diff options
19 files changed, 190 insertions, 51 deletions
diff --git a/templates/firewall/broadcast-ping/node.def b/templates/firewall/broadcast-ping/node.def index e92d08a..594786c 100644 --- a/templates/firewall/broadcast-ping/node.def +++ b/templates/firewall/broadcast-ping/node.def @@ -1,11 +1,34 @@ type: txt -help: Set ignorance of all ICMP ECHO and TIMESTAMP requests sent via broadcast/multicast (default: disable) + +help: Set handling of broadcast IPv4 ICMP echo and timestamp requests + +comp_help:Possible completions: + disable\tDisable processing of broadcast IPv4 ICMP echo/timestamp requests + enable\tEnable processing of broadcast IPv4 ICMP echo/timestamp requests + default: "disable" + syntax:expression: $VAR(@) in "enable", "disable"; "broadcast-ping must be enable or disable" -create:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts\"; fi" -update:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts\"; fi" -delete:expression: "sudo sh -c \"echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts\"" + +create: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > \ + /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts" + else + sudo sh -c "echo 0 > \ + /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts" + fi + +update: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > \ + /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts" + else + sudo sh -c "echo 0 > \ + /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts" + fi + +delete: + sudo sh -c "echo 0 > \ + /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts" + diff --git a/templates/firewall/ip-src-route/node.def b/templates/firewall/ip-src-route/node.def index 1f813dc..c9e777c 100644 --- a/templates/firewall/ip-src-route/node.def +++ b/templates/firewall/ip-src-route/node.def @@ -1,11 +1,32 @@ type: txt -help: Set acceptance for packets with SRR option (default: disable) + +help: Set policy for handling IPv4 packets with source route option + +comp_help:Possible completions: + enable\tEnable processing of IPv4 packets with source route option + disable\tDisable processing of IPv4 packets with source route option + default: "disable" + syntax:expression: $VAR(@) in "enable", "disable"; "ip-src-route must be enable or disable" -create:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/accept_source_route\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route\"; fi" -update:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/accept_source_route\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route\"; fi" -delete:expression: "sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route\"" + +create: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > \ + /proc/sys/net/ipv4/conf/all/accept_source_route" + else + sudo sh -c "echo 0 > \ + /proc/sys/net/ipv4/conf/all/accept_source_route" + fi + +update: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > \ + /proc/sys/net/ipv4/conf/all/accept_source_route" + else + sudo sh -c "echo 0 > \ + /proc/sys/net/ipv4/conf/all/accept_source_route" + fi + +delete: + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route" diff --git a/templates/firewall/log-martians/node.def b/templates/firewall/log-martians/node.def index 4a31e68..cee3e6a 100644 --- a/templates/firewall/log-martians/node.def +++ b/templates/firewall/log-martians/node.def @@ -1,11 +1,28 @@ type: txt -help: Set syslog logging of packets with impossible addresses (default: enable) + +help: Set policy for logging IPv4 packets with invalid addresses + +comp_help:Possible completions: + enable\tEnable logging of IPv4 packets with invalid addresses + disable\tDisable logging of Ipv4 packets with invalid addresses + default: "enable" + syntax:expression: $VAR(@) in "enable", "disable"; "log-martians must be enable or disable" -create:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/log_martians\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/log_martians\"; fi" -update:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/log_martians\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/log_martians\"; fi" -delete:expression: "sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/log_martians\"" + +create: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > /proc/sys/net/ipv4/conf/all/log_martians" + else + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/log_martians" + fi + +update: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > /proc/sys/net/ipv4/conf/all/log_martians" + else + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/log_martians" + fi + +delete: + sudo sh -c "echo 1 > /proc/sys/net/ipv4/conf/all/log_martians" diff --git a/templates/firewall/modify/node.def b/templates/firewall/modify/node.def index 6fb513f..7e9046f 100644 --- a/templates/firewall/modify/node.def +++ b/templates/firewall/modify/node.def @@ -1,4 +1,7 @@ tag: + type: txt + syntax:expression: pattern $VAR(@) "^[^-]" ; "Modify rule set name cannot start with \"-\"" + help: Set modify rule set name diff --git a/templates/firewall/modify/node.tag/description/node.def b/templates/firewall/modify/node.tag/description/node.def index d5d4dba..fbf2144 100644 --- a/templates/firewall/modify/node.tag/description/node.def +++ b/templates/firewall/modify/node.tag/description/node.def @@ -1,2 +1,3 @@ type: txt + help: Set modify rule set description diff --git a/templates/firewall/modify/node.tag/rule/node.def b/templates/firewall/modify/node.tag/rule/node.def index f2e7c6f..19c467b 100644 --- a/templates/firewall/modify/node.tag/rule/node.def +++ b/templates/firewall/modify/node.tag/rule/node.def @@ -1,4 +1,7 @@ tag: + type: u32 + help: Set modify rule number (1-1024) + syntax:expression: $VAR(@) > 0 && $VAR(@) < 1025; "modify rule number must be between 1 and 1024" diff --git a/templates/firewall/name/node.def b/templates/firewall/name/node.def index 491fe71..b82683d 100644 --- a/templates/firewall/name/node.def +++ b/templates/firewall/name/node.def @@ -1,4 +1,7 @@ tag: + type: txt + syntax:expression: pattern $VAR(@) "^[^-]" ; "Firewall rule set name cannot start with \"-\"" + help: Set firewall rule set name diff --git a/templates/firewall/name/node.tag/description/node.def b/templates/firewall/name/node.tag/description/node.def index 678e325..d181e33 100644 --- a/templates/firewall/name/node.tag/description/node.def +++ b/templates/firewall/name/node.tag/description/node.def @@ -1,2 +1,3 @@ type: txt + help: Set firewall description diff --git a/templates/firewall/name/node.tag/rule/node.def b/templates/firewall/name/node.tag/rule/node.def index 010f808..c3c7b43 100644 --- a/templates/firewall/name/node.tag/rule/node.def +++ b/templates/firewall/name/node.tag/rule/node.def @@ -1,4 +1,7 @@ tag: + type: u32 + help: Set firewall rule number (1-1024) + syntax:expression: $VAR(@) > 0 && $VAR(@) < 1025; "firewall rule number must be between 1 and 1024" diff --git a/templates/firewall/name/node.tag/rule/node.tag/action/node.def b/templates/firewall/name/node.tag/rule/node.tag/action/node.def index 7bb7278..9391bda 100644 --- a/templates/firewall/name/node.tag/rule/node.tag/action/node.def +++ b/templates/firewall/name/node.tag/rule/node.tag/action/node.def @@ -1,4 +1,6 @@ type: txt + help: Set firewall rule action + syntax:expression: $VAR(@) in "drop", "reject", "accept", "inspect"; "action must be one of drop, reject, accept, or inspect" diff --git a/templates/firewall/name/node.tag/rule/node.tag/description/node.def b/templates/firewall/name/node.tag/rule/node.tag/description/node.def index 9c0c2bb..b49b91e 100644 --- a/templates/firewall/name/node.tag/rule/node.tag/description/node.def +++ b/templates/firewall/name/node.tag/rule/node.tag/description/node.def @@ -1,2 +1,3 @@ type: txt + help: Set rule description diff --git a/templates/firewall/name/node.tag/rule/node.tag/destination/address/node.def b/templates/firewall/name/node.tag/rule/node.tag/destination/address/node.def index e25da77..e78fd70 100644 --- a/templates/firewall/name/node.tag/rule/node.tag/destination/address/node.def +++ b/templates/firewall/name/node.tag/rule/node.tag/destination/address/node.def @@ -1,9 +1,11 @@ type: txt + help: Set destination IP address, subnet, or range + comp_help: Possible completions: - <x.x.x.x> IP address to match - <x.x.x.x/x> Subnet to match - <x.x.x.x>-<x.x.x.x> IP range to match + <x.x.x.x> IPv4 address to match + <x.x.x.x/x> IPv4 Subnet to match + <x.x.x.x>-<x.x.x.x> IPv4 range to match !<x.x.x.x> Match everything except the specified address !<x.x.x.x/x> Match everything except the specified subnet !<x.x.x.x>-<x.x.x.x> Match everything except the specified range diff --git a/templates/firewall/name/node.tag/rule/node.tag/destination/port/node.def b/templates/firewall/name/node.tag/rule/node.tag/destination/port/node.def index 65170b2..b292864 100644 --- a/templates/firewall/name/node.tag/rule/node.tag/destination/port/node.def +++ b/templates/firewall/name/node.tag/rule/node.tag/destination/port/node.def @@ -1,5 +1,7 @@ type: txt + help: Set destination port + comp_help: Destination port(s) can be specified as a comma-separated list of: <port name> Named port (any name in /etc/services, e.g., http) <1-65535> Numbered port diff --git a/templates/firewall/name/node.tag/rule/node.tag/icmp/code/node.def b/templates/firewall/name/node.tag/rule/node.tag/icmp/code/node.def index 71bacfc..8ff1c09 100644 --- a/templates/firewall/name/node.tag/rule/node.tag/icmp/code/node.def +++ b/templates/firewall/name/node.tag/rule/node.tag/icmp/code/node.def @@ -1,3 +1,5 @@ type: u32; "ICMP code must be between 0 and 255" + help: Set ICMP code (0-255) + syntax:expression: $VAR(@) >=0 && $VAR(@) <= 255; "ICMP code must be between 0 and 255" diff --git a/templates/firewall/name/node.tag/rule/node.tag/icmp/type/node.def b/templates/firewall/name/node.tag/rule/node.tag/icmp/type/node.def index 6275a64..9cd72b3 100644 --- a/templates/firewall/name/node.tag/rule/node.tag/icmp/type/node.def +++ b/templates/firewall/name/node.tag/rule/node.tag/icmp/type/node.def @@ -1,3 +1,5 @@ type: u32; "ICMP type must be between 0 and 255" + help: Set ICMP type (0-255) + syntax:expression: $VAR(@) >=0 && $VAR(@) <= 255; "ICMP type must be between 0 and 255" diff --git a/templates/firewall/node.def b/templates/firewall/node.def index ead7027..a849d50 100644 --- a/templates/firewall/node.def +++ b/templates/firewall/node.def @@ -1,4 +1,10 @@ help: Configure firewall -end:expression: "sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-rules" -create:expression: "sudo /opt/vyatta/sbin/vyatta-firewall.pl --setup" -delete:expression: "sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown" + +end: + sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-rules + +create: + sudo /opt/vyatta/sbin/vyatta-firewall.pl --setup + +delete: + sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown diff --git a/templates/firewall/receive-redirects/node.def b/templates/firewall/receive-redirects/node.def index 59996ec..94410c7 100644 --- a/templates/firewall/receive-redirects/node.def +++ b/templates/firewall/receive-redirects/node.def @@ -1,11 +1,28 @@ type: txt -help: Set receive ICMP redirects (default: disable) + +help: Set policy for handling received IPv4 ICMP redirect messages + +comp_help:Possible completions: + enable\tEnable processing of received IPv4 ICMP redirect messages + disable\tDisable processing of received IPv4 ICMP redirect messages + default: "disable" + syntax:expression: $VAR(@) in "enable", "disable"; "receive-redirects must be enable or disable" -create:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects\"; fi" -update:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects\"; fi" -delete:expression: "sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects\"" + +create: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects" + else + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects" + fi + +update: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects" + else + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects" + fi + +delete: + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects" diff --git a/templates/firewall/send-redirects/node.def b/templates/firewall/send-redirects/node.def index a83fa45..9a36554 100644 --- a/templates/firewall/send-redirects/node.def +++ b/templates/firewall/send-redirects/node.def @@ -1,11 +1,28 @@ type: txt -help: Set send ICMP redirects (default: disable) + +help: Set policy for sending IPv4 ICMP redirect messages + +comp_help:Possible completions: + enable\tEnable sending IPv4 ICMP redirect messages + disable\tDisable sending IPv4 ICMP redirect messages + default: "disable" + syntax:expression: $VAR(@) in "enable", "disable"; "send-redirects must be enable or disable" -create:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects\"; fi" -update:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects\"; fi" -delete:expression: "sudo sh -c \"echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects\"" + +create: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects" + else + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects" + fi + +update: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects" + else + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects" + fi + +delete: + sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects" diff --git a/templates/firewall/syn-cookies/node.def b/templates/firewall/syn-cookies/node.def index 9521f12..d85c84d 100644 --- a/templates/firewall/syn-cookies/node.def +++ b/templates/firewall/syn-cookies/node.def @@ -1,8 +1,21 @@ type: txt -help: Set use TCP syn cookies (default: enable) + +help: Set policy for using TCP SYN cookies with IPv4 + +comp_help:Possible completions: + enable\tEnable use of TCP SYN cookies with IPv4 + disable\tDisable use of TCP SYN cookies with IPv4 + default: "enable" + syntax:expression: $VAR(@) in "enable", "disable"; "syn-cookies must be enable or disable" -update:expression: "if [ x$VAR(@) == xenable ]; \ - then sudo sh -c \"echo 1 > /proc/sys/net/ipv4/tcp_syncookies\"; \ - else sudo sh -c \"echo 0 > /proc/sys/net/ipv4/tcp_syncookies\"; fi" -delete:expression: "sudo sh -c \"echo 1 > /proc/sys/net/ipv4/tcp_syncookies\"" + +update: + if [ x$VAR(@) == xenable ]; then + sudo sh -c "echo 1 > /proc/sys/net/ipv4/tcp_syncookies" + else + sudo sh -c "echo 0 > /proc/sys/net/ipv4/tcp_syncookies" + fi + +delete: + sudo sh -c "echo 1 > /proc/sys/net/ipv4/tcp_syncookies" |