diff --git a/src/www/firewall_rules_edit.php b/src/www/firewall_rules_edit.php index e61e53488..f5ac4a446 100644 --- a/src/www/firewall_rules_edit.php +++ b/src/www/firewall_rules_edit.php @@ -48,7 +48,7 @@ $gateways = new \OPNsense\Routing\Gateways(legacy_interfaces_details()); */ function FormSetAdvancedOptions(&$item) { foreach (array("max", "max-src-nodes", "max-src-conn", "max-src-states","nopfsync", "statetimeout" - ,"max-src-conn-rate","max-src-conn-rates", "tag", "tagged", "allowopts", "disablereplyto","tcpflags1" + ,"max-src-conn-rate","max-src-conn-rates", "tag", "tagged", "allowopts", "reply-to","tcpflags1" ,"tcpflags2") as $fieldname) { if (!empty($item[$fieldname])) { @@ -97,6 +97,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { 'direction', 'disabled', 'disablereplyto', + 'reply-to', 'floating', 'gateway', 'icmptype', @@ -172,6 +173,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { $pconfig[$fieldname] = null; } } + // replyto switch + $pconfig['reply-to'] = !empty($pconfig['disablereplyto']) ? "__disable__" : $pconfig['reply-to']; } elseif ($_SERVER['REQUEST_METHOD'] === 'POST') { $input_errors = array(); $pconfig = $_POST; @@ -238,6 +241,16 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { $input_errors[] = gettext('You can not assign the IPv6 Gateway to an IPv4 filter rule.'); } } + if ($pconfig['ipprotocol'] == "inet46" && !empty($pconfig['reply-to']) && $pconfig['reply-to'] != '__disable__') { + $input_errors[] = gettext("You can not assign a reply-to destination to a rule that applies to IPv4 and IPv6"); + } elseif (!empty($pconfig['reply-to']) && is_ipaddr($gateways->getAddress($pconfig['reply-to']))) { + if ($pconfig['ipprotocol'] == "inet6" && !is_ipaddrv6($gateways->getAddress($pconfig['reply-to']))) { + $input_errors[] = gettext('You can not assign the IPv4 reply-to destination to an IPv6 filter rule.'); + } + if ($pconfig['ipprotocol'] == "inet" && !is_ipaddrv4($gateways->getAddress($pconfig['reply-to']))) { + $input_errors[] = gettext('You can not assign the IPv6 reply-to destination to an IPv4 filter rule.'); + } + } if ($pconfig['protocol'] == "icmp" && !empty($pconfig['icmptype']) && $pconfig['ipprotocol'] == "inet46") { $input_errors[] = gettext('You can not assign an ICMP type to a rule that applies to IPv4 and IPv6.'); } elseif ($pconfig['protocol'] == "ipv6-icmp" && !empty($pconfig['icmp6-type']) && $pconfig['ipprotocol'] == "inet46") { @@ -457,8 +470,10 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') { if (!empty($pconfig['allowopts'])) { $filterent['allowopts'] = true; } - if (!empty($pconfig['disablereplyto'])) { + if ($pconfig['reply-to'] == "__disable__") { $filterent['disablereplyto'] = true; + } elseif (!empty($pconfig['reply-to'])) { + $filterent['reply-to'] = $pconfig['reply-to']; } if(!empty($pconfig['nopfsync'])) { $filterent['nopfsync'] = true; @@ -1340,11 +1355,26 @@ include("head.inc");