diff options
| author | Ruben Herold <ruben@puettmann.net> | 2026-09-11 16:28:09 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-09-11 15:28:09 +0100 |
| commit | 8fec254b2d17d5aec30589f0b3c5444ad1dfd1f5 (patch) | |
| tree | 36d23d74daba786b9e67d2b31e706e021306172d /src | |
| parent | 148dd2b2f5ac5f0cd3671650aa11100fc293b588 (diff) | |
| download | vyos-1x-8fec254b2d17d5aec30589f0b3c5444ad1dfd1f5.tar.gz vyos-1x-8fec254b2d17d5aec30589f0b3c5444ad1dfd1f5.zip | |
Merge pull request #5372 from ruben-herold/T9157-fib-type-match
firewall: T9157: add fib-type match for destination/source
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/firewall.py | 68 |
1 files changed, 41 insertions, 27 deletions
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py index 4ca383d88..3a01d2225 100755 --- a/src/conf_mode/firewall.py +++ b/src/conf_mode/firewall.py @@ -216,33 +216,37 @@ def verify_jump_target(firewall, hook, jump_target, family, recursive=False): def is_node_empty(rule_conf): is_empty_list = [] - is_empty_list.append([ - ['add_address_to_group'], - ['connection_status'], - ['destination'], - ['destination', 'group'], - ['destination', 'geoip'], - ['fragment'], - ['gre'], - ['gre', 'flags'], - ['hop_limit'], - ['icmp'], - ['icmpv6'], - ['inbound_interface'], - ['ipsec'], - ['limit'], - ['log_options'], - ['outbound_interface'], - ['set'], - ['source'], - ['source', 'group'], - ['source', 'geoip'], - ['tcp'], - ['tcp', 'flags'], - ['time'], - ['ttl'], - ['vlan'] - ]) + is_empty_list.append( + [ + ['add_address_to_group'], + ['connection_status'], + ['destination'], + ['destination', 'group'], + ['destination', 'geoip'], + ['fib'], + ['fib', 'match'], + ['fragment'], + ['gre'], + ['gre', 'flags'], + ['hop_limit'], + ['icmp'], + ['icmpv6'], + ['inbound_interface'], + ['ipsec'], + ['limit'], + ['log_options'], + ['outbound_interface'], + ['set'], + ['source'], + ['source', 'group'], + ['source', 'geoip'], + ['tcp'], + ['tcp', 'flags'], + ['time'], + ['ttl'], + ['vlan'], + ] + ) for node in is_empty_list[0]: if dict_search_args(rule_conf, *node) == {}: @@ -331,6 +335,16 @@ def verify_rule(firewall, family, hook, priority, rule_id, rule_conf): if {'match_frag', 'match_non_frag'} <= set(rule_conf['fragment']): raise ConfigError(f'{rule_num}Cannot specify both "match-frag" and "match-non-frag"') + if 'fib' in rule_conf: + if 'lookup' not in rule_conf['fib']: + raise ConfigError(f'{rule_num}fib lookup must be defined') + if {'source-address', 'destination-address'} <= set(rule_conf['fib']['lookup']): + raise ConfigError( + f'{rule_num}fib lookup cannot specify both "source-address" and "destination-address"' + ) + if 'match' not in rule_conf['fib']: + raise ConfigError(f'{rule_num}fib match must be defined') + node_empty, node_name = is_node_empty(rule_conf) if node_empty: tmp = ' '.join(node_name).replace('_', '-') |