diff options
Diffstat (limited to 'interface-definitions')
| -rw-r--r-- | interface-definitions/https.xml.in | 13 | ||||
| -rw-r--r-- | interface-definitions/include/interface/dhcp-options.xml.i | 6 | ||||
| -rw-r--r-- | interface-definitions/include/ipv4-address-prefix-range.xml.i | 39 | ||||
| -rw-r--r-- | interface-definitions/include/port-port-range.xml.i | 26 | ||||
| -rw-r--r-- | interface-definitions/load-balancing-wan.xml.in | 395 | ||||
| -rw-r--r-- | interface-definitions/nat66.xml.in | 73 | ||||
| -rw-r--r-- | interface-definitions/policy.xml.in | 4 | ||||
| -rw-r--r-- | interface-definitions/service-ids-ddos-protection.xml.in | 40 | ||||
| -rw-r--r-- | interface-definitions/service-router-advert.xml.in | 12 | ||||
| -rw-r--r-- | interface-definitions/service-webproxy.xml.in | 26 |
10 files changed, 630 insertions, 4 deletions
diff --git a/interface-definitions/https.xml.in b/interface-definitions/https.xml.in index d2c393036..d096c4ff1 100644 --- a/interface-definitions/https.xml.in +++ b/interface-definitions/https.xml.in @@ -107,6 +107,19 @@ <valueless/> </properties> </leafNode> + <node name="gql"> + <properties> + <help>GraphQL support</help> + </properties> + <children> + <leafNode name="introspection"> + <properties> + <help>Schema introspection</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> <node name="cors"> <properties> <help>Set CORS options</help> diff --git a/interface-definitions/include/interface/dhcp-options.xml.i b/interface-definitions/include/interface/dhcp-options.xml.i index 914b60503..2ed5fd403 100644 --- a/interface-definitions/include/interface/dhcp-options.xml.i +++ b/interface-definitions/include/interface/dhcp-options.xml.i @@ -14,6 +14,12 @@ <help>Override system host-name sent to DHCP server</help> </properties> </leafNode> + <leafNode name="mtu"> + <properties> + <help>Use MTU value from DHCP server - ignore interface setting</help> + <valueless/> + </properties> + </leafNode> <leafNode name="vendor-class-id"> <properties> <help>Identify the vendor client type to the DHCP server</help> diff --git a/interface-definitions/include/ipv4-address-prefix-range.xml.i b/interface-definitions/include/ipv4-address-prefix-range.xml.i new file mode 100644 index 000000000..aadc6aaec --- /dev/null +++ b/interface-definitions/include/ipv4-address-prefix-range.xml.i @@ -0,0 +1,39 @@ +<!-- include start from ipv4-address-prefix-range.xml.i --> +<leafNode name="address"> + <properties> + <help>IP address, subnet, or range</help> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address to match</description> + </valueHelp> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 prefix to match</description> + </valueHelp> + <valueHelp> + <format>ipv4range</format> + <description>IPv4 address range to match</description> + </valueHelp> + <valueHelp> + <format>!ipv4</format> + <description>Match everything except the specified address</description> + </valueHelp> + <valueHelp> + <format>!ipv4net</format> + <description>Match everything except the specified prefix</description> + </valueHelp> + <valueHelp> + <format>!ipv4range</format> + <description>Match everything except the specified range</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + <validator name="ipv4-prefix"/> + <validator name="ipv4-range"/> + <validator name="ipv4-address-exclude"/> + <validator name="ipv4-prefix-exclude"/> + <validator name="ipv4-range-exclude"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/include/port-port-range.xml.i b/interface-definitions/include/port-port-range.xml.i new file mode 100644 index 000000000..ce550f549 --- /dev/null +++ b/interface-definitions/include/port-port-range.xml.i @@ -0,0 +1,26 @@ +<!-- include start from port-port-range.xml.i --> +<leafNode name="port"> + <properties> + <help>Port number</help> + <valueHelp> + <format>txt</format> + <description>Named port (any name in /etc/services, e.g., http)</description> + </valueHelp> + <valueHelp> + <format>u32:1-65535</format> + <description>Numeric IP port</description> + </valueHelp> + <valueHelp> + <format>start-end</format> + <description>Numbered port range (e.g. 1001-1005)</description> + </valueHelp> + <valueHelp> + <format/> + <description>\n\nMultiple destination ports can be specified as a comma-separated list.\nThe whole list can also be negated using '!'.\nFor example: '!22,telnet,http,123,1001-1005'</description> + </valueHelp> + <constraint> + <validator name="port-multi"/> + </constraint> + </properties> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/load-balancing-wan.xml.in b/interface-definitions/load-balancing-wan.xml.in new file mode 100644 index 000000000..c2b6316ae --- /dev/null +++ b/interface-definitions/load-balancing-wan.xml.in @@ -0,0 +1,395 @@ +<?xml version="1.0"?> +<interfaceDefinition> + <node name="load-balancing"> + <properties> + <help>Configure load-balancing</help> + </properties> + <children> + <node name="wan" owner="${vyos_conf_scripts_dir}/load-balancing-wan.py"> + <properties> + <help>Configure Wide Area Network (WAN) load-balancing</help> + </properties> + <children> + <leafNode name="disable-source-nat"> + <properties> + <help>Disable source NAT rules from being configured for WAN load balancing</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="enable-local-traffic"> + <properties> + <help>Enable WAN load balancing for locally sourced traffic</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="flush-connections"> + <properties> + <help>Flush connection tracking tables on connection state change</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="hook"> + <properties> + <help>Script to be executed on interface status change</help> + <valueHelp> + <format>txt</format> + <description>Script in /config/scripts</description> + </valueHelp> + <constraint> + <validator name="script"/> + </constraint> + </properties> + </leafNode> + <tagNode name="interface-health"> + <properties> + <help>Interface name</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces.py</script> + </completionHelp> + </properties> + <children> + <leafNode name="failure-count"> + <properties> + <help>Failure count</help> + <valueHelp> + <format>u32:1-10</format> + <description>Failure count</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-10"/> + </constraint> + </properties> + </leafNode> + <leafNode name="nexthop"> + <properties> + <help>Outbound interface nexthop address. Can be 'DHCP or IPv4 address' [REQUIRED]</help> + <completionHelp> + <list>dhcp</list> + </completionHelp> + <valueHelp> + <format>ipv4</format> + <description>Nexthop IP address</description> + </valueHelp> + <valueHelp> + <format>dhcp</format> + <description>Set the nexthop via DHCP</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + <regex>(dhcp)</regex> + </constraint> + </properties> + </leafNode> + <leafNode name="success-count"> + <properties> + <help>Success count</help> + <valueHelp> + <format>u32:1-10</format> + <description>Success count</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-10"/> + </constraint> + </properties> + </leafNode> + <tagNode name="test"> + <properties> + <help>Rule number</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Rule number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + <children> + <leafNode name="resp-time"> + <properties> + <help>Ping response time (seconds)</help> + <valueHelp> + <format>u32:1-30</format> + <description>Response time (seconds)</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-30"/> + </constraint> + </properties> + </leafNode> + <leafNode name="target"> + <properties> + <help>Health target address</help> + <valueHelp> + <format>ipv4</format> + <description>Health target address</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + </constraint> + </properties> + </leafNode> + <leafNode name="test-script"> + <properties> + <help>Path to user-defined script</help> + <valueHelp> + <format>txt</format> + <description>Script in /config/scripts</description> + </valueHelp> + <constraint> + <validator name="script"/> + </constraint> + </properties> + </leafNode> + <leafNode name="ttl-limit"> + <properties> + <help>TTL limit (hop count)</help> + <valueHelp> + <format>u32:1-254</format> + <description>Number of hops</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-254"/> + </constraint> + </properties> + </leafNode> + <leafNode name="type"> + <properties> + <help>WLB test type</help> + <completionHelp> + <list>ping ttl user-defined</list> + </completionHelp> + <valueHelp> + <format>ping</format> + <description>Test with ICMP echo response</description> + </valueHelp> + <valueHelp> + <format>ttl</format> + <description>Test with UDP TTL expired response</description> + </valueHelp> + <valueHelp> + <format>user-defined</format> + <description>User-defined test script</description> + </valueHelp> + <constraint> + <regex>(ping|ttl|user-defined)</regex> + </constraint> + </properties> + </leafNode> + </children> + </tagNode> + </children> + </tagNode> + <tagNode name="rule"> + <properties> + <help>Rule number (1-9999)</help> + <valueHelp> + <format>u32:1-9999</format> + <description>Rule number</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-9999"/> + </constraint> + </properties> + <children> + <leafNode name="description"> + <properties> + <help>Description for this rule</help> + <valueHelp> + <format>txt</format> + <description>Description for this rule</description> + </valueHelp> + </properties> + </leafNode> + <node name="destination"> + <properties> + <help>Destination</help> + </properties> + <children> + #include <include/ipv4-address-prefix-range.xml.i> + #include <include/port-port-range.xml.i> + </children> + </node> + <leafNode name="exclude"> + <properties> + <help>Exclude packets matching this rule from WAN load balance</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="failover"> + <properties> + <help>Enable failover for packets matching this rule from WAN load balance</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="inbound-interface"> + <properties> + <help>Inbound interface name (e.g., "eth0") [REQUIRED]</help> + <completionHelp> + <list>any</list> + <script>${vyos_completion_dir}/list_interfaces.py</script> + </completionHelp> + </properties> + </leafNode> + <tagNode name="interface"> + <properties> + <help>Interface name [REQUIRED]</help> + <completionHelp> + <script>${vyos_completion_dir}/list_interfaces.py</script> + </completionHelp> + </properties> + <children> + <leafNode name="weight"> + <properties> + <help>Load-balance weight</help> + <valueHelp> + <format>u32:1-255</format> + <description>Interface weight</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-255"/> + </constraint> + <constraintErrorMessage>Weight must be between 1 and 255</constraintErrorMessage> + </properties> + </leafNode> + </children> + </tagNode> + <node name="limit"> + <properties> + <help>Enable packet limit for this rule</help> + </properties> + <children> + <leafNode name="burst"> + <properties> + <help>Burst limit for matching packets</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Burst limit for matching packets</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="period"> + <properties> + <help>Time window for rate calculation</help> + <completionHelp> + <list>hour minute second</list> + </completionHelp> + <valueHelp> + <format>hour</format> + <description>hour</description> + </valueHelp> + <valueHelp> + <format>minute</format> + <description>minute</description> + </valueHelp> + <valueHelp> + <format>second</format> + <description>second</description> + </valueHelp> + <constraint> + <regex>(hour|minute|second)</regex> + </constraint> + </properties> + </leafNode> + <leafNode name="rate"> + <properties> + <help>Number of packets used for rate limit</help> + <valueHelp> + <format>u32:0-4294967295</format> + <description>Number of packets used for rate limit</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 0-4294967295"/> + </constraint> + </properties> + </leafNode> + <leafNode name="threshold"> + <properties> + <help>Threshold behavior for limit</help> + <completionHelp> + <list>above below</list> + </completionHelp> + <valueHelp> + <format>above</format> + <description>Above limit</description> + </valueHelp> + <valueHelp> + <format>below</format> + <description>Below limit</description> + </valueHelp> + <constraint> + <regex>(above|below)</regex> + </constraint> + </properties> + </leafNode> + </children> + </node> + <leafNode name="per-packet-balancing"> + <properties> + <help>Option to match traffic per-packet instead of the default, per-flow</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="protocol"> + <properties> + <help>Protocol to match (protocol name, number, or "all")</help> + <completionHelp> + <script>${vyos_completion_dir}/list_protocols.sh</script> + <list>all tcp_udp</list> + </completionHelp> + <valueHelp> + <format>all</format> + <description>All IP protocols</description> + </valueHelp> + <valueHelp> + <format>tcp_udp</format> + <description>Both TCP and UDP</description> + </valueHelp> + <valueHelp> + <format>u32:0-255</format> + <description>IP protocol number</description> + </valueHelp> + <valueHelp> + <format><protocol></format> + <description>IP protocol name</description> + </valueHelp> + <valueHelp> + <format>!<protocol></format> + <description>IP protocol name</description> + </valueHelp> + <constraint> + <validator name="ip-protocol"/> + </constraint> + </properties> + </leafNode> + <node name="source"> + <properties> + <help>Source information</help> + </properties> + <children> + #include <include/ipv4-address-prefix-range.xml.i> + #include <include/port-port-range.xml.i> + </children> + </node> + </children> + </tagNode> + <node name="sticky-connections"> + <properties> + <help>Configure sticky connections</help> + </properties> + <children> + <leafNode name="inbound"> + <properties> + <help>Enable sticky incoming WAN connections</help> + <valueless/> + </properties> + </leafNode> + </children> + </node> + </children> + </node> + </children> + </node> +</interfaceDefinition> diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in index b47f653c6..ac3198f45 100644 --- a/interface-definitions/nat66.xml.in +++ b/interface-definitions/nat66.xml.in @@ -49,6 +49,30 @@ </completionHelp> </properties> </leafNode> + <node name="destination"> + <properties> + <help>IPv6 destination prefix options</help> + </properties> + <children> + <leafNode name="prefix"> + <properties> + <help>IPv6 prefix to be translated</help> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix</description> + </valueHelp> + <valueHelp> + <format>!ipv6net</format> + <description>Match everything except the specified IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv6-prefix"/> + <validator name="ipv6-prefix-exclude"/> + </constraint> + </properties> + </leafNode> + </children> + </node> <node name="source"> <properties> <help>IPv6 source prefix options</help> @@ -61,8 +85,13 @@ <format>ipv6net</format> <description>IPv6 prefix</description> </valueHelp> + <valueHelp> + <format>!ipv6net</format> + <description>Match everything except the specified IPv6 prefix</description> + </valueHelp> <constraint> <validator name="ipv6-prefix"/> + <validator name="ipv6-prefix-exclude"/> </constraint> </properties> </leafNode> @@ -164,9 +193,53 @@ <format>ipv6net</format> <description>IPv6 prefix</description> </valueHelp> + <valueHelp> + <format>!ipv6</format> + <description>Match everything except the specified IPv6 address</description> + </valueHelp> + <valueHelp> + <format>!ipv6net</format> + <description>Match everything except the specified IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv6-address"/> + <validator name="ipv6-prefix"/> + <validator name="ipv6-address-exclude"/> + <validator name="ipv6-prefix-exclude"/> + </constraint> + </properties> + </leafNode> + </children> + </node> + <node name="source"> + <properties> + <help>IPv6 source prefix options</help> + </properties> + <children> + <leafNode name="address"> + <properties> + <help>IPv6 address or prefix to be translated</help> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix</description> + </valueHelp> + <valueHelp> + <format>!ipv6</format> + <description>Match everything except the specified IPv6 address</description> + </valueHelp> + <valueHelp> + <format>!ipv6net</format> + <description>Match everything except the specified IPv6 prefix</description> + </valueHelp> <constraint> <validator name="ipv6-address"/> <validator name="ipv6-prefix"/> + <validator name="ipv6-address-exclude"/> + <validator name="ipv6-prefix-exclude"/> </constraint> </properties> </leafNode> diff --git a/interface-definitions/policy.xml.in b/interface-definitions/policy.xml.in index 15c2beefa..cc1de609d 100644 --- a/interface-definitions/policy.xml.in +++ b/interface-definitions/policy.xml.in @@ -639,7 +639,7 @@ </leafNode> <leafNode name="prefix-len"> <properties> - <help>IP prefix-length to match (cannot be used for BGP routes)</help> + <help>IP prefix-length to match (can be used for kernel routes only)</help> <valueHelp> <format>u32:0-32</format> <description>Prefix length</description> @@ -809,7 +809,7 @@ </leafNode> <leafNode name="prefix-len"> <properties> - <help>IPv6 prefix-length to match (cannot be used for BGP routes)</help> + <help>IPv6 prefix-length to match (can be used for kernel routes only)</help> <valueHelp> <format>u32:0-128</format> <description>Prefix length</description> diff --git a/interface-definitions/service-ids-ddos-protection.xml.in b/interface-definitions/service-ids-ddos-protection.xml.in index 5e65d3106..86fc4dffa 100644 --- a/interface-definitions/service-ids-ddos-protection.xml.in +++ b/interface-definitions/service-ids-ddos-protection.xml.in @@ -18,6 +18,19 @@ <help>Path to fastnetmon alert script</help> </properties> </leafNode> + <leafNode name="ban-time"> + <properties> + <help>How long we should keep an IP in blocked state</help> + <valueHelp> + <format>u32:1-4294967294</format> + <description>Time in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-4294967294"/> + </constraint> + </properties> + <defaultValue>1900</defaultValue> + </leafNode> <leafNode name="direction"> <properties> <help>Direction for processing traffic</help> @@ -30,6 +43,24 @@ <multi/> </properties> </leafNode> + <leafNode name="excluded-network"> + <properties> + <help>Specify IPv4 and IPv6 networks which are going to be excluded from protection</help> + <valueHelp> + <format>ipv4net</format> + <description>IPv4 prefix(es) to exclude</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>IPv6 prefix(es) to exclude</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> <leafNode name="listen-interface"> <properties> <help>Listen interface for mirroring traffic</help> @@ -55,13 +86,18 @@ </node> <leafNode name="network"> <properties> - <help>Define monitoring networks</help> + <help>Specify IPv4 and IPv6 networks which belong to you</help> <valueHelp> <format>ipv4net</format> - <description>Processed network</description> + <description>Your IPv4 prefix(es)</description> + </valueHelp> + <valueHelp> + <format>ipv6net</format> + <description>Your IPv6 prefix(es)</description> </valueHelp> <constraint> <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> </constraint> <multi/> </properties> diff --git a/interface-definitions/service-router-advert.xml.in b/interface-definitions/service-router-advert.xml.in index 258b7b749..87ec512d6 100644 --- a/interface-definitions/service-router-advert.xml.in +++ b/interface-definitions/service-router-advert.xml.in @@ -249,6 +249,18 @@ <valueless/> </properties> </leafNode> + <leafNode name="deprecate-prefix"> + <properties> + <help>Upon shutdown, this option will deprecate the prefix by announcing it in the shutdown RA</help> + <valueless/> + </properties> + </leafNode> + <leafNode name="decrement-lifetime"> + <properties> + <help>Lifetime is decremented by the number of seconds since the last RA - use in conjunction with a DHCPv6-PD prefix</help> + <valueless/> + </properties> + </leafNode> <leafNode name="preferred-lifetime"> <properties> <help>Time in seconds that the prefix will remain preferred</help> diff --git a/interface-definitions/service-webproxy.xml.in b/interface-definitions/service-webproxy.xml.in index e4609b699..a315aa2ef 100644 --- a/interface-definitions/service-webproxy.xml.in +++ b/interface-definitions/service-webproxy.xml.in @@ -8,6 +8,32 @@ <priority>500</priority> </properties> <children> + <leafNode name="safe-ports"> + <properties> + <help>Safe port ACL</help> + <valueHelp> + <format>u32:1-1024</format> + <description>Port number. Ports included by default: 21,70,80,210,280,443,488,591,777,873,1025-65535</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-20 --range 22-69 --range 71-79 --range 81-209 --range 211-279 --range 281-442 --range 444-487 --range 489-590 --range 592-776 --range 778-872 --range 874-1024"/> + </constraint> + <multi/> + </properties> + </leafNode> + <leafNode name="ssl-safe-ports"> + <properties> + <help>SSL safe port</help> + <valueHelp> + <format>u32:1-65535</format> + <description>Port number. Ports included by default: 443</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 1-442 --range 444-65535"/> + </constraint> + <multi/> + </properties> + </leafNode> <leafNode name="append-domain"> <properties> <help>Default domain name</help> |