summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--data/templates/conntrack/nftables-helpers.j26
-rw-r--r--debian/control3
-rw-r--r--interface-definitions/include/firewall/conntrack-helper.xml.i6
-rw-r--r--interface-definitions/service_config-sync.xml.in394
-rw-r--r--interface-definitions/system_conntrack.xml.in6
-rw-r--r--python/vyos/config_mgmt.py3
-rwxr-xr-xsmoketest/scripts/cli/test_system_conntrack.py8
-rwxr-xr-xsrc/conf_mode/system_conntrack.py7
-rwxr-xr-xsrc/helpers/vyos_config_sync.py26
-rwxr-xr-xsrc/migration-scripts/policy/1-to-218
10 files changed, 434 insertions, 43 deletions
diff --git a/data/templates/conntrack/nftables-helpers.j2 b/data/templates/conntrack/nftables-helpers.j2
index 433931162..63a0cc855 100644
--- a/data/templates/conntrack/nftables-helpers.j2
+++ b/data/templates/conntrack/nftables-helpers.j2
@@ -31,6 +31,12 @@
}
{% endif %}
+{% if modules.rtsp is vyos_defined and ipv4 %}
+ ct helper rtsp_tcp {
+ type "rtsp" protocol tcp;
+ }
+{% endif %}
+
{% if modules.sip is vyos_defined %}
ct helper sip_tcp {
type "sip" protocol tcp;
diff --git a/debian/control b/debian/control
index dddc4e14c..c5a60f660 100644
--- a/debian/control
+++ b/debian/control
@@ -256,6 +256,9 @@ Depends:
# For "nat64"
jool,
# End "nat64"
+# For "system conntrack modules rtsp"
+ nat-rtsp,
+# End "system conntrack modules rtsp"
# For "system ntp"
chrony,
# End "system ntp"
diff --git a/interface-definitions/include/firewall/conntrack-helper.xml.i b/interface-definitions/include/firewall/conntrack-helper.xml.i
index ee17f2c61..3ca1a0353 100644
--- a/interface-definitions/include/firewall/conntrack-helper.xml.i
+++ b/interface-definitions/include/firewall/conntrack-helper.xml.i
@@ -22,6 +22,10 @@
<description>Related traffic from NFS helper</description>
</valueHelp>
<valueHelp>
+ <format>rtsp</format>
+ <description>Related traffic from RTSP helper</description>
+ </valueHelp>
+ <valueHelp>
<format>sip</format>
<description>Related traffic from SIP helper</description>
</valueHelp>
@@ -34,7 +38,7 @@
<description>Related traffic from SQLNet helper</description>
</valueHelp>
<constraint>
- <regex>(ftp|h323|pptp|nfs|sip|tftp|sqlnet)</regex>
+ <regex>(ftp|h323|pptp|nfs|rtsp|sip|tftp|sqlnet)</regex>
</constraint>
<multi/>
</properties>
diff --git a/interface-definitions/service_config-sync.xml.in b/interface-definitions/service_config-sync.xml.in
index 9955acfee..9e9dcdb69 100644
--- a/interface-definitions/service_config-sync.xml.in
+++ b/interface-definitions/service_config-sync.xml.in
@@ -73,30 +73,382 @@
</constraint>
</properties>
</leafNode>
- <leafNode name="section">
+ <node name="section">
<properties>
<help>Section for synchronization</help>
- <completionHelp>
- <list>nat nat66 firewall</list>
- </completionHelp>
- <valueHelp>
- <format>nat</format>
- <description>NAT</description>
- </valueHelp>
- <valueHelp>
- <format>nat66</format>
- <description>NAT66</description>
- </valueHelp>
- <valueHelp>
- <format>firewall</format>
- <description>firewall</description>
- </valueHelp>
- <constraint>
- <regex>(nat|nat66|firewall)</regex>
- </constraint>
- <multi/>
</properties>
- </leafNode>
+ <children>
+ <leafNode name="firewall">
+ <properties>
+ <help>Firewall</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <node name="interfaces">
+ <properties>
+ <help>Interfaces</help>
+ </properties>
+ <children>
+ <leafNode name="bonding">
+ <properties>
+ <help>Bonding interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="bridge">
+ <properties>
+ <help>Bridge interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="dummy">
+ <properties>
+ <help>Dummy interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="ethernet">
+ <properties>
+ <help>Ethernet interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="geneve">
+ <properties>
+ <help>GENEVE interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="input">
+ <properties>
+ <help>Input interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="l2tpv3">
+ <properties>
+ <help>L2TPv3 interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="loopback">
+ <properties>
+ <help>Loopback interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="macsec">
+ <properties>
+ <help>MACsec interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="openvpn">
+ <properties>
+ <help>OpenVPN interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="pppoe">
+ <properties>
+ <help>PPPoE interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="pseudo-ethernet">
+ <properties>
+ <help>Pseudo-Ethernet interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="sstpc">
+ <properties>
+ <help>SSTP client interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="tunnel">
+ <properties>
+ <help>Tunnel interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="virtual-ethernet">
+ <properties>
+ <help>Virtual Ethernet interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="vti">
+ <properties>
+ <help>Virtual tunnel interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="vxlan">
+ <properties>
+ <help>VXLAN interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="wireguard">
+ <properties>
+ <help>Wireguard interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="wireless">
+ <properties>
+ <help>Wireless interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="wwan">
+ <properties>
+ <help>WWAN interface</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
+ <leafNode name="nat">
+ <properties>
+ <help>NAT</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="nat66">
+ <properties>
+ <help>NAT66</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="pki">
+ <properties>
+ <help>Public key infrastructure (PKI)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="policy">
+ <properties>
+ <help>Routing policy</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <node name="protocols">
+ <properties>
+ <help>Routing protocols</help>
+ </properties>
+ <children>
+ <leafNode name="babel">
+ <properties>
+ <help>Babel Routing Protocol</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="bfd">
+ <properties>
+ <help>Bidirectional Forwarding Detection (BFD)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="bgp">
+ <properties>
+ <help>Border Gateway Protocol (BGP)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="failover">
+ <properties>
+ <help>Failover route</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="igmp-proxy">
+ <properties>
+ <help>Internet Group Management Protocol (IGMP) proxy</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="isis">
+ <properties>
+ <help>Intermediate System to Intermediate System (IS-IS)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="mpls">
+ <properties>
+ <help>Multiprotocol Label Switching (MPLS)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="nhrp">
+ <properties>
+ <help>Next Hop Resolution Protocol (NHRP) parameters</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="ospf">
+ <properties>
+ <help>Open Shortest Path First (OSPF)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="ospfv3">
+ <properties>
+ <help>Open Shortest Path First (OSPF) for IPv6</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="pim">
+ <properties>
+ <help>Protocol Independent Multicast (PIM) and IGMP</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="pim6">
+ <properties>
+ <help>Protocol Independent Multicast for IPv6 (PIMv6) and MLD</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="rip">
+ <properties>
+ <help>Routing Information Protocol (RIP) parameters</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="ripng">
+ <properties>
+ <help>Routing Information Protocol (RIPng) parameters</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="rpki">
+ <properties>
+ <help>Resource Public Key Infrastructure (RPKI)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="segment-routing">
+ <properties>
+ <help>Segment Routing</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="static">
+ <properties>
+ <help>Static Routing</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
+ <node name="service">
+ <properties>
+ <help>System services</help>
+ </properties>
+ <children>
+ <leafNode name="console-server">
+ <properties>
+ <help>Serial Console Server</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="dhcp-relay">
+ <properties>
+ <help>Host Configuration Protocol (DHCP) relay agent</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="dhcp-server">
+ <properties>
+ <help>Dynamic Host Configuration Protocol (DHCP) for DHCP server</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="dhcpv6-relay">
+ <properties>
+ <help>DHCPv6 Relay Agent parameters</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="dhcpv6-server">
+ <properties>
+ <help>DHCP for IPv6 (DHCPv6) server</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="dns">
+ <properties>
+ <help>Domain Name System (DNS) related services</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="lldp">
+ <properties>
+ <help>LLDP settings</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="mdns">
+ <properties>
+ <help>Multicast DNS (mDNS) parameters</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="monitoring">
+ <properties>
+ <help>Monitoring services</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="ndp-proxy">
+ <properties>
+ <help>Neighbor Discovery Protocol (NDP) Proxy</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="ntp">
+ <properties>
+ <help>Network Time Protocol (NTP) configuration</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="snmp">
+ <properties>
+ <help>Simple Network Management Protocol (SNMP)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="tftp-server">
+ <properties>
+ <help>Trivial File Transfer Protocol (TFTP) server</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="webproxy">
+ <properties>
+ <help>Webproxy service settings</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
+ <leafNode name="vpn">
+ <properties>
+ <help>Virtual Private Network (VPN)</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <leafNode name="vrf">
+ <properties>
+ <help>Virtual Routing and Forwarding</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
</children>
</node>
</children>
diff --git a/interface-definitions/system_conntrack.xml.in b/interface-definitions/system_conntrack.xml.in
index a348097cc..219c6e28e 100644
--- a/interface-definitions/system_conntrack.xml.in
+++ b/interface-definitions/system_conntrack.xml.in
@@ -289,6 +289,12 @@
<valueless/>
</properties>
</leafNode>
+ <leafNode name="rtsp">
+ <properties>
+ <help>RTSP connection tracking</help>
+ <valueless/>
+ </properties>
+ </leafNode>
<leafNode name="sip">
<properties>
<help>SIP connection tracking</help>
diff --git a/python/vyos/config_mgmt.py b/python/vyos/config_mgmt.py
index ff078649d..28ccee769 100644
--- a/python/vyos/config_mgmt.py
+++ b/python/vyos/config_mgmt.py
@@ -132,6 +132,9 @@ class ConfigMgmt:
{}).get('source_address', '')
if config.exists(['system', 'host-name']):
self.hostname = config.return_value(['system', 'host-name'])
+ if config.exists(['system', 'domain-name']):
+ tmp = config.return_value(['system', 'domain-name'])
+ self.hostname += f'.{tmp}'
else:
self.hostname = 'vyos'
diff --git a/smoketest/scripts/cli/test_system_conntrack.py b/smoketest/scripts/cli/test_system_conntrack.py
index f00626b3d..2d76da145 100755
--- a/smoketest/scripts/cli/test_system_conntrack.py
+++ b/smoketest/scripts/cli/test_system_conntrack.py
@@ -174,12 +174,16 @@ class TestSystemConntrack(VyOSUnitTestSHIM.TestCase):
'pptp': {
'driver': ['nf_nat_pptp', 'nf_conntrack_pptp'],
'nftables': ['ct helper set "pptp_tcp"']
- },
+ },
+ 'rtsp': {
+ 'driver': ['nf_nat_rtsp', 'nf_conntrack_rtsp'],
+ 'nftables': ['ct helper set "rtsp_tcp"']
+ },
'sip': {
'driver': ['nf_nat_sip', 'nf_conntrack_sip'],
'nftables': ['ct helper set "sip_tcp"',
'ct helper set "sip_udp"']
- },
+ },
'sqlnet': {
'nftables': ['ct helper set "tns_tcp"']
},
diff --git a/src/conf_mode/system_conntrack.py b/src/conf_mode/system_conntrack.py
index 2a55daed4..a1472aaaa 100755
--- a/src/conf_mode/system_conntrack.py
+++ b/src/conf_mode/system_conntrack.py
@@ -58,6 +58,11 @@ module_map = {
'nftables': ['tcp dport {1723} ct helper set "pptp_tcp" return'],
'ipv4': True
},
+ 'rtsp': {
+ 'ko': ['nf_nat_rtsp', 'nf_conntrack_rtsp'],
+ 'nftables': ['tcp dport {554} ct helper set "rtsp_tcp" return'],
+ 'ipv4': True
+ },
'sip': {
'ko': ['nf_nat_sip', 'nf_conntrack_sip'],
'nftables': ['tcp dport {5060,5061} ct helper set "sip_tcp" return',
@@ -195,7 +200,7 @@ def generate(conntrack):
def apply(conntrack):
# Depending on the enable/disable state of the ALG (Application Layer Gateway)
# modules we need to either insmod or rmmod the helpers.
-
+
add_modules = []
rm_modules = []
diff --git a/src/helpers/vyos_config_sync.py b/src/helpers/vyos_config_sync.py
index 7cfa8fe88..572fea61f 100755
--- a/src/helpers/vyos_config_sync.py
+++ b/src/helpers/vyos_config_sync.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python3
#
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright (C) 2023-2024 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
@@ -60,6 +60,7 @@ def post_request(url: str,
return response
+
def retrieve_config(section: str = None) -> Optional[Dict[str, Any]]:
"""Retrieves the configuration from the local server.
@@ -71,8 +72,6 @@ def retrieve_config(section: str = None) -> Optional[Dict[str, Any]]:
"""
if section is None:
section = []
- else:
- section = section.split()
conf = Config()
config = conf.get_config_dict(section, get_first_key=True)
@@ -101,8 +100,6 @@ def set_remote_config(
if path is None:
path = []
- else:
- path = path.split()
headers = {'Content-Type': 'application/json'}
# Disable the InsecureRequestWarning
@@ -127,17 +124,16 @@ def set_remote_config(
def is_section_revised(section: str) -> bool:
from vyos.config_mgmt import is_node_revised
- return is_node_revised([section])
+ return is_node_revised(section)
def config_sync(secondary_address: str,
secondary_key: str,
- sections: List[str],
+ sections: List[list],
mode: str):
"""Retrieve a config section from primary router in JSON format and send it to
secondary router
"""
- # Config sync only if sections changed
if not any(map(is_section_revised, sections)):
return
@@ -188,5 +184,17 @@ if __name__ == '__main__':
"Missing required configuration data for config synchronization.")
exit(0)
+ # Generate list_sections of sections/subsections
+ # [
+ # ['interfaces', 'pseudo-ethernet'], ['interfaces', 'virtual-ethernet'], ['nat'], ['nat66']
+ # ]
+ list_sections = []
+ for section, subsections in sections.items():
+ if subsections:
+ for subsection in subsections:
+ list_sections.append([section, subsection])
+ else:
+ list_sections.append([section])
+
config_sync(secondary_address, secondary_key,
- sections, mode)
+ list_sections, mode)
diff --git a/src/migration-scripts/policy/1-to-2 b/src/migration-scripts/policy/1-to-2
index c70490ce9..c7a983bba 100755
--- a/src/migration-scripts/policy/1-to-2
+++ b/src/migration-scripts/policy/1-to-2
@@ -32,23 +32,23 @@ file_name = argv[1]
with open(file_name, 'r') as f:
config_file = f.read()
-base = ['policy', 'ipv6-route']
+base = ['policy']
config = ConfigTree(config_file)
if not config.exists(base):
# Nothing to do
exit(0)
-config.rename(base, 'route6')
-config.set_tag(['policy', 'route6'])
+if config.exists(base + ['ipv6-route']):
+ config.rename(base + ['ipv6-route'],'route6')
+ config.set_tag(['policy', 'route6'])
for route in ['route', 'route6']:
- route_path = ['policy', route]
- if config.exists(route_path):
- for name in config.list_nodes(route_path):
- if config.exists(route_path + [name, 'rule']):
- for rule in config.list_nodes(route_path + [name, 'rule']):
- rule_tcp_flags = route_path + [name, 'rule', rule, 'tcp', 'flags']
+ if config.exists(base + [route]):
+ for name in config.list_nodes(base + [route]):
+ if config.exists(base + [route, name, 'rule']):
+ for rule in config.list_nodes(base + [route, name, 'rule']):
+ rule_tcp_flags = base + [route, name, 'rule', rule, 'tcp', 'flags']
if config.exists(rule_tcp_flags):
tmp = config.return_value(rule_tcp_flags)