diff options
16 files changed, 23 insertions, 17 deletions
diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm index e293240..cee7935 100755 --- a/lib/Vyatta/IpTables/IpSet.pm +++ b/lib/Vyatta/IpTables/IpSet.pm @@ -471,7 +471,7 @@ sub get_firewall_references { my @fw_refs = (); return @fw_refs if !$self->exists(); my $config = new Vyatta::Config; - foreach my $tree ('name', 'modify') { + foreach my $tree ('name', 'ipv6-name', 'modify') { my $path = "firewall $tree "; $config->setLevel($path); my @names = $config->$lfunc(); diff --git a/scripts/firewall/vyatta-ipset.pl b/scripts/firewall/vyatta-ipset.pl index f18237d..0f7f731 100755 --- a/scripts/firewall/vyatta-ipset.pl +++ b/scripts/firewall/vyatta-ipset.pl @@ -252,7 +252,7 @@ sub ipset_is_group_defined { die "Error: undefined set_type\n" if ! defined $set_type; die "Error: undefined set_family\n" if ! defined $set_family; - my $gpath = ($set_family eq 'inet') ? "firewall ipv6-group $set_type-group" : "firewall group $set_type-group"; + my $gpath = ($set_family eq 'inet') ? "firewall group ipv6-$set_type-group" : "firewall group $set_type-group"; my @groups = $cfg->listOrigNodes($gpath); my $group; foreach $group (@groups) { @@ -267,7 +267,7 @@ sub update_set { my ($set_name, $set_type, $set_family) = @_; my $cfg = new Vyatta::Config; my ($rc, $newset); - my $cpath = ($set_family eq 'inet') ? "firewall group $set_type-group $set_name" : "firewall ipv6-group $set_type-group $set_name"; + my $cpath = ($set_family eq 'inet') ? "firewall group $set_type-group $set_name" : "firewall group ipv6-$set_type-group $set_name"; if ($cfg->existsOrig($cpath)) { if (!$cfg->exists($cpath)) { # deleted diff --git a/templates/firewall/ipv6-group/address-group/node.def b/templates/firewall/group/ipv6-address-group/node.def index b61f784..20e4430 100644 --- a/templates/firewall/ipv6-group/address-group/node.def +++ b/templates/firewall/group/ipv6-address-group/node.def @@ -1,7 +1,7 @@ tag: priority: 200 type: txt -help: Firewall address-group +help: Firewall ipv6-address-group syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \ "Firewall group name must be 31 characters or less" @@ -21,5 +21,5 @@ syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defi end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ --set-name="$VAR(@)" --set-type=address --set-family=inet6; then - ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group address-group $VAR(@)" + ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-address-group $VAR(@)" fi diff --git a/templates/firewall/ipv6-group/address-group/node.tag/address/node.def b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def index ba944e6..5bd948b 100644 --- a/templates/firewall/ipv6-group/address-group/node.tag/address/node.def +++ b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def @@ -3,4 +3,7 @@ type: txt help: Address-group member val_help: ipv6; IPv6 address to match +syntax:expression: pattern $VAR(@) "^[^|;&$<>/]*$" ; \ + "Error [$VAR(@)] isn't valid IPv6 host address" + syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)" diff --git a/templates/firewall/group/ipv6-address-group/node.tag/description/node.def b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def new file mode 100644 index 0000000..f630483 --- /dev/null +++ b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def @@ -0,0 +1,2 @@ +type: txt +help: IPv6 Address-group description
\ No newline at end of file diff --git a/templates/firewall/ipv6-group/network-group/node.def b/templates/firewall/group/ipv6-network-group/node.def index 90383c2..084fdb0 100644 --- a/templates/firewall/ipv6-group/network-group/node.def +++ b/templates/firewall/group/ipv6-network-group/node.def @@ -1,7 +1,7 @@ tag: priority: 200 type: txt -help: Firewall network-group +help: Firewall ipv6-network-group syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \ "Firewall group name must be 31 characters or less" @@ -15,7 +15,11 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ "Firewall group name cannot contain shell punctuation" +syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ + --set-type=network --set-family=inet6"; \ + "Firewall group name already used as Ipv4 group address" + end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ --set-name="$VAR(@)" --set-type=network --set-family=inet6; then - ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-group network-group $VAR(@)" + ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-network-group $VAR(@)" fi diff --git a/templates/firewall/group/ipv6-network-group/node.tag/description/node.def b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def new file mode 100644 index 0000000..cc905df --- /dev/null +++ b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def @@ -0,0 +1,2 @@ +type: txt +help: IPv6-network-group description diff --git a/templates/firewall/ipv6-group/network-group/node.tag/network/node.def b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def index 879a164..879a164 100644 --- a/templates/firewall/ipv6-group/network-group/node.tag/network/node.def +++ b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def diff --git a/templates/firewall/group/network-group/node.def b/templates/firewall/group/network-group/node.def index ed9810d..14b8366 100644 --- a/templates/firewall/group/network-group/node.def +++ b/templates/firewall/group/network-group/node.def @@ -16,7 +16,7 @@ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ "Firewall group name cannot contain shell punctuation" syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ - --set-type=address --set-family=inet"; \ + --set-type=network --set-family=inet"; \ "Firewall group name already used as Ipv6 group address" end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ diff --git a/templates/firewall/ipv6-group/address-group/node.tag/description/node.def b/templates/firewall/ipv6-group/address-group/node.tag/description/node.def deleted file mode 100644 index 032553a..0000000 --- a/templates/firewall/ipv6-group/address-group/node.tag/description/node.def +++ /dev/null @@ -1,2 +0,0 @@ -type: txt -help: IPv6 Address-group description diff --git a/templates/firewall/ipv6-group/network-group/node.tag/description/node.def b/templates/firewall/ipv6-group/network-group/node.tag/description/node.def deleted file mode 100644 index 52bb8e4..0000000 --- a/templates/firewall/ipv6-group/network-group/node.tag/description/node.def +++ /dev/null @@ -1,2 +0,0 @@ -type: txt -help: Network-group description diff --git a/templates/firewall/ipv6-group/node.def b/templates/firewall/ipv6-group/node.def deleted file mode 100644 index 3c87f34..0000000 --- a/templates/firewall/ipv6-group/node.def +++ /dev/null @@ -1 +0,0 @@ -help: IPv6 Firewall group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def index 71a4326..961663c 100644 --- a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def @@ -6,4 +6,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --set-name=$VAR(@) \ --set-type=address;" -allowed: cli-shell-api listNodes firewall ipv6-group address-group +allowed: cli-shell-api listNodes firewall group ipv6-address-group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def index b3e2718..262c4dd 100644 --- a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def @@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --action=check-set-type \ --set-name=$VAR(@) \ --set-type=network;" -allowed: cli-shell-api listNodes firewall ipv6-group network-group +allowed: cli-shell-api listNodes firewall group ipv6-network-group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def index 63f0540..9323938 100644 --- a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def @@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --action=check-set-type \ --set-name=$VAR(@) \ --set-type=address;" -allowed: cli-shell-api listNodes firewall ipv6-group address-group +allowed: cli-shell-api listNodes firewall group ipv6-address-group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def index b3e2718..262c4dd 100644 --- a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def @@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --action=check-set-type \ --set-name=$VAR(@) \ --set-type=network;" -allowed: cli-shell-api listNodes firewall ipv6-group network-group +allowed: cli-shell-api listNodes firewall group ipv6-network-group |