From c12fb6cb5408cbcaa6090d4871bf500a705d7d7b Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 3 Sep 2010 17:45:12 +0000 Subject: Allow 1:1 rules to specify source and destination. This is almost the same as on Port Forward tab rules without protocol and ports. --- usr/local/www/firewall_nat_1to1_edit.php | 437 ++++++++++++++++++++++++------- 1 file changed, 344 insertions(+), 93 deletions(-) (limited to 'usr/local/www/firewall_nat_1to1_edit.php') diff --git a/usr/local/www/firewall_nat_1to1_edit.php b/usr/local/www/firewall_nat_1to1_edit.php index 5057959..89c3335 100755 --- a/usr/local/www/firewall_nat_1to1_edit.php +++ b/usr/local/www/firewall_nat_1to1_edit.php @@ -54,9 +54,17 @@ function nat_1to1_rules_sort() { } require("guiconfig.inc"); +require_once("interfaces.inc"); require("filter.inc"); require("shaper.inc"); +$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn"); +$ifdisp = get_configured_interface_with_descr(); +foreach ($ifdisp as $kif => $kdescr) { + $specialsrcdst[] = "{$kif}"; + $specialsrcdst[] = "{$kif}ip"; +} + if (!is_array($config['nat']['onetoone'])) { $config['nat']['onetoone'] = array(); } @@ -67,21 +75,25 @@ if (isset($_POST['id'])) $id = $_POST['id']; if (isset($id) && $a_1to1[$id]) { - $pconfig['external'] = $a_1to1[$id]['external']; - $pconfig['internal'] = $a_1to1[$id]['internal']; + $pconfig['disabled'] = isset($a_1to1[$id]['disabled']); + + address_to_pconfig($a_1to1[$id]['source'], $pconfig['src'], + $pconfig['srcmask'], $pconfig['srcnot'], + $pconfig['srcbeginport'], $pconfig['srcendport']); + + address_to_pconfig($a_1to1[$id]['destination'], $pconfig['dst'], + $pconfig['dstmask'], $pconfig['dstnot'], + $pconfig['dstbeginport'], $pconfig['dstendport']); + $pconfig['interface'] = $a_1to1[$id]['interface']; if (!$pconfig['interface']) $pconfig['interface'] = "wan"; - if (!$a_1to1[$id]['subnet']) - $pconfig['subnet'] = 32; - else - $pconfig['subnet'] = $a_1to1[$id]['subnet']; + + $pconfig['external'] = $a_1to1[$id]['external']; $pconfig['descr'] = $a_1to1[$id]['descr']; $pconfig['natreflection'] = $a_1to1[$id]['natreflection']; -} else { - $pconfig['subnet'] = 32; +} else $pconfig['interface'] = "wan"; -} if ($_POST) { @@ -89,27 +101,67 @@ if ($_POST) { $pconfig = $_POST; /* input validation */ - $reqdfields = explode(" ", "interface external internal"); - $reqdfieldsn = array(gettext("Interface"),gettext("External subnet"),gettext("Internal subnet")); + $reqdfields = explode(" ", "interface external"); + $reqdfieldsn = array(gettext("Interface"), gettext("External subnet")); + if ($_POST['srctype'] == "single" || $_POST['srctype'] == "network") { + $reqdfields[] = "src"; + $reqdfieldsn[] = gettext("Source address"); + } + if ($_POST['dsttype'] == "single" || $_POST['dsttype'] == "network") { + $reqdfields[] = "dst"; + $reqdfieldsn[] = gettext("Destination address"); + } do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); - if (($_POST['external'] && !is_ipaddr($_POST['external']))) { + if (is_specialnet($_POST['srctype'])) { + $_POST['src'] = $_POST['srctype']; + $_POST['srcmask'] = 0; + } else if ($_POST['srctype'] == "single") { + $_POST['srcmask'] = 32; + } + if (is_specialnet($_POST['dsttype'])) { + $_POST['dst'] = $_POST['dsttype']; + $_POST['dstmask'] = 0; + } else if ($_POST['dsttype'] == "single") { + $_POST['dstmask'] = 32; + } else if (is_ipaddr($_POST['dsttype'])) { + $_POST['dst'] = $_POST['dsttype']; + $_POST['dstmask'] = 32; + $_POST['dsttype'] = "single"; + } + + if (($_POST['external'] && !is_ipaddroralias($_POST['external']))) $input_errors[] = gettext("A valid external subnet must be specified."); - } - if (($_POST['internal'] && !is_ipaddr($_POST['internal']))) { - $input_errors[] = gettext("A valid internal subnet must be specified."); - } + + /* if user enters an alias and selects "network" then disallow. */ + if( ($_POST['srctype'] == "network" && is_alias($_POST['src']) ) + || ($_POST['dsttype'] == "network" && is_alias($_POST['dst']) ) ) + $input_errors[] = gettext("You must specify single host or alias for alias entries."); + + if (!is_specialnet($_POST['srctype'])) { + if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) { + $input_errors[] = sprintf(gettext("%s is not a valid source IP address or alias."), $_POST['src']); + } + if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) { + $input_errors[] = gettext("A valid source bit count must be specified."); + } + } + if (!is_specialnet($_POST['dsttype'])) { + if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) { + $input_errors[] = sprintf(gettext("%s is not a valid destination IP address or alias."), $_POST['dst']); + } + if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) { + $input_errors[] = gettext("A valid destination bit count must be specified."); + } + } /* check for overlaps with other 1:1 */ foreach ($a_1to1 as $natent) { if (isset($id) && ($a_1to1[$id]) && ($a_1to1[$id] === $natent)) continue; - if (check_subnets_overlap($_POST['external'], $_POST['subnet'], $natent['external'], $natent['subnet'])) { - //$input_errors[] = "Another 1:1 rule overlaps with the specified external subnet."; - //break; - } else if (check_subnets_overlap($_POST['internal'], $_POST['subnet'], $natent['internal'], $natent['subnet'])) { + if (check_subnets_overlap($_POST['internal'], $_POST['subnet'], $natent['internal'], $natent['subnet'])) { //$input_errors[] = "Another 1:1 rule overlaps with the specified internal subnet."; //break; } @@ -118,16 +170,20 @@ if ($_POST) { if (!$input_errors) { $natent = array(); + $natent['disabled'] = isset($_POST['disabled']) ? true:false; $natent['external'] = $_POST['external']; - $natent['internal'] = $_POST['internal']; - $natent['subnet'] = $_POST['subnet']; + $natent['externalmask'] = $_POST['externalmask']; $natent['descr'] = $_POST['descr']; $natent['interface'] = $_POST['interface']; + pconfig_to_address($natent['source'], $_POST['src'], + $_POST['srcmask'], $_POST['srcnot']); + + pconfig_to_address($natent['destination'], $_POST['dst'], + $_POST['dstmask'], $_POST['dstnot']); + if ($_POST['natreflection'] == "enable" || $_POST['natreflection'] == "disable") $natent['natreflection'] = $_POST['natreflection']; - else - unset($natent['natreflection']); if (isset($id) && $a_1to1[$id]) $a_1to1[$id] = $natent; @@ -150,6 +206,49 @@ include("head.inc"); ?> + + + +
@@ -157,85 +256,205 @@ include("head.inc"); - - - -
- .
- . - - - - - - -
- + + + + > +
+ + + + + +
+ .
+ . + + + + + > + +
+ +
+
+ + + + + + + + + +
   + +
   + / + +
+
+ + + + + + + > + +
+ +
+
+ + + + + + + + + +
   + +
   + + / + +
+
- + - -
- + +
+ -
- - - - - - + + + + + +   @@ -247,6 +466,38 @@ include("head.inc"); + + "") + foreach($config['aliases']['alias'] as $alias_name) { + switch ($alias_name['type']) { + case "host": + case "network": + case "openvpn": + case "urltable": + if($addrisfirst == 1) $aliasesaddr .= ","; + $aliasesaddr .= "'" . $alias_name['name'] . "'"; + $addrisfirst = 1; + break; + default: + break; + } + } +?> + -- cgit v1.1