From 728e1c6073cb216d3cb8b66f519bd590458165e6 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 12 May 2020 18:44:20 +0200
Subject: nat: T2198: add new ipv4-range validator

---
 src/validators/ipv4-range | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100755 src/validators/ipv4-range

(limited to 'src/validators/ipv4-range')

diff --git a/src/validators/ipv4-range b/src/validators/ipv4-range
new file mode 100755
index 000000000..0d707d6c5
--- /dev/null
+++ b/src/validators/ipv4-range
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# snippet from https://stackoverflow.com/questions/10768160/ip-address-converter
+ip2dec () {
+    local a b c d ip=$@
+    IFS=. read -r a b c d <<< "$ip"
+    printf '%d\n' "$((a * 256 ** 3 + b * 256 ** 2 + c * 256 + d))"
+}
+
+# This only works with real bash (<<<) - split IP addresses into array with
+# hyphen as delimiter
+readarray -d - -t strarr <<< $1
+
+ipaddrcheck --is-ipv4-single ${strarr[0]}
+if [ $? -gt 0 ]; then
+  exit 1
+fi
+
+ipaddrcheck --is-ipv4-single ${strarr[1]}
+if [ $? -gt 0 ]; then
+  exit 1
+fi
+
+start=$(ip2dec ${strarr[0]})
+stop=$(ip2dec ${strarr[1]})
+if [ $start -ge $stop ]; then
+  exit 1
+fi
+
+exit 0
-- 
cgit v1.2.3


From 1330898ed095b42b6aba7ba00f9a6932b241a230 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 12 May 2020 19:23:15 +0200
Subject: nat: T2198: add ipv4-{address,prefix,rage}-exclude validators

Exclude validators are required to support the ! (not) operator on the CLI to
exclude addresses from NAT.
---
 .../include/nat-address-port.xml.i                 |  9 +++++-
 src/validators/ipv4-address-exclude                |  7 +++++
 src/validators/ipv4-prefix-exclude                 |  7 +++++
 src/validators/ipv4-range                          | 33 ++++++++++++----------
 src/validators/ipv4-range-exclude                  |  7 +++++
 5 files changed, 47 insertions(+), 16 deletions(-)
 create mode 100755 src/validators/ipv4-address-exclude
 create mode 100755 src/validators/ipv4-prefix-exclude
 create mode 100755 src/validators/ipv4-range-exclude

(limited to 'src/validators/ipv4-range')

diff --git a/interface-definitions/include/nat-address-port.xml.i b/interface-definitions/include/nat-address-port.xml.i
index 0848364ff..8705d31cb 100644
--- a/interface-definitions/include/nat-address-port.xml.i
+++ b/interface-definitions/include/nat-address-port.xml.i
@@ -25,7 +25,14 @@
       <format>!ipv4range</format>
       <description>Match everything except the specified range</description>
     </valueHelp>
-    <!-- TODO: add general iptables constraint script -->
+    <constraint>
+      <validator name="ipv4-address"/>
+      <validator name="ipv4-prefix"/>
+      <validator name="ipv4-range"/>
+      <validator name="ipv4-address-exclude"/>
+      <validator name="ipv4-prefix-exclude"/>
+      <validator name="ipv4-range-exclude"/>
+    </constraint>
   </properties>
 </leafNode>
 <leafNode name="port">
diff --git a/src/validators/ipv4-address-exclude b/src/validators/ipv4-address-exclude
new file mode 100755
index 000000000..80ad17d45
--- /dev/null
+++ b/src/validators/ipv4-address-exclude
@@ -0,0 +1,7 @@
+#!/bin/sh
+arg="$1"
+if [ "${arg:0:1}" != "!" ]; then
+  exit 1
+fi
+path=$(dirname "$0")
+${path}/ipv4-address "${arg:1}"
diff --git a/src/validators/ipv4-prefix-exclude b/src/validators/ipv4-prefix-exclude
new file mode 100755
index 000000000..4f7de400a
--- /dev/null
+++ b/src/validators/ipv4-prefix-exclude
@@ -0,0 +1,7 @@
+#!/bin/sh
+arg="$1"
+if [ "${arg:0:1}" != "!" ]; then
+  exit 1
+fi
+path=$(dirname "$0")
+${path}/ipv4-prefix "${arg:1}"
diff --git a/src/validators/ipv4-range b/src/validators/ipv4-range
index 0d707d6c5..ae3f3f163 100755
--- a/src/validators/ipv4-range
+++ b/src/validators/ipv4-range
@@ -7,24 +7,27 @@ ip2dec () {
     printf '%d\n' "$((a * 256 ** 3 + b * 256 ** 2 + c * 256 + d))"
 }
 
-# This only works with real bash (<<<) - split IP addresses into array with
-# hyphen as delimiter
-readarray -d - -t strarr <<< $1
+# Only run this if there is a hypen present in $1
+if [[ "$1" =~ "-" ]]; then
+  # This only works with real bash (<<<) - split IP addresses into array with
+  # hyphen as delimiter
+  readarray -d - -t strarr <<< $1
 
-ipaddrcheck --is-ipv4-single ${strarr[0]}
-if [ $? -gt 0 ]; then
-  exit 1
-fi
+  ipaddrcheck --is-ipv4-single ${strarr[0]}
+  if [ $? -gt 0 ]; then
+    exit 1
+  fi
 
-ipaddrcheck --is-ipv4-single ${strarr[1]}
-if [ $? -gt 0 ]; then
-  exit 1
-fi
+  ipaddrcheck --is-ipv4-single ${strarr[1]}
+  if [ $? -gt 0 ]; then
+    exit 1
+  fi
 
-start=$(ip2dec ${strarr[0]})
-stop=$(ip2dec ${strarr[1]})
-if [ $start -ge $stop ]; then
-  exit 1
+  start=$(ip2dec ${strarr[0]})
+  stop=$(ip2dec ${strarr[1]})
+  if [ $start -ge $stop ]; then
+    exit 1
+  fi
 fi
 
 exit 0
diff --git a/src/validators/ipv4-range-exclude b/src/validators/ipv4-range-exclude
new file mode 100755
index 000000000..3787b4dec
--- /dev/null
+++ b/src/validators/ipv4-range-exclude
@@ -0,0 +1,7 @@
+#!/bin/sh
+arg="$1"
+if [ "${arg:0:1}" != "!" ]; then
+  exit 1
+fi
+path=$(dirname "$0")
+${path}/ipv4-range "${arg:1}"
-- 
cgit v1.2.3