From 46bc6e545a17e77202aaf01ec0cd8d5a46567525 Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Tue, 25 Aug 2015 08:08:24 -0300 Subject: Move main pfSense content to src/ --- src/usr/local/www/system_advanced_firewall.php | 807 +++++++++++++++++++++++++ 1 file changed, 807 insertions(+) create mode 100644 src/usr/local/www/system_advanced_firewall.php (limited to 'src/usr/local/www/system_advanced_firewall.php') diff --git a/src/usr/local/www/system_advanced_firewall.php b/src/usr/local/www/system_advanced_firewall.php new file mode 100644 index 0000000..fc6b0ed --- /dev/null +++ b/src/usr/local/www/system_advanced_firewall.php @@ -0,0 +1,807 @@ +. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ +/* + pfSense_MODULE: system +*/ + +##|+PRIV +##|*IDENT=page-system-advanced-firewall +##|*NAME=System: Advanced: Firewall and NAT page +##|*DESCR=Allow access to the 'System: Advanced: Firewall and NAT' page. +##|*MATCH=system_advanced_firewall.php* +##|-PRIV + +require("guiconfig.inc"); +require_once("functions.inc"); +require_once("filter.inc"); +require_once("shaper.inc"); + +$pconfig['disablefilter'] = $config['system']['disablefilter']; +$pconfig['rfc959workaround'] = $config['system']['rfc959workaround']; +$pconfig['scrubnodf'] = $config['system']['scrubnodf']; +$pconfig['scrubrnid'] = $config['system']['scrubrnid']; +$pconfig['tcpidletimeout'] = $config['filter']['tcpidletimeout']; +$pconfig['optimization'] = $config['filter']['optimization']; +$pconfig['adaptivestart'] = $config['system']['adaptivestart']; +$pconfig['adaptiveend'] = $config['system']['adaptiveend']; +$pconfig['maximumstates'] = $config['system']['maximumstates']; +$pconfig['aliasesresolveinterval'] = $config['system']['aliasesresolveinterval']; +$old_aliasesresolveinterval = $config['system']['aliasesresolveinterval']; +$pconfig['checkaliasesurlcert'] = isset($config['system']['checkaliasesurlcert']); +$pconfig['maximumtableentries'] = $config['system']['maximumtableentries']; +$pconfig['maximumfrags'] = $config['system']['maximumfrags']; +$pconfig['disablereplyto'] = isset($config['system']['disablereplyto']); +$pconfig['disablenegate'] = isset($config['system']['disablenegate']); +$pconfig['bogonsinterval'] = $config['system']['bogons']['interval']; +$pconfig['disablenatreflection'] = $config['system']['disablenatreflection']; +$pconfig['enablebinatreflection'] = $config['system']['enablebinatreflection']; +$pconfig['reflectiontimeout'] = $config['system']['reflectiontimeout']; +$pconfig['bypassstaticroutes'] = isset($config['filter']['bypassstaticroutes']); +$pconfig['disablescrub'] = isset($config['system']['disablescrub']); +$pconfig['tftpinterface'] = explode(",", $config['system']['tftpinterface']); +$pconfig['disablevpnrules'] = isset($config['system']['disablevpnrules']); +$pconfig['tcpfirsttimeout'] = $config['system']['tcpfirsttimeout']; +$pconfig['tcpopeningtimeout'] = $config['system']['tcpopeningtimeout']; +$pconfig['tcpestablishedtimeout'] = $config['system']['tcpestablishedtimeout']; +$pconfig['tcpclosingtimeout'] = $config['system']['tcpclosingtimeout']; +$pconfig['tcpfinwaittimeout'] = $config['system']['tcpfinwaittimeout']; +$pconfig['tcpclosedtimeout'] = $config['system']['tcpclosedtimeout']; +$pconfig['udpfirsttimeout'] = $config['system']['udpfirsttimeout']; +$pconfig['udpsingletimeout'] = $config['system']['udpsingletimeout']; +$pconfig['udpmultipletimeout'] = $config['system']['udpmultipletimeout']; +$pconfig['icmpfirsttimeout'] = $config['system']['icmpfirsttimeout']; +$pconfig['icmperrortimeout'] = $config['system']['icmperrortimeout']; +$pconfig['otherfirsttimeout'] = $config['system']['otherfirsttimeout']; +$pconfig['othersingletimeout'] = $config['system']['othersingletimeout']; +$pconfig['othermultipletimeout'] = $config['system']['othermultipletimeout']; + +if ($_POST) { + + unset($input_errors); + $pconfig = $_POST; + + /* input validation */ + if ((empty($_POST['adaptivestart']) && !empty($_POST['adaptiveend'])) || (!empty($_POST['adaptivestart']) && empty($_POST['adaptiveend']))) { + $input_errors[] = gettext("The Firewall Adaptive values must be set together."); + } + if (!empty($_POST['adaptivestart']) && !is_numericint($_POST['adaptivestart'])) { + $input_errors[] = gettext("The Firewall Adaptive Start value must be an integer."); + } + if (!empty($_POST['adaptiveend']) && !is_numericint($_POST['adaptiveend'])) { + $input_errors[] = gettext("The Firewall Adaptive End value must be an integer."); + } + if ($_POST['maximumstates'] && !is_numericint($_POST['maximumstates'])) { + $input_errors[] = gettext("The Firewall Maximum States value must be an integer."); + } + if ($_POST['aliasesresolveinterval'] && !is_numericint($_POST['aliasesresolveinterval'])) { + $input_errors[] = gettext("The Aliases Hostname Resolve Interval value must be an integer."); + } + if ($_POST['maximumtableentries'] && !is_numericint($_POST['maximumtableentries'])) { + $input_errors[] = gettext("The Firewall Maximum Table Entries value must be an integer."); + } + if ($_POST['maximumfrags'] && !is_numericint($_POST['maximumfrags'])) { + $input_errors[] = gettext("The Firewall Maximum Fragment Entries value must be an integer."); + } + if ($_POST['tcpidletimeout'] && !is_numericint($_POST['tcpidletimeout'])) { + $input_errors[] = gettext("The TCP idle timeout must be an integer."); + } + if ($_POST['reflectiontimeout'] && !is_numericint($_POST['reflectiontimeout'])) { + $input_errors[] = gettext("The Reflection timeout must be an integer."); + } + if ($_POST['tcpfirsttimeout'] && !is_numericint($_POST['tcpfirsttimeout'])) { + $input_errors[] = gettext("The TCP first timeout value must be an integer."); + } + if ($_POST['tcpopeningtimeout'] && !is_numericint($_POST['tcpopeningtimeout'])) { + $input_errors[] = gettext("The TCP opening timeout value must be an integer."); + } + if ($_POST['tcpestablishedtimeout'] && !is_numericint($_POST['tcpestablishedtimeout'])) { + $input_errors[] = gettext("The TCP established timeout value must be an integer."); + } + if ($_POST['tcpclosingtimeout'] && !is_numericint($_POST['tcpclosingtimeout'])) { + $input_errors[] = gettext("The TCP closing timeout value must be an integer."); + } + if ($_POST['tcpfinwaittimeout'] && !is_numericint($_POST['tcpfinwaittimeout'])) { + $input_errors[] = gettext("The TCP FIN wait timeout value must be an integer."); + } + if ($_POST['tcpclosedtimeout'] && !is_numericint($_POST['tcpclosedtimeout'])) { + $input_errors[] = gettext("The TCP closed timeout value must be an integer."); + } + if ($_POST['udpfirsttimeout'] && !is_numericint($_POST['udpfirsttimeout'])) { + $input_errors[] = gettext("The UDP first timeout value must be an integer."); + } + if ($_POST['udpsingletimeout'] && !is_numericint($_POST['udpsingletimeout'])) { + $input_errors[] = gettext("The UDP single timeout value must be an integer."); + } + if ($_POST['udpmultipletimeout'] && !is_numericint($_POST['udpmultipletimeout'])) { + $input_errors[] = gettext("The UDP multiple timeout value must be an integer."); + } + if ($_POST['icmpfirsttimeout'] && !is_numericint($_POST['icmpfirsttimeout'])) { + $input_errors[] = gettext("The ICMP first timeout value must be an integer."); + } + if ($_POST['icmperrortimeout'] && !is_numericint($_POST['icmperrortimeout'])) { + $input_errors[] = gettext("The ICMP error timeout value must be an integer."); + } + if ($_POST['otherfirsttimeout'] && !is_numericint($_POST['otherfirsttimeout'])) { + $input_errors[] = gettext("The Other first timeout value must be an integer."); + } + if ($_POST['othersingletimeout'] && !is_numericint($_POST['othersingletimeout'])) { + $input_errors[] = gettext("The Other single timeout value must be an integer."); + } + if ($_POST['othermultipletimeout'] && !is_numericint($_POST['othermultipletimeout'])) { + $input_errors[] = gettext("The Other multiple timeout value must be an integer."); + } + + ob_flush(); + flush(); + + if (!$input_errors) { + + if ($_POST['disablefilter'] == "yes") { + $config['system']['disablefilter'] = "enabled"; + } else { + unset($config['system']['disablefilter']); + } + + if ($_POST['disablevpnrules'] == "yes") { + $config['system']['disablevpnrules'] = true; + } else { + unset($config['system']['disablevpnrules']); + } + if ($_POST['rfc959workaround'] == "yes") { + $config['system']['rfc959workaround'] = "enabled"; + } else { + unset($config['system']['rfc959workaround']); + } + + if ($_POST['scrubnodf'] == "yes") { + $config['system']['scrubnodf'] = "enabled"; + } else { + unset($config['system']['scrubnodf']); + } + + if ($_POST['scrubrnid'] == "yes") { + $config['system']['scrubrnid'] = "enabled"; + } else { + unset($config['system']['scrubrnid']); + } + + if (!empty($_POST['adaptiveend'])) { + $config['system']['adaptiveend'] = $_POST['adaptiveend']; + } else { + unset($config['system']['adaptiveend']); + } + if (!empty($_POST['adaptivestart'])) { + $config['system']['adaptivestart'] = $_POST['adaptivestart']; + } else { + unset($config['system']['adaptivestart']); + } + + if ($_POST['checkaliasesurlcert'] == "yes") { + $config['system']['checkaliasesurlcert'] = true; + } else { + unset($config['system']['checkaliasesurlcert']); + } + + $config['system']['optimization'] = $_POST['optimization']; + $config['system']['maximumstates'] = $_POST['maximumstates']; + $config['system']['aliasesresolveinterval'] = $_POST['aliasesresolveinterval']; + $config['system']['maximumtableentries'] = $_POST['maximumtableentries']; + $config['system']['maximumfrags'] = $_POST['maximumfrags']; + + if (!empty($_POST['tcpfirsttimeout'])) { + $config['system']['tcpfirsttimeout'] = $_POST['tcpfirsttimeout']; + } else { + unset($config['system']['tcpfirsttimeout']); + } + if (!empty($_POST['tcpopeningtimeout'])) { + $config['system']['tcpopeningtimeout'] = $_POST['tcpopeningtimeout']; + } else { + unset($config['system']['tcpopeningtimeout']); + } + if (!empty($_POST['tcpestablishedtimeout'])) { + $config['system']['tcpestablishedtimeout'] = $_POST['tcpestablishedtimeout']; + } else { + unset($config['system']['tcpestablishedtimeout']); + } + if (!empty($_POST['tcpclosingtimeout'])) { + $config['system']['tcpclosingtimeout'] = $_POST['tcpclosingtimeout']; + } else { + unset($config['system']['tcpclosingtimeout']); + } + if (!empty($_POST['tcpfinwaittimeout'])) { + $config['system']['tcpfinwaittimeout'] = $_POST['tcpfinwaittimeout']; + } else { + unset($config['system']['tcpfinwaittimeout']); + } + if (!empty($_POST['tcpclosedtimeout'])) { + $config['system']['tcpclosedtimeout'] = $_POST['tcpclosedtimeout']; + } else { + unset($config['system']['tcpclosedtimeout']); + } + if (!empty($_POST['udpfirsttimeout'])) { + $config['system']['udpfirsttimeout'] = $_POST['udpfirsttimeout']; + } else { + unset($config['system']['udpfirsttimeout']); + } + if (!empty($_POST['udpsingletimeout'])) { + $config['system']['udpsingletimeout'] = $_POST['udpsingletimeout']; + } else { + unset($config['system']['udpsingletimeout']); + } + if (!empty($_POST['udpmultipletimeout'])) { + $config['system']['udpmultipletimeout'] = $_POST['udpmultipletimeout']; + } else { + unset($config['system']['udpmultipletimeout']); + } + if (!empty($_POST['icmpfirsttimeout'])) { + $config['system']['icmpfirsttimeout'] = $_POST['icmpfirsttimeout']; + } else { + unset($config['system']['icmpfirsttimeout']); + } + if (!empty($_POST['icmperrortimeout'])) { + $config['system']['icmperrortimeout'] = $_POST['icmperrortimeout']; + } else { + unset($config['system']['icmperrortimeout']); + } + if (!empty($_POST['otherfirsttimeout'])) { + $config['system']['otherfirsttimeout'] = $_POST['otherfirsttimeout']; + } else { + unset($config['system']['otherfirsttimeout']); + } + if (!empty($_POST['othersingletimeout'])) { + $config['system']['othersingletimeout'] = $_POST['othersingletimeout']; + } else { + unset($config['system']['othersingletimeout']); + } + if (!empty($_POST['othermultipletimeout'])) { + $config['system']['othermultipletimeout'] = $_POST['othermultipletimeout']; + } else { + unset($config['system']['othermultipletimeout']); + } + + if ($_POST['natreflection'] == "proxy") { + unset($config['system']['disablenatreflection']); + unset($config['system']['enablenatreflectionpurenat']); + } else if ($_POST['natreflection'] == "purenat") { + unset($config['system']['disablenatreflection']); + $config['system']['enablenatreflectionpurenat'] = "yes"; + } else { + $config['system']['disablenatreflection'] = "yes"; + unset($config['system']['enablenatreflectionpurenat']); + } + + if ($_POST['enablebinatreflection'] == "yes") { + $config['system']['enablebinatreflection'] = "yes"; + } else { + unset($config['system']['enablebinatreflection']); + } + + if ($_POST['disablereplyto'] == "yes") { + $config['system']['disablereplyto'] = $_POST['disablereplyto']; + } else { + unset($config['system']['disablereplyto']); + } + + if ($_POST['disablenegate'] == "yes") { + $config['system']['disablenegate'] = $_POST['disablenegate']; + } else { + unset($config['system']['disablenegate']); + } + + if ($_POST['enablenatreflectionhelper'] == "yes") { + $config['system']['enablenatreflectionhelper'] = "yes"; + } else { + unset($config['system']['enablenatreflectionhelper']); + } + + $config['system']['reflectiontimeout'] = $_POST['reflectiontimeout']; + + if ($_POST['bypassstaticroutes'] == "yes") { + $config['filter']['bypassstaticroutes'] = $_POST['bypassstaticroutes']; + } elseif (isset($config['filter']['bypassstaticroutes'])) { + unset($config['filter']['bypassstaticroutes']); + } + + if ($_POST['disablescrub'] == "yes") { + $config['system']['disablescrub'] = $_POST['disablescrub']; + } else { + unset($config['system']['disablescrub']); + } + + if ($_POST['tftpinterface']) { + $config['system']['tftpinterface'] = implode(",", $_POST['tftpinterface']); + } else { + unset($config['system']['tftpinterface']); + } + + if ($_POST['bogonsinterval'] != $config['system']['bogons']['interval']) { + switch ($_POST['bogonsinterval']) { + case 'daily': + install_cron_job("/usr/bin/nice -n20 /etc/rc.update_bogons.sh", true, "1", "3", "*", "*", "*"); + break; + case 'weekly': + install_cron_job("/usr/bin/nice -n20 /etc/rc.update_bogons.sh", true, "1", "3", "*", "*", "0"); + break; + case 'monthly': + // fall through + default: + install_cron_job("/usr/bin/nice -n20 /etc/rc.update_bogons.sh", true, "1", "3", "1", "*", "*"); + } + $config['system']['bogons']['interval'] = $_POST['bogonsinterval']; + } + + write_config(); + + // Kill filterdns when value changes, filter_configure() will restart it + if (($old_aliasesresolveinterval != $config['system']['aliasesresolveinterval']) && + isvalidpid("{$g['varrun_path']}/filterdns.pid")) { + killbypid("{$g['varrun_path']}/filterdns.pid"); + } + + $retval = 0; + $retval = filter_configure(); + if (stristr($retval, "error") <> true) { + $savemsg = get_std_save_message($retval); + } else { + $savemsg = $retval; + } + } +} + +$pgtitle = array(gettext("System"), gettext("Advanced: Firewall and NAT")); +include("head.inc"); + +?> + + + + + + + +
+ + + + + + + +
+ +
+
+ + +   + + +
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 1): +?> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
+ /> +
+ +
+ /> +
+ +
+ +
+ + +
+ +
+ /> + +
+
+ +
. + +
+ /> + +
+
+ +
+ +
+ +
+ +
+
+ +
+ +
+ +
+ +
+ +
+ +
+ + + + + + +
+ +
+ +
+ + + +
+ /> + +
+ +
+
Disable Auto-added VPN rules + /> + +
+ + + +
Disable reply-to + /> + +
+ +
+
Disable Negate rules + /> + +
+ +
+
+ +
+ +
+ +
+ /> + +
+ +
+
 
+ +
+ +
 
+ +
+ +

+ +

+ +

+ +
+
+ +

+ +
+ /> + +

+ +

+ +
+ /> + +
+ +

+ +
+ +
+
+   +
+
+ +

+
+ +

+
+ +

+
+ +

+
+ +

+
+ +
+
+ +

+
+ +

+
+ +
+
+ +

+
+ +
+
+ +

+
+ +

+
+ +
 
 " />
+
+
+
+ + + + -- cgit v1.1