From 728e1c6073cb216d3cb8b66f519bd590458165e6 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Tue, 12 May 2020 18:44:20 +0200 Subject: nat: T2198: add new ipv4-range validator --- src/validators/ipv4-range | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100755 src/validators/ipv4-range (limited to 'src/validators') diff --git a/src/validators/ipv4-range b/src/validators/ipv4-range new file mode 100755 index 000000000..0d707d6c5 --- /dev/null +++ b/src/validators/ipv4-range @@ -0,0 +1,30 @@ +#!/bin/bash + +# snippet from https://stackoverflow.com/questions/10768160/ip-address-converter +ip2dec () { + local a b c d ip=$@ + IFS=. read -r a b c d <<< "$ip" + printf '%d\n' "$((a * 256 ** 3 + b * 256 ** 2 + c * 256 + d))" +} + +# This only works with real bash (<<<) - split IP addresses into array with +# hyphen as delimiter +readarray -d - -t strarr <<< $1 + +ipaddrcheck --is-ipv4-single ${strarr[0]} +if [ $? -gt 0 ]; then + exit 1 +fi + +ipaddrcheck --is-ipv4-single ${strarr[1]} +if [ $? -gt 0 ]; then + exit 1 +fi + +start=$(ip2dec ${strarr[0]}) +stop=$(ip2dec ${strarr[1]}) +if [ $start -ge $stop ]; then + exit 1 +fi + +exit 0 -- cgit v1.2.3 From 1330898ed095b42b6aba7ba00f9a6932b241a230 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Tue, 12 May 2020 19:23:15 +0200 Subject: nat: T2198: add ipv4-{address,prefix,rage}-exclude validators Exclude validators are required to support the ! (not) operator on the CLI to exclude addresses from NAT. --- .../include/nat-address-port.xml.i | 9 +++++- src/validators/ipv4-address-exclude | 7 +++++ src/validators/ipv4-prefix-exclude | 7 +++++ src/validators/ipv4-range | 33 ++++++++++++---------- src/validators/ipv4-range-exclude | 7 +++++ 5 files changed, 47 insertions(+), 16 deletions(-) create mode 100755 src/validators/ipv4-address-exclude create mode 100755 src/validators/ipv4-prefix-exclude create mode 100755 src/validators/ipv4-range-exclude (limited to 'src/validators') diff --git a/interface-definitions/include/nat-address-port.xml.i b/interface-definitions/include/nat-address-port.xml.i index 0848364ff..8705d31cb 100644 --- a/interface-definitions/include/nat-address-port.xml.i +++ b/interface-definitions/include/nat-address-port.xml.i @@ -25,7 +25,14 @@ !ipv4range Match everything except the specified range - + + + + + + + + diff --git a/src/validators/ipv4-address-exclude b/src/validators/ipv4-address-exclude new file mode 100755 index 000000000..80ad17d45 --- /dev/null +++ b/src/validators/ipv4-address-exclude @@ -0,0 +1,7 @@ +#!/bin/sh +arg="$1" +if [ "${arg:0:1}" != "!" ]; then + exit 1 +fi +path=$(dirname "$0") +${path}/ipv4-address "${arg:1}" diff --git a/src/validators/ipv4-prefix-exclude b/src/validators/ipv4-prefix-exclude new file mode 100755 index 000000000..4f7de400a --- /dev/null +++ b/src/validators/ipv4-prefix-exclude @@ -0,0 +1,7 @@ +#!/bin/sh +arg="$1" +if [ "${arg:0:1}" != "!" ]; then + exit 1 +fi +path=$(dirname "$0") +${path}/ipv4-prefix "${arg:1}" diff --git a/src/validators/ipv4-range b/src/validators/ipv4-range index 0d707d6c5..ae3f3f163 100755 --- a/src/validators/ipv4-range +++ b/src/validators/ipv4-range @@ -7,24 +7,27 @@ ip2dec () { printf '%d\n' "$((a * 256 ** 3 + b * 256 ** 2 + c * 256 + d))" } -# This only works with real bash (<<<) - split IP addresses into array with -# hyphen as delimiter -readarray -d - -t strarr <<< $1 +# Only run this if there is a hypen present in $1 +if [[ "$1" =~ "-" ]]; then + # This only works with real bash (<<<) - split IP addresses into array with + # hyphen as delimiter + readarray -d - -t strarr <<< $1 -ipaddrcheck --is-ipv4-single ${strarr[0]} -if [ $? -gt 0 ]; then - exit 1 -fi + ipaddrcheck --is-ipv4-single ${strarr[0]} + if [ $? -gt 0 ]; then + exit 1 + fi -ipaddrcheck --is-ipv4-single ${strarr[1]} -if [ $? -gt 0 ]; then - exit 1 -fi + ipaddrcheck --is-ipv4-single ${strarr[1]} + if [ $? -gt 0 ]; then + exit 1 + fi -start=$(ip2dec ${strarr[0]}) -stop=$(ip2dec ${strarr[1]}) -if [ $start -ge $stop ]; then - exit 1 + start=$(ip2dec ${strarr[0]}) + stop=$(ip2dec ${strarr[1]}) + if [ $start -ge $stop ]; then + exit 1 + fi fi exit 0 diff --git a/src/validators/ipv4-range-exclude b/src/validators/ipv4-range-exclude new file mode 100755 index 000000000..3787b4dec --- /dev/null +++ b/src/validators/ipv4-range-exclude @@ -0,0 +1,7 @@ +#!/bin/sh +arg="$1" +if [ "${arg:0:1}" != "!" ]; then + exit 1 +fi +path=$(dirname "$0") +${path}/ipv4-range "${arg:1}" -- cgit v1.2.3 From 2a0d1e77e650bd3e8cdff29ac62a3b23c41c85af Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 16 May 2020 17:21:21 +0200 Subject: nat: T2198: add common ip-protocol validator It allows IP protocol numbers 0-255, protocol names e.g. tcp, ip, ipv6 and the negated form with a leading "!". --- interface-definitions/include/nat-rule.xml.i | 2 +- src/validators/ip-protocol | 41 ++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100755 src/validators/ip-protocol (limited to 'src/validators') diff --git a/interface-definitions/include/nat-rule.xml.i b/interface-definitions/include/nat-rule.xml.i index b52eb86c3..f62a08987 100644 --- a/interface-definitions/include/nat-rule.xml.i +++ b/interface-definitions/include/nat-rule.xml.i @@ -286,7 +286,7 @@ IP protocol number - !?(all|ip|hopopt|icmp|igmp|ggp|ipencap|st|tcp|egp|igp|pup|udp|tcp_udp|hmp|xns-idp|rdp|iso-tp4|dccp|xtp|ddp|idpr-cmtp|ipv6|ipv6-route|ipv6-frag|idrp|rsvp|gre|esp|ah|skip|ipv6-icmp|ipv6-nonxt|ipv6-opts|rspf|vmtp|eigrp|ospf|ax.25|ipip|etherip|encap|99|pim|ipcomp|vrrp|l2tp|isis|sctp|fc|mobility-header|udplite|mpls-in-ip|manet|hip|shim6|wesp|rohc|[01]?[0-9][0-9]?) + diff --git a/src/validators/ip-protocol b/src/validators/ip-protocol new file mode 100755 index 000000000..078f8e319 --- /dev/null +++ b/src/validators/ip-protocol @@ -0,0 +1,41 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import re +from sys import argv,exit + +if __name__ == '__main__': + if len(argv) != 2: + exit(1) + + input = argv[1] + try: + # IP protocol can be in the range 0 - 255, thus the range must end with 256 + if int(input) in range(0, 256): + exit(0) + except ValueError: + pass + + pattern = "!?\\b(all|ip|hopopt|icmp|igmp|ggp|ipencap|st|tcp|egp|igp|pup|udp|" \ + "tcp_udp|hmp|xns-idp|rdp|iso-tp4|dccp|xtp|ddp|idpr-cmtp|ipv6|" \ + "ipv6-route|ipv6-frag|idrp|rsvp|gre|esp|ah|skip|ipv6-icmp|" \ + "ipv6-nonxt|ipv6-opts|rspf|vmtp|eigrp|ospf|ax.25|ipip|etherip|" \ + "encap|99|pim|ipcomp|vrrp|l2tp|isis|sctp|fc|mobility-header|" \ + "udplite|mpls-in-ip|manet|hip|shim6|wesp|rohc)\\b" + if re.match(pattern, input): + exit(0) + + exit(1) -- cgit v1.2.3