diff options
Diffstat (limited to 'interface-definitions/include/firewall')
20 files changed, 181 insertions, 103 deletions
diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i index e8da1a0e1..85f1071a6 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i @@ -27,7 +27,12 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> <node name="source"> @@ -41,7 +46,12 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/common-rule-ipv4.xml.i b/interface-definitions/include/firewall/common-rule-ipv4.xml.i index b67ef25dc..b6c1b13b3 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4.xml.i @@ -14,7 +14,12 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/source-destination-dynamic-group.xml.i> #include <include/firewall/source-destination-remote-group.xml.i> </children> @@ -38,9 +43,14 @@ #include <include/firewall/geoip.xml.i> #include <include/firewall/mac-address.xml.i> #include <include/firewall/port.xml.i> - #include <include/firewall/source-destination-group.xml.i> + #include <include/firewall/source-destination-group-ipv4.xml.i> + <node name="group"> + <children> + #include <include/firewall/mac-group.xml.i> + </children> + </node> #include <include/firewall/source-destination-dynamic-group.xml.i> #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/common-rule-ipv6.xml.i b/interface-definitions/include/firewall/common-rule-ipv6.xml.i index bb176fe71..65ec415fb 100644 --- a/interface-definitions/include/firewall/common-rule-ipv6.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv6.xml.i @@ -16,6 +16,7 @@ #include <include/firewall/port.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i> + #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> <leafNode name="jump-target"> @@ -39,6 +40,7 @@ #include <include/firewall/port.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i> + #include <include/firewall/source-destination-remote-group.xml.i> </children> </node> -<!-- include end -->
\ No newline at end of file +<!-- include end --> diff --git a/interface-definitions/include/firewall/disable-conntrack.xml.i b/interface-definitions/include/firewall/disable-conntrack.xml.i new file mode 100644 index 000000000..96a692166 --- /dev/null +++ b/interface-definitions/include/firewall/disable-conntrack.xml.i @@ -0,0 +1,8 @@ +<!-- include start from firewall/disable-conntrack.xml.i --> +<leafNode name="disable-conntrack"> + <properties> + <help>Disable conntrack within this chain</help> + <valueless/> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/firewall/domain-group.xml.i b/interface-definitions/include/firewall/domain-group.xml.i new file mode 100644 index 000000000..46e00ce09 --- /dev/null +++ b/interface-definitions/include/firewall/domain-group.xml.i @@ -0,0 +1,10 @@ +<!-- include start from firewall/domain-group.xml.i --> +<leafNode name="domain-group"> + <properties> + <help>Group of domains</help> + <completionHelp> + <path>firewall group domain-group</path> + </completionHelp> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/firewall/geoip.xml.i b/interface-definitions/include/firewall/geoip.xml.i index 9fb37a574..09b2da663 100644 --- a/interface-definitions/include/firewall/geoip.xml.i +++ b/interface-definitions/include/firewall/geoip.xml.i @@ -7,12 +7,15 @@ <leafNode name="country-code"> <properties> <help>GeoIP country code</help> + <completionHelp> + <list>ad ae af ag ai al am ao aq ar as at au aw ax az ba bb bd be bf bg bh bi bj bl bm bn bo bq br bs bt bv bw by bz ca cc cd cf cg ch ci ck cl cm cn co cr cu cv cw cx cy cz de dj dk dm do dz ec ee eg eh er es et fi fj fk fm fo fr ga gb gd ge gf gg gh gi gl gm gn gp gq gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in io iq ir is it je jm jo jp ke kg kh ki km kn kp kr kw ky kz la lb lc li lk lr ls lt lu lv ly ma mc md me mf mg mh mk ml mm mn mo mp mq mr ms mt mu mv mw mx my mz na nc ne nf ng ni nl no np nr nu nz om pa pe pf pg ph pk pl pm pn pr ps pt pw py qa re ro rs ru rw sa sb sc sd se sg sh si sj sk sl sm sn so sr ss st sv sx sy sz tc td tf tg th tj tk tl tm tn to tr tt tv tw tz ua ug um us uy uz va vc ve vg vi vn vu wf ws ye yt za zm zw</list> + </completionHelp> <valueHelp> <format><country></format> - <description>Country code (2 characters)</description> + <description>Country code (2 characters, lowercase)</description> </valueHelp> <constraint> - <regex>^(ad|ae|af|ag|ai|al|am|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|ss|st|sv|sx|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tr|tt|tv|tw|tz|ua|ug|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|za|zm|zw)$</regex> + <regex>(ad|ae|af|ag|ai|al|am|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|ss|st|sv|sx|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tr|tt|tv|tw|tz|ua|ug|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|za|zm|zw)</regex> </constraint> <multi /> </properties> diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i index 355b41fde..5ff5acfd8 100644 --- a/interface-definitions/include/firewall/global-options.xml.i +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -49,12 +49,53 @@ <help>Apply configured firewall rules to traffic switched by bridges</help> </properties> <children> - <leafNode name="invalid-connections"> + <node name="accept-invalid"> <properties> - <help>Accept ARP, DHCP and PPPoE despite they are marked as invalid connection</help> - <valueless/> + <help>Accept connections despite they are marked as invalid</help> </properties> - </leafNode> + <children> + <leafNode name="ethernet-type"> + <properties> + <help>Ethernet type</help> + <completionHelp> + <list>arp dhcp pppoe 802.1q 802.1ad pppoe-discovery wol</list> + </completionHelp> + <valueHelp> + <format>arp</format> + <description>Address Resolution Protocol (ARP)</description> + </valueHelp> + <valueHelp> + <format>dhcp</format> + <description>Dynamic Host Configuration Protocol (DHCP)</description> + </valueHelp> + <valueHelp> + <format>pppoe</format> + <description>Point to Point over Ethernet (PPPoE) Session</description> + </valueHelp> + <valueHelp> + <format>pppoe-discovery</format> + <description>PPPoE Discovery</description> + </valueHelp> + <valueHelp> + <format>802.1q</format> + <description>Customer VLAN tag type (802.1Q)</description> + </valueHelp> + <valueHelp> + <format>802.1ad</format> + <description>Service VLAN tag type (802.1ad)</description> + </valueHelp> + <valueHelp> + <format>wol</format> + <description>Wake-on-LAN magic packet</description> + </valueHelp> + <constraint> + <regex>(arp|dhcp|pppoe|pppoe-discovery|802.1q|802.1ad|wol)</regex> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> <leafNode name="ipv4"> <properties> <help>Apply configured IPv4 firewall rules</help> @@ -89,6 +130,49 @@ </properties> <defaultValue>enable</defaultValue> </leafNode> + <node name="geoip"> + <properties> + <help>GeoIP options</help> + </properties> + <children> + <leafNode name="provider"> + <properties> + <help>GeoIP database provider</help> + <completionHelp> + <list>db-ip maxmind</list> + </completionHelp> + <valueHelp> + <format>db-ip</format> + <description>Use GeoIP database by DB-IP.com</description> + </valueHelp> + <valueHelp> + <format>maxmind</format> + <description>Use GeoIP database by MaxMind (Requires API key)</description> + </valueHelp> + <constraint> + <regex>(db-ip|maxmind)</regex> + </constraint> + </properties> + <defaultValue>db-ip</defaultValue> + </leafNode> + <leafNode name="maxmind-account-id"> + <properties> + <help>Account ID for MaxMind GeoIP database</help> + </properties> + </leafNode> + <leafNode name="maxmind-license-key"> + <properties> + <help>License key for MaxMind GeoIP database</help> + </properties> + </leafNode> + <leafNode name="maxmind-lite"> + <properties> + <help>Use MaxMind GeoLite2 database</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> <leafNode name="ip-src-route"> <properties> <help>Policy for handling IPv4 packets with source route option</help> @@ -217,6 +301,14 @@ <help>Global firewall state-policy</help> </properties> <children> + <node name="offload"> + <properties> + <help>All stateful forward traffic is offloaded to a flowtable</help> + </properties> + <children> + #include <include/firewall/offload-target.xml.i> + </children> + </node> <node name="established"> <properties> <help>Global firewall policy for packets part of an established connection</help> @@ -279,7 +371,7 @@ </node> <leafNode name="twa-hazards-protection"> <properties> - <help>RFC1337 TCP TIME-WAIT assasination hazards protection</help> + <help>RFC1337 TCP TIME-WAIT assassination hazards protection</help> <completionHelp> <list>enable disable</list> </completionHelp> diff --git a/interface-definitions/include/firewall/icmpv6.xml.i b/interface-definitions/include/firewall/icmpv6.xml.i index c0118626e..9631f0012 100644 --- a/interface-definitions/include/firewall/icmpv6.xml.i +++ b/interface-definitions/include/firewall/icmpv6.xml.i @@ -6,7 +6,7 @@ <children> <leafNode name="code"> <properties> - <help>ICMPv6 code</help> + <help>ICMPv6 code field - depends on the message type</help> <valueHelp> <format>u32:0-255</format> <description>ICMPv6 code (0-255)</description> @@ -18,10 +18,14 @@ </leafNode> <leafNode name="type"> <properties> - <help>ICMPv6 type</help> + <help>ICMPv6 message type</help> <valueHelp> - <format>u32:0-255</format> - <description>ICMPv6 type (0-255)</description> + <format>u32:0-127</format> + <description>ICMPv6 error message</description> + </valueHelp> + <valueHelp> + <format>u32:128-255</format> + <description>ICMPv6 information message</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> diff --git a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i index a2da4b701..8f04d6739 100644 --- a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall forward filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv4-hook-input.xml.i b/interface-definitions/include/firewall/ipv4-hook-input.xml.i index 491d1a9f3..64366eac0 100644 --- a/interface-definitions/include/firewall/ipv4-hook-input.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-input.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall input filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv4-hook-output.xml.i b/interface-definitions/include/firewall/ipv4-hook-output.xml.i index f68136557..14ea1073b 100644 --- a/interface-definitions/include/firewall/ipv4-hook-output.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-output.xml.i @@ -9,6 +9,7 @@ <help>IPv4 firewall output filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i index 79898d691..0319c915a 100644 --- a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall forward filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv6-hook-input.xml.i b/interface-definitions/include/firewall/ipv6-hook-input.xml.i index 154b10259..ae78f8910 100644 --- a/interface-definitions/include/firewall/ipv6-hook-input.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-input.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall input filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/ipv6-hook-output.xml.i b/interface-definitions/include/firewall/ipv6-hook-output.xml.i index 9a6d0bb77..96976b4a8 100644 --- a/interface-definitions/include/firewall/ipv6-hook-output.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-output.xml.i @@ -9,6 +9,7 @@ <help>IPv6 firewall output filter</help> </properties> <children> + #include <include/firewall/disable-conntrack.xml.i> #include <include/firewall/default-action-base-chains.xml.i> #include <include/firewall/default-log.xml.i> #include <include/generic-description.xml.i> diff --git a/interface-definitions/include/firewall/match-ether-type.xml.i b/interface-definitions/include/firewall/match-ether-type.xml.i index abfa9034d..536e59bb3 100644 --- a/interface-definitions/include/firewall/match-ether-type.xml.i +++ b/interface-definitions/include/firewall/match-ether-type.xml.i @@ -15,7 +15,7 @@ </valueHelp> <valueHelp> <format>arp</format> - <description>Adress Resolution Protocol</description> + <description>Address Resolution Protocol</description> </valueHelp> <valueHelp> <format>_ipv4</format> diff --git a/interface-definitions/include/firewall/port-group.xml.i b/interface-definitions/include/firewall/port-group.xml.i new file mode 100644 index 000000000..297f0d781 --- /dev/null +++ b/interface-definitions/include/firewall/port-group.xml.i @@ -0,0 +1,10 @@ + <!-- include start from firewall/port-group.xml.i --> + <leafNode name="port-group"> + <properties> + <help>Group of ports</help> + <completionHelp> + <path>firewall group port-group</path> + </completionHelp> + </properties> + </leafNode> + <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group-inet.xml.i b/interface-definitions/include/firewall/source-destination-group-inet.xml.i index 174051624..775fda9b3 100644 --- a/interface-definitions/include/firewall/source-destination-group-inet.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-inet.xml.i @@ -20,7 +20,6 @@ </completionHelp> </properties> </leafNode> - #include <include/firewall/mac-group.xml.i> <leafNode name="ipv4-network-group"> <properties> <help>Group of IPv4 networks</help> @@ -37,14 +36,8 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/mac-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i index 8c34fb933..ccee5b247 100644 --- a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i @@ -12,14 +12,6 @@ </completionHelp> </properties> </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> <leafNode name="network-group"> <properties> <help>Group of networks</help> @@ -28,14 +20,8 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/domain-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i index 2a42d236c..43a9e9cf5 100644 --- a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i +++ b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i @@ -12,15 +12,6 @@ </completionHelp> </properties> </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> - #include <include/firewall/mac-group.xml.i> <leafNode name="network-group"> <properties> <help>Group of networks</help> @@ -29,14 +20,9 @@ </completionHelp> </properties> </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> + #include <include/firewall/mac-group.xml.i> + #include <include/firewall/domain-group.xml.i> + #include <include/firewall/port-group.xml.i> </children> </node> <!-- include end --> diff --git a/interface-definitions/include/firewall/source-destination-group.xml.i b/interface-definitions/include/firewall/source-destination-group.xml.i deleted file mode 100644 index 6ebee356c..000000000 --- a/interface-definitions/include/firewall/source-destination-group.xml.i +++ /dev/null @@ -1,42 +0,0 @@ -<!-- include start from firewall/source-destination-group.xml.i --> -<node name="group"> - <properties> - <help>Group</help> - </properties> - <children> - <leafNode name="address-group"> - <properties> - <help>Group of addresses</help> - <completionHelp> - <path>firewall group address-group</path> - </completionHelp> - </properties> - </leafNode> - <leafNode name="domain-group"> - <properties> - <help>Group of domains</help> - <completionHelp> - <path>firewall group domain-group</path> - </completionHelp> - </properties> - </leafNode> - #include <include/firewall/mac-group.xml.i> - <leafNode name="network-group"> - <properties> - <help>Group of networks</help> - <completionHelp> - <path>firewall group network-group</path> - </completionHelp> - </properties> - </leafNode> - <leafNode name="port-group"> - <properties> - <help>Group of ports</help> - <completionHelp> - <path>firewall group port-group</path> - </completionHelp> - </properties> - </leafNode> - </children> -</node> -<!-- include end --> |