summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--debian/changelog16
-rw-r--r--debian/control6
-rwxr-xr-xgen-interface-policy-templates.pl20
-rwxr-xr-xlib/Vyatta/IpTables/AddressFilter.pm36
-rwxr-xr-xlib/Vyatta/IpTables/IpSet.pm29
-rw-r--r--scripts/firewall/firewall.init.in6
-rwxr-xr-xscripts/firewall/vyatta-firewall-trap.pl2
-rwxr-xr-xscripts/firewall/vyatta-firewall.pl6
-rwxr-xr-xscripts/firewall/vyatta-ipset.pl40
-rw-r--r--templates/firewall/group/address-group/node.def6
-rw-r--r--templates/firewall/group/ipv6-address-group/node.def25
-rw-r--r--templates/firewall/group/ipv6-address-group/node.tag/address/node.def9
-rw-r--r--templates/firewall/group/ipv6-address-group/node.tag/description/node.def2
-rw-r--r--templates/firewall/group/ipv6-network-group/node.def25
-rw-r--r--templates/firewall/group/ipv6-network-group/node.tag/description/node.def2
-rw-r--r--templates/firewall/group/ipv6-network-group/node.tag/network/node.def8
-rw-r--r--templates/firewall/group/network-group/node.def6
-rw-r--r--templates/firewall/group/port-group/node.def2
-rw-r--r--templates/firewall/ipv6-name/node.def10
-rw-r--r--templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def9
-rw-r--r--templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def8
-rw-r--r--templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def1
-rw-r--r--templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def8
-rw-r--r--templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def8
-rw-r--r--templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def8
-rw-r--r--templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def1
-rw-r--r--templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def8
-rw-r--r--templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def2
-rw-r--r--templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def2
-rw-r--r--templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def2
-rw-r--r--templates/policy/route/node.tag/rule/node.tag/set/table/node.def1
-rw-r--r--templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def2
-rw-r--r--templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def2
-rw-r--r--templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def2
34 files changed, 247 insertions, 73 deletions
diff --git a/debian/changelog b/debian/changelog
index c51a0ce..c0b54d9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,18 @@
-vyatta-cfg-firewall (0.14.0+vyos2+lithium17) unstable; urgency=low
+vyatta-cfg-firewall (0.14.0+vyos2+lithium17) UNRELEASED; urgency=medium
- * Remove dead code from the IPset module.
+ * Sync with current.
- -- Daniil Baturin <daniil@baturin.org> Tue, 22 Dec 2015 21:38:37 +0100
+ -- Daniil Baturin <daniil@baturin.org> Sun, 24 Jun 2018 12:31:12 +0200
+
+vyatta-cfg-firewall (0.14.0+vyos2+current1) unstable; urgency=medium
+
+ [ Thomas Jepp ]
+ * Fix build depends.
+ * Fix runtime depends.
+
+ [ Kim Hagen ]
+
+ -- Kim Hagen <kim.sidney@gmail.com> Sun, 24 Jan 2016 15:00:40 -0500
vyatta-cfg-firewall (0.14.0+vyos2+lithium16) unstable; urgency=low
diff --git a/debian/control b/debian/control
index 335bd13..7e6cadd 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: vyatta-cfg-firewall
Section: contrib/net
Priority: extra
Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
-Build-Depends: debhelper (>= 5), autotools-dev
+Build-Depends: debhelper (>= 5), autotools-dev, autoconf, automake, cpio
Standards-Version: 3.9.1
Package: vyatta-cfg-firewall
@@ -23,7 +23,9 @@ Depends: sed (>= 4.1.5),
sudo,
snmpd,
ipset,
- iptables
+ iptables,
+ libswitch-perl,
+ libsnmp-perl
Replaces: vyatta-cfg-system,
vyatta-openvpn,
vyatta-wirelessmodem
diff --git a/gen-interface-policy-templates.pl b/gen-interface-policy-templates.pl
index afea8cf..a86c5d6 100755
--- a/gen-interface-policy-templates.pl
+++ b/gen-interface-policy-templates.pl
@@ -107,16 +107,12 @@ sub gen_firewall_template {
#
my %table_help_hash = (
"route" => "IPv4 policy route",
- "local-route" => "IPv4 policy route of local traffic",
"ipv6-route" => "IPv6 policy route",
- "ipv6-local-route" => "IPv6 policy route of local traffic",
);
my %config_association_hash = (
"route" => "\"policy route\"",
- "local-route" => "\"policy local-route\"",
"ipv6-route" => "\"policy ipv6-route\"",
- "ipv6-local-route" => "\"policy ipv6-local-route\"",
);
# Generate the template file at the leaf of the per-interface firewall tree.
@@ -124,10 +120,10 @@ my %config_association_hash = (
# ruleset on an interface for a particular ruleset type and direction.
#
sub gen_template {
- my ( $if_tree, $direction, $table, $if_name ) = @_;
+ my ( $if_tree, $table, $if_name ) = @_;
if ($debug) {
- print "debug: table=$table direction=$direction\n";
+ print "debug: table=$table\n";
}
my $template_dir =
@@ -151,16 +147,16 @@ allowed: local -a params
echo -n "\${params[@]}"
create: ifname=$if_name
sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\
- update \$ifname $direction \$VAR(@) $config_association_hash{$table}
+ update \$ifname in \$VAR(@) $config_association_hash{$table}
update: ifname=$if_name
sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\
- update \$ifname $direction \$VAR(@) $config_association_hash{$table}
+ update \$ifname in \$VAR(@) $config_association_hash{$table}
delete: ifname=$if_name
sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\
- delete \$ifname $direction \$VAR(@) $config_association_hash{$table}
+ delete \$ifname in \$VAR(@) $config_association_hash{$table}
EOF
close $tp
@@ -177,10 +173,8 @@ foreach my $if_tree ( keys %interface_hash ) {
}
gen_firewall_template($if_tree);
- gen_template( $if_tree, "in", "route", $if_name );
- gen_template( $if_tree, "out", "local-route", $if_name );
- gen_template( $if_tree, "in", "ipv6-route", $if_name );
- gen_template( $if_tree, "out", "ipv6-local-route", $if_name );
+ gen_template( $if_tree, "route", $if_name );
+ gen_template( $if_tree, "ipv6-route", $if_name );
}
print "Done.\n";
diff --git a/lib/Vyatta/IpTables/AddressFilter.pm b/lib/Vyatta/IpTables/AddressFilter.pm
index 9100c24..9b3be53 100755
--- a/lib/Vyatta/IpTables/AddressFilter.pm
+++ b/lib/Vyatta/IpTables/AddressFilter.pm
@@ -238,31 +238,25 @@ sub rule {
my ($port_str, $port_err)= getPortRuleString($self->{_port}, $can_use_port,($self->{_srcdst} eq "source") ? "s" : "d",$self->{_protocol});
return (undef, $port_err) if (!defined($port_str));
$rule .= $port_str;
-
# Handle groups last so we can check $group_ok
- if ($self->{_ip_version} eq "ipv4") {
-
- # so far ipset only supports IPv4
- my %group_used = ('address' => 0, 'network' => 0);
- foreach my $group_type ('address', 'network', 'port') {
- my $var_name = '_' . $group_type . '_group';
- if (defined($self->{$var_name})) {
- $group_used{$group_type} = 1;
- my $name = $self->{$var_name};
- if (!$group_ok{$group_type}) {
- return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type");
- }
- my $group = new Vyatta::IpTables::IpSet($name, $group_type);
- my ($set_rule, $err_str) = $group->rule($self->{_srcdst});
- return ($err_str,) if !defined $set_rule;
- $rule .= $set_rule;
+ my %group_used = ('address' => 0, 'network' => 0);
+ foreach my $group_type ('address', 'network', 'port') {
+ my $var_name = '_' . $group_type . '_group';
+ if (defined($self->{$var_name})) {
+ $group_used{$group_type} = 1;
+ my $name = $self->{$var_name};
+ if (!$group_ok{$group_type}) {
+ return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type");
}
- }
- if ($group_used{address} and $group_used{network}) {
- return (undef,"Can't combine network and address group for $self->{_srcdst}\n");
+ my $group = new Vyatta::IpTables::IpSet($name, $group_type);
+ my ($set_rule, $err_str) = $group->rule($self->{_srcdst});
+ return ($err_str,) if !defined $set_rule;
+ $rule .= $set_rule;
}
}
-
+ if ($group_used{address} and $group_used{network}) {
+ return (undef,"Can't combine network and address group for $self->{_srcdst}\n");
+ }
return ($rule, undef);
}
diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm
index d6a1d31..dafdf4b 100755
--- a/lib/Vyatta/IpTables/IpSet.pm
+++ b/lib/Vyatta/IpTables/IpSet.pm
@@ -35,6 +35,7 @@ use warnings;
my %fields = (
_name => undef,
_type => undef, # vyatta group type, not ipset type
+ _family => undef,
_exists => undef,
_negate => undef,
_debug => undef,
@@ -66,7 +67,7 @@ sub INT_handler {
$SIG{'INT'} = 'INT_handler';
sub new {
- my ($that, $name, $type) = @_;
+ my ($that, $name, $type, $family) = @_;
my $class = ref($that) || $that;
my $self = {%fields,};
@@ -76,6 +77,7 @@ sub new {
}
$self->{_name} = $name;
$self->{_type} = $type;
+ $self->{_family} = $family;
bless $self, $class;
return $self;
@@ -136,6 +138,25 @@ sub get_type {
return $self->{_type};
}
+sub get_family {
+ my ($self) = @_;
+ return $self->{_family} if defined $self->{_family};
+ return if !$self->exists();
+ my @lines = `ipset -L $self->{_name}`;
+ my $family;
+ foreach my $line (@lines) {
+ if ($line =~ /^Header: family (\w+) hashsize/) {
+ $family = $1;
+ $self->{_family} = $family;
+ last;
+ } elsif ($line =~ /^Type: bitmap:port$/){
+ $self->{_family} = "inet";
+ last;
+ }
+ }
+ return $self->{_family};
+}
+
sub alphanum_split {
my ($str) = @_;
my @list = split m/(?=(?<=\D)\d|(?<=\d)\D)/, $str;
@@ -189,11 +210,13 @@ sub create {
my $ipset_param = $grouptype_hash{$self->{_type}};
return "Error: invalid group type\n" if !defined $ipset_param;
+ my $cmd = "ipset -N $self->{_name} $ipset_param family $self->{_family}";
+
if ($self->{_type} eq 'port') {
$ipset_param .= ' --from 1 --to 65535';
+ $cmd = "ipset -N $self->{_name} $ipset_param";
}
- my $cmd = "ipset -N $self->{_name} $ipset_param";
my $rc = $self->run_cmd($cmd);
return "Error: call to ipset failed [$rc]" if $rc;
return; # undef
@@ -398,7 +421,7 @@ sub get_firewall_references {
my @fw_refs = ();
return @fw_refs if !$self->exists();
my $config = new Vyatta::Config;
- foreach my $tree ('name', 'modify') {
+ foreach my $tree ('name', 'ipv6-name', 'modify') {
my $path = "firewall $tree ";
$config->setLevel($path);
my @names = $config->$lfunc();
diff --git a/scripts/firewall/firewall.init.in b/scripts/firewall/firewall.init.in
index 30614bf..98ed54a 100644
--- a/scripts/firewall/firewall.init.in
+++ b/scripts/firewall/firewall.init.in
@@ -62,9 +62,9 @@ start () {
# user space helpers chain, enables helpers using iptables --helper.
# FTP, sip and h323 to use this chain later on.
iptables -t raw -N VYATTA_CT_HELPER
- /usr/sbin/nfct add helper rpc inet tcp
- /usr/sbin/nfct add helper rpc inet udp
- /usr/sbin/nfct add helper tns inet tcp
+ /usr/sbin/nfct helper add rpc inet tcp
+ /usr/sbin/nfct helper add rpc inet udp
+ /usr/sbin/nfct helper add tns inet tcp
iptables -t raw -I VYATTA_CT_HELPER -p tcp --dport 111 -j CT --helper rpc
iptables -t raw -I VYATTA_CT_HELPER -p udp --dport 111 -j CT --helper rpc
iptables -t raw -I VYATTA_CT_HELPER -p tcp --dport 1521 -j CT --helper tns
diff --git a/scripts/firewall/vyatta-firewall-trap.pl b/scripts/firewall/vyatta-firewall-trap.pl
index 5a19f7d..159feea 100755
--- a/scripts/firewall/vyatta-firewall-trap.pl
+++ b/scripts/firewall/vyatta-firewall-trap.pl
@@ -280,7 +280,7 @@ my $config = new Vyatta::Config;
exit 0 if ! is_trap_enabled($config);
# Detect system startup (i.e., no snmpd running) and just exit.
-my $snmpd_service = `/usr/sbin/invoke-rc.d snmpd status 2> /dev/null`;
+my $snmpd_service = `systemctl status snmpd.service 2> /dev/null`;
exit 0 if (! $snmpd_service =~ m/snmpd is running/);
# If no trap-targets configured just exit.
diff --git a/scripts/firewall/vyatta-firewall.pl b/scripts/firewall/vyatta-firewall.pl
index c2727cc..f770719 100755
--- a/scripts/firewall/vyatta-firewall.pl
+++ b/scripts/firewall/vyatta-firewall.pl
@@ -553,12 +553,6 @@ sub update_rules {
Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: $err_str\n");
exit 1;
}
- } elsif ("$test_rule_hash{$test_rule}" eq 'deleted') {
- if (Vyatta::IpTables::Mgr::chain_referenced($table, $name, $iptables_cmd)) {
- # Disallow deleting a chain if it's still referenced
- Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: Cannot delete rule set \"$name\" (still in use)\n");
- exit 1;
- }
}
}
diff --git a/scripts/firewall/vyatta-ipset.pl b/scripts/firewall/vyatta-ipset.pl
index 1fa432b..0b7b365 100755
--- a/scripts/firewall/vyatta-ipset.pl
+++ b/scripts/firewall/vyatta-ipset.pl
@@ -67,9 +67,9 @@ sub ipset_reset {
}
sub ipset_create {
- my ($set_name, $set_type) = @_;
+ my ($set_name, $set_type, $set_family) = @_;
- my $group = new Vyatta::IpTables::IpSet($set_name, $set_type);
+ my $group = new Vyatta::IpTables::IpSet($set_name, $set_type, $set_family);
return $group->create();
}
@@ -235,11 +235,30 @@ sub ipset_is_group_used {
exit 1;
}
+sub ipset_is_group_defined {
+ my ($set_name, $set_type, $set_family) = @_;
+ my $cfg = new Vyatta::Config;
+
+ die "Error: undefined set_name\n" if ! defined $set_name;
+ die "Error: undefined set_type\n" if ! defined $set_type;
+ die "Error: undefined set_family\n" if ! defined $set_family;
+
+ my $gpath = ($set_family eq 'inet') ? "firewall group ipv6-$set_type-group" : "firewall group $set_type-group";
+ my @groups = $cfg->listOrigNodes($gpath);
+ my $group;
+ foreach $group (@groups) {
+ if ($set_name eq $group) {
+ exit 1;
+ }
+ }
+ exit 0;
+}
+
sub update_set {
- my ($set_name, $set_type) = @_;
+ my ($set_name, $set_type, $set_family) = @_;
my $cfg = new Vyatta::Config;
my ($rc, $newset);
- my $cpath = "firewall group $set_type-group $set_name";
+ my $cpath = ($set_family eq 'inet') ? "firewall group $set_type-group $set_name" : "firewall group ipv6-$set_type-group $set_name";
if ($cfg->existsOrig($cpath)) {
if (!$cfg->exists($cpath)) {
# deleted
@@ -249,7 +268,7 @@ sub update_set {
} else {
if ($cfg->exists($cpath)) {
# added
- return $rc if (($rc = ipset_create($set_name, $set_type)));
+ return $rc if (($rc = ipset_create($set_name, $set_type, $set_family)));
$newset = 1;
} else {
# doesn't exist! should not happen
@@ -322,7 +341,8 @@ sub prune_deleted_sets {
# only try groups with no references
if ($group->exists() && ($group->references() == 0)) {
my $type = $group->get_type();
- $cfg->setLevel("firewall group $type-group");
+ my $family = $group->get_family();
+ ($family eq 'inet') ? $cfg->setLevel("firewall group $type-group") : $cfg->setLevel("firewall group ipv6-$type-group");
next if ($cfg->isEffective($set)); # don't prune if still in config
my $rc;
$rc = ipset_delete($set);
@@ -358,11 +378,12 @@ sub show_port_groups {
#
# main
#
-my ($action, $set_name, $set_type, $member, $set_copy, $alias);
+my ($action, $set_name, $set_type, $set_family, $member, $set_copy, $alias);
GetOptions("action=s" => \$action,
"set-name=s" => \$set_name,
"set-type=s" => \$set_type,
+ "set-family=s" => \$set_family,
"member=s" => \$member,
"alias=s" => \$alias,
"set-copy=s" => \$set_copy,
@@ -377,7 +398,7 @@ show_network_groups() if $action eq 'show-network-groups';
$rc = ipset_reset($set_name, $set_type) if $action eq 'reset-set';
-$rc = ipset_create($set_name, $set_type) if $action eq 'create-set';
+$rc = ipset_create($set_name, $set_type, $set_family) if $action eq 'create-set';
$rc = ipset_delete($set_name) if $action eq 'delete-set';
@@ -399,8 +420,9 @@ $rc = ipset_is_group_deleted($set_name, $set_type)
if $action eq 'is-group-deleted';
$rc = ipset_is_group_used($set_name, $set_type) if $action eq 'is-group-used';
+$rc = ipset_is_group_defined($set_name, $set_type, $set_family) if $action eq 'is-group-defined';
-$rc = update_set($set_name, $set_type) if $action eq 'update-set';
+$rc = update_set($set_name, $set_type, $set_family) if $action eq 'update-set';
$rc = prune_deleted_sets() if $action eq 'prune-deleted-sets';
if (defined $rc) {
diff --git a/templates/firewall/group/address-group/node.def b/templates/firewall/group/address-group/node.def
index 13b2e72..d89233d 100644
--- a/templates/firewall/group/address-group/node.def
+++ b/templates/firewall/group/address-group/node.def
@@ -15,7 +15,11 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \
syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
"Firewall group name cannot contain shell punctuation"
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+ --set-type=address --set-family=inet"; \
+ "Firewall group name already used as Ipv6 group address"
+
end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
- --set-name="$VAR(@)" --set-type=address; then
+ --set-name="$VAR(@)" --set-type=address --set-family=inet; then
${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group address-group $VAR(@)"
fi
diff --git a/templates/firewall/group/ipv6-address-group/node.def b/templates/firewall/group/ipv6-address-group/node.def
new file mode 100644
index 0000000..20e4430
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.def
@@ -0,0 +1,25 @@
+tag:
+priority: 200
+type: txt
+help: Firewall ipv6-address-group
+
+syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \
+ "Firewall group name must be 31 characters or less"
+
+syntax:expression: pattern $VAR(@) "^[^-]" ; \
+ "Firewall group name cannot start with \"-\""
+
+syntax:expression: pattern $VAR(@) "^[^!]" ; \
+ "Firewall group name cannot start with \"!\""
+
+syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
+ "Firewall group name cannot contain shell punctuation"
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+ --set-type=address --set-family=inet6"; \
+ "Firewall group name already used as Ipv4 group address"
+
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+ --set-name="$VAR(@)" --set-type=address --set-family=inet6; then
+ ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-address-group $VAR(@)"
+ fi
diff --git a/templates/firewall/group/ipv6-address-group/node.tag/address/node.def b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def
new file mode 100644
index 0000000..5bd948b
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def
@@ -0,0 +1,9 @@
+multi:
+type: txt
+help: Address-group member
+val_help: ipv6; IPv6 address to match
+
+syntax:expression: pattern $VAR(@) "^[^|;&$<>/]*$" ; \
+ "Error [$VAR(@)] isn't valid IPv6 host address"
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)"
diff --git a/templates/firewall/group/ipv6-address-group/node.tag/description/node.def b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def
new file mode 100644
index 0000000..f630483
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def
@@ -0,0 +1,2 @@
+type: txt
+help: IPv6 Address-group description \ No newline at end of file
diff --git a/templates/firewall/group/ipv6-network-group/node.def b/templates/firewall/group/ipv6-network-group/node.def
new file mode 100644
index 0000000..084fdb0
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.def
@@ -0,0 +1,25 @@
+tag:
+priority: 200
+type: txt
+help: Firewall ipv6-network-group
+
+syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \
+ "Firewall group name must be 31 characters or less"
+
+syntax:expression: pattern $VAR(@) "^[^-]" ; \
+ "Firewall group name cannot start with \"-\""
+
+syntax:expression: pattern $VAR(@) "^[^!]" ; \
+ "Firewall group name cannot start with \"!\""
+
+syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
+ "Firewall group name cannot contain shell punctuation"
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+ --set-type=network --set-family=inet6"; \
+ "Firewall group name already used as Ipv4 group address"
+
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+ --set-name="$VAR(@)" --set-type=network --set-family=inet6; then
+ ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-network-group $VAR(@)"
+ fi
diff --git a/templates/firewall/group/ipv6-network-group/node.tag/description/node.def b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def
new file mode 100644
index 0000000..cc905df
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def
@@ -0,0 +1,2 @@
+type: txt
+help: IPv6-network-group description
diff --git a/templates/firewall/group/ipv6-network-group/node.tag/network/node.def b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def
new file mode 100644
index 0000000..879a164
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def
@@ -0,0 +1,8 @@
+multi:
+type: ipv6net
+help: Network-group member
+val_help: ipv6net; IPv6 Subnet to match
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)"
+
+syntax:expression: exec "/opt/vyatta/sbin/check_prefix_boundary $VAR(@)"
diff --git a/templates/firewall/group/network-group/node.def b/templates/firewall/group/network-group/node.def
index 263a772..14b8366 100644
--- a/templates/firewall/group/network-group/node.def
+++ b/templates/firewall/group/network-group/node.def
@@ -15,8 +15,12 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \
syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
"Firewall group name cannot contain shell punctuation"
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+ --set-type=network --set-family=inet"; \
+ "Firewall group name already used as Ipv6 group address"
+
end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
- --set-name="$VAR(@)" --set-type=network; then
+ --set-name="$VAR(@)" --set-type=network --set-family=inet; then
${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group network-group $VAR(@)"
fi
diff --git a/templates/firewall/group/port-group/node.def b/templates/firewall/group/port-group/node.def
index 1484be2..729165f 100644
--- a/templates/firewall/group/port-group/node.def
+++ b/templates/firewall/group/port-group/node.def
@@ -16,6 +16,6 @@ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
"Firewall group name cannot contain shell punctuation"
end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
- --set-name="$VAR(@)" --set-type=port; then
+ --set-name="$VAR(@)" --set-type=port --set-family=inet; then
${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group port-group $VAR(@)"
fi
diff --git a/templates/firewall/ipv6-name/node.def b/templates/firewall/ipv6-name/node.def
index e7e1167..2e20b9a 100644
--- a/templates/firewall/ipv6-name/node.def
+++ b/templates/firewall/ipv6-name/node.def
@@ -14,17 +14,21 @@ syntax:expression: ! pattern $VAR(@) "^VZONE" ; \
end: if sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-rules "firewall ipv6-name" "$VAR(@)" ;
then
- if [ ${COMMIT_ACTION} = 'DELETE' ] ;
+ if [ ${COMMIT_ACTION} = 'DELETE' ] ;
then
if sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown-ok "firewall ipv6-name" ;
then
- sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown "firewall ipv6-name"
+ if sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown "firewall ipv6-name"; then
+ ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)"
+ fi
fi
+ else
+ ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)"
fi
else
exit 1;
fi
- ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)"
+ sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=prune-deleted-sets
create: sudo /opt/vyatta/sbin/vyatta-firewall.pl --setup ip6tables "firewall ipv6-name"
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def
new file mode 100644
index 0000000..961663c
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def
@@ -0,0 +1,9 @@
+type: txt
+help: Group of addresses
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+ --action=check-set-type \
+ --set-name=$VAR(@) \
+ --set-type=address;"
+
+allowed: cli-shell-api listNodes firewall group ipv6-address-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def
new file mode 100644
index 0000000..262c4dd
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of networks
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+ --action=check-set-type \
+ --set-name=$VAR(@) \
+ --set-type=network;"
+allowed: cli-shell-api listNodes firewall group ipv6-network-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def
new file mode 100644
index 0000000..bb11dae
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def
@@ -0,0 +1 @@
+help: Destination group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def
new file mode 100644
index 0000000..985302b
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of ports
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+ --action=check-set-type \
+ --set-name=$VAR(@) \
+ --set-type=port;"
+allowed: cli-shell-api listNodes firewall group port-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def
new file mode 100644
index 0000000..9323938
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of addresses
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+ --action=check-set-type \
+ --set-name=$VAR(@) \
+ --set-type=address;"
+allowed: cli-shell-api listNodes firewall group ipv6-address-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def
new file mode 100644
index 0000000..262c4dd
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of networks
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+ --action=check-set-type \
+ --set-name=$VAR(@) \
+ --set-type=network;"
+allowed: cli-shell-api listNodes firewall group ipv6-network-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def
new file mode 100644
index 0000000..7b36071
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def
@@ -0,0 +1 @@
+help: Source group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def
new file mode 100644
index 0000000..985302b
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of ports
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+ --action=check-set-type \
+ --set-name=$VAR(@) \
+ --set-type=port;"
+allowed: cli-shell-api listNodes firewall group port-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def
index 07e791c..272149b 100644
--- a/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def
@@ -6,4 +6,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
--set-name=$VAR(@) \
--set-type=address;"
-allowed: cli-shell-api listActiveNodes firewall group address-group
+allowed: cli-shell-api listNodes firewall group address-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def
index bf018a0..54604da 100644
--- a/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
--action=check-set-type \
--set-name=$VAR(@) \
--set-type=network;"
-allowed: cli-shell-api listActiveNodes firewall group network-group
+allowed: cli-shell-api listNodes firewall group network-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def
index 865d2c5..985302b 100644
--- a/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
--action=check-set-type \
--set-name=$VAR(@) \
--set-type=port;"
-allowed: cli-shell-api listActiveNodes firewall group port-group
+allowed: cli-shell-api listNodes firewall group port-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/set/table/node.def b/templates/policy/route/node.tag/rule/node.tag/set/table/node.def
index bb97649..632ed54 100644
--- a/templates/policy/route/node.tag/rule/node.tag/set/table/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/set/table/node.def
@@ -2,6 +2,7 @@ type: txt
help: Routing table to forward packet with
val_help: u32:1-200 ; Table number
val_help: main ; Main table
+allowed: echo main `cli-shell-api listNodes protocols static table`
syntax:expression: exec "
if [[ $VAR(@) =~ ^-?[0-9]+$ ]] ; then
if [ $VAR(@) -lt 1 -o $VAR(@) -gt 200 ] ; then
diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def
index 97c748d..8506b28 100644
--- a/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
--action=check-set-type \
--set-name=$VAR(@) \
--set-type=address;"
-allowed: cli-shell-api listActiveNodes firewall group address-group
+allowed: cli-shell-api listNodes firewall group address-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def
index bf018a0..54604da 100644
--- a/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
--action=check-set-type \
--set-name=$VAR(@) \
--set-type=network;"
-allowed: cli-shell-api listActiveNodes firewall group network-group
+allowed: cli-shell-api listNodes firewall group network-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def
index 865d2c5..985302b 100644
--- a/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
--action=check-set-type \
--set-name=$VAR(@) \
--set-type=port;"
-allowed: cli-shell-api listActiveNodes firewall group port-group
+allowed: cli-shell-api listNodes firewall group port-group