diff options
34 files changed, 247 insertions, 73 deletions
diff --git a/debian/changelog b/debian/changelog index c51a0ce..c0b54d9 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,18 @@ -vyatta-cfg-firewall (0.14.0+vyos2+lithium17) unstable; urgency=low +vyatta-cfg-firewall (0.14.0+vyos2+lithium17) UNRELEASED; urgency=medium - * Remove dead code from the IPset module. + * Sync with current. - -- Daniil Baturin <daniil@baturin.org> Tue, 22 Dec 2015 21:38:37 +0100 + -- Daniil Baturin <daniil@baturin.org> Sun, 24 Jun 2018 12:31:12 +0200 + +vyatta-cfg-firewall (0.14.0+vyos2+current1) unstable; urgency=medium + + [ Thomas Jepp ] + * Fix build depends. + * Fix runtime depends. + + [ Kim Hagen ] + + -- Kim Hagen <kim.sidney@gmail.com> Sun, 24 Jan 2016 15:00:40 -0500 vyatta-cfg-firewall (0.14.0+vyos2+lithium16) unstable; urgency=low diff --git a/debian/control b/debian/control index 335bd13..7e6cadd 100644 --- a/debian/control +++ b/debian/control @@ -2,7 +2,7 @@ Source: vyatta-cfg-firewall Section: contrib/net Priority: extra Maintainer: VyOS Package Maintainers <maintainers@vyos.net> -Build-Depends: debhelper (>= 5), autotools-dev +Build-Depends: debhelper (>= 5), autotools-dev, autoconf, automake, cpio Standards-Version: 3.9.1 Package: vyatta-cfg-firewall @@ -23,7 +23,9 @@ Depends: sed (>= 4.1.5), sudo, snmpd, ipset, - iptables + iptables, + libswitch-perl, + libsnmp-perl Replaces: vyatta-cfg-system, vyatta-openvpn, vyatta-wirelessmodem diff --git a/gen-interface-policy-templates.pl b/gen-interface-policy-templates.pl index afea8cf..a86c5d6 100755 --- a/gen-interface-policy-templates.pl +++ b/gen-interface-policy-templates.pl @@ -107,16 +107,12 @@ sub gen_firewall_template { # my %table_help_hash = ( "route" => "IPv4 policy route", - "local-route" => "IPv4 policy route of local traffic", "ipv6-route" => "IPv6 policy route", - "ipv6-local-route" => "IPv6 policy route of local traffic", ); my %config_association_hash = ( "route" => "\"policy route\"", - "local-route" => "\"policy local-route\"", "ipv6-route" => "\"policy ipv6-route\"", - "ipv6-local-route" => "\"policy ipv6-local-route\"", ); # Generate the template file at the leaf of the per-interface firewall tree. @@ -124,10 +120,10 @@ my %config_association_hash = ( # ruleset on an interface for a particular ruleset type and direction. # sub gen_template { - my ( $if_tree, $direction, $table, $if_name ) = @_; + my ( $if_tree, $table, $if_name ) = @_; if ($debug) { - print "debug: table=$table direction=$direction\n"; + print "debug: table=$table\n"; } my $template_dir = @@ -151,16 +147,16 @@ allowed: local -a params echo -n "\${params[@]}" create: ifname=$if_name sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\ - update \$ifname $direction \$VAR(@) $config_association_hash{$table} + update \$ifname in \$VAR(@) $config_association_hash{$table} update: ifname=$if_name sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\ - update \$ifname $direction \$VAR(@) $config_association_hash{$table} + update \$ifname in \$VAR(@) $config_association_hash{$table} delete: ifname=$if_name sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\ - delete \$ifname $direction \$VAR(@) $config_association_hash{$table} + delete \$ifname in \$VAR(@) $config_association_hash{$table} EOF close $tp @@ -177,10 +173,8 @@ foreach my $if_tree ( keys %interface_hash ) { } gen_firewall_template($if_tree); - gen_template( $if_tree, "in", "route", $if_name ); - gen_template( $if_tree, "out", "local-route", $if_name ); - gen_template( $if_tree, "in", "ipv6-route", $if_name ); - gen_template( $if_tree, "out", "ipv6-local-route", $if_name ); + gen_template( $if_tree, "route", $if_name ); + gen_template( $if_tree, "ipv6-route", $if_name ); } print "Done.\n"; diff --git a/lib/Vyatta/IpTables/AddressFilter.pm b/lib/Vyatta/IpTables/AddressFilter.pm index 9100c24..9b3be53 100755 --- a/lib/Vyatta/IpTables/AddressFilter.pm +++ b/lib/Vyatta/IpTables/AddressFilter.pm @@ -238,31 +238,25 @@ sub rule { my ($port_str, $port_err)= getPortRuleString($self->{_port}, $can_use_port,($self->{_srcdst} eq "source") ? "s" : "d",$self->{_protocol}); return (undef, $port_err) if (!defined($port_str)); $rule .= $port_str; - # Handle groups last so we can check $group_ok - if ($self->{_ip_version} eq "ipv4") { - - # so far ipset only supports IPv4 - my %group_used = ('address' => 0, 'network' => 0); - foreach my $group_type ('address', 'network', 'port') { - my $var_name = '_' . $group_type . '_group'; - if (defined($self->{$var_name})) { - $group_used{$group_type} = 1; - my $name = $self->{$var_name}; - if (!$group_ok{$group_type}) { - return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type"); - } - my $group = new Vyatta::IpTables::IpSet($name, $group_type); - my ($set_rule, $err_str) = $group->rule($self->{_srcdst}); - return ($err_str,) if !defined $set_rule; - $rule .= $set_rule; + my %group_used = ('address' => 0, 'network' => 0); + foreach my $group_type ('address', 'network', 'port') { + my $var_name = '_' . $group_type . '_group'; + if (defined($self->{$var_name})) { + $group_used{$group_type} = 1; + my $name = $self->{$var_name}; + if (!$group_ok{$group_type}) { + return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type"); } - } - if ($group_used{address} and $group_used{network}) { - return (undef,"Can't combine network and address group for $self->{_srcdst}\n"); + my $group = new Vyatta::IpTables::IpSet($name, $group_type); + my ($set_rule, $err_str) = $group->rule($self->{_srcdst}); + return ($err_str,) if !defined $set_rule; + $rule .= $set_rule; } } - + if ($group_used{address} and $group_used{network}) { + return (undef,"Can't combine network and address group for $self->{_srcdst}\n"); + } return ($rule, undef); } diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm index d6a1d31..dafdf4b 100755 --- a/lib/Vyatta/IpTables/IpSet.pm +++ b/lib/Vyatta/IpTables/IpSet.pm @@ -35,6 +35,7 @@ use warnings; my %fields = ( _name => undef, _type => undef, # vyatta group type, not ipset type + _family => undef, _exists => undef, _negate => undef, _debug => undef, @@ -66,7 +67,7 @@ sub INT_handler { $SIG{'INT'} = 'INT_handler'; sub new { - my ($that, $name, $type) = @_; + my ($that, $name, $type, $family) = @_; my $class = ref($that) || $that; my $self = {%fields,}; @@ -76,6 +77,7 @@ sub new { } $self->{_name} = $name; $self->{_type} = $type; + $self->{_family} = $family; bless $self, $class; return $self; @@ -136,6 +138,25 @@ sub get_type { return $self->{_type}; } +sub get_family { + my ($self) = @_; + return $self->{_family} if defined $self->{_family}; + return if !$self->exists(); + my @lines = `ipset -L $self->{_name}`; + my $family; + foreach my $line (@lines) { + if ($line =~ /^Header: family (\w+) hashsize/) { + $family = $1; + $self->{_family} = $family; + last; + } elsif ($line =~ /^Type: bitmap:port$/){ + $self->{_family} = "inet"; + last; + } + } + return $self->{_family}; +} + sub alphanum_split { my ($str) = @_; my @list = split m/(?=(?<=\D)\d|(?<=\d)\D)/, $str; @@ -189,11 +210,13 @@ sub create { my $ipset_param = $grouptype_hash{$self->{_type}}; return "Error: invalid group type\n" if !defined $ipset_param; + my $cmd = "ipset -N $self->{_name} $ipset_param family $self->{_family}"; + if ($self->{_type} eq 'port') { $ipset_param .= ' --from 1 --to 65535'; + $cmd = "ipset -N $self->{_name} $ipset_param"; } - my $cmd = "ipset -N $self->{_name} $ipset_param"; my $rc = $self->run_cmd($cmd); return "Error: call to ipset failed [$rc]" if $rc; return; # undef @@ -398,7 +421,7 @@ sub get_firewall_references { my @fw_refs = (); return @fw_refs if !$self->exists(); my $config = new Vyatta::Config; - foreach my $tree ('name', 'modify') { + foreach my $tree ('name', 'ipv6-name', 'modify') { my $path = "firewall $tree "; $config->setLevel($path); my @names = $config->$lfunc(); diff --git a/scripts/firewall/firewall.init.in b/scripts/firewall/firewall.init.in index 30614bf..98ed54a 100644 --- a/scripts/firewall/firewall.init.in +++ b/scripts/firewall/firewall.init.in @@ -62,9 +62,9 @@ start () { # user space helpers chain, enables helpers using iptables --helper. # FTP, sip and h323 to use this chain later on. iptables -t raw -N VYATTA_CT_HELPER - /usr/sbin/nfct add helper rpc inet tcp - /usr/sbin/nfct add helper rpc inet udp - /usr/sbin/nfct add helper tns inet tcp + /usr/sbin/nfct helper add rpc inet tcp + /usr/sbin/nfct helper add rpc inet udp + /usr/sbin/nfct helper add tns inet tcp iptables -t raw -I VYATTA_CT_HELPER -p tcp --dport 111 -j CT --helper rpc iptables -t raw -I VYATTA_CT_HELPER -p udp --dport 111 -j CT --helper rpc iptables -t raw -I VYATTA_CT_HELPER -p tcp --dport 1521 -j CT --helper tns diff --git a/scripts/firewall/vyatta-firewall-trap.pl b/scripts/firewall/vyatta-firewall-trap.pl index 5a19f7d..159feea 100755 --- a/scripts/firewall/vyatta-firewall-trap.pl +++ b/scripts/firewall/vyatta-firewall-trap.pl @@ -280,7 +280,7 @@ my $config = new Vyatta::Config; exit 0 if ! is_trap_enabled($config); # Detect system startup (i.e., no snmpd running) and just exit. -my $snmpd_service = `/usr/sbin/invoke-rc.d snmpd status 2> /dev/null`; +my $snmpd_service = `systemctl status snmpd.service 2> /dev/null`; exit 0 if (! $snmpd_service =~ m/snmpd is running/); # If no trap-targets configured just exit. diff --git a/scripts/firewall/vyatta-firewall.pl b/scripts/firewall/vyatta-firewall.pl index c2727cc..f770719 100755 --- a/scripts/firewall/vyatta-firewall.pl +++ b/scripts/firewall/vyatta-firewall.pl @@ -553,12 +553,6 @@ sub update_rules { Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: $err_str\n"); exit 1; } - } elsif ("$test_rule_hash{$test_rule}" eq 'deleted') { - if (Vyatta::IpTables::Mgr::chain_referenced($table, $name, $iptables_cmd)) { - # Disallow deleting a chain if it's still referenced - Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: Cannot delete rule set \"$name\" (still in use)\n"); - exit 1; - } } } diff --git a/scripts/firewall/vyatta-ipset.pl b/scripts/firewall/vyatta-ipset.pl index 1fa432b..0b7b365 100755 --- a/scripts/firewall/vyatta-ipset.pl +++ b/scripts/firewall/vyatta-ipset.pl @@ -67,9 +67,9 @@ sub ipset_reset { } sub ipset_create { - my ($set_name, $set_type) = @_; + my ($set_name, $set_type, $set_family) = @_; - my $group = new Vyatta::IpTables::IpSet($set_name, $set_type); + my $group = new Vyatta::IpTables::IpSet($set_name, $set_type, $set_family); return $group->create(); } @@ -235,11 +235,30 @@ sub ipset_is_group_used { exit 1; } +sub ipset_is_group_defined { + my ($set_name, $set_type, $set_family) = @_; + my $cfg = new Vyatta::Config; + + die "Error: undefined set_name\n" if ! defined $set_name; + die "Error: undefined set_type\n" if ! defined $set_type; + die "Error: undefined set_family\n" if ! defined $set_family; + + my $gpath = ($set_family eq 'inet') ? "firewall group ipv6-$set_type-group" : "firewall group $set_type-group"; + my @groups = $cfg->listOrigNodes($gpath); + my $group; + foreach $group (@groups) { + if ($set_name eq $group) { + exit 1; + } + } + exit 0; +} + sub update_set { - my ($set_name, $set_type) = @_; + my ($set_name, $set_type, $set_family) = @_; my $cfg = new Vyatta::Config; my ($rc, $newset); - my $cpath = "firewall group $set_type-group $set_name"; + my $cpath = ($set_family eq 'inet') ? "firewall group $set_type-group $set_name" : "firewall group ipv6-$set_type-group $set_name"; if ($cfg->existsOrig($cpath)) { if (!$cfg->exists($cpath)) { # deleted @@ -249,7 +268,7 @@ sub update_set { } else { if ($cfg->exists($cpath)) { # added - return $rc if (($rc = ipset_create($set_name, $set_type))); + return $rc if (($rc = ipset_create($set_name, $set_type, $set_family))); $newset = 1; } else { # doesn't exist! should not happen @@ -322,7 +341,8 @@ sub prune_deleted_sets { # only try groups with no references if ($group->exists() && ($group->references() == 0)) { my $type = $group->get_type(); - $cfg->setLevel("firewall group $type-group"); + my $family = $group->get_family(); + ($family eq 'inet') ? $cfg->setLevel("firewall group $type-group") : $cfg->setLevel("firewall group ipv6-$type-group"); next if ($cfg->isEffective($set)); # don't prune if still in config my $rc; $rc = ipset_delete($set); @@ -358,11 +378,12 @@ sub show_port_groups { # # main # -my ($action, $set_name, $set_type, $member, $set_copy, $alias); +my ($action, $set_name, $set_type, $set_family, $member, $set_copy, $alias); GetOptions("action=s" => \$action, "set-name=s" => \$set_name, "set-type=s" => \$set_type, + "set-family=s" => \$set_family, "member=s" => \$member, "alias=s" => \$alias, "set-copy=s" => \$set_copy, @@ -377,7 +398,7 @@ show_network_groups() if $action eq 'show-network-groups'; $rc = ipset_reset($set_name, $set_type) if $action eq 'reset-set'; -$rc = ipset_create($set_name, $set_type) if $action eq 'create-set'; +$rc = ipset_create($set_name, $set_type, $set_family) if $action eq 'create-set'; $rc = ipset_delete($set_name) if $action eq 'delete-set'; @@ -399,8 +420,9 @@ $rc = ipset_is_group_deleted($set_name, $set_type) if $action eq 'is-group-deleted'; $rc = ipset_is_group_used($set_name, $set_type) if $action eq 'is-group-used'; +$rc = ipset_is_group_defined($set_name, $set_type, $set_family) if $action eq 'is-group-defined'; -$rc = update_set($set_name, $set_type) if $action eq 'update-set'; +$rc = update_set($set_name, $set_type, $set_family) if $action eq 'update-set'; $rc = prune_deleted_sets() if $action eq 'prune-deleted-sets'; if (defined $rc) { diff --git a/templates/firewall/group/address-group/node.def b/templates/firewall/group/address-group/node.def index 13b2e72..d89233d 100644 --- a/templates/firewall/group/address-group/node.def +++ b/templates/firewall/group/address-group/node.def @@ -15,7 +15,11 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ "Firewall group name cannot contain shell punctuation" +syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ + --set-type=address --set-family=inet"; \ + "Firewall group name already used as Ipv6 group address" + end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ - --set-name="$VAR(@)" --set-type=address; then + --set-name="$VAR(@)" --set-type=address --set-family=inet; then ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group address-group $VAR(@)" fi diff --git a/templates/firewall/group/ipv6-address-group/node.def b/templates/firewall/group/ipv6-address-group/node.def new file mode 100644 index 0000000..20e4430 --- /dev/null +++ b/templates/firewall/group/ipv6-address-group/node.def @@ -0,0 +1,25 @@ +tag: +priority: 200 +type: txt +help: Firewall ipv6-address-group + +syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \ + "Firewall group name must be 31 characters or less" + +syntax:expression: pattern $VAR(@) "^[^-]" ; \ + "Firewall group name cannot start with \"-\"" + +syntax:expression: pattern $VAR(@) "^[^!]" ; \ + "Firewall group name cannot start with \"!\"" + +syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ + "Firewall group name cannot contain shell punctuation" + +syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ + --set-type=address --set-family=inet6"; \ + "Firewall group name already used as Ipv4 group address" + +end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ + --set-name="$VAR(@)" --set-type=address --set-family=inet6; then + ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-address-group $VAR(@)" + fi diff --git a/templates/firewall/group/ipv6-address-group/node.tag/address/node.def b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def new file mode 100644 index 0000000..5bd948b --- /dev/null +++ b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def @@ -0,0 +1,9 @@ +multi: +type: txt +help: Address-group member +val_help: ipv6; IPv6 address to match + +syntax:expression: pattern $VAR(@) "^[^|;&$<>/]*$" ; \ + "Error [$VAR(@)] isn't valid IPv6 host address" + +syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)" diff --git a/templates/firewall/group/ipv6-address-group/node.tag/description/node.def b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def new file mode 100644 index 0000000..f630483 --- /dev/null +++ b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def @@ -0,0 +1,2 @@ +type: txt +help: IPv6 Address-group description
\ No newline at end of file diff --git a/templates/firewall/group/ipv6-network-group/node.def b/templates/firewall/group/ipv6-network-group/node.def new file mode 100644 index 0000000..084fdb0 --- /dev/null +++ b/templates/firewall/group/ipv6-network-group/node.def @@ -0,0 +1,25 @@ +tag: +priority: 200 +type: txt +help: Firewall ipv6-network-group + +syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \ + "Firewall group name must be 31 characters or less" + +syntax:expression: pattern $VAR(@) "^[^-]" ; \ + "Firewall group name cannot start with \"-\"" + +syntax:expression: pattern $VAR(@) "^[^!]" ; \ + "Firewall group name cannot start with \"!\"" + +syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ + "Firewall group name cannot contain shell punctuation" + +syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ + --set-type=network --set-family=inet6"; \ + "Firewall group name already used as Ipv4 group address" + +end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ + --set-name="$VAR(@)" --set-type=network --set-family=inet6; then + ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-network-group $VAR(@)" + fi diff --git a/templates/firewall/group/ipv6-network-group/node.tag/description/node.def b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def new file mode 100644 index 0000000..cc905df --- /dev/null +++ b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def @@ -0,0 +1,2 @@ +type: txt +help: IPv6-network-group description diff --git a/templates/firewall/group/ipv6-network-group/node.tag/network/node.def b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def new file mode 100644 index 0000000..879a164 --- /dev/null +++ b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def @@ -0,0 +1,8 @@ +multi: +type: ipv6net +help: Network-group member +val_help: ipv6net; IPv6 Subnet to match + +syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)" + +syntax:expression: exec "/opt/vyatta/sbin/check_prefix_boundary $VAR(@)" diff --git a/templates/firewall/group/network-group/node.def b/templates/firewall/group/network-group/node.def index 263a772..14b8366 100644 --- a/templates/firewall/group/network-group/node.def +++ b/templates/firewall/group/network-group/node.def @@ -15,8 +15,12 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ "Firewall group name cannot contain shell punctuation" +syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ + --set-type=network --set-family=inet"; \ + "Firewall group name already used as Ipv6 group address" + end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ - --set-name="$VAR(@)" --set-type=network; then + --set-name="$VAR(@)" --set-type=network --set-family=inet; then ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group network-group $VAR(@)" fi diff --git a/templates/firewall/group/port-group/node.def b/templates/firewall/group/port-group/node.def index 1484be2..729165f 100644 --- a/templates/firewall/group/port-group/node.def +++ b/templates/firewall/group/port-group/node.def @@ -16,6 +16,6 @@ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ "Firewall group name cannot contain shell punctuation" end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ - --set-name="$VAR(@)" --set-type=port; then + --set-name="$VAR(@)" --set-type=port --set-family=inet; then ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group port-group $VAR(@)" fi diff --git a/templates/firewall/ipv6-name/node.def b/templates/firewall/ipv6-name/node.def index e7e1167..2e20b9a 100644 --- a/templates/firewall/ipv6-name/node.def +++ b/templates/firewall/ipv6-name/node.def @@ -14,17 +14,21 @@ syntax:expression: ! pattern $VAR(@) "^VZONE" ; \ end: if sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-rules "firewall ipv6-name" "$VAR(@)" ; then - if [ ${COMMIT_ACTION} = 'DELETE' ] ; + if [ ${COMMIT_ACTION} = 'DELETE' ] ; then if sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown-ok "firewall ipv6-name" ; then - sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown "firewall ipv6-name" + if sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown "firewall ipv6-name"; then + ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)" + fi fi + else + ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)" fi else exit 1; fi - ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)" + sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=prune-deleted-sets create: sudo /opt/vyatta/sbin/vyatta-firewall.pl --setup ip6tables "firewall ipv6-name" diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def new file mode 100644 index 0000000..961663c --- /dev/null +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def @@ -0,0 +1,9 @@ +type: txt +help: Group of addresses + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=address;" + +allowed: cli-shell-api listNodes firewall group ipv6-address-group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def new file mode 100644 index 0000000..262c4dd --- /dev/null +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of networks + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=network;" +allowed: cli-shell-api listNodes firewall group ipv6-network-group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def new file mode 100644 index 0000000..bb11dae --- /dev/null +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def @@ -0,0 +1 @@ +help: Destination group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def new file mode 100644 index 0000000..985302b --- /dev/null +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of ports + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=port;" +allowed: cli-shell-api listNodes firewall group port-group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def new file mode 100644 index 0000000..9323938 --- /dev/null +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of addresses + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=address;" +allowed: cli-shell-api listNodes firewall group ipv6-address-group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def new file mode 100644 index 0000000..262c4dd --- /dev/null +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of networks + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=network;" +allowed: cli-shell-api listNodes firewall group ipv6-network-group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def new file mode 100644 index 0000000..7b36071 --- /dev/null +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def @@ -0,0 +1 @@ +help: Source group diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def new file mode 100644 index 0000000..985302b --- /dev/null +++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of ports + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=port;" +allowed: cli-shell-api listNodes firewall group port-group diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def index 07e791c..272149b 100644 --- a/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def +++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def @@ -6,4 +6,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --set-name=$VAR(@) \ --set-type=address;" -allowed: cli-shell-api listActiveNodes firewall group address-group +allowed: cli-shell-api listNodes firewall group address-group diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def index bf018a0..54604da 100644 --- a/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def +++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def @@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --action=check-set-type \ --set-name=$VAR(@) \ --set-type=network;" -allowed: cli-shell-api listActiveNodes firewall group network-group +allowed: cli-shell-api listNodes firewall group network-group diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def index 865d2c5..985302b 100644 --- a/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def +++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def @@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --action=check-set-type \ --set-name=$VAR(@) \ --set-type=port;" -allowed: cli-shell-api listActiveNodes firewall group port-group +allowed: cli-shell-api listNodes firewall group port-group diff --git a/templates/policy/route/node.tag/rule/node.tag/set/table/node.def b/templates/policy/route/node.tag/rule/node.tag/set/table/node.def index bb97649..632ed54 100644 --- a/templates/policy/route/node.tag/rule/node.tag/set/table/node.def +++ b/templates/policy/route/node.tag/rule/node.tag/set/table/node.def @@ -2,6 +2,7 @@ type: txt help: Routing table to forward packet with val_help: u32:1-200 ; Table number val_help: main ; Main table +allowed: echo main `cli-shell-api listNodes protocols static table` syntax:expression: exec " if [[ $VAR(@) =~ ^-?[0-9]+$ ]] ; then if [ $VAR(@) -lt 1 -o $VAR(@) -gt 200 ] ; then diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def index 97c748d..8506b28 100644 --- a/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def +++ b/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def @@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --action=check-set-type \ --set-name=$VAR(@) \ --set-type=address;" -allowed: cli-shell-api listActiveNodes firewall group address-group +allowed: cli-shell-api listNodes firewall group address-group diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def index bf018a0..54604da 100644 --- a/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def +++ b/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def @@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --action=check-set-type \ --set-name=$VAR(@) \ --set-type=network;" -allowed: cli-shell-api listActiveNodes firewall group network-group +allowed: cli-shell-api listNodes firewall group network-group diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def index 865d2c5..985302b 100644 --- a/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def +++ b/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def @@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ --action=check-set-type \ --set-name=$VAR(@) \ --set-type=port;" -allowed: cli-shell-api listActiveNodes firewall group port-group +allowed: cli-shell-api listNodes firewall group port-group |