99011fea7d115f45835750ea5d131de20503e914
[project/luci.git] / applications / luci-firewall / luasrc / model / cbi / luci_fw / trule.lua
1 --[[
2 LuCI - Lua Configuration Interface
3
4 Copyright 2008 Steven Barth <steven@midlink.org>
5 Copyright 2010 Jo-Philipp Wich <xm@subsignal.org>
6
7 Licensed under the Apache License, Version 2.0 (the "License");
8 you may not use this file except in compliance with the License.
9 You may obtain a copy of the License at
10
11         http://www.apache.org/licenses/LICENSE-2.0
12
13 $Id$
14 ]]--
15
16 local has_v2 = nixio.fs.access("/lib/firewall/fw.sh")
17 local dsp = require "luci.dispatcher"
18
19 arg[1] = arg[1] or ""
20
21 m = Map("firewall", translate("Advanced Rules"),
22         translate("Advanced rules let you customize the firewall to your " ..
23                 "needs. Only new connections will be matched. Packets " ..
24                 "belonging to already open connections are automatically " ..
25                 "allowed to pass the firewall."))
26
27 m.redirect = dsp.build_url("admin", "network", "firewall")
28
29 if not m.uci:get(arg[1]) == "rule" then
30         luci.http.redirect(m.redirect)
31         return
32 end
33
34 s = m:section(NamedSection, arg[1], "rule", "")
35 s.anonymous = true
36 s.addremove = false
37
38 s:tab("general", translate("General Settings"))
39 s:tab("advanced", translate("Advanced Options"))
40
41 back = s:option(DummyValue, "_overview", translate("Overview"))
42 back.value = ""
43 back.titleref = dsp.build_url("admin", "network", "firewall", "rule")
44
45
46 name = s:taboption("general", Value, "_name", translate("Name").." "..translate("(optional)"))
47 name.rmempty = true
48
49 src = s:taboption("general", Value, "src", translate("Source zone"))
50 src.nocreate = true
51 src.default = "wan"
52 src.template = "cbi/firewall_zonelist"
53
54 dest = s:taboption("advanced", Value, "dest", translate("Destination zone"))
55 dest.nocreate = true
56 dest.allowlocal = true
57 dest.template = "cbi/firewall_zonelist"
58
59 proto = s:taboption("general", Value, "proto", translate("Protocol"))
60 proto.optional = true
61 proto:value("all", translate("Any"))
62 proto:value("tcpudp", "TCP+UDP")
63 proto:value("tcp", "TCP")
64 proto:value("udp", "UDP")
65 proto:value("icmp", "ICMP")
66
67 icmpt = s:taboption("general", Value, "icmp_type", translate("Match ICMP type"))
68 icmpt:depends("proto", "icmp")
69 icmpt:value("any")
70 icmpt:value("echo-reply")
71 icmpt:value("destination-unreachable")
72 icmpt:value("network-unreachable")
73 icmpt:value("host-unreachable")
74 icmpt:value("protocol-unreachable")
75 icmpt:value("port-unreachable")
76 icmpt:value("fragmentation-needed")
77 icmpt:value("source-route-failed")
78 icmpt:value("network-unknown")
79 icmpt:value("host-unknown")
80 icmpt:value("network-prohibited")
81 icmpt:value("host-prohibited")
82 icmpt:value("TOS-network-unreachable")
83 icmpt:value("TOS-host-unreachable")
84 icmpt:value("communication-prohibited")
85 icmpt:value("host-precedence-violation")
86 icmpt:value("precedence-cutoff")
87 icmpt:value("source-quench")
88 icmpt:value("redirect")
89 icmpt:value("network-redirect")
90 icmpt:value("host-redirect")
91 icmpt:value("TOS-network-redirect")
92 icmpt:value("TOS-host-redirect")
93 icmpt:value("echo-request")
94 icmpt:value("router-advertisement")
95 icmpt:value("router-solicitation")
96 icmpt:value("time-exceeded")
97 icmpt:value("ttl-zero-during-transit")
98 icmpt:value("ttl-zero-during-reassembly")
99 icmpt:value("parameter-problem")
100 icmpt:value("ip-header-bad")
101 icmpt:value("required-option-missing")
102 icmpt:value("timestamp-request")
103 icmpt:value("timestamp-reply")
104 icmpt:value("address-mask-request")
105 icmpt:value("address-mask-reply")
106
107 src_ip = s:taboption("general", Value, "src_ip", translate("Source address"))
108 src_ip.optional = true
109 src_ip.datatype = has_v2 and "ipaddr" or "ip4addr"
110 src_ip.placeholder = translate("any")
111
112 sport = s:taboption("general", Value, "src_port", translate("Source port"))
113 sport.optional = true
114 sport.datatype = "portrange"
115 sport.placeholder = "0-65535"
116 sport:depends("proto", "tcp")
117 sport:depends("proto", "udp")
118 sport:depends("proto", "tcpudp")
119
120 dest_ip = s:taboption("general", Value, "dest_ip", translate("Destination address"))
121 dest_ip.optional = true
122 dest_ip.datatype = has_v2 and "ipaddr" or "ip4addr"
123 dest_ip.placeholder = translate("any")
124
125 dport = s:taboption("general", Value, "dest_port", translate("Destination port"))
126 dport.optional = true
127 dport.datatype = "portrange"
128 dport:depends("proto", "tcp")
129 dport:depends("proto", "udp")
130 dport:depends("proto", "tcpudp")
131 dport.placeholder = "0-65535"
132
133 jump = s:taboption("general", ListValue, "target", translate("Action"))
134 jump.rmempty = true
135 jump.default = "ACCEPT"
136 jump:value("DROP", translate("drop"))
137 jump:value("ACCEPT", translate("accept"))
138 jump:value("REJECT", translate("reject"))
139
140
141 smac = s:taboption("advanced", Value, "src_mac", translate("Source MAC address"))
142 smac.optional = true
143 smac.datatype = "macaddr"
144 smac.placeholder = translate("any")
145
146 if has_v2 then
147         family = s:taboption("advanced", ListValue, "family", translate("Restrict to address family"))
148         family.rmempty = true
149         family:value("", translate("IPv4 and IPv6"))
150         family:value("ipv4", translate("IPv4 only"))
151         family:value("ipv6", translate("IPv6 only"))
152 end
153
154 return m