firewall_aliases.php 13.6 KB
Newer Older
Ad Schellevis's avatar
Ad Schellevis committed
1
<?php
2

Ad Schellevis's avatar
Ad Schellevis committed
3
/*
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
    Copyright (C) 2014 Deciso B.V.
    Copyright (C) 2004 Scott Ullrich
    Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
    All rights reserved.

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions are met:

    1. Redistributions of source code must retain the above copyright notice,
       this list of conditions and the following disclaimer.

    2. Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.

    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
    POSSIBILITY OF SUCH DAMAGE.
Ad Schellevis's avatar
Ad Schellevis committed
29 30
*/

31
require_once("guiconfig.inc");
Ad Schellevis's avatar
Ad Schellevis committed
32 33
require_once("filter.inc");

34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
function find_alias_type($type)
{
    $types = array(
        'host' => gettext('Host(s)'),
        'network' => gettext('Network(s)'),
        'port' => gettext('Port(s)'),
        'url' => gettext('URL (IPs)'),
        'url_ports' => gettext('URL (Ports)'),
        'urltable' => gettext('URL Table (IPs)'),
        'urltable_ports' => gettext('URL Table (Ports)'),
    );

    if (isset($types[$type])) {
        return $types[$type];
    }

    return $type;
}

Ad Schellevis's avatar
Ad Schellevis committed
53 54
function find_alias_reference($section, $field, $origname, &$is_alias_referenced, &$referenced_by)
{
55
    global $config;
Ad Schellevis's avatar
Ad Schellevis committed
56
    if (!$origname || $is_alias_referenced) {
57
        return;
Ad Schellevis's avatar
Ad Schellevis committed
58
    }
Ad Schellevis's avatar
Ad Schellevis committed
59

60 61
    $sectionref = &$config;
    foreach($section as $sectionname) {
Ad Schellevis's avatar
Ad Schellevis committed
62
        if (is_array($sectionref) && isset($sectionref[$sectionname])) {
63
            $sectionref = &$sectionref[$sectionname];
Ad Schellevis's avatar
Ad Schellevis committed
64
        } else {
65
            return;
Ad Schellevis's avatar
Ad Schellevis committed
66
        }
67
    }
Ad Schellevis's avatar
Ad Schellevis committed
68

Ad Schellevis's avatar
Ad Schellevis committed
69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90
    if (is_array($sectionref)) {
        foreach($sectionref as $itemkey => $item) {
            $fieldfound = true;
            $fieldref = &$sectionref[$itemkey];
            foreach($field as $fieldname) {
                if (is_array($fieldref) && isset($fieldref[$fieldname])) {
                    $fieldref = &$fieldref[$fieldname];
                } else {
                    $fieldfound = false;
                    break;
                }
            }
            if ($fieldfound && $fieldref == $origname) {
                $is_alias_referenced = true;
                $referenced_by = '';
                if (is_array($item)) {
                    if (isset($item['descr'])) {
                        $referenced_by .= $item['descr'];
                    } else {
                        $referenced_by .= implode(',', $section) . ' / '. implode(',', $field);
                    }
                }
91 92 93 94
                break;
            }
        }
    }
Ad Schellevis's avatar
Ad Schellevis committed
95 96
}

Ad Schellevis's avatar
Ad Schellevis committed
97 98 99 100 101 102 103 104 105 106 107 108 109 110 111
function alias_used_recursive($origname)
{
    global $config;
    if (!empty($config['aliases']['alias'])) {
        foreach($config['aliases']['alias'] as $alias) {
            // exclude geoips and urltypes, they don't support nesting.
            if ($alias['type'] != 'geoip' && !preg_match("/urltable/i",$alias['type'])) {
                if ($origname == $alias['address']) {
                    return empty($alias['description']) ? $alias['name'] : $alias['description'];
                }
            }
        }
    }
    return null;
}
Ad Schellevis's avatar
Ad Schellevis committed
112

113
if (!isset($config['aliases']) || !is_array($config['aliases'])) {
114
    $config['aliases'] = array();
115 116
}
if (!isset($config['aliases']['alias'])) {
117
    $config['aliases']['alias'] = array();
118 119
}
$a_aliases = &$config['aliases']['alias'];
Ad Schellevis's avatar
Ad Schellevis committed
120

121
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155
    if (isset($_POST['apply'])) {
        /* reload all components that use aliases */
        filter_configure();
        $savemsg = get_std_save_message();
        clear_subsystem_dirty('aliases');
    } elseif (isset($_POST['act']) && $_POST['act'] == "del") {
        if (isset($_POST['id']) && isset($a_aliases[$_POST['id']])) {
            // perform validation
            /* make sure rule is not being referenced by any nat or filter rules */
            $is_alias_referenced = false;
            $referenced_by = false;
            $alias_name = $a_aliases[$_POST['id']]['name'];
            // Firewall rules
            find_alias_reference(array('filter', 'rule'), array('source', 'address'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('filter', 'rule'), array('destination', 'address'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('filter', 'rule'), array('source', 'port'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('filter', 'rule'), array('destination', 'port'), $alias_name, $is_alias_referenced, $referenced_by);
            // NAT Rules
            find_alias_reference(array('nat', 'rule'), array('source', 'address'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'rule'), array('source', 'port'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'rule'), array('destination', 'address'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'rule'), array('destination', 'port'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'rule'), array('target'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'rule'), array('local-port'), $alias_name, $is_alias_referenced, $referenced_by);
            // NAT 1:1 Rules
            //find_alias_reference(array('nat', 'onetoone'), array('external'), $alias_name, $is_alias_referenced, $referenced_by);
            //find_alias_reference(array('nat', 'onetoone'), array('source', 'address'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'onetoone'), array('destination', 'address'), $alias_name, $is_alias_referenced, $referenced_by);
            // NAT Outbound Rules
            find_alias_reference(array('nat', 'advancedoutbound', 'rule'), array('source', 'network'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'advancedoutbound', 'rule'), array('sourceport'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'advancedoutbound', 'rule'), array('destination', 'address'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'advancedoutbound', 'rule'), array('dstport'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('nat', 'advancedoutbound', 'rule'), array('target'), $alias_name, $is_alias_referenced, $referenced_by);
Ad Schellevis's avatar
Ad Schellevis committed
156 157 158 159 160 161
            // Alias in an alias, only for selected types
            $alias_recursive_used = alias_used_recursive($alias_name);
            if  ($alias_recursive_used != null) {
                $is_alias_referenced = true;
                $referenced_by = $alias_recursive_used;
            }
162 163 164 165 166
            // Load Balancer
            find_alias_reference(array('load_balancer', 'lbpool'),         array('port'), $alias_name, $is_alias_referenced, $referenced_by);
            find_alias_reference(array('load_balancer', 'virtual_server'), array('port'), $alias_name, $is_alias_referenced, $referenced_by);
            // Static routes
            find_alias_reference(array('staticroutes', 'route'), array('network'), $alias_name, $is_alias_referenced, $referenced_by);
Ad Schellevis's avatar
Ad Schellevis committed
167
            if ($is_alias_referenced) {
168
                $savemsg = sprintf(gettext("Cannot delete alias. Currently in use by %s"), $referenced_by);
169
            } else {
170
                configd_run("filter kill table {$alias_name}");
171 172 173 174 175
                unset($a_aliases[$_POST['id']]);
                if (write_config()) {
                    filter_configure();
                    mark_subsystem_dirty('aliases');
                }
176
                header('Location: firewall_aliases.php');
177
                exit;
178 179 180
            }
        }
    }
181 182
}

183
legacy_html_escape_form_data($a_aliases);
Ad Schellevis's avatar
Ad Schellevis committed
184
$main_buttons = array(
185
    array('href' => 'firewall_aliases_edit.php', 'label' => gettext('Add a new alias')),
Ad Schellevis's avatar
Ad Schellevis committed
186
);
Ad Schellevis's avatar
Ad Schellevis committed
187

188
include("head.inc");
189

190
?>
Ad Schellevis's avatar
Ad Schellevis committed
191
<body>
192 193
<script type="text/javascript">
$( document ).ready(function() {
194 195 196 197
  // link delete buttons
  $(".act_delete").click(function(){
    var id = $(this).attr("id").split('_').pop(-1);
    BootstrapDialog.show({
Fabian Franz's avatar
Fabian Franz committed
198
        type:BootstrapDialog.TYPE_DANGER,
199
        title: "<?= gettext("Aliases");?>",
200 201 202 203 204 205 206 207 208 209 210 211 212 213
        message: "<?=gettext("Do you really want to delete this alias? All elements that still use it will become invalid (e.g. filter rules)!");?>",
        buttons: [{
                label: "<?= gettext("No");?>",
                action: function(dialogRef) {
                  dialogRef.close();
                }}, {
                  label: "<?= gettext("Yes");?>",
                  action: function(dialogRef) {
                    $("#delId").val(id);
                    $("#iform").submit()
                }
        }]
    });
  });
214 215
});
</script>
Ad Schellevis's avatar
Ad Schellevis committed
216
<?php include("fbegin.inc"); ?>
217 218 219
  <section class="page-content-main">
    <div class="container-fluid">
      <div class="row">
220 221
<?php if (isset($savemsg)) print_info_box($savemsg); ?>
<?php if (is_subsystem_dirty('aliases')): ?>
222
<?php print_info_box_apply(gettext("The alias list has been changed.") . "<br />" . gettext("You must apply the changes in order for them to take effect."));?>
223
<?php endif; ?>
224
        <section class="col-xs-12">
225
          <div class="content-box">
226
            <form method="post" name="iform" id="iform">
227 228 229 230 231 232 233
              <input type="hidden" name="tab" value="<?=$selected_tab;?>" />
              <input type="hidden" name="id" value="" id="delId"/>
              <input type="hidden" name="act" value="del"/>
                <div class="table-responsive">
                  <table class="table table-striped">
                    <tr>
                      <td><?=gettext("Name"); ?></td>
234
                      <td><?=gettext("Type"); ?></td>
235
                      <td><?=gettext("Description"); ?></td>
236
                      <td><?=gettext("Values"); ?></td>
237 238
                      <td>&nbsp;</td>
                    </tr>
239
<?php
240
                    uasort($a_aliases, function($a, $b) {
241 242
                        return strnatcmp($a['name'], $b['name']);
                    });
243

244
                    foreach ($a_aliases as $i=> $alias){
245
?>
246 247
                    <tr>
                      <td ondblclick="document.location='firewall_aliases_edit.php?id=<?=$i;?>';">
248
                        <?=$alias['name'];?>
249
                      </td>
250 251
<?php
                        $alias_values = '';
252 253
                        if (!empty($alias["url"])) {
                            $alias_values = $alias["url"];
Ad Schellevis's avatar
Ad Schellevis committed
254
                        } elseif (isset($alias["aliasurl"])) {
255
                            $alias_values = implode(", ", array_slice($alias['aliasurl'], 0, 5));
Ad Schellevis's avatar
Ad Schellevis committed
256
                            if (count($alias['aliasurl']) > 5) {
257 258 259 260
                                $alias_values .= "...";
                            }
                        } else {
                            $alias_values = implode(", ", array_slice(explode(" ", $alias['address']), 0, 5));
Ad Schellevis's avatar
Ad Schellevis committed
261
                            if (count(explode(" ", $alias['address'])) > 5) {
262 263 264
                                $alias_values .= "...";
                            }
                      }
265
?>
266
                      <td ondblclick="document.location='firewall_aliases_edit.php?id=<?=$i;?>';">
267 268 269 270
                        <?= find_alias_type($alias['type']) ?>
                      </td>
                      <td ondblclick="document.location='firewall_aliases_edit.php?id=<?=$i;?>';">
                        <?= $alias['descr'] ?>
271 272
                      </td>
                      <td ondblclick="document.location='firewall_aliases_edit.php?id=<?=$i;?>';">
273
                        <?= $alias_values ?>
274 275 276
                      </td>
                      <td>
                        <a href="firewall_aliases_edit.php?id=<?=$i;?>" title="<?=gettext("Edit alias"); ?>" class="btn btn-default btn-xs"><span class="glyphicon glyphicon-pencil"></span></a>
277
                        <a id="del_<?=$i;?>" title="<?=gettext("delete alias"); ?>" class="act_delete btn btn-default btn-xs"><span class="fa fa-trash text-muted"></span></a>
278 279
                      </td>
                    </tr>
280
<?php
281
                    } // foreach
282
?>
283 284 285 286 287
                  <tr>
                    <td colspan="5">
                      <?=gettext("Aliases act as placeholders for real hosts, networks or ports. They can be used to minimize the number of changes that have to be made if a host, network or port changes. You can enter the name of an alias instead of the host, network or port in all fields that have a red background. The alias will be resolved according to the list above. If an alias cannot be resolved (e.g. because you deleted it), the corresponding element (e.g. filter/NAT/shaper rule) will be considered invalid and skipped."); ?>
                    </td>
                  </tr>
288 289 290 291 292 293 294
                </table>
            </form>
          </div>
        </section>
      </div>
    </div>
  </section>
295
<?php include("foot.inc"); ?>