From 23c6d1b766e8eb211594a8167a86bb2f27465cfb Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Mon, 30 May 2016 14:11:02 +0200 Subject: [PATCH] (firewall, scrub) move relevant scrub options to firewall_scrub.php ditch disablescrub option, fragment reassemble is enabled by default. --- src/etc/inc/filter.inc | 31 +++----- src/www/firewall_scrub.php | 104 ++++++++++++++++++++++++--- src/www/system_advanced_firewall.php | 56 --------------- 3 files changed, 101 insertions(+), 90 deletions(-) diff --git a/src/etc/inc/filter.inc b/src/etc/inc/filter.inc index 7b7662021..5df1e7e33 100644 --- a/src/etc/inc/filter.inc +++ b/src/etc/inc/filter.inc @@ -388,37 +388,22 @@ function filter_generate_scrubing(&$FilterIflist) } $scrubrules .= "scrub from any to max-mss {$maxmss}\n"; } - /* disable scrub option */ + + /* scrub per interface options */ foreach ($FilterIflist as $scrubif => $scrubcfg) { if (isset($scrubcfg['virtual']) || empty($scrubcfg['descr'])) { continue; } else { /* set up MSS clamping */ - $mssclamp = ''; - if ( - $scrubcfg['mss'] != '' && is_numeric($scrubcfg['mss']) && - $scrubcfg['if'] != 'pppoe' && $scrubcfg['if'] != 'pptp' && - $scrubcfg['if'] != 'l2tp' - ) { + if (!empty($scrubcfg['mss']) && is_numeric($scrubcfg['mss']) && + !in_array($scrubcfg['if'], array('pppoe', 'pptp', 'l2tp'))) { $mssclamp = "max-mss " . (intval($scrubcfg['mss'] - 40)); - } - - /* configure no-df for linux nfs and others */ - if (!empty($config['system']['scrubnodf'])) { - $scrubnodf = "no-df"; } else { - $scrubnodf = ""; - } - if (!empty($config['system']['scrubrnid'])) { - $scrubrnid = "random-id"; - } else { - $scrubrnid = ""; - } - if (!isset($config['system']['disablescrub'])) { - $scrubrules .= "scrub on \${$scrubcfg['descr']} all {$scrubnodf} {$scrubrnid} {$mssclamp} fragment reassemble\n"; // reassemble all directions - } else if (!empty($mssclamp)) { - $scrubrules .= "scrub on \${$scrubcfg['descr']} {$mssclamp}\n"; + $mssclamp = ''; } + $scrubnodf = !empty($config['system']['scrubnodf']) ? "no-df" : ""; + $scrubrnid = !empty($config['system']['scrubrnid']) ? "random-id" : ""; + $scrubrules .= "scrub on \${$scrubcfg['descr']} all {$scrubnodf} {$scrubrnid} {$mssclamp}\n"; } } diff --git a/src/www/firewall_scrub.php b/src/www/firewall_scrub.php index 26817f648..fb5e7c450 100644 --- a/src/www/firewall_scrub.php +++ b/src/www/firewall_scrub.php @@ -35,12 +35,34 @@ if (!isset($config['filter']['scrub']['rule'])) { } $a_scrub = &$config['filter']['scrub']['rule']; -if ($_SERVER['REQUEST_METHOD'] === 'POST') { +if ($_SERVER['REQUEST_METHOD'] === 'GET') { + $pconfig = array(); + $pconfig['scrubnodf'] = !empty($config['system']['scrubnodf']); + $pconfig['scrubrnid'] = !empty($config['system']['scrubrnid']); +} elseif ($_SERVER['REQUEST_METHOD'] === 'POST') { $pconfig = $_POST; if (isset($pconfig['id']) && isset($a_scrub[$pconfig['id']])) { $id = $pconfig['id']; } - if (isset($pconfig['apply'])) { + + if (isset($pconfig['act']) && $pconfig['act'] == 'edit') { + // update general settings + if (!empty($pconfig['scrubnodf'])) { + $config['system']['scrubnodf'] = "enabled"; + } elseif (isset($config['system']['scrubnodf'])) { + unset($config['system']['scrubnodf']); + } + if (!empty($pconfig['scrubrnid'])) { + $config['system']['scrubrnid'] = "enabled"; + } elseif (isset($config['system']['scrubrnid'])) { + unset($config['system']['scrubrnid']); + } + if (write_config()) { + mark_subsystem_dirty('filter'); + } + header("Location: firewall_scrub.php"); + exit; + } elseif (isset($pconfig['apply'])) { filter_configure(); clear_subsystem_dirty('filter'); $savemsg = sprintf( @@ -163,6 +185,12 @@ $( document ).ready(function() { $("#iform").submit(); }); + $("#save").click(function(event){ + event.preventDefault(); + $("#action").val("edit"); + $("#iform").submit(); + }); + // watch scroll position and set to last known on page load watchScrollPosition(); @@ -178,14 +206,68 @@ $( document ).ready(function() {

You must apply the changes in order for them to take effect."));?> -

-
-
- - + + + +
+
+
+ + + + + + + + + + + + + + + + + + + + + +
+ +   +
+ /> + +
+ /> + +
+ " /> +
+
+
+
+
+
+ + + + + @@ -194,7 +276,7 @@ $( document ).ready(function() { - +
 
- -
-
+
+
+ diff --git a/src/www/system_advanced_firewall.php b/src/www/system_advanced_firewall.php index 1ee926528..edc302342 100644 --- a/src/www/system_advanced_firewall.php +++ b/src/www/system_advanced_firewall.php @@ -44,8 +44,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { $pconfig = array(); $pconfig['ipv6allow'] = isset($config['system']['ipv6allow']); $pconfig['disablefilter'] = !empty($config['system']['disablefilter']); - $pconfig['scrubnodf'] = !empty($config['system']['scrubnodf']); - $pconfig['scrubrnid'] = !empty($config['system']['scrubrnid']); $pconfig['optimization'] = isset($config['system']['optimization']) ? $config['system']['optimization'] : "normal"; $pconfig['maximumstates'] = isset($config['system']['maximumstates']) ? $config['system']['maximumstates'] : null; $pconfig['adaptivestart'] = isset($config['system']['adaptivestart']) ? $config['system']['adaptivestart'] : null; @@ -70,7 +68,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { $pconfig['enablenatreflectionhelper'] = isset($config['system']['enablenatreflectionhelper']) ? $config['system']['enablenatreflectionhelper'] : null; $pconfig['reflectiontimeout'] = !empty($config['system']['reflectiontimeout']) ? $config['system']['reflectiontimeout'] : null; $pconfig['bypassstaticroutes'] = isset($config['filter']['bypassstaticroutes']); - $pconfig['disablescrub'] = isset($config['system']['disablescrub']); $pconfig['disablevpnrules'] = isset($config['system']['disablevpnrules']); } elseif ($_SERVER['REQUEST_METHOD'] === 'POST') { $pconfig = $_POST; @@ -131,18 +128,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { unset($config['system']['disablevpnrules']); } - if (!empty($pconfig['scrubnodf'])) { - $config['system']['scrubnodf'] = "enabled"; - } elseif (isset($config['system']['scrubnodf'])) { - unset($config['system']['scrubnodf']); - } - - if (!empty($pconfig['scrubrnid'])) { - $config['system']['scrubrnid'] = "enabled"; - } elseif (isset($config['system']['scrubrnid'])) { - unset($config['system']['scrubrnid']); - } - if (!empty($pconfig['adaptiveend'])) { $config['system']['adaptiveend'] = $pconfig['adaptiveend']; } elseif (isset($config['system']['adaptiveend'])) { @@ -204,12 +189,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { unset($config['filter']['bypassstaticroutes']); } - if (!empty($pconfig['disablescrub'])) { - $config['system']['disablescrub'] = $pconfig['disablescrub']; - } elseif (isset($config['system']['disablescrub'])) { - unset($config['system']['disablescrub']); - } - if ($pconfig['bogonsinterval'] != $config['system']['bogons']['interval']) { $config['system']['bogons']['interval'] = $pconfig['bogonsinterval']; } @@ -437,32 +416,6 @@ include("head.inc"); - - - - /> - - - - - - - - /> - - - - @@ -519,15 +472,6 @@ include("head.inc"); - - - - /> - - -