Task T35 change to place ipv6 address-groups and network groups under group config tree

6 files changed, 68 insertions, 0 deletions

diff --git a/templates/firewall/group/ipv6-address-group/node.def b/templates/firewall/group/ipv6-address-group/node.def
new file mode 100644
index 0000000..7ce50d2
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.def
@@ -0,0 +1,25 @@
+tag:
+priority: 200
+type: txt
+help: Firewall address-group
+
+syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \
+       "Firewall group name must be 31 characters or less"
+
+syntax:expression: pattern $VAR(@) "^[^-]" ; \
+       "Firewall group name cannot start with \"-\""
+
+syntax:expression: pattern $VAR(@) "^[^!]" ; \
+       "Firewall group name cannot start with \"!\""
+
+syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
+       "Firewall group name cannot contain shell punctuation"
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+        --set-type=address --set-family=inet6"; \
+      "Firewall group name already used as Ipv4 group address"
+
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+        --set-name="$VAR(@)" --set-type=address --set-family=inet6; then
+       ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-address-group $VAR(@)"
+     fi
diff --git a/templates/firewall/group/ipv6-address-group/node.tag/address/node.def b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def
new file mode 100644
index 0000000..ba944e6
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def
@@ -0,0 +1,6 @@
+multi:
+type: txt
+help: Address-group member
+val_help: ipv6; IPv6 address to match
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)"
diff --git a/templates/firewall/group/ipv6-address-group/node.tag/description/node.def b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def
new file mode 100644
index 0000000..f630483
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def
@@ -0,0 +1,2 @@
+type: txt
+help: IPv6 Address-group description
\ No newline at end of file
diff --git a/templates/firewall/group/ipv6-network-group/node.def b/templates/firewall/group/ipv6-network-group/node.def
new file mode 100644
index 0000000..299b8cc
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.def
@@ -0,0 +1,25 @@
+tag:
+priority: 200
+type: txt
+help: Firewall network-group
+
+syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \
+       "Firewall group name must be 31 characters or less"
+
+syntax:expression: pattern $VAR(@) "^[^-]" ; \
+       "Firewall group name cannot start with \"-\""
+
+syntax:expression: pattern $VAR(@) "^[^!]" ; \
+       "Firewall group name cannot start with \"!\""
+
+syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
+       "Firewall group name cannot contain shell punctuation"
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+        --set-type=network --set-family=inet6"; \
+      "Firewall group name already used as Ipv6 group address"    
+
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+        --set-name="$VAR(@)" --set-type=network --set-family=inet6; then
+        ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-network-group $VAR(@)"
+     fi
diff --git a/templates/firewall/group/ipv6-network-group/node.tag/description/node.def b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def
new file mode 100644
index 0000000..cc905df
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def
@@ -0,0 +1,2 @@
+type: txt
+help: IPv6-network-group description
diff --git a/templates/firewall/group/ipv6-network-group/node.tag/network/node.def b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def
new file mode 100644
index 0000000..879a164
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def
@@ -0,0 +1,8 @@
+multi:
+type: ipv6net
+help: Network-group member
+val_help: ipv6net; IPv6 Subnet to match
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)"
+
+syntax:expression: exec "/opt/vyatta/sbin/check_prefix_boundary $VAR(@)"