summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2019-01-30 06:09:04 +0100
committerChristian Poessinger <christian@poessinger.com>2019-01-30 06:13:36 +0100
commitcc07c4727bdffb4c220ce28ab9f697b01fe4afb7 (patch)
tree3b00fa5aae4ec805d9b8b3fd667afed3920c0327 /src/conf_mode
parent6d172d767360a675462da6a0bac100a24c544892 (diff)
downloadvyos-1x-cc07c4727bdffb4c220ce28ab9f697b01fe4afb7.tar.gz
vyos-1x-cc07c4727bdffb4c220ce28ab9f697b01fe4afb7.zip
T1160: fix (ro|rw)community ACL
WHen building up the SNMP v2 community ro/rw access all hosts from a INET version could access even when the community was locked to one INET family. Example #1: set service snmp community bar network 172.16.0.0/12 Allowed access only to IPv4 network 172.16.0.0/12 but it allowed acces from IPv6 ::/0. Example #2: set service snmp community baz network 2001:db8::/64 Limited IPv6 access to 2001:db8::/64 but IPv4 was open to 0.0.0.0/0
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/snmp.py13
1 files changed, 10 insertions, 3 deletions
diff --git a/src/conf_mode/snmp.py b/src/conf_mode/snmp.py
index d21a2b603..06d2e253a 100755
--- a/src/conf_mode/snmp.py
+++ b/src/conf_mode/snmp.py
@@ -134,20 +134,23 @@ agentaddress unix:/run/snmpd.socket{% if listen_on %}{% for li in listen_on %},{
# SNMP communities
{%- for c in communities %}
+
{%- if c.network_v4 %}
{%- for network in c.network_v4 %}
{{ c.authorization }}community {{ c.name }} {{ network }}
{%- endfor %}
-{%- else %}
+{%- elif not c.has_source %}
{{ c.authorization }}community {{ c.name }}
{%- endif %}
+
{%- if c.network_v6 %}
{%- for network in c.network_v6 %}
{{ c.authorization }}community6 {{ c.name }} {{ network }}
{%- endfor %}
-{%- else %}
+{%- elif not c.has_source %}
{{ c.authorization }}community6 {{ c.name }}
{%- endif %}
+
{%- endfor %}
{% if contact %}
@@ -266,7 +269,8 @@ def get_config():
'name': name,
'authorization': 'ro',
'network_v4': [],
- 'network_v6': []
+ 'network_v6': [],
+ 'has_source' : False
}
if conf.exists('community {0} authorization'.format(name)):
@@ -288,6 +292,9 @@ def get_config():
else:
community['network_v6'].append(addr)
+ if (len(community['network_v4']) > 0) or (len(community['network_v6']) > 0):
+ community['has_source'] = True
+
snmp['communities'].append(community)
if conf.exists('contact'):