Merge pull request #1174 from sarthurdev/firewall

firewall: T4178: T3873: tcp flags syntax refactor, intra-zone-filtering fix

2 files changed, 24 insertions, 10 deletions

diff --git a/src/validators/port-range b/src/validators/port-range
index 6c01048f0..5468000a7 100755
--- a/src/validators/port-range
+++ b/src/validators/port-range
@@ -3,6 +3,19 @@
 import sys
 import re
 
+from vyos.util import read_file
+
+services_file = '/etc/services'
+
+def get_services():
+    names = []
+    service_data = read_file(services_file, "")
+    for line in service_data.split("\n"):
+        if not line or line[0] == '#':
+            continue
+        names.append(line.split(None, 1)[0])
+    return names
+
 def error(port_range):
     print(f'Error: {port_range} is not a valid port or port range')
     sys.exit(1)
@@ -16,8 +29,11 @@ if __name__ == '__main__':
                 error(port_range)
             if int(port_1) > int(port_2):
                 error(port_range)
-        elif not port_range.isnumeric() or int(port_range) not in range(1, 65536):
-                error(port_range)
+        elif port_range.isnumeric() and int(port_range) not in range(1, 65536):
+            error(port_range)
+        elif not port_range.isnumeric() and port_range not in get_services():
+            print(f'Error: {port_range} is not a valid service name')
+            sys.exit(1)
     else:
         sys.exit(2)
 
diff --git a/src/validators/tcp-flag b/src/validators/tcp-flag
index 86ebec189..1496b904a 100755
--- a/src/validators/tcp-flag
+++ b/src/validators/tcp-flag
@@ -5,14 +5,12 @@ import re
 
 if __name__ == '__main__':
     if len(sys.argv)>1:
-        flags = sys.argv[1].split(",")
-
-        for flag in flags:
-            if flag and flag[0] == '!':
-                flag = flag[1:]
-            if flag.lower() not in ['syn', 'ack', 'rst', 'fin', 'urg', 'psh']:
-                print(f'Error: {flag} is not a valid TCP flag')
-                sys.exit(1)
+        flag = sys.argv[1]
+        if flag and flag[0] == '!':
+            flag = flag[1:]
+        if flag not in ['syn', 'ack', 'rst', 'fin', 'urg', 'psh', 'ecn', 'cwr']:
+            print(f'Error: {flag} is not a valid TCP flag')
+            sys.exit(1)
     else:
         sys.exit(2)