This patch adds the initial support for layer7 protocol inspection gui.

8 files changed, 1120 insertions, 8 deletions

diff --git a/etc/inc/shaper.inc b/etc/inc/shaper.inc
index 63a14ff..24b02b4 100644
--- a/etc/inc/shaper.inc
+++ b/etc/inc/shaper.inc
@@ -3032,6 +3032,392 @@ class dnqueue_class extends dummynet_class {
 	}
 }
 
+// List of layer7 objects
+$layer7_rules_list = array();
+
+class layer7 {
+    
+    var $rname; //alias
+    var $rdescription; //alias description
+    var $rport; //divert port
+    var $renabled; //rule enabled
+    var $rsets = array(); //array of l7 associations
+    
+    // Auxiliary functions
+    
+    function GetRName() {
+        return $this->rname;
+    }
+    function SetRName($rname) {
+        $this->rname = $rname;
+    }
+    function GetRDescription() {
+        return $this->rdescription;
+    }
+    function SetRDescription($rdescription) {
+        $this->rdescription = $rdescription;
+    }
+    function GetRPort() {
+        return $this->rport;
+    }
+    function SetRPort($rport) {
+        $this->rport = $rport;
+    }
+    function GetREnabled() {
+        return $this->renabled;
+    }
+    function SetREnabled($value) {
+        $this->renabled = $value;
+    }
+    function GetRl7() {
+        return $this->rsets;
+    }
+    function SetRl7($rsets) {
+        $this->rsets = $rsets;
+    }
+    
+    //Add a tuple (rule,sctructure,element) to the $rsets
+    
+    function add_rule($l7set) {
+        $this->rsets[] = $l7set;
+    }
+    
+    // Build the layer7 rules
+    function build_l7_rules() {
+        if($this->GetREnabled() == "") {
+            return;
+        }
+        //$l7rules = "#" . $this->rdescription . "\n";
+        foreach ($this->rsets as $rl7) {
+            $l7rules .= $rl7->build_rules();
+        }
+        return $l7rules;
+    }
+    
+    // Read the config from array
+    function ReadConfig(&$qname, &$q) {
+        $this->SetRName($qname);
+        $this->SetREnabled($q['enabled']);
+        $this->SetRPort($q['divert_port']);
+        if(isset($q['description']) && $q['description'] <> "")
+            $this->SetRDescription($q['description']);
+        $rsets = $q['l7rules'];
+        //Put individual rules in the array
+	if(is_array($rsets)) {
+	    foreach($rsets as $l7r) {
+	        $l7obj = new l7rule();
+	        $l7obj->SetRProtocol($l7r['protocol']);
+	        $l7obj->SetRStructure($l7r['structure']);
+	        $l7obj->SetRBehaviour($l7r['behaviour']);
+	        $this->add_rule($l7obj);
+	    }
+	}
+    }
+    
+    //Generate a random port for the divert socket
+    function gen_divert_port() {
+        $dports = get_divert_ports(); //array of used ports
+        $divert_port = rand(40000, 60000);
+        while(true) {
+            foreach($dports as $dport) {
+                $dupe = false;
+                if($dport == $divert_port) {
+                    $divert_port = rand(40000, 60000);
+                    $dupe = true;
+                    break;
+                }
+            }
+            if(!$dupe) {
+                break;
+            }
+        }
+        return $divert_port;
+    }
+    
+    //Helps building the left tree
+    function build_tree() {
+        $tree = " <li><a href=\"firewall_shaper_layer7.php?container=" . $this->GetRName() ."&action=show\">"; 
+        $tree .= $this->GetRName() . "</a>";
+	$tree .= "</li>";
+		
+	return $tree;
+    }
+    
+    function build_form() {
+        $form = "<tr><td valign=\"top\" class=\"vncellreq\"><br>";
+	$form .= "Enable/Disable";
+	$form .= "</td><td class=\"vncellreq\">";
+	$form .= " <input type=\"checkbox\" id=\"enabled\" name=\"enabled\"";
+	if ($this->GetREnabled()) {
+       	    $form .=  "checked = \"CHECKED\"";
+	}
+	$form .= " ><span class=\"vexpl\"> Enable/Disable layer7 Container</span>";
+	$form .= "</td></tr>";
+        $form .= "<tr><td valign=\"top\" class=\"vncellreq\"><br><span class=\"vexpl\">Name</span></td>";
+	$form .= "<td class=\"vncellreq\">";
+	$form .= "<input type=\"text\" id=\"container\" name=\"container\" value=\"";
+	$form .= $this->GetRName()."\">";
+	$form .= "</td></tr>";
+	$form .= "<tr><td valign=\"top\" class=\"vncellreq\">Description</td>";
+	$form .= "<td class=\"vncellreq\">";
+	$form .= "<input type=\"text\" class=\"formfld unknown\" size=\"50%\" id=\"description\" name=\"description\" value=\"";
+	$form .= $this->GetRDescription();
+	$form .= "\">";
+	$form .= "<br> <span class=\"vexpl\">";
+	$form .= "You may enter a description here ";
+	$form .= "for your reference (not parsed).</span>";
+	$form .= "</td></tr>";
+	
+	return $form;
+    }
+    
+    //Write the setting to the $config array
+    function wconfig() {
+	global $config;
+	
+	if(!is_array($config['l7shaper']['container'])) {
+		$config['l7shaper']['container'] = array();
+	}
+        //
+        $cflink =& get_l7c_reference_to_me_in_config($this->GetRName());
+	// Test if this rule does exists already
+	if(!$cflink) {
+		$cflink =& $config['l7shaper']['container'][];
+	}
+	$cflink['name'] = $this->GetRName();
+        $cflink['enabled'] = $this->GetREnabled();
+        $cflink['description'] = $this->GetRDescription();
+        $cflink['divert_port'] = $this->GetRPort();
+        
+	//Destroy previously existent rules
+	if(is_array($cflink['rules'])) {
+		unset($cflink['l7rules']);
+	}
+	
+        $cflink['l7rules'] = array();
+	
+        $i = 0;
+        foreach($this->rsets as $rulel7) {
+            $cflink['l7rules'][$i]['protocol'] = $rulel7->GetRProtocol();
+            $cflink['l7rules'][$i]['structure'] = $rulel7->GetRStructure();
+            $cflink['l7rules'][$i]['behaviour'] = $rulel7->GetRBehaviour();
+            $i++;
+        }
+    }
+    
+    //This function is necessary to help producing the overload options for keep state
+    function get_unique_structures() {
+        
+        $unique_structures = array("action" => false, "dummynet" => false, "altq" => false);
+        foreach($this->rsets as $l7rule) {
+		if($l7rule->GetRStructure() == "action")
+			$unique_structures['action'] = true;
+		else if($l7rule->GetRStructure() == "limiter")
+			$unique_structures['dummynet'] = true;
+		else
+			$unique_structures['altq'] = true;
+        }
+	//Delete non used structures so we don't have to check this in filter.inc
+	foreach($unique_structures as $key => $value)
+		if(!$value)
+			unset($unique_structures[$key]);
+        return $unique_structures;
+    }
+    
+    function validate_input($data, &$input_errors) {
+	$reqfields[] = "container";
+	$reqdfieldsn[] = "Name";
+		
+	shaper_do_input_validation($data, $reqdfields, $reqdfieldsn, $input_errors);
+        
+        if (!preg_match("/^[a-zA-Z0-9_-]+$/", $data['container']))
+            $input_errors[] = "Queue names must be alphanumeric and _ or - only.";
+    }
+    
+    function delete_l7c() {
+	unset_l7_object_by_reference($this->GetRName());
+	cleanup_l7_from_rules($this->GetRName());
+    }
+}
+
+class l7rule {
+    
+    var $rprotocol; //protocol
+    var $rstructure; //action, limiter, queue
+    var $rbehaviour; //allow, block, queue_name, pipe_number ...
+    
+    //Auxiliary Functions
+    
+    function GetRProtocol() {
+        return $this->rprotocol;
+    }
+    function SetRProtocol($rprotocol) {
+        $this->rprotocol = $rprotocol;
+    }
+    function GetRStructure() {
+        return $this->rstructure;
+    }
+    function SetRStructure($rstructure) {
+        $this->rstructure = $rstructure;
+    }
+    function GetRBehaviour() {
+        return $this->rbehaviour;
+    }
+    function SetRBehaviour($rbehaviour) {
+        $this->rbehaviour = $rbehaviour;
+    }
+    
+    //XXX Do we need to test any particularity for AltQ queues?
+    function build_rules() {
+	global $dummynet_pipe_list;
+	switch ($this->GetRStructure()) {
+		case "limiter":
+			read_dummynet_config();
+			$dn_list =& get_unique_dnqueue_list();
+			$found = false;
+			if(is_array($dn_list)) {
+				foreach($dn_list as $key => $value) {
+					if($key == $this->GetRBehaviour()) {
+						if($value[0] == "?")
+							$l7rule = $this->GetRProtocol() . " = dnqueue " . substr($value, 1) . "\n";
+						else
+							$l7rule = $this->GetRProtocol() . " = dnpipe " . $value . "\n";
+						$found = true;
+					}
+					if($found)
+						break;
+				}
+			}
+			break;
+		default: //This is for action and for altq
+			$l7rule = $this->GetRProtocol() . " = " . $this->GetRStructure() . " " . $this->GetRBehaviour() . "\n";
+			break;
+	}
+        return $l7rule;
+    }
+}
+
+/*
+ * This function allows to return an array with all the used divert socket ports
+ */
+function get_divert_ports() {
+    global $layer7_rules_list;
+    $dports = array();
+    
+    foreach($layer7_rules_list as $l7r)
+        $dports[] = $l7r->GetRPort();
+    
+    return $dports;
+}
+
+function &get_l7c_reference_to_me_in_config(&$name) {
+	global $config;
+	
+	$ptr = NULL;
+	
+	if(is_array($config['l7shaper']['container'])) {
+		foreach($config['l7shaper']['container'] as $key => $value) {
+			if($value['name'] == $name)
+				$ptr =& $config['l7shaper']['container'][$key];
+		}
+	}	
+	return $ptr;
+// $ptr can be null. has to be checked later
+}
+
+function unset_l7_object_by_reference(&$name) {
+	global $config;
+        
+	if(is_array($config['l7shaper']['container'])) {
+		foreach($config['l7shaper']['container'] as $key => $value) {
+			if($value['name'] == $name) {
+				unset($config['l7shaper']['container'][$key]['l7rules']);
+				unset($config['l7shaper']['container'][$key]);
+				break;
+			}
+		}
+	}
+}
+
+function read_layer7_config() {
+    global $layer7_rules_list, $config;
+    
+    $l7cs = &$config['l7shaper']['container'];
+    
+    $layer7_rules_list = array();
+    
+    if (!is_array($config['l7shaper']['container']) || !count($config['l7shaper']['container']))
+	return;
+    
+    foreach ($l7cs as $conf) {
+	if (empty($conf['name']))
+		continue; /* XXX: grrrrrr at php */ 
+        $root =& new layer7();
+        $root->ReadConfig($conf['name'],$conf);
+        $layer7_rules_list[$root->GetRName()] = &$root;
+    }
+}
+
+function generate_layer7_files() {
+    global $layer7_rules_list;
+    
+    read_layer7_config();
+    
+    if (!empty($layer7_rules_list)) {
+	mwexec("kldload ipdivert.ko");
+        mwexec("killall -9 ipfw-classifyd");
+    }
+    
+    foreach($layer7_rules_list as $l7rules) {
+        if($l7rules->GetREnabled()) {
+            $filename = $l7rules->GetRName() . ".l7";
+            $path = "/tmp/" . $filename;
+        
+            $rules = $l7rules->build_l7_rules();
+        
+            $fp = fopen($path,'w');
+            fwrite($fp,$rules);
+            fclose($fp);
+            
+            $ipfw_classifyd_init = "ipfw-classifyd -c " . $path . " -p " . $l7rules->GetRPort() . " -P /usr/local/share/protocols";
+            mwexec($ipfw_classifyd_init);
+        }
+    }
+}
+
+// This function uses /usr/local/share/protocols as a default directory for searching .pat files
+function generate_protocols_array() {
+	$protocols = return_dir_as_array("/usr/local/share/protocols");
+	if(is_array($protocols)) {
+		foreach($protocols as $key => $proto)
+			$protocols[$key] =& str_replace(".pat", "", $proto);
+		sort($protocols);
+	}		
+	return $protocols;
+}
+
+function get_l7_unique_list() {
+	global $layer7_rules_list;
+	
+	$l7list = array();
+	if(is_array($layer7_rules_list)) 
+		foreach($layer7_rules_list as $l7c)
+			if($l7c->GetREnabled())
+				$l7list[] = $l7c->GetRName();
+	
+	return $l7list;
+}
+
+// Disable a removed l7 container from the filter
+function cleanup_l7_from_rules(&$name) {
+	global $config;
+
+	foreach ($config['filter']['rule'] as $key => $rule) {
+		//We have to change this
+		if ($rule['l7container'] == $name)
+			unset($config['filter']['rule'][$key]['l7container']);
+	}
+}
 
 /*
  * XXX: TODO Make a class shaper to hide all these function
@@ -3290,14 +3676,14 @@ $default_shaper_msg =	"<tr><td align=\"center\" width=\"80%\" >";
 $default_shaper_msg .= "<span class=\"vexpl\"><strong><p><b>Welcome to the pfSense Traffic Shaper.</b><br />";
 $default_shaper_msg .= "The tree on the left helps you navigate through the queues <br />";
 $default_shaper_msg .= "buttons at the bottom represent queue actions and are activated accordingly.";
-$default_shaper_ms .= " </p></strong></span>";
+$default_shaper_msg .= " </p></strong></span>";
 $default_shaper_msg .= "</td></tr>";
 
 $dn_default_shaper_msg =	"<tr><td align=\"center\" width=\"80%\" >";
 $dn_default_shaper_msg .= "<span class=\"vexpl\"><strong><p><b>Welcome to the pfSense Traffic Shaper.</b><br />";
 $dn_default_shaper_msg .= "The tree on the left helps you navigate through the queues <br />";
 $dn_default_shaper_msg .= "buttons at the bottom represent queue actions and are activated accordingly.";
-$dn_default_shaper_ms .= " </p></strong></span>";
+$dn_default_shaper_msg .= " </p></strong></span>";
 $dn_default_shaper_msg .= "</td></tr>";
 
 
diff --git a/etc/inc/xmlparse.inc b/etc/inc/xmlparse.inc
index e406f5a..c1caaa7 100644
--- a/etc/inc/xmlparse.inc
+++ b/etc/inc/xmlparse.inc
@@ -36,11 +36,11 @@ function listtags() {
    * I know it's a pain, but it's a pain to find stuff too if it's not
    */
 	$ret = explode(" ",
-		"alias aliasurl allowedip authserver bridged ca cacert cert config ".
+		"alias aliasurl allowedip authserver bridged ca cacert cert config container ".
 		"columnitem depends_on_package disk dnsserver dnsupdate domainoverrides ".
 		"dyndns earlyshellcmd element encryption-algorithm-option field ".
 		"fieldname hash-algorithm-option gateway_item gateway_group gif gre ".
-		"group hosts member interface_array item key lagg lbaction lbpool ".
+		"group hosts member interface_array item key lagg lbaction lbpool l7rules ".
 		"lbprotocol member menu tab mobilekey monitor_type mount ntpserver onetoone ".
 		"openvpn-server openvpn-client openvpn-csc " .
 		"option ppp package passthrumac phase1 phase2 priv proxyarpnet queue ".
diff --git a/usr/local/www/diag_patterns.php b/usr/local/www/diag_patterns.php
new file mode 100755
index 0000000..551fc44
--- /dev/null
+++ b/usr/local/www/diag_patterns.php
@@ -0,0 +1,130 @@
+<?php
+/* $Id$ */
+/*
+	Exec+ v1.02-000 - Copyright 2001-2003, All rights reserved
+	Created by André Ribeiro and Hélder Pereira
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+##|+PRIV
+##|*IDENT=page-diagnostics-patters
+##|*NAME=Diagnostics: Patterns page
+##|*DESCR=Allow access to the 'Diagnostics: Patterns' page.
+##|*MATCH=patterns.php*
+##|-PRIV
+
+
+require("guiconfig.inc");
+
+//Move the upload file to /usr/local/share/protocols (is_uploaded_file must use tmp_name as argument)
+if (($_POST['submit'] == "Upload") && is_uploaded_file($_FILES['ulfile']['tmp_name'])) {
+	if(fileExtension($_FILES['ulfile']['name'])) {
+		move_uploaded_file($_FILES['ulfile']['tmp_name'], "/usr/local/share/protocols/" . $_FILES['ulfile']['name']);
+		$ulmsg = "Uploaded file to /usr/local/share/protocols/" . htmlentities($_FILES['ulfile']['name']);
+	}
+	else
+		$ulmsg = "Warning: You must upload a file with .pat extension.";
+}
+
+//Check if file has correct extension (.pat)
+function fileExtension($nameFile) {
+	$format = substr($nameFile, -4);	
+	return ($format == ".pat");	
+}
+
+$pgtitle = array("Diagnostics","Add layer7 pattern");
+include("head.inc");
+?>
+
+
+<style>
+<!--
+
+input {
+   font-family: courier new, courier;
+   font-weight: normal;
+   font-size: 9pt;
+}
+
+pre {
+   border: 2px solid #435370;
+   background: #F0F0F0;
+   padding: 1em;
+   font-family: courier new, courier;
+   white-space: pre;
+   line-height: 10pt;
+   font-size: 10pt;
+}
+
+.label {
+   font-family: tahoma, verdana, arial, helvetica;
+   font-size: 11px;
+   font-weight: bold;
+}
+
+.button {
+   font-family: tahoma, verdana, arial, helvetica;
+   font-weight: bold;
+   font-size: 11px;
+}
+
+-->
+</style>
+</head>
+<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
+<?php include("fbegin.inc"); ?>
+<p><strong>You can upload new layer7 patterns to your system!</strong></p>
+<?php if ($ulmsg) echo "<p class=\"red\"><strong>" . $ulmsg . "</strong></p>\n"; ?>
+
+
+<div id="niftyOutter">
+<form action="diag_patterns.php" method="POST" enctype="multipart/form-data" name="frmPattern">
+  <table>
+	
+  <tr>
+    <td colspan="2" valign="top" class="vnsepcell">Upload</td>
+  </tr>    
+    <tr>
+      <td align="right">File to upload:</td>
+      <td valign="top" class="label">
+	<input name="ulfile" type="file" class="formfld file" id="ulfile">
+	</td></tr>
+    <tr>
+      <td valign="top">&nbsp;&nbsp;&nbsp;</td>
+      <td valign="top" class="label">	
+        <input name="submit" type="submit"  class="button" id="upload" value="Upload"></td>
+    </tr>
+	<tr>
+	  <td colspan="2" valign="top" height="16"></td>
+	</tr>
+	    
+  </table>
+</div>
+<?php include("fend.inc"); ?>
+</form>
+</body>
+</html>
+
+<?php
+
+?>
diff --git a/usr/local/www/firewall_shaper.php b/usr/local/www/firewall_shaper.php
index 9f74264..ec803a1 100755
--- a/usr/local/www/firewall_shaper.php
+++ b/usr/local/www/firewall_shaper.php
@@ -424,7 +424,8 @@ include("fbegin.inc");
 	$tab_array[0] = array("By Interface", true, "firewall_shaper.php");
 	$tab_array[1] = array("By Queue", false, "firewall_shaper_queues.php");
 	$tab_array[2] = array("Limiter", false, "firewall_shaper_vinterface.php");
-	$tab_array[3] = array("Wizards", false, "firewall_shaper_wizards.php");
+	$tab_array[3] = array("Layer7", false, "firewall_shaper_layer7.php");
+	$tab_array[4] = array("Wizards", false, "firewall_shaper_wizards.php");
 	display_top_tabs($tab_array);
 ?>
   </td></tr>
diff --git a/usr/local/www/firewall_shaper_layer7.php b/usr/local/www/firewall_shaper_layer7.php
new file mode 100755
index 0000000..71574ec
--- /dev/null
+++ b/usr/local/www/firewall_shaper_layer7.php
@@ -0,0 +1,592 @@
+<?php

+/* $Id$ */

+/*

+	firewall_shaper_layer7.php

+	Copyright (C) 2008 Helder Pereira, André Ribeiro

+	All rights reserved.

+

+	Redistribution and use in source and binary forms, with or without

+	modification, are permitted provided that the following conditions are met:

+

+	1. Redistributions of source code must retain the above copyright notice,

+	   this list of conditions and the following disclaimer.

+

+	2. Redistributions in binary form must reproduce the above copyright

+	   notice, this list of conditions and the following disclaimer in the

+	   documentation and/or other materials provided with the distribution.

+

+	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,

+	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY

+	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

+	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,

+	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

+	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

+	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

+	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

+	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

+	POSSIBILITY OF SUCH DAMAGE.

+*/

+

+##|+PRIV

+##|*IDENT=page-firewall-trafficshaper-layer7

+##|*NAME=Firewall: Traffic Shaper: Layer7 page

+##|*DESCR=Allow access to the 'Firewall: Traffic Shaper: Layer7' page.

+##|*MATCH=firewall_shaper_layer7.php*

+##|-PRIV

+

+require("guiconfig.inc");

+

+// Variables protocols (dynamic) and structures (static)

+$avail_protos =& generate_protocols_array();

+$avail_structures = array("action","queue","limiter");

+

+// Available behaviours

+$avail_behaviours_action = array("allow","block");

+read_altq_config();

+$avail_behaviours_altq = get_altq_name_list();

+read_dummynet_config();

+$avail_behaviours_limiter = get_dummynet_name_list();

+$show_proto_form = false;

+

+

+//More variables

+$pgtitle = array("Firewall","Traffic Shaper", "Layer7");

+

+$output_form = "";

+

+$default_layer7shaper_msg = "<tr><td colspan=\"4\">";

+$default_layer7shaper_msg .= "<p><span class=\"vexpl\"><span class=\"red\"><strong>Note:<br>";

+$default_layer7shaper_msg .= "</strong></span>You can add new layer7 protocol patterns by simply uploading the file <a href=\"diag_patterns.php\">here.</a><br>";

+$default_layer7shaper_msg .= "</td></tr>";

+

+

+read_layer7_config();

+

+if($_GET['reset'] <> "") {

+        mwexec("killall -9 pfctl php");

+	mwexec("killall -9 ipfw-classifyd"); //kill all ipfw-classifyd processes

+	exit;

+}

+

+if ($_GET) {

+	if ($_GET['container'])

+        	$name = trim($_GET['container']);        

+        if ($_GET['action'])

+                $action = $_GET['action'];

+}

+

+if($_POST) {

+	if ($_POST['container']) {

+		$name = trim($_POST['container']);

+	}

+}

+

+if ($name) {

+	//Get the object from the 7rules list

+	$container = $layer7_rules_list[$name];

+}

+

+

+if ($_GET) {

+	switch ($action) {

+		case "add":

+			$show_proto_form = true;

+			$container = new layer7();

+			$output_form .= $container->build_form(); //constructs the graphical interface on the right side

+			unset($container);

+			break;

+		case "show":

+			$show_proto_form = true;

+			if($container) {

+				$output_form .= $container->build_form();

+			}

+			else {

+				$show_proto_form = false;

+				$input_errors[] = "Layer7 Rules Container not found!";

+			}

+			break;

+		default:

+			echo log_error("Get default");

+			$show_proto_form = false;

+			$output_form .= "<p class=\"pgtitle\">" . $dn_default_shaper_msg . $default_layer7shaper_msg . "</p>";

+			break;

+	}

+}

+

+//add a new l7rules container

+else if ($_POST) {

+	$show_proto_form = true;

+	unset($input_errors);

+	

+	if($_POST['submit']) {

+		$l7r =& new layer7();

+		$_POST['divert_port'] = $l7r->gen_divert_port();

+		for($i=0; $i<100; $i++) {

+			if($_POST['protocol'][$i] <> "") {

+				$_POST['l7rules'][$i]['protocol'] = $_POST['protocol'][$i];

+				$_POST['l7rules'][$i]['structure'] = $_POST['structure'][$i];

+				$_POST['l7rules'][$i]['behaviour'] = $_POST['behaviour'][$i];

+			}

+			else {

+				break;

+			}

+		}

+		$l7r->validate_input($_POST,&$input_errors);

+		$l7r->ReadConfig($_POST['container'], $_POST);

+		//Before writing the results, we need to test for repeated protocols

+		$non_dupes = array();

+		$dupes = array();

+		for($j=0; $j<$i; $j++) {

+			if(!$non_dupes[$_POST['protocol'][$j]])

+				$non_dupes[$_POST['protocol'][$j]] = true;

+			else

+				$dupes[] = $_POST['protocol'][$j];

+		}

+		unset($non_dupes);

+		if(sizeof($dupes) == 0 && !$input_errors) {

+			$l7r->wconfig();

+			write_config();

+			touch($d_shaperconfdirty_path);

+		

+			read_layer7_config();

+		}

+		else {

+			if(sizeof($dupes) > 0) {

+				$dupe_error = "Found the following repeated protocol definitions: ";

+				foreach($dupes as $dupe)

+					$dupe_error .= "$dupe ";

+				$input_errors[] .= $dupe_error;

+			}

+		}

+		unset($dupes);

+		unset($dupe_error);

+		//Even if there are repeated protocols, we won't loose any previous values

+		//The user will be able to solve the situation

+		$output_form .= $l7r->build_form();

+		//Necessary to correctly build the proto form

+		$container = $layer7_rules_list[$name];

+		if($input_errors)

+			$container =& $l7r;

+	} else if($_POST['apply']) {

+		write_config();

+

+		$retval = 0;

+		$savemsg = get_std_save_message($retval);

+			

+		config_lock();

+		$retval = filter_configure();

+		config_unlock();

+			

+		if(stristr($retval, "error") <> true)

+			$savemsg = get_std_save_message($retval);

+		else

+			$savemsg = $retval;

+

+		unlink($d_shaperconfdirty_path);

+		

+		if($container) {

+			$output_form .= $container->build_form();

+		} else {

+			$show_proto_form = false;

+			$output_form .= "<p class=\"pgtitle\">" . $dn_default_shaper_msg . $default_layer7shaper_msg . "</p>";

+		}

+	} else if ($_POST['delete']) {

+		$container->delete_l7c();

+		write_config();

+		touch($d_shaperconfdirty_path);

+		unset($container);

+		

+		header("Location: firewall_shaper_layer7.php");

+		exit;

+	}

+	else {

+		$show_proto_form = false;

+	}

+}

+else {

+	$show_proto_form = false;

+	$output_form .= "<p class=\"pgtitle\">" . $dn_default_shaper_msg . $default_layer7shaper_msg . "</p>";

+}

+

+// Builds the left tree

+$tree = "<ul class=\"tree\" >";

+if (is_array($layer7_rules_list)) {

+        foreach ($layer7_rules_list as $tmpl7) {

+                $tree .= $tmpl7->build_tree();

+        }

+}

+$tree .= "</ul>";

+

+$output = "<div id=\"shaperarea\" style=\"position:relative\">";

+$output .= $output_form;

+

+include("head.inc");

+?>

+

+<body link="#0000CC" vlink="#0000CC" alink="#0000CC" >

+<link rel="stylesheet" type="text/css" media="all" href="./tree/tree.css" />

+<script type="text/javascript" src="./tree/tree.js"></script>

+                                        

+<script language="javascript">

+

+var initial_count = new Array();

+var rows_limit = 0; // Set to 0 to disable limitation

+

+

+/* Build the behaviours arrays in javascript */

+var js_behaviours_action = ['allow', 'block']; //static

+

+var js_behaviours_altq = new Array();

+js_behaviours_altq = array_altq(js_behaviours_altq);

+

+var js_behaviours_limiter = new Array();

+js_behaviours_limiter = array_limiter(js_behaviours_limiter);

+

+function array_altq(a_behav) {

+	var index;

+	<? if (!empty($avail_behaviours_altq)) {

+	  foreach ($avail_behaviours_altq as $key => $queue) { ?>

+	    name = "<?= $queue; ?>";

+	    index = <? echo $key; ?>;

+	    a_behav[index] = name;

+	<? }

+	} ?>

+	return a_behav;

+}

+

+function array_limiter(a_behav) {

+	var index;

+	<? if (!empty($avail_behaviours_limiter)) {

+	  foreach ($avail_behaviours_limiter as $key => $limiter) { ?>

+		name = "<?= $limiter; ?>";

+		index = <? echo $key; ?>;

+		a_behav[index] = name;

+	<? }

+	} ?>

+	return a_behav;

+}

+

+/* Fill the variables with available protocols, structures and behaviours */

+function fillProtocol() {

+	var protocol = '<select name="protocol[]" id="protocol" style="font-size:8pt">';

+	var name;

+

+	<? foreach ($avail_protos as $key => $proto) { ?>

+		name = "<?= $proto; ?>";

+		protocol += "<option value=" + name + ">" + name + "</option>";

+	<? } ?>

+	protocol += "</select>";

+	

+	return protocol;

+}

+

+function fillStructure() {

+	var structure = '<select name="structure[]" id="structure" style="font-size:8pt" onchange="changeBehaviourValues(this.parentNode.parentNode);">';

+	var name;

+	<? foreach ($avail_structures as $key => $struct) { ?>

+		name = "<?= $struct; ?>";

+		if(name == "queue") {

+		  if(js_behaviours_altq != "") { structure += "<option value=" + name + ">" + name + "</option>";}

+		}

+		else {

+		  if(name == "limiter") {

+		    if(js_behaviours_limiter != "") { structure += "<option value=" + name + ">" + name + "</option>";}

+		  }

+		  else structure += "<option value=" + name + ">" + name + "</option>"; //action		  		

+		}		

+	<? } ?>

+	structure += "</select>";

+	

+	return structure;

+}

+		

+//Used by default to fill the values when inserting a new row.

+function fillBehaviour() {

+	var behaviour = '<select name="behaviour[]" id="behaviour" style="width:80px; font-size:8pt">';

+	var name;

+	<? foreach ($avail_behaviours_action as $key => $behav) { ?>

+		name = "<?= $behav; ?>";

+		behaviour += "<option value=" + name + ">" + name + "</option>";

+	<? } ?>

+	behaviour += "</select>";

+	

+	return behaviour;

+}

+

+/* Change the values on behaviours select when changing the structure row */

+function changeBehaviourValues(row) {

+	var selectedRow = row.rowIndex - 2; //because row.rowIndex returns 2, not 0

+	var structureSelected = document.getElementsByName("structure[]")[selectedRow].value;		

+	

+	//Select the behaviours values to array a_behav

+	var a_behav = new Array();	

+	if (structureSelected == "action") {

+		a_behav = js_behaviours_action; //static

+	}

+	else {

+		if (structureSelected == "queue") {			

+			a_behav = js_behaviours_altq;

+		}

+		else {							

+			a_behav = js_behaviours_limiter;

+		}					

+	}			

+	

+	//Build the html statement with the array values previously selected

+	var new_behav;

+	var name;

+	for(i=0; i<a_behav.length; i++) {

+		new_behav += "<option value=" + a_behav[i] + ">" + a_behav[i] + "</option>";	

+	}

+		

+	document.getElementsByName("behaviour[]")[selectedRow].innerHTML = new_behav;		

+}

+

+/* Add row to the table */

+function addRow(table_id) {

+  var tbl = document.getElementById(table_id);

+  // counting rows in table

+  var rows_count = tbl.rows.length;

+  if (initial_count[table_id] == undefined) {

+    // if it is first adding in this table setting initial rows count

+    initial_count[table_id] = rows_count;

+  }

+  // determining real count of added fields

+  var tFielsNum =  rows_count - initial_count[table_id];

+  if (rows_limit!=0 && tFielsNum >= rows_limit) return false;

+  

+  var remove = '<input type = "image" src = "/themes/<?echo $g['theme'];?>/images/icons/icon_x.gif" onclick="removeRow(\''+table_id+'\',this.parentNode.parentNode)" value = "Delete" />';

+  

+  try {

+    var newRow = tbl.insertRow(rows_count);

+    var newCell = newRow.insertCell(0);

+    newCell.innerHTML = fillProtocol();

+    var newCell = newRow.insertCell(1);

+    newCell.innerHTML = fillStructure();

+    var newCell = newRow.insertCell(2);

+    newCell.innerHTML = fillBehaviour();

+    var newCell = newRow.insertCell(3);

+    newCell.innerHTML = remove;

+  }   

+  catch (ex) {

+    //if exception occurs

+    alert(ex);

+  }   

+}

+

+/* Remove row from the table */

+function removeRow(tbl,row) {

+  var table = document.getElementById(tbl);

+  try {

+    table.deleteRow(row.rowIndex);

+  } catch (ex) {

+    alert(ex);

+  }

+}

+</script>

+

+<?php

+include("fbegin.inc"); 

+?>

+<div id="inputerrors"></div>

+<?php if ($input_errors) print_input_errors($input_errors); ?>

+

+<form action="firewall_shaper_layer7.php" method="post" id="iform" name="iform">

+

+<?php if ($savemsg) print_info_box($savemsg); ?>

+<?php if (file_exists($d_shaperconfdirty_path)): ?><p>

+<?php print_info_box_np("The traffic shaper configuration has been changed.<br>You must apply the changes in order for them to take effect.");?><br>

+<?php endif; ?>

+<table width="100%" border="0" cellpadding="0" cellspacing="0">

+  <tr><td>

+<?php

+	$tab_array = array();

+	$tab_array[0] = array("By Interface", false, "firewall_shaper.php");

+	$tab_array[1] = array("By Queue", false, "firewall_shaper_queues.php");

+	$tab_array[2] = array("Limiter", false, "firewall_shaper_vinterface.php");

+	$tab_array[3] = array("Layer7", true, "firewall_shaper_layer7.php");

+	$tab_array[4] = array("Wizards", false, "firewall_shaper_wizards.php");

+	display_top_tabs($tab_array);

+?>

+  </td></tr>

+  <tr>

+    <td>

+	<div id="mainarea">

+              <table class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0">

+		

+		<?php if (count($layer7_rules_list) > 0): ?>

+                        <tr class="tabcont"><td width="25%" align="left">

+                        </td><td width="75%"> </td></tr>

+		

+		<? endif; ?>

+			<tr>

+			<td width="25%" valign="top" algin="left">

+			<?php

+				echo $tree; 

+			?>

+			<br/><br/>

+			<a href="firewall_shaper_layer7.php?action=add">

+			<img src="./themes/<?=$g['theme']; ?>/images/icons/icon_plus.gif" title="Create new l7 rules group" width="17" height="17" border="0">  Create new l7 rules group

+			</a><br/>

+			</td>

+			<td width="75%" valign="top" align="center">

+			<table>

+			<?

+				echo $output;

+			?>

+			

+			<!-- Layer 7 rules form -->

+			<?php if($show_proto_form): ?>

+			<td width = "22%" valign = "top" class = "vncellreq">

+                                <div id = "addressnetworkport">

+                                        Rule(s)

+                                </div>

+                        </td>

+

+                        <td width = "78%" class = "vtable">

+                                <table width="236" id = "maintable">

+					<tbody>

+                                                    

+						<tr>

+                                                        <td colspan = "4">

+                                                            <div style = "font-size: 8pt; padding:5px; margin-top: 16px; margin-bottom: 16px; border:1px dashed #000066;"

+                                                                id = "itemhelp">

+                                                                Add one or more rules

+                                                            </div>

+                                                        </td>

+                                                </tr>

+

+                                                <tr>

+                                                        <td>

+                                                            <div style = "font-size: 8pt; padding:5px;"

+                                                                id = "onecolumn">

+                                                                Protocol

+                                                            </div>

+                                                        </td>

+

+                                                        <td>

+                                                            <div style = "font-size: 8pt; padding:5px;"

+                                                                id = "twocolumn">

+                                                                Structure

+                                                            </div>

+                                                        </td>

+

+                                                        <td>

+                                                            <div style = "font-size: 8pt; padding:5px;"

+                                                                id = "threecolumn">

+                                                                Behaviour

+                                                            </div>

+                                                        </td>

+                                                </tr>                                                                                                        

+                                                <!-- PHP Code to generate the existing rules -->

+						<?php

+						if($container) {

+							foreach($container->rsets as $l7rule) {

+						?>

+						<tr>

+							<td>

+							<select name="protocol[]" class="formselect" id="protocol" style="font-size:8pt">

+							<?php foreach($avail_protos as $proto): ?>

+							<option value="<?=$proto;?>" <?php if ($proto == $l7rule->GetRProtocol()) echo "selected"; ?>><?=$proto;?></option>

+							<? endforeach; ?>

+							</select>

+						</td>

+						<td>

+							<select name="structure[]" class="formselect" id="structure" style="font-size:8pt" onchange="changeBehaviourValues(this.parentNode.parentNode);">

+							<?php foreach($avail_structures as $struct) {

+							  if($struct == "queue") {

+							    if(!empty($avail_behaviours_altq)) { ?>

+							      <option value="<?=$struct ?>" <?php if ($struct == $l7rule->GetRStructure()) echo "selected"; ?>><?=$struct;?></option>

+							    <?php }

+							  }

+							  else {

+							    if($struct == "limiter") {

+								if(!empty($avail_behaviours_limiter)) { ?>

+								  <option value="<?=$struct ?>" <?php if ($struct == $l7rule->GetRStructure()) echo "selected"; ?>><?=$struct;?></option>

+								<?php }

+							    }

+							    else {

+							      if($struct == "action") { ?>

+								  <option value="<?=$struct ?>" <?php if ($struct == $l7rule->GetRStructure()) echo "selected"; ?>><?=$struct;?></option>

+							      <?php }							      							      

+							    }

+							  }

+							} ?>

+							</select>

+						</td>

+						<td>

+							<select name="behaviour[]" class="formselect" id="behaviour" style="width:80px; font-size:8pt">

+							<?php if($l7rule->GetRStructure() == "action"): ?>

+								<?php foreach($avail_behaviours_action as $behaviour): ?>

+								<option value="<?=$behaviour ?>" <?php if ($behaviour == $l7rule->GetRBehaviour()) echo "selected"; ?>><?=$behaviour;?></option>

+								<? endforeach; ?>

+								</select>

+							<? endif; ?>

+							<?php if($l7rule->GetRStructure() == "queue"): ?>

+								<?php foreach($avail_behaviours_altq as $behaviour): ?>

+								<option value="<?=$behaviour ?>" <?php if ($behaviour == $l7rule->GetRBehaviour()) echo "selected"; ?>><?=$behaviour;?></option>

+								<? endforeach; ?>

+								</select>

+							<? endif; ?>

+							<?php if($l7rule->GetRStructure() == "limiter"): ?>

+								<?php foreach($avail_behaviours_limiter as $behaviour): ?>

+								<option value="<?=$behaviour ?>" <?php if ($behaviour == $l7rule->GetRBehaviour()) echo "selected"; ?>><?=$behaviour;?></option>

+								<? endforeach; ?>

+								</select>

+							<? endif; ?>							

+						</td>

+						<td>

+							<input type="image" src="/themes/<? echo $g['theme'];?>/images/icons/icon_x.gif" onclick="removeRow('maintable',this.parentNode.parentNode); return false;" value="Delete" />

+						</td>

+						</tr>

+						

+						<?php

+							} //end foreach

+						} //end if

+						?>  

+                                        </tbody>

+

+                                        <tfoot>

+                                        </tfoot>

+                                </table>

+

+                                        <a onclick = "javascript:addRow('maintable'); return false;" href="#"> <img border = "0"

+                                                src = "/themes/<?=$g['theme']; ?>/images/icons/icon_plus.gif"

+                                                alt = "" title = "add another entry" /> </a>

+                        </td>

+			</tr>

+

+                        <tr>

+                        <td width = "22%" valign = "top">

+                                &nbsp;

+                        </td>

+

+                        <td width = "78%">

+                                <input id = "submit"

+                                name = "submit" type = "submit" class = "formbtn" value = "Save" />

+

+				<a href= "firewall_shaper_layer7.php">

+                                <input id = "cancelbutton"

+                                name = "cancelbutton" type = "button" class = "formbtn" value = "Cancel" /></a>

+				

+				<?php if($container): ?>

+						<input id = "delete" type="submit" class="formbtn" name="delete" value="Delete"></a>

+				<? endif ?>

+                        </td>

+                        </tr>

+			<? endif; ?>

+			<!-- End of layer7 rules form -->

+			</table>

+

+		      </td></tr>

+                    </table>

+		</div>

+	  </td>

+	</tr>

+</table>

+</form>

+

+<?php include("fend.inc"); 

+?>

+</body>

+</html>
\ No newline at end of file
diff --git a/usr/local/www/firewall_shaper_queues.php b/usr/local/www/firewall_shaper_queues.php
index 061314b..342083e 100755
--- a/usr/local/www/firewall_shaper_queues.php
+++ b/usr/local/www/firewall_shaper_queues.php
@@ -188,7 +188,8 @@ include("head.inc");
 	$tab_array[0] = array("By Interface", false, "firewall_shaper.php");
 	$tab_array[1] = array("By Queue", true, "firewall_shaper_queues.php");
 	$tab_array[2] = array("Limiter", false, "firewall_shaper_vinterface.php");
-	$tab_array[3] = array("Wizards", false, "firewall_shaper_wizards.php");
+	$tab_array[3] = array("Layer7", false, "firewall_shaper_layer7.php");
+	$tab_array[4] = array("Wizards", false, "firewall_shaper_wizards.php");
 	display_top_tabs($tab_array);
 ?>
   </td></tr>
diff --git a/usr/local/www/firewall_shaper_vinterface.php b/usr/local/www/firewall_shaper_vinterface.php
index b1bf9a5..75b7e6c 100644
--- a/usr/local/www/firewall_shaper_vinterface.php
+++ b/usr/local/www/firewall_shaper_vinterface.php
@@ -367,7 +367,8 @@ include("fbegin.inc");
 	$tab_array[0] = array("By Interface", false, "firewall_shaper.php");
 	$tab_array[1] = array("By Queue", false, "firewall_shaper_queues.php");
 	$tab_array[2] = array("Limiter", true, "firewall_shaper_vinterface.php");
-	$tab_array[3] = array("Wizards", false, "firewall_shaper_wizards.php");
+	$tab_array[3] = array("Layer7", false, "firewall_shaper_layer7.php");
+	$tab_array[4] = array("Wizards", false, "firewall_shaper_wizards.php");
 	display_top_tabs($tab_array);
 ?>
   </td></tr>
diff --git a/usr/local/www/firewall_shaper_wizards.php b/usr/local/www/firewall_shaper_wizards.php
index a086cc1..2290a3f 100755
--- a/usr/local/www/firewall_shaper_wizards.php
+++ b/usr/local/www/firewall_shaper_wizards.php
@@ -97,7 +97,8 @@ include("fbegin.inc");
 	$tab_array[0] = array("By Interface", false, "firewall_shaper.php");
 	$tab_array[1] = array("By Queue", false, "firewall_shaper_queues.php");
 	$tab_array[2] = array("Limiter", false, "firewall_shaper_vinterface.php");
-	$tab_array[3] = array("Wizards", true, "firewall_shaper_wizards.php");
+	$tab_array[3] = array("Layer7", false, "firewall_shaper_layer7.php");
+	$tab_array[4] = array("Wizards", true, "firewall_shaper_wizards.php");
 	display_top_tabs($tab_array);
 ?>
   </td></tr>