better off storing icmp type-names than depend on iptables help

2 files changed, 80 insertions, 24 deletions

diff --git a/templates/firewall/modify/node.tag/rule/node.tag/icmp/type-name/node.def b/templates/firewall/modify/node.tag/rule/node.tag/icmp/type-name/node.def
index 0ad5e97..413f817 100644
--- a/templates/firewall/modify/node.tag/rule/node.tag/icmp/type-name/node.def
+++ b/templates/firewall/modify/node.tag/rule/node.tag/icmp/type-name/node.def
@@ -1,15 +1,43 @@
 type: txt
 help: Set icmp type-name to match
-allowed: sudo /sbin/iptables -p icmp -h | awk 'NR>67 {print $1}'
+allowed:
+array=(any echo-reply destination-unreachable network-unreachable
+       host-unreachable protocol-unreachable port-unreachable
+       fragmentation-needed source-route-failed network-unknown host-unknown
+       network-prohibited host-prohibited TOS-network-unreachable
+       TOS-host-unreachable communication-prohibited host-precedence-violation
+       precedence-cutoff source-quench redirect network-redirect host-redirect
+       TOS-network-redirect TOS-host-redirect echo-request router-advertisement
+       router-solicitation time-exceeded ttl-zero-during-transit
+       ttl-zero-during-reassembly parameter-problem ip-header-bad
+       required-option-missing timestamp-request timestamp-reply
+       address-mask-request address-mask-reply)
+len=${#array[*]}
+i=0
+while [ $i -lt $len ]; do
+ echo "${array[$i]}"
+ let i++
+done
+
 syntax:expression: exec "
-        icmp_type_array=($(sudo /sbin/iptables -p icmp -h | awk 'NR>67 {print $1}'))
-        icmp_type_array_len=${#icmp_type_array[*]}
-        i=0
-        while [ $i -lt $icmp_type_array_len ]; do
-             if [ \"${icmp_type_array[$i]}\" == \"$VAR(@)\" ] ; then
-                   exit 0
-             fi
-             let i++
-        done
-        echo Invalid ICMP type-name [$VAR(@)]
-        exit 1 "
+array=(any echo-reply destination-unreachable network-unreachable
+       host-unreachable protocol-unreachable port-unreachable
+       fragmentation-needed source-route-failed network-unknown host-unknown
+       network-prohibited host-prohibited TOS-network-unreachable
+       TOS-host-unreachable communication-prohibited host-precedence-violation
+       precedence-cutoff source-quench redirect network-redirect host-redirect
+       TOS-network-redirect TOS-host-redirect echo-request router-advertisement
+       router-solicitation time-exceeded ttl-zero-during-transit
+       ttl-zero-during-reassembly parameter-problem ip-header-bad
+       required-option-missing timestamp-request timestamp-reply
+       address-mask-request address-mask-reply)
+len=${#array[*]}
+i=0
+while [ $i -lt $len ]; do
+ if [ \"${array[$i]}\" == \"$VAR(@)\" ] ; then
+  exit 0
+ fi
+ let i++
+done
+echo Invalid ICMP type-name [$VAR(@)]
+exit 1 "
diff --git a/templates/firewall/name/node.tag/rule/node.tag/icmp/type-name/node.def b/templates/firewall/name/node.tag/rule/node.tag/icmp/type-name/node.def
index 0ad5e97..413f817 100644
--- a/templates/firewall/name/node.tag/rule/node.tag/icmp/type-name/node.def
+++ b/templates/firewall/name/node.tag/rule/node.tag/icmp/type-name/node.def
@@ -1,15 +1,43 @@
 type: txt
 help: Set icmp type-name to match
-allowed: sudo /sbin/iptables -p icmp -h | awk 'NR>67 {print $1}'
+allowed:
+array=(any echo-reply destination-unreachable network-unreachable
+       host-unreachable protocol-unreachable port-unreachable
+       fragmentation-needed source-route-failed network-unknown host-unknown
+       network-prohibited host-prohibited TOS-network-unreachable
+       TOS-host-unreachable communication-prohibited host-precedence-violation
+       precedence-cutoff source-quench redirect network-redirect host-redirect
+       TOS-network-redirect TOS-host-redirect echo-request router-advertisement
+       router-solicitation time-exceeded ttl-zero-during-transit
+       ttl-zero-during-reassembly parameter-problem ip-header-bad
+       required-option-missing timestamp-request timestamp-reply
+       address-mask-request address-mask-reply)
+len=${#array[*]}
+i=0
+while [ $i -lt $len ]; do
+ echo "${array[$i]}"
+ let i++
+done
+
 syntax:expression: exec "
-        icmp_type_array=($(sudo /sbin/iptables -p icmp -h | awk 'NR>67 {print $1}'))
-        icmp_type_array_len=${#icmp_type_array[*]}
-        i=0
-        while [ $i -lt $icmp_type_array_len ]; do
-             if [ \"${icmp_type_array[$i]}\" == \"$VAR(@)\" ] ; then
-                   exit 0
-             fi
-             let i++
-        done
-        echo Invalid ICMP type-name [$VAR(@)]
-        exit 1 "
+array=(any echo-reply destination-unreachable network-unreachable
+       host-unreachable protocol-unreachable port-unreachable
+       fragmentation-needed source-route-failed network-unknown host-unknown
+       network-prohibited host-prohibited TOS-network-unreachable
+       TOS-host-unreachable communication-prohibited host-precedence-violation
+       precedence-cutoff source-quench redirect network-redirect host-redirect
+       TOS-network-redirect TOS-host-redirect echo-request router-advertisement
+       router-solicitation time-exceeded ttl-zero-during-transit
+       ttl-zero-during-reassembly parameter-problem ip-header-bad
+       required-option-missing timestamp-request timestamp-reply
+       address-mask-request address-mask-reply)
+len=${#array[*]}
+i=0
+while [ $i -lt $len ]; do
+ if [ \"${array[$i]}\" == \"$VAR(@)\" ] ; then
+  exit 0
+ fi
+ let i++
+done
+echo Invalid ICMP type-name [$VAR(@)]
+exit 1 "