From 3ffab55538c704045dd5128a73d33dc08068c230 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Sun, 23 Jan 2005 03:44:07 +0000 Subject: [PATCH] Restore 1.2b3 version. --- usr/local/www/firewall_shaper_edit.php | 324 +++++++++++++------------ 1 file changed, 171 insertions(+), 153 deletions(-) diff --git a/usr/local/www/firewall_shaper_edit.php b/usr/local/www/firewall_shaper_edit.php index 5362be218b..5b0e249e11 100755 --- a/usr/local/www/firewall_shaper_edit.php +++ b/usr/local/www/firewall_shaper_edit.php @@ -1,34 +1,32 @@ #!/usr/local/bin/php -. - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. + firewall_shaper_edit.php + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2004 Manuel Kasper . + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. */ require("guiconfig.inc"); @@ -43,27 +41,27 @@ $specialsrcdst = explode(" ", "any lan pptp"); $id = $_GET['id']; if (isset($_POST['id'])) $id = $_POST['id']; - + $after = $_GET['after']; if (isset($_POST['after'])) $after = $_POST['after']; - + if (isset($_GET['dup'])) { $id = $_GET['dup']; $after = $_GET['dup']; } - + function is_specialnet($net) { global $specialsrcdst; - + if (in_array($net, $specialsrcdst) || strstr($net, "opt")) return true; else return false; } - + function address_to_pconfig($adr, &$padr, &$pmask, &$pnot, &$pbeginport, &$pendport) { - + if (isset($adr['any'])) $padr = "any"; else if ($adr['network']) @@ -73,12 +71,12 @@ function address_to_pconfig($adr, &$padr, &$pmask, &$pnot, &$pbeginport, &$pendp if (!$pmask) $pmask = 32; } - + if (isset($adr['not'])) $pnot = 1; else $pnot = 0; - + if ($adr['port']) { list($pbeginport, $pendport) = explode("-", $adr['port']); if (!$pendport) @@ -90,9 +88,9 @@ function address_to_pconfig($adr, &$padr, &$pmask, &$pnot, &$pbeginport, &$pendp } function pconfig_to_address(&$adr, $padr, $pmask, $pnot, $pbeginport, $pendport) { - + $adr = array(); - + if ($padr == "any") $adr['any'] = true; else if (is_specialnet($padr)) @@ -102,9 +100,9 @@ function pconfig_to_address(&$adr, $padr, $pmask, $pnot, $pbeginport, $pendport) if ($pmask != 32) $adr['address'] .= "/" . $pmask; } - + $adr['not'] = $pnot ? true : false; - + if (($pbeginport != 0) && ($pbeginport != "any")) { if ($pbeginport != $pendport) $adr['port'] = $pbeginport . "-" . $pendport; @@ -115,29 +113,33 @@ function pconfig_to_address(&$adr, $padr, $pmask, $pnot, $pbeginport, $pendport) if (isset($id) && $a_shaper[$id]) { $pconfig['interface'] = $a_shaper[$id]['interface']; - + if (isset($a_shaper[$id]['protocol'])) $pconfig['proto'] = $a_shaper[$id]['protocol']; else $pconfig['proto'] = "any"; - + address_to_pconfig($a_shaper[$id]['source'], $pconfig['src'], $pconfig['srcmask'], $pconfig['srcnot'], $pconfig['srcbeginport'], $pconfig['srcendport']); - + address_to_pconfig($a_shaper[$id]['destination'], $pconfig['dst'], $pconfig['dstmask'], $pconfig['dstnot'], $pconfig['dstbeginport'], $pconfig['dstendport']); - - $pconfig['target'] = $a_shaper[$id]['targetqueue']; - + + if (isset($a_shaper[$id]['targetpipe'])) { + $pconfig['target'] = "targetpipe:" . $a_shaper[$id]['targetpipe']; + } else if (isset($a_shaper[$id]['targetqueue'])) { + $pconfig['target'] = "targetqueue:" . $a_shaper[$id]['targetqueue']; + } + $pconfig['direction'] = $a_shaper[$id]['direction']; $pconfig['iptos'] = $a_shaper[$id]['iptos']; $pconfig['iplen'] = $a_shaper[$id]['iplen']; $pconfig['tcpflags'] = $a_shaper[$id]['tcpflags']; $pconfig['descr'] = $a_shaper[$id]['descr']; $pconfig['disabled'] = isset($a_shaper[$id]['disabled']); - + if ($pconfig['srcbeginport'] == 0) { $pconfig['srcbeginport'] = "any"; $pconfig['srcendport'] = "any"; @@ -146,7 +148,7 @@ if (isset($id) && $a_shaper[$id]) { $pconfig['dstbeginport'] = "any"; $pconfig['dstendport'] = "any"; } - + } else { /* defaults */ $pconfig['src'] = "any"; @@ -164,38 +166,38 @@ if ($_POST) { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } else { - + if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport']) $_POST['srcbeginport'] = $_POST['srcbeginport_cust']; if ($_POST['srcendport_cust'] && !$_POST['srcendport']) $_POST['srcendport'] = $_POST['srcendport_cust']; - + if ($_POST['srcbeginport'] == "any") { $_POST['srcbeginport'] = 0; $_POST['srcendport'] = 0; - } else { + } else { if (!$_POST['srcendport']) $_POST['srcendport'] = $_POST['srcbeginport']; } if ($_POST['srcendport'] == "any") $_POST['srcendport'] = $_POST['srcbeginport']; - + if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport']) $_POST['dstbeginport'] = $_POST['dstbeginport_cust']; if ($_POST['dstendport_cust'] && !$_POST['dstendport']) $_POST['dstendport'] = $_POST['dstendport_cust']; - + if ($_POST['dstbeginport'] == "any") { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; - } else { + } else { if (!$_POST['dstendport']) $_POST['dstendport'] = $_POST['dstbeginport']; } if ($_POST['dstendport'] == "any") - $_POST['dstendport'] = $_POST['dstbeginport']; + $_POST['dstendport'] = $_POST['dstbeginport']; } - + if (is_specialnet($_POST['srctype'])) { $_POST['src'] = $_POST['srctype']; $_POST['srcmask'] = 0; @@ -208,7 +210,7 @@ if ($_POST) { } else if ($_POST['dsttype'] == "single") { $_POST['dstmask'] = 32; } - + $intos = array(); foreach ($iptos as $tos) { if ($_POST['iptos_' . $tos] == "on") @@ -217,7 +219,7 @@ if ($_POST) { $intos[] = "!" . $tos; } $_POST['iptos'] = join(",", $intos); - + $intcpflags = array(); foreach ($tcpflags as $tcpflag) { if ($_POST['tcpflags_' . $tcpflag] == "on") @@ -226,14 +228,14 @@ if ($_POST) { $intcpflags[] = "!" . $tcpflag; } $_POST['tcpflags'] = join(",", $intcpflags); - + unset($input_errors); $pconfig = $_POST; /* input validation */ $reqdfields = explode(" ", "target proto src dst"); $reqdfieldsn = explode(",", "Target,Protocol,Source,Destination"); - + if (!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) { $reqdfields[] = "srcmask"; $reqdfieldsn[] = "Source bit count"; @@ -242,9 +244,9 @@ if ($_POST) { $reqdfields[] = "dstmask"; $reqdfieldsn[] = "Destination bit count"; } - + do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); - + if (!$_POST['srcbeginport']) { $_POST['srcbeginport'] = 0; $_POST['srcendport'] = 0; @@ -253,7 +255,7 @@ if ($_POST) { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } - + if (($_POST['srcbeginport'] && !is_port($_POST['srcbeginport']))) { $input_errors[] = "The start source port must be an integer between 1 and 65535."; } @@ -266,7 +268,7 @@ if ($_POST) { if (($_POST['dstendport'] && !is_port($_POST['dstendport']))) { $input_errors[] = "The end destination port must be an integer between 1 and 65535."; } - + if (!is_specialnet($_POST['srctype'])) { if (($_POST['src'] && !is_ipaddroranyalias($_POST['src']))) { $input_errors[] = "A valid source IP address or alias must be specified."; @@ -283,7 +285,7 @@ if ($_POST) { $input_errors[] = "A valid destination bit count must be specified."; } } - + if ($_POST['srcbeginport'] > $_POST['srcendport']) { /* swap */ $tmp = $_POST['srcendport']; @@ -296,7 +298,7 @@ if ($_POST) { $_POST['dstendport'] = $_POST['dstbeginport']; $_POST['dstbeginport'] = $tmp; } - + if (($_POST['iplen'] && !preg_match("/^(\d+)(-(\d+))?$/", $_POST['iplen']))) { $input_errors[] = "The IP packet length must be an integer or a range (from-to)."; } @@ -304,30 +306,30 @@ if ($_POST) { if (!$input_errors) { $shaperent = array(); $shaperent['interface'] = $_POST['interface']; - + if ($_POST['proto'] != "any") $shaperent['protocol'] = $_POST['proto']; else unset($shaperent['protocol']); - + pconfig_to_address($shaperent['source'], $_POST['src'], $_POST['srcmask'], $_POST['srcnot'], $_POST['srcbeginport'], $_POST['srcendport']); - + pconfig_to_address($shaperent['destination'], $_POST['dst'], $_POST['dstmask'], $_POST['dstnot'], $_POST['dstbeginport'], $_POST['dstendport']); - + $shaperent['direction'] = $_POST['direction']; $shaperent['iplen'] = $_POST['iplen']; $shaperent['iptos'] = $_POST['iptos']; $shaperent['tcpflags'] = $_POST['tcpflags']; $shaperent['descr'] = $_POST['descr']; $shaperent['disabled'] = $_POST['disabled'] ? true : false; - + list($targettype,$target) = explode(":", $_POST['target']); $shaperent[$targettype] = $target; - + if (isset($id) && $a_shaper[$id]) $a_shaper[$id] = $shaperent; else { @@ -336,10 +338,10 @@ if ($_POST) { else $a_shaper[] = $shaperent; } - + write_config(); touch($d_shaperconfdirty_path); - + header("Location: firewall_shaper.php"); exit; } @@ -380,7 +382,7 @@ function ext_change() { document.iform.dstendport_cust.value = ""; document.iform.dstendport_cust.disabled = 1; } - + if (!portsenabled) { document.iform.srcbeginport.disabled = 1; document.iform.srcendport.disabled = 1; @@ -437,7 +439,7 @@ function proto_change() { } else { portsenabled = 0; } - + ext_change(); } @@ -455,25 +457,33 @@ function dst_rep_change() {

Firewall: Traffic shaper: Edit rule

- 0): ?> - + 0)): ?>
- + @@ -483,7 +493,7 @@ function dst_rep_change() { Disable this rule
Set this option to disable this rule without removing it from the list. - + - + - + - - - + - + - - - + - + - +
Target
- Choose a pipe or queue where packets that + Choose a pipe or queue where packets that match this rule should be sent.
Interface
- Choose which interface packets must pass + Choose which interface packets must pass through to match this rule.
Protocol
Choose which IP protocol +
Choose which IP protocol this rule should match.
Hint: in most cases, you should specify TCP  here.
Source > + > not
- Use this option to invert the sense of the match.

+ Use this option to invert the sense of the match.

- + - +
Type:  
Address:   - / + /
Source port range +
Source port range - + - +
from:  
to:
-
Specify the port or port range for +
Specify the port or port range for the source of the packet for this rule.
- Hint: you can leave the 'to' field empty if you only + Hint: you can leave the 'to' field empty if you only want to filter a single port
Destination > + > not
- Use this option to invert the sense of the match.

+ Use this option to invert the sense of the match.

- + - +
Type:  
Address:   - / + /
Destination port +
Destination port range - + - +
from:  
to:
-
Specify the port or port range for +
Specify the port or port range for the destination of the packet for this rule.
- Hint: you can leave the 'to' field empty if you only + Hint: you can leave the 'to' field empty if you only want to filter a single port
Direction
- Use this to match only packets travelling in a given direction - on the interface specified above (as seen from the firewall's + Use this to match only packets travelling in a given direction + on the interface specified above (as seen from the firewall's perspective).
IP Type of Service (TOS) - - - + @@ -704,14 +714,22 @@ function dst_rep_change() { Use this to match packets according to their IP TOS values. - + + + + + - + - - + -
- + +
+ > yes   
IP packet length +
+ Setting this makes the rule match packets of a given length + (either a single value or a range in the syntax from-to, + e.g. 0-80).
TCP flags - - - +
+
> @@ -723,18 +741,18 @@ function dst_rep_change() {
- Use this to choose TCP flags that must + Use this to choose TCP flags that must be set or cleared for this rule to match.
Description -
You may enter a description here + 		+
You may enter a description here for your reference (not parsed).
  + @@ -751,7 +769,7 @@ proto_change(); //--> -

You need to create a queue before you can add a new rule.

+

You need to create a pipe or queue before you can add a new rule.