Merge pull request #3290 from nicolas-fort/T6216

firewall: T6216: replace plus symbols (allowed by IPset but not NFT) in group names with underscores

1 files changed, 69 insertions, 11 deletions

diff --git a/src/migration-scripts/firewall/6-to-7 b/src/migration-scripts/firewall/6-to-7
index 72f07880b..938044c6d 100755
--- a/src/migration-scripts/firewall/6-to-7
+++ b/src/migration-scripts/firewall/6-to-7
@@ -107,6 +107,12 @@ icmpv6_translations = {
     'unknown-option': [4, 2]
 }
 
+v4_found = False
+v6_found = False
+v4_groups = ["address-group", "network-group", "port-group"]
+v6_groups = ["ipv6-address-group", "ipv6-network-group", "port-group"]
+translated_dict = {}
+
 if config.exists(base + ['group']):
     for group_type in config.list_nodes(base + ['group']):
         for group_name in config.list_nodes(base + ['group', group_type]):
@@ -114,6 +120,19 @@ if config.exists(base + ['group']):
             if config.exists(name_description):
                 tmp = config.return_value(name_description)
                 config.set(name_description, value=tmp[:max_len_description])
+            if '+' in group_name:
+                replacement_string = "_"
+                if group_type in v4_groups and not v4_found:
+                    v4_found = True
+                if group_type in v6_groups and not v6_found:
+                    v6_found = True
+                new_group_name = group_name.replace('+', replacement_string)
+                while config.exists(base + ['group', group_type, new_group_name]):
+                    replacement_string = replacement_string + "_"
+                    new_group_name = group_name.replace('+', replacement_string)
+                translated_dict[group_name] = new_group_name
+                config.copy(base + ['group', group_type, group_name], base + ['group', group_type, new_group_name])
+                config.delete(base + ['group', group_type, group_name])
 
 if config.exists(base + ['name']):
     for name in config.list_nodes(base + ['name']):
@@ -173,11 +192,31 @@ if config.exists(base + ['name']):
                         config.set(rule_icmp + ['type'], value=translate[0])
                         config.set(rule_icmp + ['code'], value=translate[1])
 
-            for src_dst in ['destination', 'source']:
-                pg_base = base + ['name', name, 'rule', rule, src_dst, 'group', 'port-group']
-                proto_base = base + ['name', name, 'rule', rule, 'protocol']
-                if config.exists(pg_base) and not config.exists(proto_base):
-                    config.set(proto_base, value='tcp_udp')
+            for direction in ['destination', 'source']:
+                if config.exists(base + ['name', name, 'rule', rule, direction]):
+                    if config.exists(base + ['name', name, 'rule', rule, direction, 'group']) and v4_found:
+                        for group_type in config.list_nodes(base + ['name', name, 'rule', rule, direction, 'group']):
+                            group_name = config.return_value(base + ['name', name, 'rule', rule, direction, 'group', group_type])
+                            if '+' in group_name:
+                                if group_name[0] == "!":
+                                    new_group_name = "!" + translated_dict[group_name[1:]]
+                                else:
+                                    new_group_name = translated_dict[group_name]
+                                config.set(base + ['name', name, 'rule', rule, direction, 'group', group_type], value=new_group_name)
+
+                    pg_base = base + ['name', name, 'rule', rule, direction, 'group', 'port-group']
+                    proto_base = base + ['name', name, 'rule', rule, 'protocol']
+                    if config.exists(pg_base) and not config.exists(proto_base):
+                        config.set(proto_base, value='tcp_udp')
+
+        if '+' in name:
+            replacement_string = "_"
+            new_name = name.replace('+', replacement_string)
+            while config.exists(base + ['name', new_name]):
+                replacement_string = replacement_string + "_"
+                new_name = name.replace('+', replacement_string)
+            config.copy(base + ['name', name], base + ['name', new_name])
+            config.delete(base + ['name', name])
 
 if config.exists(base + ['ipv6-name']):
     for name in config.list_nodes(base + ['ipv6-name']):
@@ -250,12 +289,31 @@ if config.exists(base + ['ipv6-name']):
                 else:
                     config.rename(rule_icmp + ['type'], 'type-name')
 
-            for src_dst in ['destination', 'source']:
-                pg_base = base + ['ipv6-name', name, 'rule', rule, src_dst, 'group', 'port-group']
-                proto_base = base + ['ipv6-name', name, 'rule', rule, 'protocol']
-                if config.exists(pg_base) and not config.exists(proto_base):
-                    config.set(proto_base, value='tcp_udp')
-
+            for direction in ['destination', 'source']:
+                if config.exists(base + ['ipv6-name', name, 'rule', rule, direction]):
+                    if config.exists(base + ['ipv6-name', name, 'rule', rule, direction, 'group']) and v6_found:
+                        for group_type in config.list_nodes(base + ['ipv6-name', name, 'rule', rule, direction, 'group']):
+                            group_name = config.return_value(base + ['ipv6-name', name, 'rule', rule, direction, 'group', group_type])
+                            if '+' in group_name:
+                                if group_name[0] == "!":
+                                    new_group_name = "!" + translated_dict[group_name[1:]]
+                                else:
+                                    new_group_name = translated_dict[group_name]
+                                config.set(base + ['ipv6-name', name, 'rule', rule, direction, 'group', group_type], value=new_group_name)
+
+                    pg_base = base + ['ipv6-name', name, 'rule', rule, direction, 'group', 'port-group']
+                    proto_base = base + ['ipv6-name', name, 'rule', rule, 'protocol']
+                    if config.exists(pg_base) and not config.exists(proto_base):
+                        config.set(proto_base, value='tcp_udp')
+
+        if '+' in name:
+            replacement_string = "_"
+            new_name = name.replace('+', replacement_string)
+            while config.exists(base + ['ipv6-name', new_name]):
+                replacement_string = replacement_string + "_"
+                new_name = name.replace('+', replacement_string)
+            config.copy(base + ['ipv6-name', name], base + ['ipv6-name', new_name])
+            config.delete(base + ['ipv6-name', name])
 try:
     with open(file_name, 'w') as f:
         f.write(config.to_string())