Commit graph

60 commits

Author SHA1 Message Date
Jo-Philipp Wich
ed8f1c4c1c luci-app-firewall: honour global default policies in per-zone settings
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-08-14 22:58:15 +02:00
Jo-Philipp Wich
9f032e02e4 luci-app-firewall: drop usage of getOffloadSupport()
Rely on the more generic L.hasSystemFeature() from now on.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-08-14 22:58:15 +02:00
Aaron Jones
f7cb913d10
luci-app-firewall: rules: sort ICMP types alphabetically
This just makes it easier to find the type one would want.
No types were added or removed, only re-arranged.

Signed-off-by: Aaron Jones <aaronmdjones@gmail.com>
2019-08-11 06:13:15 +00:00
Aaron Jones
17f3e03930
luci-app-firewall: rules: allow ICMPv6 ND types
The "Match ICMP Type" dropdown had entries for router
solicitation & router advertisements, but not the more
generic neighbour solicitation & neighbour advertisements.

A LAN cannot function without Neighbour Discovery; this
means that setting a LAN interface default input policy to
REJECT breaks IPv6 WAN access for all hosts on that LAN;
as they can no longer discover their gateway's MAC address.
This can be fixed with appropriate rules allowing ND input,
which this patch allows one to do in LuCI.

The spelling is the same as in [1].

[1] <https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=package/network/config/firewall/files/firewall.config>

Signed-off-by: Aaron Jones <aaronmdjones@gmail.com>
2019-08-11 06:10:47 +00:00
Jo-Philipp Wich
d25f95c93d luci-app-firewall: explicitely set 'DNAT' target on new forwards
Fixes: #2920
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-26 12:36:04 +02:00
Jo-Philipp Wich
df77b47bad luci-app-firewall: add support for further per-zone options
This commit introduces support for zone devices, subnets, conntrack helpers
and iptables extra options.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-22 16:46:51 +02:00
Jo-Philipp Wich
0be4ad51a0 luci-app-firewall: fix cbi form for rules
- Set src/dest defaults only in initial section create state, otherwise it
   is impossible to specify output rules
 - Get rid of dest_remote/dest_local widget switching and implement change
   logic directly in tools.widgets.CBIZoneSelect
 - Remove leftover debug code

Ref: https://github.com/openwrt/luci/issues/2889
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-21 22:35:24 +02:00
Anton Kikin
b15c62071c luci-app-firewall: format protocol family for forwards and rules
Fixes: #2878
Signed-off-by: Anton Kikin <a.kikin@tano-systems.com>
2019-07-18 12:46:00 +03:00
Jo-Philipp Wich
f970c485cf treewide: switch to shared isObject(), toArray() and sortedKeys() helpers
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-07 20:11:35 +02:00
Jo-Philipp Wich
9c16090780 luci-app-firewall: switch to client side CBI views
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-07 15:36:26 +02:00