From 65410961b33a072addf91dce7879f6a734aa2187 Mon Sep 17 00:00:00 2001 From: Marian Tudosoiu Date: Wed, 14 Mar 2018 10:27:25 +0200 Subject: Task T35 change to place ipv6 address-groups and network groups under group config tree --- .../firewall/group/ipv6-address-group/node.def | 25 ++++++++++++++++++++++ .../ipv6-address-group/node.tag/address/node.def | 6 ++++++ .../node.tag/description/node.def | 2 ++ 3 files changed, 33 insertions(+) create mode 100644 templates/firewall/group/ipv6-address-group/node.def create mode 100644 templates/firewall/group/ipv6-address-group/node.tag/address/node.def create mode 100644 templates/firewall/group/ipv6-address-group/node.tag/description/node.def (limited to 'templates/firewall/group/ipv6-address-group') diff --git a/templates/firewall/group/ipv6-address-group/node.def b/templates/firewall/group/ipv6-address-group/node.def new file mode 100644 index 0000000..7ce50d2 --- /dev/null +++ b/templates/firewall/group/ipv6-address-group/node.def @@ -0,0 +1,25 @@ +tag: +priority: 200 +type: txt +help: Firewall address-group + +syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \ + "Firewall group name must be 31 characters or less" + +syntax:expression: pattern $VAR(@) "^[^-]" ; \ + "Firewall group name cannot start with \"-\"" + +syntax:expression: pattern $VAR(@) "^[^!]" ; \ + "Firewall group name cannot start with \"!\"" + +syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ + "Firewall group name cannot contain shell punctuation" + +syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ + --set-type=address --set-family=inet6"; \ + "Firewall group name already used as Ipv4 group address" + +end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ + --set-name="$VAR(@)" --set-type=address --set-family=inet6; then + ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-address-group $VAR(@)" + fi diff --git a/templates/firewall/group/ipv6-address-group/node.tag/address/node.def b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def new file mode 100644 index 0000000..ba944e6 --- /dev/null +++ b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def @@ -0,0 +1,6 @@ +multi: +type: txt +help: Address-group member +val_help: ipv6; IPv6 address to match + +syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)" diff --git a/templates/firewall/group/ipv6-address-group/node.tag/description/node.def b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def new file mode 100644 index 0000000..f630483 --- /dev/null +++ b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def @@ -0,0 +1,2 @@ +type: txt +help: IPv6 Address-group description \ No newline at end of file -- cgit v1.2.3 From 6a5ef5fbfa2d1f399bf3584710c5e1a7f9380b30 Mon Sep 17 00:00:00 2001 From: mtudosoiu Date: Wed, 14 Mar 2018 11:06:05 +0200 Subject: Task T35 place ipv6 groups under group config tree --- templates/firewall/group/ipv6-address-group/node.tag/address/node.def | 3 +++ 1 file changed, 3 insertions(+) (limited to 'templates/firewall/group/ipv6-address-group') diff --git a/templates/firewall/group/ipv6-address-group/node.tag/address/node.def b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def index ba944e6..5bd948b 100644 --- a/templates/firewall/group/ipv6-address-group/node.tag/address/node.def +++ b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def @@ -3,4 +3,7 @@ type: txt help: Address-group member val_help: ipv6; IPv6 address to match +syntax:expression: pattern $VAR(@) "^[^|;&$<>/]*$" ; \ + "Error [$VAR(@)] isn't valid IPv6 host address" + syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)" -- cgit v1.2.3 From 1d21300885e606ec9e8da2b9a9b7af898d896a24 Mon Sep 17 00:00:00 2001 From: Marian Tudosoiu Date: Wed, 14 Mar 2018 11:14:34 +0200 Subject: Task T35 place ipv6 groups under group config tree --- templates/firewall/group/ipv6-address-group/node.def | 2 +- templates/firewall/group/ipv6-network-group/node.def | 4 ++-- templates/firewall/group/network-group/node.def | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) (limited to 'templates/firewall/group/ipv6-address-group') diff --git a/templates/firewall/group/ipv6-address-group/node.def b/templates/firewall/group/ipv6-address-group/node.def index 7ce50d2..20e4430 100644 --- a/templates/firewall/group/ipv6-address-group/node.def +++ b/templates/firewall/group/ipv6-address-group/node.def @@ -1,7 +1,7 @@ tag: priority: 200 type: txt -help: Firewall address-group +help: Firewall ipv6-address-group syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \ "Firewall group name must be 31 characters or less" diff --git a/templates/firewall/group/ipv6-network-group/node.def b/templates/firewall/group/ipv6-network-group/node.def index 299b8cc..084fdb0 100644 --- a/templates/firewall/group/ipv6-network-group/node.def +++ b/templates/firewall/group/ipv6-network-group/node.def @@ -1,7 +1,7 @@ tag: priority: 200 type: txt -help: Firewall network-group +help: Firewall ipv6-network-group syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \ "Firewall group name must be 31 characters or less" @@ -17,7 +17,7 @@ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ --set-type=network --set-family=inet6"; \ - "Firewall group name already used as Ipv6 group address" + "Firewall group name already used as Ipv4 group address" end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ --set-name="$VAR(@)" --set-type=network --set-family=inet6; then diff --git a/templates/firewall/group/network-group/node.def b/templates/firewall/group/network-group/node.def index ed9810d..14b8366 100644 --- a/templates/firewall/group/network-group/node.def +++ b/templates/firewall/group/network-group/node.def @@ -16,7 +16,7 @@ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \ "Firewall group name cannot contain shell punctuation" syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \ - --set-type=address --set-family=inet"; \ + --set-type=network --set-family=inet"; \ "Firewall group name already used as Ipv6 group address" end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ -- cgit v1.2.3