Skip to content

Commit 8367013

Browse files
slayercatslayercat
committed
Filter Rules Management: filter_rules_create / filter_rules_delele
Signed-off-by: lilinzhe <[email protected]>
1 parent ab2542e commit 8367013

File tree

6 files changed

+980
-24
lines changed

6 files changed

+980
-24
lines changed

‎README.md‎

Lines changed: 76 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ tasks feasible.
2929
- [network_address_aliases_update](#user-content-network_address_aliases_update) - Update a address aliaes. Returns newest result
3030
- [network_address_aliases_delete](#user-content-network_address_aliases_delete) - delete a address aliaes. Returns newest result
3131
- [filter_rules_get](#user-content-filter_rules_get) - Returns firewall filters.
32+
- [filter_rules_create](#user-content-filter_rules_create) - Creates firewall filters.
33+
- [filter_rules_delete](#user-content-filter_rules_delete) - Deletes firewall filters.
3234

3335

3436
## Approach
@@ -977,13 +979,13 @@ curl \
977979
- HTTP: **POST**
978980
- Params: none
979981
- Request body: json
980-
- **name** :<string> name of aliases
981-
- **type** :<string> type of aliases. **MUST** be `network` for now.
982-
- **cidr_addresses** : < list of <object> > name alias what
982+
- **name** :< string > name of aliases
983+
- **type** :< string > type of aliases. **MUST** be `network` for now.
984+
- **cidr_addresses** : < list of < object > > name alias what
983985
- **address** an ip address or a network prefix.
984986
- **details** a description of this address. for human readable documentation.
985-
- **descr** : <string> the description of current aliases.
986-
- Response: json <object>: the items after created
987+
- **descr** : < string > the description of current aliases.
988+
- Response: json < object >: the items after created
987989
988990
*Example Request*
989991
```bash
@@ -1030,13 +1032,13 @@ curl \
10301032
- HTTP: **POST**
10311033
- Params: none
10321034
- Request body: json
1033-
- **name** :<string> name of aliases. identiy which aliases frr modify
1034-
- **type** :<string> type of aliases. **MUST** be `network` for now.
1035-
- **cidr_addresses** : < list of <object> > name alias what
1035+
- **name** :< string > name of aliases. identiy which aliases frr modify
1036+
- **type** :< string > type of aliases. **MUST** be `network` for now.
1037+
- **cidr_addresses** : < list of < object > > name alias what
10361038
- **address** an ip address or a network prefix.
10371039
- **details** a description of this address. for human readable documentation.
1038-
- **descr** : <string> the description of current aliases.
1039-
- Response: json <object>: the items after created
1040+
- **descr** : < string > the description of current aliases.
1041+
- Response: json < object >: the items after created
10401042
10411043
*Example Request*
10421044
```bash
@@ -1083,8 +1085,8 @@ curl \
10831085
- HTTP: **POST**
10841086
- Params: none
10851087
- Request body: json
1086-
- **name** :<string> name of aliases. identiy which aliase to delete
1087-
- Response: json <object>: the items after created
1088+
- **name** :< string > name of aliases. identiy which aliase to delete
1089+
- Response: json < object >: the items after created
10881090
10891091
*Example Request*
10901092
```bash
@@ -1210,6 +1212,68 @@ curl \
12101212
}
12111213
}
12121214
```
1215+
---
1216+
### filter_rules_create
1217+
- Creates firewall filters
1218+
- HTTP: **POST**
1219+
- Params: none
1220+
- Request body: json
1221+
- **position**: < int >: insert to which position.
1222+
- **rule**: < object >: what is the rule.
1223+
- **type** :< string > : Type of filter. could take value: pass / block / reject
1224+
- **ipprotocol**: < string >: Which network type? could take value: inet / inet6 / inet46
1225+
- **protocol**: < string >: if seted. could only take value: tcp. used for port match.
1226+
- **descr** : < string > : Used for description.
1227+
- **interface**: < string >: To which interface. e.g. WAN
1228+
- **source**: < object > : match source item.
1229+
- `{"any":""}`: matchs any address.
1230+
- `{"address": "network_address_aliases"}`: matchs any network_address_aliases.
1231+
- `{"address": "1.2.3.4"}`: matchs address 1.2.3.4
1232+
- `{"any":"", "port": "443-1000"}`: matchs 443 to 1000 port. uses with protocol
1233+
- **destination**: < object >: match description. -- same as above.
1234+
- Response: json < object >: the items after created
1235+
1236+
*Test it carefully before going to wild please. USE AT YOUR OWN RISK*
1237+
1238+
*Example Request*
1239+
```bash
1240+
curl \
1241+
-X POST \
1242+
--silent \
1243+
--insecure \
1244+
--header "fauxapi-auth: <auth-value>" \
1245+
--data '{"position": 1, "rule": {"type": "reject", "ipprotocol": "inet", "descr": "testobject", "interface": "wan", "source": {"any": ""}, "destination": {"address": "1.2.3.4"}}}' \
1246+
"https://<host-address>/fauxapi/v1/?action=filter_rules_create"
1247+
```
1248+
*Example Response*
1249+
Same As [filter_rules_get](#user-content-filter_rules_get)
1250+
1251+
---
1252+
### filter_rules_delete
1253+
- Returns firewall filters.
1254+
- HTTP: **POST**
1255+
- Params: none
1256+
- Request body: json
1257+
- **position**: <int>: deletes which position.
1258+
1259+
*Test it carefully before going to wild please. USE AT YOUR OWN RISK*
1260+
1261+
Because there's nothing like Unique ID or name in rule. Currently we could only take the position to identify which rule shell be deleted.
1262+
1263+
*Example Request*
1264+
```bash
1265+
curl \
1266+
-X POST \
1267+
--silent \
1268+
--insecure \
1269+
--header "fauxapi-auth: <auth-value>" \
1270+
--data '{"position": 1}' \
1271+
"https://<host-address>/fauxapi/v1/?action=filter_rules_delete"
1272+
```
1273+
1274+
*Example Response*
1275+
Same As [filter_rules_get](#user-content-filter_rules_get)
1276+
12131277
---
12141278
12151279
## Versions and Testing

‎pfSense-pkg-FauxAPI/files/etc/inc/fauxapi/fauxapi_actions.inc‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -450,6 +450,66 @@ class fauxApiActions {
450450
return TRUE;
451451
}
452452

453+
/**
454+
* filter_rules_create()
455+
*
456+
* @return boolean
457+
*/
458+
public function filter_rules_create() {
459+
fauxApiLogger::debug(__METHOD__);
460+
461+
$position = $this->action_input_data["position"];
462+
$ruleobj = $this->action_input_data["rule"];
463+
$rules = $this->PfsenseInterface->filter_rules_create($position, $ruleobj);
464+
465+
if (empty($rules)) {
466+
$this->response->http_code = 500;
467+
$this->response->message = 'unable to get filter rule(s)';
468+
return FALSE;
469+
}
470+
$this->response->http_code = 200;
471+
$this->response->message = 'ok';
472+
$this->response->data = array(
473+
'filter' => array(
474+
'rules' => $rules
475+
),
476+
);
477+
return TRUE;
478+
}
479+
480+
/**
481+
* filter_rules_create()
482+
*
483+
* @return boolean
484+
*/
485+
public function filter_rules_delete() {
486+
fauxApiLogger::debug(__METHOD__);
487+
488+
if(!isset($this->action_input_data["position"])) {
489+
$error_message = "could only delete by position at now";
490+
$error_data = array('postdata' => $this->action_input_data);
491+
fauxApiLogger::error($error_message, $error_data);
492+
throw new \Exception($error_message);
493+
return FALSE;
494+
}
495+
$position = $this->action_input_data["position"];
496+
$rules = $this->PfsenseInterface->filter_rules_delete_by_position($position);
497+
498+
if (empty($rules)) {
499+
$this->response->http_code = 500;
500+
$this->response->message = 'unable to get filter rule(s)';
501+
return FALSE;
502+
}
503+
$this->response->http_code = 200;
504+
$this->response->message = 'ok';
505+
$this->response->data = array(
506+
'filter' => array(
507+
'rules' => $rules
508+
),
509+
);
510+
return TRUE;
511+
}
512+
453513
/**
454514
* network_address_aliases_get()
455515
*

‎pfSense-pkg-FauxAPI/files/etc/inc/fauxapi/fauxapi_pfsense_interface.inc‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ include_once '/etc/inc/pkg-utils.inc';
3232
include_once '/usr/local/www/includes/functions.inc.php';
3333

3434
include_once 'fauxapi_pfsense_interface_alias.inc';
35+
include_once 'fauxapi_pfsense_interface_filter_rules.inc';
3536
class fauxApiPfsenseInterface {
3637

3738
public $config_xml_root = 'pfsense';
@@ -766,16 +767,8 @@ class fauxApiPfsenseInterface {
766767
return \pfSense_get_interface_stats($interface);
767768
}
768769

769-
/**
770-
* filter_rules_get()
771-
*
772-
* @return array
773-
*/
774-
public function filter_rules_get(){
775-
global $config;
776-
fauxApiLogger::debug(__METHOD__);
777-
return $config["filter"]["rule"];
778-
}
770+
771+
use network_filter_rules;
779772

780773
use network_address_aliases;
781774

‎pfSense-pkg-FauxAPI/files/etc/inc/fauxapi/fauxapi_pfsense_interface_alias.priv.inc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
namespace fauxapi\v1;
33

44
// write_config requires functions from this
5-
include '/etc/inc/phpsessionmanager.inc';
6-
include '/etc/inc/auth.inc';
5+
include_once '/etc/inc/phpsessionmanager.inc';
6+
include_once '/etc/inc/auth.inc';
77

88
class fauxApiInterfaceAliasTools
99
{

‎pfSense-pkg-FauxAPI/files/etc/inc/fauxapi/fauxapi_pfsense_interface_filter_rules.inc‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<?php
2+
3+
namespace fauxapi\v1;
4+
5+
include 'fauxapi_pfsense_interface_filter_rules.priv.inc';
6+
trait network_filter_rules
7+
{
8+
/**
9+
* filter_rules_get()
10+
*
11+
* @return array
12+
*/
13+
public function filter_rules_get()
14+
{
15+
global $config;
16+
fauxApiLogger::debug(__METHOD__);
17+
return $config["filter"]["rule"];
18+
}
19+
20+
/**
21+
* filter_rules_create()
22+
*
23+
* @return array
24+
*/
25+
public function filter_rules_create($position, $ruleobj)
26+
{
27+
global $config;
28+
fauxApiLogger::debug(__METHOD__, array("rule" => $ruleobj));
29+
if (isset($ruleobj["id"])) {
30+
$error_message = "rules create obj could not have id";
31+
$error_data = array('ruleobj' => $ruleobj);
32+
fauxApiLogger::error($error_message, $error_data);
33+
throw new \Exception($error_message);
34+
}
35+
$error_message = fauxApiFiltersRulesTools::CheckRuleObject($ruleobj);
36+
if ($error_message != NULL) {
37+
$error_data = array('ruleobj' => $ruleobj);
38+
fauxApiLogger::error($error_message, $error_data);
39+
throw new \Exception($error_message);
40+
}
41+
$target = fauxApiFiltersRulesTools::BuildRuleConfig($ruleobj);
42+
// insert position
43+
array_splice($config["filter"]["rule"], $position, 0, array($target));
44+
filter_rules_sort();
45+
fauxApiFiltersRulesTools::WriteConfig();
46+
return $config["filter"]["rule"];
47+
}
48+
49+
50+
/**
51+
* filter_rules_delete_by_position()
52+
*
53+
* @return array
54+
*/
55+
public function filter_rules_delete_by_position($position)
56+
{
57+
global $config;
58+
\array_splice($config["filter"]["rule"], $position, 1);
59+
filter_rules_sort();
60+
fauxApiFiltersRulesTools::WriteConfig();
61+
return $config["filter"]["rule"];
62+
}
63+
}

0 commit comments

Comments
 (0)