From 5d159b2c890b4c81282201315d98e38125289f53 Mon Sep 17 00:00:00 2001
From: Manuel Faux <mfaux@conf.at>
Date: Mon, 7 Dec 2015 07:57:04 +0100
Subject: [PATCH 1/3] firewall: show warning banner if firewall disabled

If firewall is globally disabled, show a warning banner in all relevant
firewall configuration and diagnostic screens (filter and NAT).
---
 src/www/diag_logs_filter.php         |  4 ++++
 src/www/diag_logs_filter_dynamic.php |  4 ++++
 src/www/diag_logs_filter_plain.php   |  4 ++++
 src/www/diag_logs_filter_summary.php |  3 +++
 src/www/firewall_nat.php             |  3 +++
 src/www/firewall_nat_1to1.php        |  3 +++
 src/www/firewall_nat_npt.php         |  3 +++
 src/www/firewall_nat_out.php         |  3 +++
 src/www/firewall_rules.php           |  3 +++
 src/www/guiconfig.inc                | 11 +++++++++++
 10 files changed, 41 insertions(+)

diff --git a/src/www/diag_logs_filter.php b/src/www/diag_logs_filter.php
index 6876cc4a1..9d51701f5 100644
--- a/src/www/diag_logs_filter.php
+++ b/src/www/diag_logs_filter.php
@@ -606,6 +606,10 @@ include("head.inc");
 		<div class="container-fluid">
 			<div class="row">
 
+                                <?php if (isset($config['system']['disablefilter'])): ?>
+                                <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+                                <?php endif; ?>
+
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 
 			    <section class="col-xs-12">
diff --git a/src/www/diag_logs_filter_dynamic.php b/src/www/diag_logs_filter_dynamic.php
index 214c8a630..7271c14e9 100644
--- a/src/www/diag_logs_filter_dynamic.php
+++ b/src/www/diag_logs_filter_dynamic.php
@@ -87,6 +87,10 @@ include("head.inc");
 		<div class="container-fluid">
 			<div class="row">
 
+                                <?php if (isset($config['system']['disablefilter'])): ?>
+                                <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+                                <?php endif; ?>
+
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 
 			    <section class="col-xs-12">
diff --git a/src/www/diag_logs_filter_plain.php b/src/www/diag_logs_filter_plain.php
index 379b2f16c..803138118 100644
--- a/src/www/diag_logs_filter_plain.php
+++ b/src/www/diag_logs_filter_plain.php
@@ -63,6 +63,10 @@ include("head.inc");
 		<div class="container-fluid">
 			<div class="row">
 
+                                <?php if (isset($config['system']['disablefilter'])): ?>
+                                <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+                                <?php endif; ?>
+
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 
 			     <section class="col-xs-12">
diff --git a/src/www/diag_logs_filter_summary.php b/src/www/diag_logs_filter_summary.php
index a2b0172a9..f39c8fd51 100644
--- a/src/www/diag_logs_filter_summary.php
+++ b/src/www/diag_logs_filter_summary.php
@@ -114,6 +114,9 @@ include("head.inc"); ?>
 	<section class="page-content-main">
 		<div class="container-fluid">
 			<div class="row">
+                                <?php if (isset($config['system']['disablefilter'])): ?>
+                                <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+                                <?php endif; ?>
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 			    <section class="col-xs-12">
 						<div class="tab-content content-box col-xs-12">
diff --git a/src/www/firewall_nat.php b/src/www/firewall_nat.php
index 0217c7e4a..38775d4a2 100644
--- a/src/www/firewall_nat.php
+++ b/src/www/firewall_nat.php
@@ -225,6 +225,9 @@ $( document ).ready(function() {
   <section class="page-content-main">
     <div class="container-fluid">
       <div class="row">
+        <?php if (isset($config['system']['disablefilter'])): ?>
+        <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+        <?php endif; ?>
 <?php   if (isset($savemsg)) print_info_box($savemsg); ?>
 <?php   if (is_subsystem_dirty('natconf')): ?>
 <?php     print_info_box_apply(gettext("The NAT configuration has been changed") . ".<br />" . gettext("You must apply the changes in order for them to take effect."));?><br />
diff --git a/src/www/firewall_nat_1to1.php b/src/www/firewall_nat_1to1.php
index 9833c8e66..f7b647f99 100644
--- a/src/www/firewall_nat_1to1.php
+++ b/src/www/firewall_nat_1to1.php
@@ -175,6 +175,9 @@ $main_buttons = array(
   <section class="page-content-main">
     <div class="container-fluid">
       <div class="row">
+        <?php if (isset($config['system']['disablefilter'])): ?>
+        <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+        <?php endif; ?>
 <?php
         if (isset($savemsg))
           print_info_box($savemsg);
diff --git a/src/www/firewall_nat_npt.php b/src/www/firewall_nat_npt.php
index 9e1fb05de..67c03ef5b 100644
--- a/src/www/firewall_nat_npt.php
+++ b/src/www/firewall_nat_npt.php
@@ -178,6 +178,9 @@ $main_buttons = array(
   <section class="page-content-main">
     <div class="container-fluid">
       <div class="row">
+        <?php if (isset($config['system']['disablefilter'])): ?>
+        <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+        <?php endif; ?>
         <?php if (isset($savemsg)) print_info_box($savemsg); ?>
         <?php if (is_subsystem_dirty('natconf')): ?>
         <?php print_info_box_apply(gettext("The NAT configuration has been changed") . ".<br />" . gettext("You must apply the changes in order for them to take effect."));?><br />
diff --git a/src/www/firewall_nat_out.php b/src/www/firewall_nat_out.php
index 6bba7da56..0043af838 100644
--- a/src/www/firewall_nat_out.php
+++ b/src/www/firewall_nat_out.php
@@ -246,6 +246,9 @@ include("head.inc");
   <section class="page-content-main">
     <div class="container-fluid">
       <div class="row">
+        <?php if (isset($config['system']['disablefilter'])): ?>
+        <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+        <?php endif; ?>
 <?php
         if (isset($savemsg))
             print_info_box($savemsg);
diff --git a/src/www/firewall_rules.php b/src/www/firewall_rules.php
index 5e8e29067..60c2ab7fc 100644
--- a/src/www/firewall_rules.php
+++ b/src/www/firewall_rules.php
@@ -200,6 +200,9 @@ $( document ).ready(function() {
   <section class="page-content-main">
     <div class="container-fluid">
       <div class="row">
+        <?php if (isset($config['system']['disablefilter'])): ?>
+        <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
+        <?php endif; ?>
         <?php if (isset($savemsg)) print_info_box($savemsg); ?>
         <?php if (is_subsystem_dirty('filter')): ?><p>
         <?php print_info_box_apply(gettext("The firewall rule configuration has been changed.<br />You must apply the changes in order for them to take effect."));?>
diff --git a/src/www/guiconfig.inc b/src/www/guiconfig.inc
index 6fafeb524..8a7c01ae9 100644
--- a/src/www/guiconfig.inc
+++ b/src/www/guiconfig.inc
@@ -237,6 +237,17 @@ function print_info_box($msg)
 EOFnp;
 }
 
+function print_warning_box($msg)
+{
+	echo <<<EOFnp
+<div class="col-xs-12">
+	<div class="alert alert-warning alert-dismissible" role="alert">
+		<p>{$msg}</p>
+	</div>
+</div>
+EOFnp;
+}
+
 function get_std_save_message() {
 	global $d_sysrebootreqd_path;
 	$filter_related = false;

From 0a7e86556f2f53593cef7adc495045fc3e401dcd Mon Sep 17 00:00:00 2001
From: Manuel Faux <mfaux@conf.at>
Date: Fri, 11 Dec 2015 15:19:07 +0100
Subject: [PATCH 2/3] Cleaner way to show banner for disabled services

---
 src/www/diag_logs_filter.php         |  5 +----
 src/www/diag_logs_filter_dynamic.php |  5 +----
 src/www/diag_logs_filter_plain.php   |  5 +----
 src/www/diag_logs_filter_summary.php |  4 +---
 src/www/diag_pf_info.php             |  1 +
 src/www/firewall_rules.php           |  4 +---
 src/www/guiconfig.inc                | 26 ++++++++++++++++++++++++--
 src/www/status_filter_reload.php     |  2 +-
 8 files changed, 31 insertions(+), 21 deletions(-)

diff --git a/src/www/diag_logs_filter.php b/src/www/diag_logs_filter.php
index 9d51701f5..16cf2a201 100644
--- a/src/www/diag_logs_filter.php
+++ b/src/www/diag_logs_filter.php
@@ -606,10 +606,7 @@ include("head.inc");
 		<div class="container-fluid">
 			<div class="row">
 
-                                <?php if (isset($config['system']['disablefilter'])): ?>
-                                <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
-                                <?php endif; ?>
-
+				<?php print_service_disabled_banner('firewall'); ?>
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 
 			    <section class="col-xs-12">
diff --git a/src/www/diag_logs_filter_dynamic.php b/src/www/diag_logs_filter_dynamic.php
index 7271c14e9..5aeb7d9a9 100644
--- a/src/www/diag_logs_filter_dynamic.php
+++ b/src/www/diag_logs_filter_dynamic.php
@@ -87,10 +87,7 @@ include("head.inc");
 		<div class="container-fluid">
 			<div class="row">
 
-                                <?php if (isset($config['system']['disablefilter'])): ?>
-                                <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
-                                <?php endif; ?>
-
+				<?php print_service_disabled_banner('firewall'); ?>
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 
 			    <section class="col-xs-12">
diff --git a/src/www/diag_logs_filter_plain.php b/src/www/diag_logs_filter_plain.php
index 803138118..bad418d8b 100644
--- a/src/www/diag_logs_filter_plain.php
+++ b/src/www/diag_logs_filter_plain.php
@@ -63,10 +63,7 @@ include("head.inc");
 		<div class="container-fluid">
 			<div class="row">
 
-                                <?php if (isset($config['system']['disablefilter'])): ?>
-                                <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
-                                <?php endif; ?>
-
+				<?php print_service_disabled_banner('firewall'); ?>
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 
 			     <section class="col-xs-12">
diff --git a/src/www/diag_logs_filter_summary.php b/src/www/diag_logs_filter_summary.php
index f39c8fd51..1d82a5c3f 100644
--- a/src/www/diag_logs_filter_summary.php
+++ b/src/www/diag_logs_filter_summary.php
@@ -114,9 +114,7 @@ include("head.inc"); ?>
 	<section class="page-content-main">
 		<div class="container-fluid">
 			<div class="row">
-                                <?php if (isset($config['system']['disablefilter'])): ?>
-                                <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
-                                <?php endif; ?>
+				<?php print_service_disabled_banner('firewall'); ?>
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 			    <section class="col-xs-12">
 						<div class="tab-content content-box col-xs-12">
diff --git a/src/www/diag_pf_info.php b/src/www/diag_pf_info.php
index 66c076b82..1c903131d 100644
--- a/src/www/diag_pf_info.php
+++ b/src/www/diag_pf_info.php
@@ -69,6 +69,7 @@ $( document ).ready(function() {
 <section class="page-content-main">
   <div class="container-fluid col-xs-12">
     <div class="row">
+        <?php print_service_disabled_banner('firewall'); ?>
         <section class="col-xs-12">
           <ul class="nav nav-tabs" data-tabs="tabs" id="maintabs">
 <?php
diff --git a/src/www/firewall_rules.php b/src/www/firewall_rules.php
index 60c2ab7fc..7e01b9b56 100644
--- a/src/www/firewall_rules.php
+++ b/src/www/firewall_rules.php
@@ -200,9 +200,7 @@ $( document ).ready(function() {
   <section class="page-content-main">
     <div class="container-fluid">
       <div class="row">
-        <?php if (isset($config['system']['disablefilter'])): ?>
-        <?php print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));?>
-        <?php endif; ?>
+        <?php print_service_disabled_banner('firewall'); ?>
         <?php if (isset($savemsg)) print_info_box($savemsg); ?>
         <?php if (is_subsystem_dirty('filter')): ?><p>
         <?php print_info_box_apply(gettext("The firewall rule configuration has been changed.<br />You must apply the changes in order for them to take effect."));?>
diff --git a/src/www/guiconfig.inc b/src/www/guiconfig.inc
index 8a7c01ae9..84bae7428 100644
--- a/src/www/guiconfig.inc
+++ b/src/www/guiconfig.inc
@@ -237,8 +237,7 @@ function print_info_box($msg)
 EOFnp;
 }
 
-function print_warning_box($msg)
-{
+function print_warning_box($msg) {
 	echo <<<EOFnp
 <div class="col-xs-12">
 	<div class="alert alert-warning alert-dismissible" role="alert">
@@ -248,6 +247,29 @@ function print_warning_box($msg)
 EOFnp;
 }
 
+function is_service_enabled($service) {
+	global $config;
+
+	switch ($service) {
+		case 'firewall':
+		case 'filter':
+			return !isset($config['system']['disablefilter']);
+		default:
+			return false;
+	}
+}
+
+function print_service_disabled_banner($service) {
+	if (!is_service_enabled($service)) {
+		switch ($service) {
+			case 'firewall':
+			case 'filter':
+				print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));
+				break;
+		}
+	}
+}
+
 function get_std_save_message() {
 	global $d_sysrebootreqd_path;
 	$filter_related = false;
diff --git a/src/www/status_filter_reload.php b/src/www/status_filter_reload.php
index 67b15875a..cd3504536 100644
--- a/src/www/status_filter_reload.php
+++ b/src/www/status_filter_reload.php
@@ -65,7 +65,7 @@ include("head.inc");
 	<section class="page-content-main">
 		<div class="container-fluid">
 			<div class="row">
-
+				<?php print_service_disabled_banner('firewall'); ?>
 				<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
 
 			    <section class="col-xs-12">

From ba1c48793f451e1188289aaf40d5b348b0414ff4 Mon Sep 17 00:00:00 2001
From: Manuel Faux <mfaux@conf.at>
Date: Fri, 11 Dec 2015 15:37:48 +0100
Subject: [PATCH 3/3] firewall: Added link to setting page to enable firewall

Added a link to the "disabled service" banner of the firewall service, to
enable the firewall.
---
 src/www/guiconfig.inc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/www/guiconfig.inc b/src/www/guiconfig.inc
index 84bae7428..a4c044c61 100644
--- a/src/www/guiconfig.inc
+++ b/src/www/guiconfig.inc
@@ -264,7 +264,10 @@ function print_service_disabled_banner($service) {
 		switch ($service) {
 			case 'firewall':
 			case 'filter':
-				print_warning_box(gettext("The firewall has globally been disabled. Configured rules are currently not enforced."));
+				print_warning_box(gettext(
+					"The firewall has globally been disabled and configured rules are currently not enforced. " .
+					"It can be enabled in the <a href=\"system_advanced_firewall.php\">Firewall and NAT settings</a> page."
+				));
 				break;
 		}
 	}