sparts) == 2 && $dparts[1] != $sparts[1]) {
+                        $messages->appendMessage(new Message(
+                            gettext("External subnet should match internal subnet."),
+                            $rule->destination_net->__reference
+                        ));
+                    }
+                }
             }
         }
         return $messages;
diff --git a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
index e18a1caa7..3e93bded0 100644
--- a/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+++ b/net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
@@ -219,6 +219,10 @@
                     <Default>1</Default>
                     <Required>Y</Required>
                 </enabled>
+                <log type="BooleanField">
+                    <Default>0</Default>
+                    <Required>Y</Required>
+                </log>
                 <sequence type="IntegerField">
                     <MinimumValue>1</MinimumValue>
                     <MaximumValue>99999</MaximumValue>
@@ -242,6 +246,8 @@
                     <NetMaskRequired>Y</NetMaskRequired>
                     <WildcardEnabled>N</WildcardEnabled>
                 </destination_net>
+                <trackif type="InterfaceField">
+                </trackif>
                 <categories type="ModelRelationField">
                     <Model>
                         <rulesets>