From 9c55500fe8efa309d55f34c21d5ae2bf69fabf06 Mon Sep 17 00:00:00 2001 From: Chen Minqiang Date: Wed, 19 Oct 2022 18:01:15 +0800 Subject: [PATCH] luci-app-firewall: allow ipv6 setup Allow setup ipv6 for Port Forwards and NAT Rules if firewall4 is used. Add 'Restrict to address family' option for NAT Rules, if family is any/empty , assume it is ipv4. this allow setup NAT6 rules in web ui Signed-off-by: Chen Minqiang --- .../luci-static/resources/tools/firewall.js | 16 +++- .../resources/view/firewall/forwards.js | 58 ++++++++++-- .../resources/view/firewall/snats.js | 90 +++++++++++++++++-- 3 files changed, 149 insertions(+), 15 deletions(-) diff --git a/applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js b/applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js index 03e505e89d..ec0ee369ea 100644 --- a/applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js +++ b/applications/luci-app-firewall/htdocs/luci-static/resources/tools/firewall.js @@ -477,18 +477,20 @@ return baseclass.extend({ addLocalIPOption: function(s, tab, name, label, description, devices) { var o = s.taboption(tab, form.Value, name, label, description); + var fw4 = L.hasSystemFeature('firewall4'); o.modalonly = true; - o.datatype = 'ip4addr("nomask")'; + o.datatype = !fw4?'ip4addr("nomask")':'ipaddr("nomask")'; o.placeholder = _('any'); L.sortedKeys(devices, 'name').forEach(function(dev) { var ip4addrs = devices[dev].ipaddrs; + var ip6addrs = devices[dev].ip6addrs; - if (!L.isObject(devices[dev].flags) || !Array.isArray(ip4addrs) || devices[dev].flags.loopback) + if (!L.isObject(devices[dev].flags) || devices[dev].flags.loopback) return; - for (var i = 0; i < ip4addrs.length; i++) { + for (var i = 0; Array.isArray(ip4addrs) && i < ip4addrs.length; i++) { if (!L.isObject(ip4addrs[i]) || !ip4addrs[i].address) continue; @@ -496,6 +498,14 @@ return baseclass.extend({ ip4addrs[i].address, ' (', E('strong', {}, [dev]), ')' ])); } + for (var i = 0; fw4 && Array.isArray(ip6addrs) && i < ip6addrs.length; i++) { + if (!L.isObject(ip6addrs[i]) || !ip6addrs[i].address) + continue; + + o.value(ip6addrs[i].address, E([], [ + ip6addrs[i].address, ' (', E('strong', {}, [dev]), ')' + ])); + } }); return o; diff --git a/applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js b/applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js index cbd4362049..149e4f0f33 100644 --- a/applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js +++ b/applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/forwards.js @@ -9,6 +9,8 @@ 'require tools.widgets as widgets'; function rule_proto_txt(s, ctHelpers) { + var family = (uci.get('firewall', s, 'family') || '').toLowerCase().replace(/^(?:any|\*)$/, ''); + var dip = uci.get('firewall', s, 'dest_ip') || '' var proto = L.toArray(uci.get('firewall', s, 'proto')).filter(function(p) { return (p != '*' && p != 'any' && p != 'all'); }).map(function(p) { @@ -35,7 +37,9 @@ function rule_proto_txt(s, ctHelpers) { mask: m[3] ? '0x%02X'.format(+m[3]) : null } : null; - return fwtool.fmt(_('Incoming IPv4%{proto?, protocol %{proto#%{next?, }%{item.types?%{item.name}ICMP with types %{item.types#%{next?, }%{item}}:%{item.name}}}}%{mark?, mark %{mark.val}}%{helper?, helper %{helper.inv?%{helper.val}:%{helper.val}}}'), { + return fwtool.fmt(_('Incoming %{ipv6?%{ipv4?IPv4 and IPv6:IPv6}:IPv4}%{proto?, protocol %{proto#%{next?, }%{item.types?%{item.name}ICMP with types %{item.types#%{next?, }%{item}}:%{item.name}}}}%{mark?, mark %{mark.val}}%{helper?, helper %{helper.inv?%{helper.val}:%{helper.val}}}'), { + ipv4: ((!family && (dip.indexOf(':') == -1)) || family == 'ipv4'), + ipv6: ((!family && (dip.indexOf(':') != -1)) || family == 'ipv6'), proto: proto, helper: h, mark: f @@ -85,6 +89,24 @@ function rule_target_txt(s) { }); } +function validate_opt_family(m, section_id, opt) { + var dopt = m.section.getOption('dest_ip'), + fmopt = m.section.getOption('family'); + + if (!dopt.isValid(section_id) && opt != 'dest_ip') + return true; + if (!fmopt.isValid(section_id) && opt != 'family') + return true; + + var dip = dopt.formvalue(section_id) || '', + fm = fmopt.formvalue(section_id) || ''; + + if (fm == '' || (fm == 'ipv6' && (dip.indexOf(':') != -1 || dip == '')) || (fm == 'ipv4' && dip.indexOf(':') == -1)) + return true; + + return _('Address family, Internal IP address must match'); +} + return view.extend({ callHostHints: rpc.declare({ object: 'luci-rpc', @@ -125,6 +147,7 @@ return view.extend({ ctHelpers = data[1], devs = data[2], m, s, o; + var fw4 = L.hasSystemFeature('firewall4'); m = new form.Map('firewall', _('Firewall - Port Forwards'), _('Port forwarding allows remote computers on the Internet to connect to a specific computer or service within the private LAN.')); @@ -160,6 +183,29 @@ return view.extend({ o.placeholder = _('Unnamed forward'); o.modalonly = true; + if (fw4) { + o = s.taboption('general', form.ListValue, 'family', _('Restrict to address family')); + o.modalonly = true; + o.rmempty = true; + o.value('ipv4', _('IPv4 only')); + o.value('ipv6', _('IPv6 only')); + o.value('', _('automatic')); // infer from zone or used IP addresses + o.cfgvalue = function(section_id) { + var val = this.map.data.get(this.map.config, section_id, 'family'); + + if (!val || val == 'any' || val == 'all' || val == '*') + return ''; + else if (val == 'inet' || String(val).indexOf('4') != -1) + return 'ipv4'; + else if (String(val).indexOf('6') != -1) + return 'ipv6'; + }; + o.validate = function(section_id, value) { + fwtool.updateHostHints(this.map, section_id, 'dest_ip', value, hosts); + return !fw4?true:validate_opt_family(this, section_id, 'family'); + }; + } + o = s.option(form.DummyValue, '_match', _('Match')); o.modalonly = false; o.textvalue = function(s) { @@ -200,9 +246,9 @@ return view.extend({ o.datatype = 'list(neg(macaddr))'; o = fwtool.addIPOption(s, 'advanced', 'src_ip', _('Source IP address'), - _('Only match incoming traffic from this IP or range.'), 'ipv4', hosts); + _('Only match incoming traffic from this IP or range.'), !fw4?'ipv4':'', hosts); o.rmempty = true; - o.datatype = 'neg(ipmask4("true"))'; + o.datatype = !fw4?'neg(ipmask4("true"))':'neg(ipmask("true"))'; o = s.taboption('advanced', form.Value, 'src_port', _('Source port'), _('Only match incoming traffic originating from the given source port or port range on the client host')); @@ -215,7 +261,7 @@ return view.extend({ o = fwtool.addLocalIPOption(s, 'advanced', 'src_dip', _('External IP address'), _('Only match incoming traffic directed at the given IP address.'), devs); - o.datatype = 'neg(ipmask4("true"))'; + o.datatype = !fw4?'neg(ipmask4("true"))':'neg(ipmask("true"))'; o.rmempty = true; o = s.taboption('general', form.Value, 'src_dport', _('External port'), @@ -232,9 +278,9 @@ return view.extend({ o.nocreate = true; o = fwtool.addIPOption(s, 'general', 'dest_ip', _('Internal IP address'), - _('Redirect matched incoming traffic to the specified internal host'), 'ipv4', hosts); + _('Redirect matched incoming traffic to the specified internal host'), !fw4?'ipv4':'', hosts); o.rmempty = true; - o.datatype = 'ipmask4'; + o.datatype = !fw4?'ipmask4':'ipmask'; o = s.taboption('general', form.Value, 'dest_port', _('Internal port'), _('Redirect matched incoming traffic to the given port on the internal host')); diff --git a/applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/snats.js b/applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/snats.js index e8c90a7574..a36dfee6bb 100644 --- a/applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/snats.js +++ b/applications/luci-app-firewall/htdocs/luci-static/resources/view/firewall/snats.js @@ -9,6 +9,10 @@ 'require tools.widgets as widgets'; function rule_proto_txt(s) { + var family = (uci.get('firewall', s, 'family') || '').toLowerCase().replace(/^(?:any|\*)$/, ''); + var sip = uci.get('firewall', s, 'src_ip') || ''; + var dip = uci.get('firewall', s, 'dest_ip') || ''; + var rwip = uci.get('firewall', s, 'snat_ip') || ''; var proto = L.toArray(uci.get('firewall', s, 'proto')).filter(function(p) { return (p != '*' && p != 'any' && p != 'all'); }).map(function(p) { @@ -27,7 +31,9 @@ function rule_proto_txt(s) { mask: m[3] ? '0x%02X'.format(+m[3]) : null } : null; - return fwtool.fmt(_('Forwarded IPv4%{proto?, protocol %{proto#%{next?, }%{item.name}}}%{mark?, mark %{mark.val}}'), { + return fwtool.fmt(_('Forwarded %{ipv6?%{ipv4?IPv4 and IPv6:IPv6}:IPv4}%{proto?, protocol %{proto#%{next?, }%{item.name}}}%{mark?, mark %{mark.val}}'), { + ipv4: (family == 'ipv4' || (!family && (sip.indexOf(':') == -1 && dip.indexOf(':') == -1 && rwip.indexOf(':') == -1))), + ipv6: (family == 'ipv6' || (!family && (sip.indexOf(':') != -1 || dip.indexOf(':') != -1 || rwip.indexOf(':') != -1))), proto: proto, mark: f }); @@ -91,6 +97,44 @@ function rule_target_txt(s) { } } +function validate_opt_family(m, section_id, opt) { + var sopt = m.section.getOption('src_ip'), + dopt = m.section.getOption('dest_ip'), + rwopt = m.section.getOption('snat_ip'), + fmopt = m.section.getOption('family'), + tgopt = m.section.getOption('target'); + + if (!sopt.isValid(section_id) && opt != 'src_ip') + return true; + if (!dopt.isValid(section_id) && opt != 'dest_ip') + return true; + if (!rwopt.isValid(section_id) && opt != 'snat_ip') + return true; + if (!fmopt.isValid(section_id) && opt != 'family') + return true; + if (!tgopt.isValid(section_id) && opt != 'target') + return true; + + var sip = sopt.formvalue(section_id) || '', + dip = dopt.formvalue(section_id) || '', + rwip = rwopt.formvalue(section_id) || '', + fm = fmopt.formvalue(section_id) || '', + tg = tgopt.formvalue(section_id); + + if (fm == 'ipv6' && (sip.indexOf(':') != -1 || sip == '') && (dip.indexOf(':') != -1 || dip == '') && ((rwip.indexOf(':') != -1 && tg == 'SNAT') || rwip == '')) + return true; + if (fm == 'ipv4' && (sip.indexOf(':') == -1) && (dip.indexOf(':') == -1) && ((rwip.indexOf(':') == -1 && tg == 'SNAT') || rwip == '')) + return true; + if (fm == '') { + if ((sip.indexOf(':') != -1 || sip == '') && (dip.indexOf(':') != -1 || dip == '') && ((rwip.indexOf(':') != -1 && tg == 'SNAT') || rwip == '')) + return true; + if ((sip.indexOf(':') == -1) && (dip.indexOf(':') == -1) && ((rwip.indexOf(':') == -1 && tg == 'SNAT') || rwip == '')) + return true; + } + + return _('Address family, source address, destination address, rewrite IP address must match'); +} + return view.extend({ callHostHints: rpc.declare({ object: 'luci-rpc', @@ -123,6 +167,7 @@ return view.extend({ var hosts = data[0], devs = data[1], m, s, o; + var fw4 = L.hasSystemFeature('firewall4'); m = new form.Map('firewall', _('Firewall - NAT Rules'), _('NAT rules allow fine grained control over the source IP to use for outbound or forwarded traffic.')); @@ -166,6 +211,30 @@ return view.extend({ o.default = o.enabled; o.editable = true; + if (fw4) { + o = s.taboption('general', form.ListValue, 'family', _('Restrict to address family')); + o.modalonly = true; + o.rmempty = true; + o.value('ipv4', _('IPv4 only')); + o.value('ipv6', _('IPv6 only')); + o.value('', _('automatic')); // infer from zone or used IP addresses + o.cfgvalue = function(section_id) { + var val = this.map.data.get(this.map.config, section_id, 'family'); + + if (!val || val == 'any' || val == 'all' || val == '*') + return ''; + else if (val == 'inet' || String(val).indexOf('4') != -1) + return 'ipv4'; + else if (String(val).indexOf('6') != -1) + return 'ipv6'; + }; + o.validate = function(section_id, value) { + fwtool.updateHostHints(this.map, section_id, 'src_ip', value, hosts); + fwtool.updateHostHints(this.map, section_id, 'dest_ip', value, hosts); + return !fw4?true:validate_opt_family(this, section_id, 'family'); + }; + } + o = s.taboption('general', fwtool.CBIProtocolSelect, 'proto', _('Protocol')); o.modalonly = true; o.default = 'all'; @@ -178,9 +247,12 @@ return view.extend({ o.default = 'lan'; o = fwtool.addIPOption(s, 'general', 'src_ip', _('Source address'), - _('Match forwarded traffic from this IP or range.'), 'ipv4', hosts); + _('Match forwarded traffic from this IP or range.'), !fw4?'ipv4':'', hosts); o.rmempty = true; - o.datatype = 'neg(ipmask4("true"))'; + o.datatype = !fw4?'neg(ipmask4("true"))':'neg(ipmask("true"))'; + o.validate = function(section_id, value) { + return !fw4?true:validate_opt_family(this, section_id, 'src_ip'); + }; o = s.taboption('general', form.Value, 'src_port', _('Source port'), _('Match forwarded traffic originating from the given source port or port range.')); @@ -192,9 +264,12 @@ return view.extend({ o.depends({ proto: 'udp', '!contains': true }); o = fwtool.addIPOption(s, 'general', 'dest_ip', _('Destination address'), - _('Match forwarded traffic directed at the given IP address.'), 'ipv4', hosts); + _('Match forwarded traffic directed at the given IP address.'), !fw4?'ipv4':'', hosts); o.rmempty = true; - o.datatype = 'neg(ipmask4("true"))'; + o.datatype = !fw4?'neg(ipmask4("true"))':'neg(ipmask("true"))'; + o.validate = function(section_id, value) { + return !fw4?true:validate_opt_family(this, section_id, 'dest_ip'); + }; o = s.taboption('general', form.Value, 'dest_port', _('Destination port'), _('Match forwarded traffic directed at the given destination port or port range.')); @@ -211,6 +286,9 @@ return view.extend({ o.value('SNAT', _('SNAT - Rewrite to specific source IP or port')); o.value('MASQUERADE', _('MASQUERADE - Automatically rewrite to outbound interface IP')); o.value('ACCEPT', _('ACCEPT - Disable address rewriting')); + o.validate = function(section_id, value) { + return !fw4?true:validate_opt_family(this, section_id, 'target'); + }; o = fwtool.addLocalIPOption(s, 'general', 'snat_ip', _('Rewrite IP address'), _('Rewrite matched traffic to the specified source IP address.'), devs); @@ -223,7 +301,7 @@ return view.extend({ if ((a == null || a == '') && (p == null || p == '') && value == '') return _('A rewrite IP must be specified!'); - return true; + return !fw4?true:validate_opt_family(this, section_id, 'snat_ip'); }; o = s.taboption('general', form.Value, 'snat_port', _('Rewrite port'), -- 2.30.2