lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-15 09:04:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Firewall/rule parsing. add initial SNAT implementation, for https://github.com/opnsense/core/issues/1326

Browse Source
This commit is contained in:
Ad Schellevis 2017-12-26 19:20:24 +01:00
parent 8a0ac7ca25
commit d3afd68acb
2 changed files with 96 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/opnsense/mvc/app/library/OPNsense/Firewall/Plugin.php
View File

@ -264,6 +264,20 @@ class Plugin
$this->natRules[$prio][] = $rule;
}
/**
* register a destination Nat rule
* @param int $prio priority
* @param array $conf configuration
*/
public function registerSNatRule($prio, $conf)
{
$rule = new SNatRule($this->interfaceMapping, $conf);
if (empty($this->natRules[$prio])) {
$this->natRules[$prio] = array();
}
$this->natRules[$prio][] = $rule;
}
/**
* register an Npt rule
* @param int $prio priority

82
src/opnsense/mvc/app/library/OPNsense/Firewall/SNatRule.php Normal file
View File

@ -0,0 +1,82 @@
<?php
/**
* Copyright (C) 2017 Deciso B.V.
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*/
namespace OPNsense\Firewall;
/**
* Class SNatRule, outbound / source nat rules
* @package OPNsense\Firewall
*/
class SNatRule extends Rule
{
private $procorder = array(
'disabled' => 'parseIsComment',
'nonat' => 'parseBool,no nat,nat',
'log' => 'parseBool,log',
'interface' => 'parseInterface',
'ipprotocol' => 'parsePlain',
'protocol' => 'parseReplaceSimple,tcp/udp:{tcp udp},proto ',
'from' => 'parsePlain,from ',
'to' => 'parsePlain,to ',
'tag' => 'parsePlain, tag ',
'tagged' => 'parsePlain, tagged ',
'target' => 'parsePlain, -> ',
'poolopts' => 'parsePlain',
'staticnatport' => 'parseBool, static-port , port 1024:65535 ',
'descr' => 'parseComment'
);
/**
* preprocess internal rule data to detail level of actual ruleset
* handles shortcuts, like inet46 and multiple interfaces
* @return array
*/
private function parseNatRules()
{
foreach ($this->reader() as $rule) {
if ($rule['target'] == "other-subnet") {
$rule['target'] = $rule['targetip'] . '/' . $rule['targetip_subnet'];
}
yield $rule;
}
}
/**
* output rule as string
* @return string ruleset
*/
public function __toString()
{
$ruleTxt = '';
foreach ($this->parseNatRules() as $rule) {
$ruleTxt .= $this->ruleToText($this->procorder, $rule). "\n";
}
return $ruleTxt;
}
}