From 603d3c16fd1bc1f5f7fd77ede899043dfadbef6a Mon Sep 17 00:00:00 2001 From: Phil Davis Date: Mon, 11 May 2015 18:55:44 +0545 Subject: Code style Firewall Rules --- usr/local/www/firewall_rules_edit.php | 899 ++++++++++++++++++++-------------- 1 file changed, 535 insertions(+), 364 deletions(-) (limited to 'usr/local/www/firewall_rules_edit.php') diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php index 03c6912..9d610ea 100644 --- a/usr/local/www/firewall_rules_edit.php +++ b/usr/local/www/firewall_rules_edit.php @@ -66,8 +66,9 @@ function is_aoadv_used($rule_config) { ($rule_config['max-src-states'] != "") || ($rule_config['max-src-conn-rate'] != "") || ($rule_config['max-src-conn-rates'] != "") || - ($rule_config['statetimeout'] != "")) + ($rule_config['statetimeout'] != "")) { return true; + } return false; } @@ -107,98 +108,121 @@ if (!is_array($config['filter']['rule'])) { filter_rules_sort(); $a_filter = &$config['filter']['rule']; -if (is_numericint($_GET['id'])) +if (is_numericint($_GET['id'])) { $id = $_GET['id']; -if (isset($_POST['id']) && is_numericint($_POST['id'])) +} +if (isset($_POST['id']) && is_numericint($_POST['id'])) { $id = $_POST['id']; +} -if (is_numericint($_GET['after']) || $_GET['after'] == "-1") +if (is_numericint($_GET['after']) || $_GET['after'] == "-1") { $after = $_GET['after']; -if (isset($_POST['after']) && (is_numericint($_POST['after']) || $_POST['after'] == "-1")) +} +if (isset($_POST['after']) && (is_numericint($_POST['after']) || $_POST['after'] == "-1")) { $after = $_POST['after']; +} if (isset($_GET['dup']) && is_numericint($_GET['dup'])) { - $id = $_GET['dup']; - $after = $_GET['dup']; + $id = $_GET['dup']; + $after = $_GET['dup']; } if (isset($id) && $a_filter[$id]) { $pconfig['interface'] = $a_filter[$id]['interface']; - if (isset($a_filter[$id]['id'])) + if (isset($a_filter[$id]['id'])) { $pconfig['ruleid'] = $a_filter[$id]['id']; + } - if ( isset($a_filter[$id]['created']) && is_array($a_filter[$id]['created']) ) + if (isset($a_filter[$id]['created']) && is_array($a_filter[$id]['created'])) { $pconfig['created'] = $a_filter[$id]['created']; + } - if ( isset($a_filter[$id]['updated']) && is_array($a_filter[$id]['updated']) ) + if (isset($a_filter[$id]['updated']) && is_array($a_filter[$id]['updated'])) { $pconfig['updated'] = $a_filter[$id]['updated']; + } - if (!isset($a_filter[$id]['type'])) + if (!isset($a_filter[$id]['type'])) { $pconfig['type'] = "pass"; - else + } else { $pconfig['type'] = $a_filter[$id]['type']; + } if (isset($a_filter[$id]['floating']) || $if == "FloatingRules") { $pconfig['floating'] = $a_filter[$id]['floating']; - if (isset($a_filter[$id]['interface']) && $a_filter[$id]['interface'] <> "") + if (isset($a_filter[$id]['interface']) && $a_filter[$id]['interface'] <> "") { $pconfig['interface'] = $a_filter[$id]['interface']; + } } - if (isset($a_filter['floating'])) + if (isset($a_filter['floating'])) { $pconfig['floating'] = "yes"; + } - if (isset($a_filter[$id]['direction'])) + if (isset($a_filter[$id]['direction'])) { $pconfig['direction'] = $a_filter[$id]['direction']; + } - if (isset($a_filter[$id]['ipprotocol'])) + if (isset($a_filter[$id]['ipprotocol'])) { $pconfig['ipprotocol'] = $a_filter[$id]['ipprotocol']; + } - if (isset($a_filter[$id]['protocol'])) + if (isset($a_filter[$id]['protocol'])) { $pconfig['proto'] = $a_filter[$id]['protocol']; - else + } else { $pconfig['proto'] = "any"; + } - if ($a_filter[$id]['protocol'] == "icmp") + if ($a_filter[$id]['protocol'] == "icmp") { $pconfig['icmptype'] = $a_filter[$id]['icmptype']; + } address_to_pconfig($a_filter[$id]['source'], $pconfig['src'], $pconfig['srcmask'], $pconfig['srcnot'], $pconfig['srcbeginport'], $pconfig['srcendport']); - if($a_filter[$id]['os'] <> "") + if ($a_filter[$id]['os'] <> "") { $pconfig['os'] = $a_filter[$id]['os']; + } address_to_pconfig($a_filter[$id]['destination'], $pconfig['dst'], $pconfig['dstmask'], $pconfig['dstnot'], $pconfig['dstbeginport'], $pconfig['dstendport']); - if ($a_filter[$id]['dscp'] <> "") + if ($a_filter[$id]['dscp'] <> "") { $pconfig['dscp'] = $a_filter[$id]['dscp']; + } $pconfig['disabled'] = isset($a_filter[$id]['disabled']); $pconfig['log'] = isset($a_filter[$id]['log']); $pconfig['descr'] = $a_filter[$id]['descr']; - if (isset($a_filter[$id]['tcpflags_any'])) + if (isset($a_filter[$id]['tcpflags_any'])) { $pconfig['tcpflags_any'] = true; - else { - if (isset($a_filter[$id]['tcpflags1']) && $a_filter[$id]['tcpflags1'] <> "") + } else { + if (isset($a_filter[$id]['tcpflags1']) && $a_filter[$id]['tcpflags1'] <> "") { $pconfig['tcpflags1'] = $a_filter[$id]['tcpflags1']; - if (isset($a_filter[$id]['tcpflags2']) && $a_filter[$id]['tcpflags2'] <> "") + } + if (isset($a_filter[$id]['tcpflags2']) && $a_filter[$id]['tcpflags2'] <> "") { $pconfig['tcpflags2'] = $a_filter[$id]['tcpflags2']; + } } - if (isset($a_filter[$id]['tag']) && $a_filter[$id]['tag'] <> "") + if (isset($a_filter[$id]['tag']) && $a_filter[$id]['tag'] <> "") { $pconfig['tag'] = $a_filter[$id]['tag']; - if (isset($a_filter[$id]['tagged']) && $a_filter[$id]['tagged'] <> "") + } + if (isset($a_filter[$id]['tagged']) && $a_filter[$id]['tagged'] <> "") { $pconfig['tagged'] = $a_filter[$id]['tagged']; - if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick']) + } + if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick']) { $pconfig['quick'] = $a_filter[$id]['quick']; - if (isset($a_filter[$id]['allowopts'])) + } + if (isset($a_filter[$id]['allowopts'])) { $pconfig['allowopts'] = true; - if (isset($a_filter[$id]['disablereplyto'])) + } + if (isset($a_filter[$id]['disablereplyto'])) { $pconfig['disablereplyto'] = true; + } /* advanced */ $pconfig['max'] = $a_filter[$id]['max']; @@ -230,15 +254,17 @@ if (isset($id) && $a_filter[$id]) { $pconfig['sched'] = (($a_filter[$id]['sched'] == "none") ? '' : $a_filter[$id]['sched']); $pconfig['vlanprio'] = (($a_filter[$id]['vlanprio'] == "none") ? '' : $a_filter[$id]['vlanprio']); $pconfig['vlanprioset'] = (($a_filter[$id]['vlanprioset'] == "none") ? '' : $a_filter[$id]['vlanprioset']); - if (!isset($_GET['dup']) || !is_numericint($_GET['dup'])) + if (!isset($_GET['dup']) || !is_numericint($_GET['dup'])) { $pconfig['associated-rule-id'] = $a_filter[$id]['associated-rule-id']; + } $pconfig['tracker'] = $a_filter[$id]['tracker']; } else { /* defaults */ - if ($_GET['if']) + if ($_GET['if']) { $pconfig['interface'] = $_GET['if']; + } $pconfig['type'] = "pass"; $pconfig['src'] = "any"; $pconfig['dst'] = "any"; @@ -246,8 +272,9 @@ if (isset($id) && $a_filter[$id]) { /* Allow the FloatingRules to work */ $if = $pconfig['interface']; -if (isset($_GET['dup']) && is_numericint($_GET['dup'])) +if (isset($_GET['dup']) && is_numericint($_GET['dup'])) { unset($id); +} read_altq_config(); /* XXX: */ $qlist =& get_unique_queue_list(); @@ -260,27 +287,28 @@ $a_gatewaygroups = return_gateway_groups_array(); if ($_POST) { unset($input_errors); - if( isset($a_filter[$id]['associated-rule-id']) ) { + if (isset($a_filter[$id]['associated-rule-id'])) { $_POST['proto'] = $pconfig['proto']; - if ($pconfig['proto'] == "icmp") + if ($pconfig['proto'] == "icmp") { $_POST['icmptype'] = $pconfig['icmptype']; + } } if (($_POST['ipprotocol'] <> "") && ($_POST['gateway'] <> "")) { - if(is_array($config['gateways']['gateway_group'])) { - foreach($config['gateways']['gateway_group'] as $gw_group) { - if($gw_group['name'] == $_POST['gateway']) { + if (is_array($config['gateways']['gateway_group'])) { + foreach ($config['gateways']['gateway_group'] as $gw_group) { + if ($gw_group['name'] == $_POST['gateway']) { $family = $a_gatewaygroups[$_POST['gateway']]['ipprotocol']; - if($_POST['ipprotocol'] == $family) { + if ($_POST['ipprotocol'] == $family) { continue; } - if(($_POST['ipprotocol'] == "inet46") && ($_POST['ipprotocol'] != $family)) { + if (($_POST['ipprotocol'] == "inet46") && ($_POST['ipprotocol'] != $family)) { $input_errors[] = gettext("You can not assign a gateway to a rule that applies to IPv4 and IPv6"); } - if(($_POST['ipprotocol'] == "inet6") && ($_POST['ipprotocol'] != $family)) { + if (($_POST['ipprotocol'] == "inet6") && ($_POST['ipprotocol'] != $family)) { $input_errors[] = gettext("You can not assign an IPv4 gateway group on IPv6 Address Family rule"); } - if(($_POST['ipprotocol'] == "inet") && ($_POST['ipprotocol'] != $family)) { + if (($_POST['ipprotocol'] == "inet") && ($_POST['ipprotocol'] != $family)) { $input_errors[] = gettext("You can not assign an IPv6 gateway group on IPv4 Address Family rule"); } } @@ -288,19 +316,20 @@ if ($_POST) { } } if (($_POST['ipprotocol'] <> "") && ($_POST['gateway'] <> "") && (is_ipaddr(lookup_gateway_ip_by_name($_POST['gateway'])))) { - if(($_POST['ipprotocol'] == "inet46") && ($_POST['gateway'] <> "")) { + if (($_POST['ipprotocol'] == "inet46") && ($_POST['gateway'] <> "")) { $input_errors[] = gettext("You can not assign a gateway to a rule that applies to IPv4 and IPv6"); } - if(($_POST['ipprotocol'] == "inet6") && (!is_ipaddrv6(lookup_gateway_ip_by_name($_POST['gateway'])))) { + if (($_POST['ipprotocol'] == "inet6") && (!is_ipaddrv6(lookup_gateway_ip_by_name($_POST['gateway'])))) { $input_errors[] = gettext("You can not assign an IPv4 Gateway to an IPv6 Filter rule"); } - if(($_POST['ipprotocol'] == "inet") && (!is_ipaddrv4(lookup_gateway_ip_by_name($_POST['gateway'])))) { + if (($_POST['ipprotocol'] == "inet") && (!is_ipaddrv4(lookup_gateway_ip_by_name($_POST['gateway'])))) { $input_errors[] = gettext("You can not assign an IPv6 Gateway to an IPv4 Filter rule"); } } - if (($_POST['proto'] == "icmp") && ($_POST['icmptype'] <> "")){ - if($_POST['ipprotocol'] == "inet46") + if (($_POST['proto'] == "icmp") && ($_POST['icmptype'] <> "")) { + if ($_POST['ipprotocol'] == "inet46") { $input_errors[] = gettext("You can not assign a ICMP type to a rule that applies to IPv4 and IPv6"); + } } if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp")) { @@ -309,83 +338,95 @@ if ($_POST) { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } else { - if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport']) + if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport']) { $_POST['srcbeginport'] = trim($_POST['srcbeginport_cust']); - if ($_POST['srcendport_cust'] && !$_POST['srcendport']) + } + if ($_POST['srcendport_cust'] && !$_POST['srcendport']) { $_POST['srcendport'] = trim($_POST['srcendport_cust']); + } if ($_POST['srcbeginport'] == "any") { $_POST['srcbeginport'] = 0; $_POST['srcendport'] = 0; } else { - if (!$_POST['srcendport']) + if (!$_POST['srcendport']) { $_POST['srcendport'] = $_POST['srcbeginport']; + } } - if ($_POST['srcendport'] == "any") + if ($_POST['srcendport'] == "any") { $_POST['srcendport'] = $_POST['srcbeginport']; + } - if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport']) + if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport']) { $_POST['dstbeginport'] = trim($_POST['dstbeginport_cust']); - if ($_POST['dstendport_cust'] && !$_POST['dstendport']) + } + if ($_POST['dstendport_cust'] && !$_POST['dstendport']) { $_POST['dstendport'] = trim($_POST['dstendport_cust']); + } if ($_POST['dstbeginport'] == "any") { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } else { - if (!$_POST['dstendport']) + if (!$_POST['dstendport']) { $_POST['dstendport'] = $_POST['dstbeginport']; + } } - if ($_POST['dstendport'] == "any") + if ($_POST['dstendport'] == "any") { $_POST['dstendport'] = $_POST['dstbeginport']; + } } if (is_specialnet($_POST['srctype'])) { $_POST['src'] = $_POST['srctype']; $_POST['srcmask'] = 0; } else if ($_POST['srctype'] == "single") { - if (is_ipaddrv6($_POST['src'])) + if (is_ipaddrv6($_POST['src'])) { $_POST['srcmask'] = 128; - else + } else { $_POST['srcmask'] = 32; + } } if (is_specialnet($_POST['dsttype'])) { $_POST['dst'] = $_POST['dsttype']; $_POST['dstmask'] = 0; } else if ($_POST['dsttype'] == "single") { - if (is_ipaddrv6($_POST['dst'])) + if (is_ipaddrv6($_POST['dst'])) { $_POST['dstmask'] = 128; - else + } else { $_POST['dstmask'] = 32; + } } $pconfig = $_POST; /* input validation */ $reqdfields = explode(" ", "type proto"); - if ( isset($a_filter[$id]['associated-rule-id'])===false ) { + if (isset($a_filter[$id]['associated-rule-id'])===false) { $reqdfields[] = "src"; $reqdfields[] = "dst"; } $reqdfieldsn = explode(",", "Type,Protocol"); - if ( isset($a_filter[$id]['associated-rule-id'])===false ) { + if (isset($a_filter[$id]['associated-rule-id'])===false) { $reqdfieldsn[] = "Source"; $reqdfieldsn[] = "Destination"; } - if($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") { - if( $_POST['proto'] != "tcp" ) + if ($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") { + if ($_POST['proto'] != "tcp") { $input_errors[] = sprintf(gettext("%s is only valid with protocol TCP."),$_POST['statetype']); - if(($_POST['statetype'] == "synproxy state") && ($_POST['gateway'] != "")) + } + if (($_POST['statetype'] == "synproxy state") && ($_POST['gateway'] != "")) { $input_errors[] = sprintf(gettext("%s is only valid if the gateway is set to 'default'."),$_POST['statetype']); + } } - if ( isset($a_filter[$id]['associated-rule-id'])===false && - (!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) ) { + if (isset($a_filter[$id]['associated-rule-id'])===false && + (!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single")))) { $reqdfields[] = "srcmask"; $reqdfieldsn[] = "Source bit count"; } - if ( isset($a_filter[$id]['associated-rule-id'])===false && - (!(is_specialnet($_POST['dsttype']) || ($_POST['dsttype'] == "single"))) ) { + if (isset($a_filter[$id]['associated-rule-id'])===false && + (!(is_specialnet($_POST['dsttype']) || ($_POST['dsttype'] == "single")))) { $reqdfields[] = "dstmask"; $reqdfieldsn[] = gettext("Destination bit count"); } @@ -401,48 +442,64 @@ if ($_POST) { $_POST['dstendport'] = 0; } - if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport'])) + if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport'])) { $input_errors[] = sprintf(gettext("%s is not a valid start source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcbeginposrt']); - if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport'])) + } + if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport'])) { $input_errors[] = sprintf(gettext("%s is not a valid end source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcendport']); - if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport'])) + } + if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport'])) { $input_errors[] = sprintf(gettext("%s is not a valid start destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstbeginport']); - if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport'])) + } + if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport'])) { $input_errors[] = sprintf(gettext("%s is not a valid end destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstendport']); - if ( !$_POST['srcbeginport_cust'] && $_POST['srcendport_cust']) - if (is_alias($_POST['srcendport_cust'])) + } + if (!$_POST['srcbeginport_cust'] && $_POST['srcendport_cust']) { + if (is_alias($_POST['srcendport_cust'])) { $input_errors[] = 'If you put port alias in Source port range to: field you must put the same port alias in from: field'; - if ( $_POST['srcbeginport_cust'] && $_POST['srcendport_cust']){ - if (is_alias($_POST['srcendport_cust']) && is_alias($_POST['srcendport_cust']) && $_POST['srcbeginport_cust'] != $_POST['srcendport_cust']) + } + } + if ($_POST['srcbeginport_cust'] && $_POST['srcendport_cust']) { + if (is_alias($_POST['srcendport_cust']) && is_alias($_POST['srcendport_cust']) && $_POST['srcbeginport_cust'] != $_POST['srcendport_cust']) { $input_errors[] = 'The same port alias must be used in Source port range from: and to: fields'; + } if ((is_alias($_POST['srcbeginport_cust']) && (!is_alias($_POST['srcendport_cust']) && $_POST['srcendport_cust']!='')) || - ((!is_alias($_POST['srcbeginport_cust']) && $_POST['srcbeginport_cust']!='') && is_alias($_POST['srcendport_cust']))) + ((!is_alias($_POST['srcbeginport_cust']) && $_POST['srcbeginport_cust']!='') && is_alias($_POST['srcendport_cust']))) { $input_errors[] = 'You cannot specify numbers and port aliases at the same time in Source port range from: and to: field'; + } } - if ( !$_POST['dstbeginport_cust'] && $_POST['dstendport_cust']) - if (is_alias($_POST['dstendport_cust'])) + if (!$_POST['dstbeginport_cust'] && $_POST['dstendport_cust']) { + if (is_alias($_POST['dstendport_cust'])) { $input_errors[] = 'If you put port alias in Destination port range to: field you must put the same port alias in from: field'; - if ( $_POST['dstbeginport_cust'] && $_POST['dstendport_cust']){ - if (is_alias($_POST['dstendport_cust']) && is_alias($_POST['dstendport_cust']) && $_POST['dstbeginport_cust'] != $_POST['dstendport_cust']) + } + } + if ($_POST['dstbeginport_cust'] && $_POST['dstendport_cust']) { + if (is_alias($_POST['dstendport_cust']) && is_alias($_POST['dstendport_cust']) && $_POST['dstbeginport_cust'] != $_POST['dstendport_cust']) { $input_errors[] = 'The same port alias must be used in Destination port range from: and to: fields'; + } if ((is_alias($_POST['dstbeginport_cust']) && (!is_alias($_POST['dstendport_cust']) && $_POST['dstendport_cust']!='')) || - ((!is_alias($_POST['dstbeginport_cust']) && $_POST['dstbeginport_cust']!='') && is_alias($_POST['dstendport_cust']))) + ((!is_alias($_POST['dstbeginport_cust']) && $_POST['dstbeginport_cust']!='') && is_alias($_POST['dstendport_cust']))) { $input_errors[] = 'You cannot specify numbers and port aliases at the same time in Destination port range from: and to: field'; + } } - if ($_POST['src']) + if ($_POST['src']) { $_POST['src'] = trim($_POST['src']); - if ($_POST['dst']) + } + if ($_POST['dst']) { $_POST['dst'] = trim($_POST['dst']); + } /* if user enters an alias and selects "network" then disallow. */ - if($_POST['srctype'] == "network") { - if(is_alias($_POST['src'])) + if ($_POST['srctype'] == "network") { + if (is_alias($_POST['src'])) { $input_errors[] = gettext("You must specify single host or alias for alias entries."); + } } - if($_POST['dsttype'] == "network") { - if(is_alias($_POST['dst'])) + if ($_POST['dsttype'] == "network") { + if (is_alias($_POST['dst'])) { $input_errors[] = gettext("You must specify single host or alias for alias entries."); + } } if (!is_specialnet($_POST['srctype'])) { @@ -461,17 +518,21 @@ if ($_POST) { $input_errors[] = gettext("A valid destination bit count must be specified."); } } - if((is_ipaddr($_POST['src']) && is_ipaddr($_POST['dst']))) { - if(!validate_address_family($_POST['src'], $_POST['dst'])) + if ((is_ipaddr($_POST['src']) && is_ipaddr($_POST['dst']))) { + if (!validate_address_family($_POST['src'], $_POST['dst'])) { $input_errors[] = sprintf(gettext("The Source IP address %s Address Family differs from the destination %s."), $_POST['src'], $_POST['dst']); - if((is_ipaddrv6($_POST['src']) || is_ipaddrv6($_POST['dst'])) && ($_POST['ipprotocol'] == "inet")) + } + if ((is_ipaddrv6($_POST['src']) || is_ipaddrv6($_POST['dst'])) && ($_POST['ipprotocol'] == "inet")) { $input_errors[] = gettext("You can not use IPv6 addresses in IPv4 rules."); - if((is_ipaddrv4($_POST['src']) || is_ipaddrv4($_POST['dst'])) && ($_POST['ipprotocol'] == "inet6")) + } + if ((is_ipaddrv4($_POST['src']) || is_ipaddrv4($_POST['dst'])) && ($_POST['ipprotocol'] == "inet6")) { $input_errors[] = gettext("You can not use IPv4 addresses in IPv6 rules."); + } } - if((is_ipaddr($_POST['src']) || is_ipaddr($_POST['dst'])) && ($_POST['ipprotocol'] == "inet46")) + if ((is_ipaddr($_POST['src']) || is_ipaddr($_POST['dst'])) && ($_POST['ipprotocol'] == "inet46")) { $input_errors[] = gettext("You can not use a IPv4 or IPv6 address in combined IPv4 + IPv6 rules."); + } if ($_POST['srcbeginport'] > $_POST['srcendport']) { /* swap */ @@ -486,115 +547,150 @@ if ($_POST) { $_POST['dstbeginport'] = $tmp; } if ($_POST['os']) { - if( $_POST['proto'] != "tcp" ) + if ($_POST['proto'] != "tcp") { $input_errors[] = gettext("OS detection is only valid with protocol TCP."); - if (!in_array($_POST['os'], $ostypes)) + } + if (!in_array($_POST['os'], $ostypes)) { $input_errors[] = gettext("Invalid OS detection selection. Please select a valid OS."); + } } if ($_POST['ackqueue'] != "") { - if ($_POST['defaultqueue'] == "" ) + if ($_POST['defaultqueue'] == "") { $input_errors[] = gettext("You have to select a queue when you select an acknowledge queue too."); - else if ($_POST['ackqueue'] == $_POST['defaultqueue']) + } else if ($_POST['ackqueue'] == $_POST['defaultqueue']) { $input_errors[] = gettext("Acknowledge queue and Queue cannot be the same."); + } } - if (isset($_POST['floating']) && $_POST['pdnpipe'] != "" && (empty($_POST['direction']) || $_POST['direction'] == "any")) + if (isset($_POST['floating']) && $_POST['pdnpipe'] != "" && (empty($_POST['direction']) || $_POST['direction'] == "any")) { $input_errors[] = gettext("You can not use limiters in Floating rules without choosing a direction."); - if (isset($_POST['floating']) && $_POST['gateway'] != "" && (empty($_POST['direction']) || $_POST['direction'] == "any")) + } + if (isset($_POST['floating']) && $_POST['gateway'] != "" && (empty($_POST['direction']) || $_POST['direction'] == "any")) { $input_errors[] = gettext("You can not use gateways in Floating rules without choosing a direction."); + } if ($_POST['pdnpipe'] && $_POST['pdnpipe'] != "") { - if ($_POST['dnpipe'] == "" ) + if ($_POST['dnpipe'] == "") { $input_errors[] = gettext("You must select a queue for the In direction before selecting one for Out too."); - else if ($_POST['pdnpipe'] == $_POST['dnpipe']) + } else if ($_POST['pdnpipe'] == $_POST['dnpipe']) { $input_errors[] = gettext("In and Out Queue cannot be the same."); - else if ($dnqlist[$_POST['pdnpipe']][0] == "?" && $dnqlist[$_POST['dnpipe']][0] <> "?") + } else if ($dnqlist[$_POST['pdnpipe']][0] == "?" && $dnqlist[$_POST['dnpipe']][0] <> "?") { $input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. Both must be from the same type."); - else if ($dnqlist[$_POST['dnpipe']][0] == "?" && $dnqlist[$_POST['pdnpipe']][0] <> "?") + } else if ($dnqlist[$_POST['dnpipe']][0] == "?" && $dnqlist[$_POST['pdnpipe']][0] <> "?") { $input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. Both must be from the same type."); - if ($_POST['direction'] == "out" && empty($_POST['gateway'])) + } + if ($_POST['direction'] == "out" && empty($_POST['gateway'])) { $input_errors[] = gettext("Please select a gateway, normally the interface selected gateway, so the limiters work correctly"); + } } - if( !empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid'])) + if (!empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid'])) { $input_errors[] = gettext('ID must be an integer'); - if($_POST['l7container'] && $_POST['l7container'] != "") { - if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp")) + } + if ($_POST['l7container'] && $_POST['l7container'] != "") { + if (!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp")) { $input_errors[] = gettext("You can only select a layer7 container for TCP and/or UDP protocols"); - if ($_POST['type'] <> "pass") + } + if ($_POST['type'] <> "pass") { $input_errors[] = gettext("You can only select a layer7 container for Pass type rules."); + } } if (!in_array($_POST['proto'], array("tcp","tcp/udp"))) { - if (!empty($_POST['max-src-conn'])) + if (!empty($_POST['max-src-conn'])) { $input_errors[] = gettext("You can only specify the maximum number of established connections per host (advanced option) for TCP protocol."); - if (!empty($_POST['max-src-conn-rate']) || !empty($_POST['max-src-conn-rates'])) + } + if (!empty($_POST['max-src-conn-rate']) || !empty($_POST['max-src-conn-rates'])) { $input_errors[] = gettext("You can only specify the maximum new connections per host / per second(s) (advanced option) for TCP protocol."); - if (!empty($_POST['statetimeout'])) + } + if (!empty($_POST['statetimeout'])) { $input_errors[] = gettext("You can only specify the state timeout (advanced option) for TCP protocol."); + } } if ($_POST['type'] <> "pass") { - if (!empty($_POST['max'])) + if (!empty($_POST['max'])) { $input_errors[] = gettext("You can only specify the maximum state entries (advanced option) for Pass type rules."); - if (!empty($_POST['max-src-nodes'])) + } + if (!empty($_POST['max-src-nodes'])) { $input_errors[] = gettext("You can only specify the maximum number of unique source hosts (advanced option) for Pass type rules."); - if (!empty($_POST['max-src-conn'])) + } + if (!empty($_POST['max-src-conn'])) { $input_errors[] = gettext("You can only specify the maximum number of established connections per host (advanced option) for Pass type rules."); - if (!empty($_POST['max-src-states'])) + } + if (!empty($_POST['max-src-states'])) { $input_errors[] = gettext("You can only specify the maximum state entries per host (advanced option) for Pass type rules."); - if (!empty($_POST['max-src-conn-rate']) || !empty($_POST['max-src-conn-rates'])) + } + if (!empty($_POST['max-src-conn-rate']) || !empty($_POST['max-src-conn-rates'])) { $input_errors[] = gettext("You can only specify the maximum new connections per host / per second(s) (advanced option) for Pass type rules."); - if (!empty($_POST['statetimeout'])) + } + if (!empty($_POST['statetimeout'])) { $input_errors[] = gettext("You can only specify the state timeout (advanced option) for Pass type rules."); + } } if (($_POST['statetype'] == "none") && (empty($_POST['l7container']))) { - if (!empty($_POST['max'])) + if (!empty($_POST['max'])) { $input_errors[] = gettext("You cannot specify the maximum state entries (advanced option) if statetype is none and no L7 container is selected."); - if (!empty($_POST['max-src-nodes'])) + } + if (!empty($_POST['max-src-nodes'])) { $input_errors[] = gettext("You cannot specify the maximum number of unique source hosts (advanced option) if statetype is none and no L7 container is selected."); - if (!empty($_POST['max-src-conn'])) + } + if (!empty($_POST['max-src-conn'])) { $input_errors[] = gettext("You cannot specify the maximum number of established connections per host (advanced option) if statetype is none and no L7 container is selected."); - if (!empty($_POST['max-src-states'])) + } + if (!empty($_POST['max-src-states'])) { $input_errors[] = gettext("You cannot specify the maximum state entries per host (advanced option) if statetype is none and no L7 container is selected."); - if (!empty($_POST['max-src-conn-rate']) || !empty($_POST['max-src-conn-rates'])) + } + if (!empty($_POST['max-src-conn-rate']) || !empty($_POST['max-src-conn-rates'])) { $input_errors[] = gettext("You cannot specify the maximum new connections per host / per second(s) (advanced option) if statetype is none and no L7 container is selected."); - if (!empty($_POST['statetimeout'])) + } + if (!empty($_POST['statetimeout'])) { $input_errors[] = gettext("You cannot specify the state timeout (advanced option) if statetype is none and no L7 container is selected."); + } } - if (($_POST['max'] != "") && !is_posnumericint($_POST['max'])) + if (($_POST['max'] != "") && !is_posnumericint($_POST['max'])) { $input_errors[] = gettext("Maximum state entries (advanced option) must be a positive integer"); + } - if (($_POST['max-src-nodes'] != "") && !is_posnumericint($_POST['max-src-nodes'])) + if (($_POST['max-src-nodes'] != "") && !is_posnumericint($_POST['max-src-nodes'])) { $input_errors[] = gettext("Maximum number of unique source hosts (advanced option) must be a positive integer"); + } - if (($_POST['max-src-conn'] != "") && !is_posnumericint($_POST['max-src-conn'])) + if (($_POST['max-src-conn'] != "") && !is_posnumericint($_POST['max-src-conn'])) { $input_errors[] = gettext("Maximum number of established connections per host (advanced option) must be a positive integer"); + } - if (($_POST['max-src-states'] != "") && !is_posnumericint($_POST['max-src-states'])) + if (($_POST['max-src-states'] != "") && !is_posnumericint($_POST['max-src-states'])) { $input_errors[] = gettext("Maximum state entries per host (advanced option) must be a positive integer"); + } - if (($_POST['max-src-conn-rate'] != "") && !is_posnumericint($_POST['max-src-conn-rate'])) + if (($_POST['max-src-conn-rate'] != "") && !is_posnumericint($_POST['max-src-conn-rate'])) { $input_errors[] = gettext("Maximum new connections per host / per second(s) (advanced option) must be a positive integer"); + } - if (($_POST['statetimeout'] != "") && !is_posnumericint($_POST['statetimeout'])) + if (($_POST['statetimeout'] != "") && !is_posnumericint($_POST['statetimeout'])) { $input_errors[] = gettext("State timeout (advanced option) must be a positive integer"); + } - if ((($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] == "")) || - (($_POST['max-src-conn-rate'] == "" and $_POST['max-src-conn-rates'] <> ""))) + if ((($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] == "")) || + (($_POST['max-src-conn-rate'] == "" and $_POST['max-src-conn-rates'] <> ""))) { $input_errors[] = gettext("Both maximum new connections per host and the interval (per second(s)) must be specified"); + } if (!$_POST['tcpflags_any']) { $settcpflags = array(); $outoftcpflags = array(); foreach ($tcpflags as $tcpflag) { - if ($_POST['tcpflags1_' . $tcpflag] == "on") + if ($_POST['tcpflags1_' . $tcpflag] == "on") { $settcpflags[] = $tcpflag; - if ($_POST['tcpflags2_' . $tcpflag] == "on") + } + if ($_POST['tcpflags2_' . $tcpflag] == "on") { $outoftcpflags[] = $tcpflag; + } } - if (empty($outoftcpflags) && !empty($settcpflags)) + if (empty($outoftcpflags) && !empty($settcpflags)) { $input_errors[] = gettext("If you specify TCP flags that should be set you should specify out of which flags as well."); + } } // Allow extending of the firewall edit page and include custom input validation @@ -607,11 +703,13 @@ if ($_POST) { $filterent['tracker'] = empty($_POST['tracker']) ? (int)microtime(true) : $_POST['tracker']; $filterent['type'] = $_POST['type']; - if (isset($_POST['interface'] )) + if (isset($_POST['interface'])) { $filterent['interface'] = $_POST['interface']; + } - if (isset($_POST['ipprotocol'] )) + if (isset($_POST['ipprotocol'])) { $filterent['ipprotocol'] = $_POST['ipprotocol']; + } if ($_POST['tcpflags_any']) { $filterent['tcpflags_any'] = true; @@ -619,26 +717,32 @@ if ($_POST) { $settcpflags = array(); $outoftcpflags = array(); foreach ($tcpflags as $tcpflag) { - if ($_POST['tcpflags1_' . $tcpflag] == "on") + if ($_POST['tcpflags1_' . $tcpflag] == "on") { $settcpflags[] = $tcpflag; - if ($_POST['tcpflags2_' . $tcpflag] == "on") + } + if ($_POST['tcpflags2_' . $tcpflag] == "on") { $outoftcpflags[] = $tcpflag; + } } if (!empty($outoftcpflags)) { $filterent['tcpflags2'] = join(",", $outoftcpflags); - if (!empty($settcpflags)) + if (!empty($settcpflags)) { $filterent['tcpflags1'] = join(",", $settcpflags); + } } } - if (isset($_POST['tag'])) + if (isset($_POST['tag'])) { $filterent['tag'] = $_POST['tag']; - if (isset($_POST['tagged'])) + } + if (isset($_POST['tagged'])) { $filterent['tagged'] = $_POST['tagged']; + } if ($if == "FloatingRules" || isset($_POST['floating'])) { $filterent['direction'] = $_POST['direction']; - if (isset($_POST['quick']) && $_POST['quick'] <> "") + if (isset($_POST['quick']) && $_POST['quick'] <> "") { $filterent['quick'] = $_POST['quick']; + } $filterent['floating'] = "yes"; if (isset($_POST['interface']) && count($_POST['interface']) > 0) { $filterent['interface'] = implode(",", $_POST['interface']); @@ -646,14 +750,16 @@ if ($_POST) { } /* Advanced options */ - if ($_POST['allowopts'] == "yes") + if ($_POST['allowopts'] == "yes") { $filterent['allowopts'] = true; - else + } else { unset($filterent['allowopts']); - if ($_POST['disablereplyto'] == "yes") + } + if ($_POST['disablereplyto'] == "yes") { $filterent['disablereplyto'] = true; - else + } else { unset($filterent['disablereplyto']); + } $filterent['max'] = $_POST['max']; $filterent['max-src-nodes'] = $_POST['max-src-nodes']; $filterent['max-src-conn'] = $_POST['max-src-conn']; @@ -661,19 +767,21 @@ if ($_POST) { $filterent['statetimeout'] = $_POST['statetimeout']; $filterent['statetype'] = $_POST['statetype']; $filterent['os'] = $_POST['os']; - if($_POST['nopfsync'] <> "") + if ($_POST['nopfsync'] <> "") { $filterent['nopfsync'] = true; - else + } else { unset($filterent['nopfsync']); + } /* Nosync directive - do not xmlrpc sync this item */ - if($_POST['nosync'] <> "") + if ($_POST['nosync'] <> "") { $filterent['nosync'] = true; - else + } else { unset($filterent['nosync']); + } /* unless both values are provided, unset the values - ticket #650 */ - if($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] <> "") { + if ($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] <> "") { $filterent['max-src-conn-rate'] = $_POST['max-src-conn-rate']; $filterent['max-src-conn-rates'] = $_POST['max-src-conn-rates']; } else { @@ -681,20 +789,23 @@ if ($_POST) { unset($filterent['max-src-conn-rates']); } - if ($_POST['proto'] != "any") + if ($_POST['proto'] != "any") { $filterent['protocol'] = $_POST['proto']; - else + } else { unset($filterent['protocol']); + } if ($_POST['proto'] == "icmp") { - if ($filterent['ipprotocol'] == 'inet6' && $_POST['icmp6type']) + if ($filterent['ipprotocol'] == 'inet6' && $_POST['icmp6type']) { $filterent['icmptype'] = $_POST['icmp6type']; - else if ($filterent['ipprotocol'] != 'inet6' && $_POST['icmptype']) + } else if ($filterent['ipprotocol'] != 'inet6' && $_POST['icmptype']) { $filterent['icmptype'] = $_POST['icmptype']; - else + } else { unset($filterent['icmptype']); - } else + } + } else { unset($filterent['icmptype']); + } pconfig_to_address($filterent['source'], $_POST['src'], $_POST['srcmask'], $_POST['srcnot'], @@ -704,18 +815,21 @@ if ($_POST) { $_POST['dstmask'], $_POST['dstnot'], $_POST['dstbeginport'], $_POST['dstendport']); - if ($_POST['disabled']) + if ($_POST['disabled']) { $filterent['disabled'] = true; - else + } else { unset($filterent['disabled']); + } - if ($_POST['dscp']) + if ($_POST['dscp']) { $filterent['dscp'] = $_POST['dscp']; + } - if ($_POST['log']) + if ($_POST['log']) { $filterent['log'] = true; - else + } else { unset($filterent['log']); + } strncpy($filterent['descr'], $_POST['descr'], 52); if ($_POST['gateway'] != "") { @@ -724,14 +838,16 @@ if ($_POST) { if ($_POST['defaultqueue'] != "") { $filterent['defaultqueue'] = $_POST['defaultqueue']; - if ($_POST['ackqueue'] != "") + if ($_POST['ackqueue'] != "") { $filterent['ackqueue'] = $_POST['ackqueue']; + } } if ($_POST['dnpipe'] != "") { $filterent['dnpipe'] = $_POST['dnpipe']; - if ($_POST['pdnpipe'] != "") + if ($_POST['pdnpipe'] != "") { $filterent['pdnpipe'] = $_POST['pdnpipe']; + } } if ($_POST['l7container'] != "") { @@ -750,49 +866,55 @@ if ($_POST) { } // If we have an associated nat rule, make sure the source and destination doesn't change - if( isset($a_filter[$id]['associated-rule-id']) ) { + if (isset($a_filter[$id]['associated-rule-id'])) { $filterent['interface'] = $a_filter[$id]['interface']; - if (isset($a_filter[$id]['protocol'])) + if (isset($a_filter[$id]['protocol'])) { $filterent['protocol'] = $a_filter[$id]['protocol']; - else if (isset($filterent['protocol'])) + } else if (isset($filterent['protocol'])) { unset($filterent['protocol']); - if ($a_filter[$id]['protocol'] == "icmp" && $a_filter[$id]['icmptype']) + } + if ($a_filter[$id]['protocol'] == "icmp" && $a_filter[$id]['icmptype']) { $filterent['icmptype'] = $a_filter[$id]['icmptype']; - else if (isset($filterent['icmptype'])) + } else if (isset($filterent['icmptype'])) { unset($filterent['icmptype']); + } $filterent['source'] = $a_filter[$id]['source']; $filterent['destination'] = $a_filter[$id]['destination']; $filterent['associated-rule-id'] = $a_filter[$id]['associated-rule-id']; } - if ( isset($a_filter[$id]['created']) && is_array($a_filter[$id]['created']) ) + if (isset($a_filter[$id]['created']) && is_array($a_filter[$id]['created'])) { $filterent['created'] = $a_filter[$id]['created']; + } $filterent['updated'] = make_config_revision_entry(); // Allow extending of the firewall edit page and include custom input validation pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_write_config"); - if (isset($id) && $a_filter[$id]) + if (isset($id) && $a_filter[$id]) { $a_filter[$id] = $filterent; - else { + } else { $filterent['created'] = make_config_revision_entry(); - if (is_numeric($after)) + if (is_numeric($after)) { array_splice($a_filter, $after+1, 0, array($filterent)); - else + } else { $a_filter[] = $filterent; + } } filter_rules_sort(); - if (write_config()) + if (write_config()) { mark_subsystem_dirty('filter'); + } - if (isset($_POST['floating'])) + if (isset($_POST['floating'])) { header("Location: firewall_rules.php?if=FloatingRules"); - else + } else { header("Location: firewall_rules.php?if=" . htmlspecialchars($_POST['interface'])); + } exit; } } @@ -868,7 +990,7 @@ include("head.inc"); - + @@ -878,16 +1000,17 @@ include("head.inc"); $nat_rule ) { - if( isset($nat_rule['associated-rule-id']) && $nat_rule['associated-rule-id']==$pconfig['associated-rule-id'] ) { + foreach ($config['nat']['rule'] as $index => $nat_rule) { + if (isset($nat_rule['associated-rule-id']) && $nat_rule['associated-rule-id']==$pconfig['associated-rule-id']) { echo "" . gettext("View the NAT rule") . "
"; break; } } } echo ""; - if (!empty($pconfig['interface'])) + if (!empty($pconfig['interface'])) { echo ""; + } ?>