mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add allow-opts filter rule option which is useful in multicast rule options.

Browse Source
This commit is contained in:
Ermal Luci 2009-01-25 19:28:53 +00:00
parent e09bd5be5f
commit 775ccea312
2 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
etc/inc/filter.inc
View File

@ -1612,12 +1612,14 @@ function generate_user_filter_rule($rule)
$aline['icmp-type'] = "icmp6-type {$rule['icmp6type']} ";
}
if ($type == "pass") {
if (isset($rule['tag']) && $rule['tag'] <> "")
if (!empty($rule['tag']))
$aline['tag'] = " tag " .$rule['tag']. " ";
if (isset($rule['tagged']) && $rule['tagged'] <> "")
if (!empty($rule['tagged']))
$aline['tagged'] = " tagged " .$rule['tagged'] . " ";
if (isset($rule['dscp']) && $rule['dscp'] <> "")
if (!empty($rule['dscp']))
$aline['dscp'] = " dscp " . $rule['dscp'] . " ";
if (isset($rule['allowopts']))
$aline['allowopts'] = " allow-opts ";
if( isset($rule['source-track']) or isset($rule['max-src-nodes']) or isset($rule['max-src-states']) )
if($rule['protocol'] == "tcp")
$aline['flags'] = "flags S/SA ";
@ -1745,14 +1747,14 @@ function generate_user_filter_rule($rule)
$vpns = " to <vpns> ";
$line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] . $aline['interface'] . $aline['prot'] .
$aline['src'] . $aline['srcport'] . $aline['os'] . $vpns . $aline['dstport'].
$aline['icmp-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . $aline['flags'].
$aline['icmp-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . $aline['allowopts'] . $aline['flags'].
$aline['queue'] . $aline['dnpipe'] .
" label \"NEGATE_ROUTE: Negate policy route for local network(s)\"\n";
/* negate directly connected networks for load balancer/gateway rules */
$direct_networks = " to <direct_networks> ";
$line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] . $aline['interface'] . $aline['prot'] .
$aline['src'] . $aline['srcport'] . $aline['os'] . $direct_networks . $aline['dstport'].
$aline['icmp-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] .
$aline['icmp-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . $aline['allowopts'] .
$aline['flags'] . $aline['queue'] . $aline['dnpipe'] .
" label \"NEGATE_ROUTE: Negate policy route for local network(s)\"\n";
}
@ -1760,7 +1762,7 @@ function generate_user_filter_rule($rule)
$line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] . $aline['interface'] . $aline['reply'] .
$aline['route'] . $aline['prot'] . $aline['src'] . $aline['srcport'] . $aline['os'] . $aline['dst'] .
$aline['dstport'] . $aline['divert'] . $aline['icmp-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] .
$aline['flags'] . $aline['queue'] . $aline['dnpipe'];
$aline['allowopts'] . $aline['flags'] . $aline['queue'] . $aline['dnpipe'];
/* is a time based rule schedule attached? */
if(!empty($rule['sched'])) {

9
usr/local/www/firewall_rules_edit.php
View File

@ -119,6 +119,8 @@ if (isset($id) && $a_filter[$id]) {
$pconfig['tagged'] = $a_filter[$id]['tagged'];
if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick'])
$pconfig['quick'] = $a_filter[$id]['quick'];
if (isset($a_filter[$id]['allowopts']))
$pconfig['allowopts'] = true;
/* advanced */
$pconfig['max-src-nodes'] = $a_filter[$id]['max-src-nodes'];
@ -359,6 +361,10 @@ if ($_POST) {
}
/* Advanced options */
if ($_POST['allowopts'] == "yes")
$filterent['allowopts'] = true;
else
unset($filterent['allowopts']);
$filterent['max-src-nodes'] = $_POST['max-src-nodes'];
$filterent['max-src-states'] = $_POST['max-src-states'];
$filterent['statetimeout'] = $_POST['statetimeout'];
@ -962,6 +968,9 @@ include("head.inc");
</div>
<div id="aodivmain" name="aodivmain" style="display:none">
<input type="checkbox" id="allowopts" value="yes" name="allowopts"<?php if($pconfig['allowopts'] == true) echo " checked"; ?>>
<br/><span class="vexpl"><?=gettext("This allows packets with ip options to pass otherwise they are blocked by default i.e. with multicast routing/proxing.");?>
</span><p>
<input name="tag" id="tag" value="<?=htmlspecialchars($pconfig['tag']);?>">
<br /><span class="vexpl"><?=gettext("You can mark a packet matching this rule and use this mark to match on other nat/filter rules. It is called <b>Policy filtering</b>");?>
</span><p>