Skip to content

Commit 901bde5

Browse files
slayercatslayercat
committed
Filter Rules Management: filter_rules_create / filter_rules_delele
Signed-off-by: lilinzhe <[email protected]>
1 parent ca0a39a commit 901bde5

File tree

6 files changed

+979
-24
lines changed

6 files changed

+979
-24
lines changed

‎README.md‎

Lines changed: 75 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ tasks feasible.
2828
- [network_address_aliases_update](#user-content-network_address_aliases_update) - Update a address aliaes. Returns newest result
2929
- [network_address_aliases_delete](#user-content-network_address_aliases_delete) - delete a address aliaes. Returns newest result
3030
- [filter_rules_get](#user-content-filter_rules_get) - Returns firewall filters.
31+
- [filter_rules_create](#user-content-filter_rules_create) - Creates firewall filters.
32+
- [filter_rules_delete](#user-content-filter_rules_delete) - Deletes firewall filters.
3133

3234

3335
## Approach
@@ -916,13 +918,13 @@ curl \
916918
- HTTP: **POST**
917919
- Params: none
918920
- Request body: json
919-
- **name** :<string> name of aliases
920-
- **type** :<string> type of aliases. **MUST** be `network` for now.
921-
- **cidr_addresses** : < list of <object> > name alias what
921+
- **name** :< string > name of aliases
922+
- **type** :< string > type of aliases. **MUST** be `network` for now.
923+
- **cidr_addresses** : < list of < object > > name alias what
922924
- **address** an ip address or a network prefix.
923925
- **details** a description of this address. for human readable documentation.
924-
- **descr** : <string> the description of current aliases.
925-
- Response: json <object>: the items after created
926+
- **descr** : < string > the description of current aliases.
927+
- Response: json < object >: the items after created
926928
927929
*Example Request*
928930
```bash
@@ -969,13 +971,13 @@ curl \
969971
- HTTP: **POST**
970972
- Params: none
971973
- Request body: json
972-
- **name** :<string> name of aliases. identiy which aliases frr modify
973-
- **type** :<string> type of aliases. **MUST** be `network` for now.
974-
- **cidr_addresses** : < list of <object> > name alias what
974+
- **name** :< string > name of aliases. identiy which aliases frr modify
975+
- **type** :< string > type of aliases. **MUST** be `network` for now.
976+
- **cidr_addresses** : < list of < object > > name alias what
975977
- **address** an ip address or a network prefix.
976978
- **details** a description of this address. for human readable documentation.
977-
- **descr** : <string> the description of current aliases.
978-
- Response: json <object>: the items after created
979+
- **descr** : < string > the description of current aliases.
980+
- Response: json < object >: the items after created
979981
980982
*Example Request*
981983
```bash
@@ -1022,8 +1024,8 @@ curl \
10221024
- HTTP: **POST**
10231025
- Params: none
10241026
- Request body: json
1025-
- **name** :<string> name of aliases. identiy which aliase to delete
1026-
- Response: json <object>: the items after created
1027+
- **name** :< string > name of aliases. identiy which aliase to delete
1028+
- Response: json < object >: the items after created
10271029
10281030
*Example Request*
10291031
```bash
@@ -1149,6 +1151,67 @@ curl \
11491151
}
11501152
}
11511153
```
1154+
---
1155+
### filter_rules_create
1156+
- Creates firewall filters
1157+
- HTTP: **POST**
1158+
- Params: none
1159+
- Request body: json
1160+
- **position**: < int >: insert to which position.
1161+
- **rule**: < object >: what is the rule.
1162+
- **type** :< string > : Type of filter. could take value: pass / block / reject
1163+
- **ipprotocol**: < string >: Which network type? could take value: inet / inet6 / inet46
1164+
- **protocol**: < string >: if seted. could only take value: tcp. used for port match.
1165+
- **descr** : < string > : Used for description.
1166+
- **interface**: < string >: To which interface. e.g. WAN
1167+
- **source**: < object > : match source item.
1168+
- `{"any":""}`: matchs any address.
1169+
- `{"address": "network_address_aliases"}`: matchs any network_address_aliases.
1170+
- `{"address": "1.2.3.4"}`: matchs address 1.2.3.4
1171+
- `{"any":"", "port": "443-443"}: matchs 443 port. uses with protocol
1172+
- **destination**: < object >: match description. -- same as above.
1173+
- Response: json < object >: the items after created
1174+
1175+
* Test it carefully before going to wild please. USE AT YOUR OWN RISK *
1176+
1177+
*Example Request*
1178+
```bash
1179+
curl \
1180+
-X POST \
1181+
--silent \
1182+
--insecure \
1183+
--header "fauxapi-auth: <auth-value>" \
1184+
--data '{"position": 1, "rule": {"type": "reject", "ipprotocol": "inet", "descr": "testobject", "interface": "wan", "source": {"any": ""}, "destination": {"address": "1.2.3.4"}}}' \
1185+
"https://<host-address>/fauxapi/v1/?action=filter_rules_create"
1186+
```
1187+
*Example Response*
1188+
Same As [filter_rules_get](#user-content-filter_rules_get)
1189+
---
1190+
### filter_rules_delete
1191+
- Returns firewall filters.
1192+
- HTTP: **POST**
1193+
- Params: none
1194+
- Request body: json
1195+
- **position**: <int>: deletes which position.
1196+
1197+
* Test it carefully before going to wild please. USE AT YOUR OWN RISK *
1198+
1199+
Because there's nothing like Unique ID or name in rule. Currently we could only take the position to identify which rule shell be deleted.
1200+
1201+
*Example Request*
1202+
```bash
1203+
curl \
1204+
-X POST \
1205+
--silent \
1206+
--insecure \
1207+
--header "fauxapi-auth: <auth-value>" \
1208+
--data '{"position": 1}' \
1209+
"https://<host-address>/fauxapi/v1/?action=filter_rules_delete"
1210+
```
1211+
1212+
*Example Response*
1213+
Same As [filter_rules_get](#user-content-filter_rules_get)
1214+
11521215
---
11531216
11541217
## Versions and Testing

‎pfSense-pkg-FauxAPI/files/etc/inc/fauxapi/fauxapi_actions.inc‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -427,6 +427,66 @@ class fauxApiActions {
427427
return TRUE;
428428
}
429429

430+
/**
431+
* filter_rules_create()
432+
*
433+
* @return boolean
434+
*/
435+
public function filter_rules_create() {
436+
fauxApiLogger::debug(__METHOD__);
437+
438+
$position = $this->action_input_data["position"];
439+
$ruleobj = $this->action_input_data["rule"];
440+
$rules = $this->PfsenseInterface->filter_rules_create($position, $ruleobj);
441+
442+
if (empty($rules)) {
443+
$this->response->http_code = 500;
444+
$this->response->message = 'unable to get filter rule(s)';
445+
return FALSE;
446+
}
447+
$this->response->http_code = 200;
448+
$this->response->message = 'ok';
449+
$this->response->data = array(
450+
'filter' => array(
451+
'rules' => $rules
452+
),
453+
);
454+
return TRUE;
455+
}
456+
457+
/**
458+
* filter_rules_create()
459+
*
460+
* @return boolean
461+
*/
462+
public function filter_rules_delete() {
463+
fauxApiLogger::debug(__METHOD__);
464+
465+
if(!isset($this->action_input_data["position"])) {
466+
$error_message = "could only delete by position at now";
467+
$error_data = array('postdata' => $this->action_input_data);
468+
fauxApiLogger::error($error_message, $error_data);
469+
throw new \Exception($error_message);
470+
return FALSE;
471+
}
472+
$position = $this->action_input_data["position"];
473+
$rules = $this->PfsenseInterface->filter_rules_delete_by_position($position);
474+
475+
if (empty($rules)) {
476+
$this->response->http_code = 500;
477+
$this->response->message = 'unable to get filter rule(s)';
478+
return FALSE;
479+
}
480+
$this->response->http_code = 200;
481+
$this->response->message = 'ok';
482+
$this->response->data = array(
483+
'filter' => array(
484+
'rules' => $rules
485+
),
486+
);
487+
return TRUE;
488+
}
489+
430490
/**
431491
* network_address_aliases_get()
432492
*

‎pfSense-pkg-FauxAPI/files/etc/inc/fauxapi/fauxapi_pfsense_interface.inc‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ include_once '/etc/inc/config.lib.inc';
2929
include_once '/etc/inc/system.inc';
3030

3131
include_once 'fauxapi_pfsense_interface_alias.inc';
32+
include_once 'fauxapi_pfsense_interface_filter_rules.inc';
3233
class fauxApiPfsenseInterface {
3334

3435
public $config_xml_root = 'pfsense';
@@ -720,16 +721,8 @@ class fauxApiPfsenseInterface {
720721
return \pfSense_get_interface_stats($interface);
721722
}
722723

723-
/**
724-
* filter_rules_get()
725-
*
726-
* @return array
727-
*/
728-
public function filter_rules_get(){
729-
global $config;
730-
fauxApiLogger::debug(__METHOD__);
731-
return $config["filter"]["rule"];
732-
}
724+
725+
use network_filter_rules;
733726

734727
use network_address_aliases;
735728

‎pfSense-pkg-FauxAPI/files/etc/inc/fauxapi/fauxapi_pfsense_interface_alias.priv.inc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
namespace fauxapi\v1;
33

44
// write_config requires functions from this
5-
include '/etc/inc/phpsessionmanager.inc';
6-
include '/etc/inc/auth.inc';
5+
include_once '/etc/inc/phpsessionmanager.inc';
6+
include_once '/etc/inc/auth.inc';
77

88
class fauxApiInterfaceAliasTools
99
{

‎pfSense-pkg-FauxAPI/files/etc/inc/fauxapi/fauxapi_pfsense_interface_filter_rules.inc‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<?php
2+
3+
namespace fauxapi\v1;
4+
5+
include 'fauxapi_pfsense_interface_filter_rules.priv.inc';
6+
trait network_filter_rules
7+
{
8+
/**
9+
* filter_rules_get()
10+
*
11+
* @return array
12+
*/
13+
public function filter_rules_get()
14+
{
15+
global $config;
16+
fauxApiLogger::debug(__METHOD__);
17+
return $config["filter"]["rule"];
18+
}
19+
20+
/**
21+
* filter_rules_create()
22+
*
23+
* @return array
24+
*/
25+
public function filter_rules_create($position, $ruleobj)
26+
{
27+
global $config;
28+
fauxApiLogger::debug(__METHOD__, array("rule" => $ruleobj));
29+
if (isset($ruleobj["id"])) {
30+
$error_message = "rules create obj could not have id";
31+
$error_data = array('ruleobj' => $ruleobj);
32+
fauxApiLogger::error($error_message, $error_data);
33+
throw new \Exception($error_message);
34+
}
35+
$error_message = fauxApiFiltersRulesTools::CheckRuleObject($ruleobj);
36+
if ($error_message != NULL) {
37+
$error_data = array('ruleobj' => $ruleobj);
38+
fauxApiLogger::error($error_message, $error_data);
39+
throw new \Exception($error_message);
40+
}
41+
$target = fauxApiFiltersRulesTools::BuildRuleConfig($ruleobj);
42+
// insert position
43+
array_splice($config["filter"]["rule"], $position, 0, array($target));
44+
filter_rules_sort();
45+
fauxApiFiltersRulesTools::WriteConfig();
46+
return $config["filter"]["rule"];
47+
}
48+
49+
50+
/**
51+
* filter_rules_delete_by_position()
52+
*
53+
* @return array
54+
*/
55+
public function filter_rules_delete_by_position($position)
56+
{
57+
global $config;
58+
\array_splice($config["filter"]["rule"], $position, 1);
59+
filter_rules_sort();
60+
fauxApiFiltersRulesTools::WriteConfig();
61+
return $config["filter"]["rule"];
62+
}
63+
}

0 commit comments

Comments
 (0)