Commit graph

39 commits

Author SHA1 Message Date
Jo-Philipp Wich
c2f30fbe4d treewide: import utility classes explicitly
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit 3c4bc228a1)
2020-05-07 19:40:49 +02:00
Jo-Philipp Wich
1cb07c011c luci-app-firewall: use Firewall.removeZone() helper
Fixes: FS#2932
Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2932
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 0ff4dc822b)
2020-03-26 19:16:00 +01:00
Jo-Philipp Wich
e8c638c869 luci-app-firewall: tools.firewall: properly handle protocol 0
The existing code failed to anticipate that '' == 0 in JS.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 2c036b36ce)
2020-03-04 20:22:56 +01:00
Jo-Philipp Wich
a24f198c6f luci-app-firewall: don't treat zone name as network fallback
Drop obsolete extra logic which treats the zone name as covered network
name in case the network list is unset. This behaviour applied to the
pre-fw3 uci firewall, but is not supported since fw3 anymore.

Ref: https://forum.openwrt.org/t/luci-zone-creation-bug/55921
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 663134cd2d)
2020-03-02 10:12:42 +01:00
Jo-Philipp Wich
087e6acbf4 luci-app-firewall: snats.js: fix rewrite IP validation for SNAT target
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d527c28ffa)
2020-02-22 22:20:40 +01:00
Jo-Philipp Wich
02b0c51844 luci-app-firewall: fix variable clash leading to incorrect family display
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 9fd7e9fc23)
2020-01-28 18:34:41 +01:00
Jo-Philipp Wich
a2e9e45c6d luci-app-firewall: add SNAT config migration
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit f1771d14aa)
2020-01-28 18:34:34 +01:00
Jo-Philipp Wich
03a8ea4edb luci-app-firewall: rework rule descriptions, deduplicate code
Use a simple custom format string DSL to assemble the rule description
texts in the overview page.

Also move common code for shared, complex cbi options to the firewall
tool class.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit 7944b0a90b)
2020-01-28 18:34:01 +01:00
Jo-Philipp Wich
3b60ada020 luci-app-firewall: consolidate duplicate option code
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit 0608ff09f8)
2020-01-28 18:33:05 +01:00
Jo-Philipp Wich
65e71b94e3 luci-app-firewall: support 'limit' and 'limit_burst' options
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit 28f4a9fced)
2020-01-28 18:32:42 +01:00
Jo-Philipp Wich
8b46570283 luci-app-firewall: support 'DSCP' action and matches for rules
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit aa62419e5b)
2020-01-28 18:31:22 +01:00
Jo-Philipp Wich
75dc12f56a luci-app-firewall: support 'MARK' action and matches for rules
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 3c0fcf49d4)
2020-01-28 18:31:22 +01:00
Jo-Philipp Wich
819079e268 luci-app-firewall: support 'mark' parameter for redirects
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit cdf240f0a0)
2020-01-28 18:30:40 +01:00
Jo-Philipp Wich
85dbdd03a3 luci-app-firewall: support 'helper' and 'reflection_src' parameters for redirects
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 61fe2146dd)
2020-01-28 18:30:40 +01:00
Jo-Philipp Wich
4a2281814d luci-app-firewall: support 'helper' and 'set_helper' parameters for rules
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d601e79da5)
2020-01-28 18:30:39 +01:00
Jo-Philipp Wich
c722cf3c46 luci-app-firewall: support 'direction' and 'device' parameters for rules
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 267085cf2d)
2020-01-28 18:30:39 +01:00
Jo-Philipp Wich
f8265cefc7 luci-app-firewall: fix family display for port forwards
The underlying fw3 program currently only does IPv4 port forwards while
LuCI incorrectly reports IPv4 + IPv6 for each forward. Adjust the text
accordingly to fix this.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit a178cdb5cf)
2020-01-28 18:30:39 +01:00
Jo-Philipp Wich
1787cd4a4c luci-app-firewall: introduce support for "config nat" sections
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit c8b8ae6b8e)
2020-01-28 18:29:51 +01:00
Jo-Philipp Wich
71c80a03ce luci-app-firewall: fix zone network default
When a `config zone` section lacks an `option network` or `list network`
setting, its contained interface list defaults to the name of the zone,
e.g. a zone named `foo` will implicitely contain the network `foo` unless
a deviating or empty `option network` is specified.

Adjust the zones.js model accordingly to reflect that implicit default.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d60a1a13b0)
2020-01-04 18:49:10 +01:00
Jo-Philipp Wich
00397cd8a4 luci-app-firewall: update rule ip hints based on address family
Fixes: #3119
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d07cfba160)
2019-12-30 14:52:27 +01:00
Jo-Philipp Wich
6f8a3452f8 luci-app-firewall: store week- and monthday restrictions as strings
Fixes: FS#2661
Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2661
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 18c60968dc)
2019-12-30 00:09:29 +01:00
Jo-Philipp Wich
bc5c197411 luci-app-firewall: remove obsolete "conntrack" option
Fixes: #3342
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit f6e56e67e8)
2019-11-22 08:50:56 +01:00
Jo-Philipp Wich
86f492173d treewide: require ui.js explicitly
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-11-03 21:55:50 +01:00
Jo-Philipp Wich
9e57fbb2c3 luci-base, luci-app-firewall: port custom rules to client side view
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-11-03 20:34:57 +01:00
Jo-Philipp Wich
37b6092aef luci-base, luci-mod-network, luci-app-firewall: migrate luci/getHostHints
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-11-01 12:03:33 +01:00
Nicholas Smith
f9e2d60f13 luci-app-firewall: display "this new zone" instead of "undefined"
Signed-off-by: Nicholas Smith <nicholas.smith@telcoantennas.com.au>
2019-09-11 12:52:24 +02:00
Jo-Philipp Wich
eeced34765 luci-app-firewall: disallow creating zone without name
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-09-11 12:46:59 +02:00
Jo-Philipp Wich
42bc712e2c luci-app-firewall: filter alias interfaces in zone device selection
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-09-10 15:28:16 +02:00
Jo-Philipp Wich
42bd5aa9c4 luci-app-firewall: fix zone overview page after rpc procedure renaming
The "conntrack_helpers" method has been renamed to "getConntrackHelpers".

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-08-15 15:40:46 +02:00
Jo-Philipp Wich
ed8f1c4c1c luci-app-firewall: honour global default policies in per-zone settings
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-08-14 22:58:15 +02:00
Jo-Philipp Wich
9f032e02e4 luci-app-firewall: drop usage of getOffloadSupport()
Rely on the more generic L.hasSystemFeature() from now on.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-08-14 22:58:15 +02:00
Aaron Jones
f7cb913d10
luci-app-firewall: rules: sort ICMP types alphabetically
This just makes it easier to find the type one would want.
No types were added or removed, only re-arranged.

Signed-off-by: Aaron Jones <aaronmdjones@gmail.com>
2019-08-11 06:13:15 +00:00
Aaron Jones
17f3e03930
luci-app-firewall: rules: allow ICMPv6 ND types
The "Match ICMP Type" dropdown had entries for router
solicitation & router advertisements, but not the more
generic neighbour solicitation & neighbour advertisements.

A LAN cannot function without Neighbour Discovery; this
means that setting a LAN interface default input policy to
REJECT breaks IPv6 WAN access for all hosts on that LAN;
as they can no longer discover their gateway's MAC address.
This can be fixed with appropriate rules allowing ND input,
which this patch allows one to do in LuCI.

The spelling is the same as in [1].

[1] <https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=package/network/config/firewall/files/firewall.config>

Signed-off-by: Aaron Jones <aaronmdjones@gmail.com>
2019-08-11 06:10:47 +00:00
Jo-Philipp Wich
d25f95c93d luci-app-firewall: explicitely set 'DNAT' target on new forwards
Fixes: #2920
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-26 12:36:04 +02:00
Jo-Philipp Wich
df77b47bad luci-app-firewall: add support for further per-zone options
This commit introduces support for zone devices, subnets, conntrack helpers
and iptables extra options.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-22 16:46:51 +02:00
Jo-Philipp Wich
0be4ad51a0 luci-app-firewall: fix cbi form for rules
- Set src/dest defaults only in initial section create state, otherwise it
   is impossible to specify output rules
 - Get rid of dest_remote/dest_local widget switching and implement change
   logic directly in tools.widgets.CBIZoneSelect
 - Remove leftover debug code

Ref: https://github.com/openwrt/luci/issues/2889
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-21 22:35:24 +02:00
Anton Kikin
b15c62071c luci-app-firewall: format protocol family for forwards and rules
Fixes: #2878
Signed-off-by: Anton Kikin <a.kikin@tano-systems.com>
2019-07-18 12:46:00 +03:00
Jo-Philipp Wich
f970c485cf treewide: switch to shared isObject(), toArray() and sortedKeys() helpers
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-07 20:11:35 +02:00
Jo-Philipp Wich
9c16090780 luci-app-firewall: switch to client side CBI views
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-07-07 15:36:26 +02:00