From 2c8e41465ee3e4ee8fe5048df3265c7b10ee3b91 Mon Sep 17 00:00:00 2001 From: Indrajit Raychaudhuri Date: Mon, 18 Dec 2023 02:45:12 -0600 Subject: firewall: T5834: Rename 'enable-default-log' to 'default-log' Rename chain level defaults log option from `enable-default-log` to `default-log` for consistency. (cherry picked from commit 245e758aa2ea8779186d0c92d79d33170d036992) --- interface-definitions/firewall.xml.in | 2 +- interface-definitions/include/firewall/bridge-custom-name.xml.i | 4 ++-- interface-definitions/include/firewall/bridge-hook-forward.xml.i | 3 ++- interface-definitions/include/firewall/default-log.xml.i | 8 ++++++++ interface-definitions/include/firewall/enable-default-log.xml.i | 8 -------- interface-definitions/include/firewall/ipv4-custom-name.xml.i | 4 ++-- interface-definitions/include/firewall/ipv4-hook-forward.xml.i | 4 ++-- interface-definitions/include/firewall/ipv4-hook-input.xml.i | 4 ++-- interface-definitions/include/firewall/ipv4-hook-output.xml.i | 4 ++-- interface-definitions/include/firewall/ipv6-custom-name.xml.i | 4 ++-- interface-definitions/include/firewall/ipv6-hook-forward.xml.i | 4 ++-- interface-definitions/include/firewall/ipv6-hook-input.xml.i | 4 ++-- interface-definitions/include/firewall/ipv6-hook-output.xml.i | 4 ++-- interface-definitions/policy-route.xml.in | 4 ++-- 14 files changed, 31 insertions(+), 30 deletions(-) create mode 100644 interface-definitions/include/firewall/default-log.xml.i delete mode 100644 interface-definitions/include/firewall/enable-default-log.xml.i (limited to 'interface-definitions') diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in index 70afdc995..a4023058f 100644 --- a/interface-definitions/firewall.xml.in +++ b/interface-definitions/firewall.xml.in @@ -368,7 +368,7 @@ #include - #include + #include Default-action for traffic coming into this zone diff --git a/interface-definitions/include/firewall/bridge-custom-name.xml.i b/interface-definitions/include/firewall/bridge-custom-name.xml.i index a85fd5a19..654493c0e 100644 --- a/interface-definitions/include/firewall/bridge-custom-name.xml.i +++ b/interface-definitions/include/firewall/bridge-custom-name.xml.i @@ -8,7 +8,7 @@ #include - #include + #include #include @@ -36,4 +36,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/bridge-hook-forward.xml.i b/interface-definitions/include/firewall/bridge-hook-forward.xml.i index 23d757070..99f66ec77 100644 --- a/interface-definitions/include/firewall/bridge-hook-forward.xml.i +++ b/interface-definitions/include/firewall/bridge-hook-forward.xml.i @@ -10,6 +10,7 @@ #include + #include #include @@ -31,4 +32,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/default-log.xml.i b/interface-definitions/include/firewall/default-log.xml.i new file mode 100644 index 000000000..dceacdb89 --- /dev/null +++ b/interface-definitions/include/firewall/default-log.xml.i @@ -0,0 +1,8 @@ + + + + Log packets hitting default-action + + + + diff --git a/interface-definitions/include/firewall/enable-default-log.xml.i b/interface-definitions/include/firewall/enable-default-log.xml.i deleted file mode 100644 index 0efd8341b..000000000 --- a/interface-definitions/include/firewall/enable-default-log.xml.i +++ /dev/null @@ -1,8 +0,0 @@ - - - - Log packets hitting default-action - - - - \ No newline at end of file diff --git a/interface-definitions/include/firewall/ipv4-custom-name.xml.i b/interface-definitions/include/firewall/ipv4-custom-name.xml.i index c6420fe1f..8199d15fe 100644 --- a/interface-definitions/include/firewall/ipv4-custom-name.xml.i +++ b/interface-definitions/include/firewall/ipv4-custom-name.xml.i @@ -8,7 +8,7 @@ #include - #include + #include #include @@ -39,4 +39,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i index 100f1c3d9..de2c70482 100644 --- a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i @@ -10,7 +10,7 @@ #include - #include + #include #include @@ -36,4 +36,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/ipv4-hook-input.xml.i b/interface-definitions/include/firewall/ipv4-hook-input.xml.i index 22546640b..5d32657ea 100644 --- a/interface-definitions/include/firewall/ipv4-hook-input.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-input.xml.i @@ -10,7 +10,7 @@ #include - #include + #include #include @@ -33,4 +33,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/ipv4-hook-output.xml.i b/interface-definitions/include/firewall/ipv4-hook-output.xml.i index 80c30cdeb..2b537ce5e 100644 --- a/interface-definitions/include/firewall/ipv4-hook-output.xml.i +++ b/interface-definitions/include/firewall/ipv4-hook-output.xml.i @@ -10,7 +10,7 @@ #include - #include + #include #include @@ -33,4 +33,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/ipv6-custom-name.xml.i b/interface-definitions/include/firewall/ipv6-custom-name.xml.i index 2cc45a60c..5748b3927 100644 --- a/interface-definitions/include/firewall/ipv6-custom-name.xml.i +++ b/interface-definitions/include/firewall/ipv6-custom-name.xml.i @@ -8,7 +8,7 @@ #include - #include + #include #include @@ -39,4 +39,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i index fb38267eb..b53f09f59 100644 --- a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i @@ -10,7 +10,7 @@ #include - #include + #include #include @@ -36,4 +36,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/ipv6-hook-input.xml.i b/interface-definitions/include/firewall/ipv6-hook-input.xml.i index 49d4493cc..493611fb1 100644 --- a/interface-definitions/include/firewall/ipv6-hook-input.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-input.xml.i @@ -10,7 +10,7 @@ #include - #include + #include #include @@ -33,4 +33,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/ipv6-hook-output.xml.i b/interface-definitions/include/firewall/ipv6-hook-output.xml.i index 452b9027f..ffe1c72b8 100644 --- a/interface-definitions/include/firewall/ipv6-hook-output.xml.i +++ b/interface-definitions/include/firewall/ipv6-hook-output.xml.i @@ -10,7 +10,7 @@ #include - #include + #include #include @@ -33,4 +33,4 @@ - \ No newline at end of file + diff --git a/interface-definitions/policy-route.xml.in b/interface-definitions/policy-route.xml.in index d4ec75786..92e7a0cb4 100644 --- a/interface-definitions/policy-route.xml.in +++ b/interface-definitions/policy-route.xml.in @@ -12,7 +12,7 @@ #include - #include + #include #include @@ -67,7 +67,7 @@ #include - #include + #include #include -- cgit v1.2.3 From 201501ace13020e187dfbba4b125eb3f8664046d Mon Sep 17 00:00:00 2001 From: Indrajit Raychaudhuri Date: Mon, 18 Dec 2023 02:57:01 -0600 Subject: firewall: T5834: Migration for 'enable-default-log' to 'default-log' (cherry picked from commit 7c40b70af9def9242b30d1fc949288d9da2bd027) --- .../include/version/firewall-version.xml.i | 2 +- .../include/version/policy-version.xml.i | 2 +- src/migration-scripts/firewall/13-to-14 | 59 ++++++++++++++++++++++ src/migration-scripts/policy/7-to-8 | 56 ++++++++++++++++++++ 4 files changed, 117 insertions(+), 2 deletions(-) create mode 100755 src/migration-scripts/firewall/13-to-14 create mode 100755 src/migration-scripts/policy/7-to-8 (limited to 'interface-definitions') diff --git a/interface-definitions/include/version/firewall-version.xml.i b/interface-definitions/include/version/firewall-version.xml.i index 299eebb00..6702ee041 100644 --- a/interface-definitions/include/version/firewall-version.xml.i +++ b/interface-definitions/include/version/firewall-version.xml.i @@ -1,3 +1,3 @@ - + diff --git a/interface-definitions/include/version/policy-version.xml.i b/interface-definitions/include/version/policy-version.xml.i index 4fbe757f5..db727fea9 100644 --- a/interface-definitions/include/version/policy-version.xml.i +++ b/interface-definitions/include/version/policy-version.xml.i @@ -1,3 +1,3 @@ - + diff --git a/src/migration-scripts/firewall/13-to-14 b/src/migration-scripts/firewall/13-to-14 new file mode 100755 index 000000000..f45ff0674 --- /dev/null +++ b/src/migration-scripts/firewall/13-to-14 @@ -0,0 +1,59 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2023 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# T5834: Rename 'enable-default-log' to 'default-log' +# From + # set firewall ... filter enable-default-log + # set firewall ... name enable-default-log +# To + # set firewall ... filter default-log + # set firewall ... name default-log + +from sys import argv +from sys import exit + +from vyos.configtree import ConfigTree + +if len(argv) < 2: + print("Must specify file name!") + exit(1) + +file_name = argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +base = ['firewall'] +config = ConfigTree(config_file) + +if not config.exists(base): + # Nothing to do + exit(0) + +for family in ['ipv4', 'ipv6', 'bridge']: + if config.exists(base + [family]): + for hook in ['forward', 'input', 'output', 'name']: + if config.exists(base + [family, hook]): + for priority in config.list_nodes(base + [family, hook]): + if config.exists(base + [family, hook, priority, 'enable-default-log']): + config.rename(base + [family, hook, priority, 'enable-default-log'], 'default-log') + +try: + with open(file_name, 'w') as f: + f.write(config.to_string()) +except OSError as e: + print("Failed to save the modified config: {}".format(e)) + exit(1) diff --git a/src/migration-scripts/policy/7-to-8 b/src/migration-scripts/policy/7-to-8 new file mode 100755 index 000000000..73eece1a6 --- /dev/null +++ b/src/migration-scripts/policy/7-to-8 @@ -0,0 +1,56 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2023 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# T5834: Rename 'enable-default-log' to 'default-log' +# From + # set policy [route | route 6] enable-default-log +# To + # set policy [route | route 6] default-log + +from sys import argv +from sys import exit + +from vyos.configtree import ConfigTree + +if len(argv) < 2: + print("Must specify file name!") + exit(1) + +file_name = argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +base = ['policy'] +config = ConfigTree(config_file) + +if not config.exists(base): + # Nothing to do + exit(0) + +for family in ['route', 'route6']: + if config.exists(base + [family]): + + for policy_name in config.list_nodes(base + [family]): + if config.exists(base + [family, policy_name, 'enable-default-log']): + config.rename(base + [family, policy_name, 'enable-default-log'], 'default-log') + +try: + with open(file_name, 'w') as f: + f.write(config.to_string()) +except OSError as e: + print("Failed to save the modified config: {}".format(e)) + exit(1) -- cgit v1.2.3 From 3d579863c98627fbe83efc6033ccc37b81e68d96 Mon Sep 17 00:00:00 2001 From: Indrajit Raychaudhuri Date: Fri, 22 Dec 2023 17:14:04 -0600 Subject: firewall: T5834: Remove vestigial include file This file is a left over from previous refactoring and no longer referenced anywhere in the interface definitions. (cherry picked from commit f8f382b2195da8db8b730f107ffba16e67dac822) --- .../include/firewall/common-rule.xml.i | 386 --------------------- 1 file changed, 386 deletions(-) delete mode 100644 interface-definitions/include/firewall/common-rule.xml.i (limited to 'interface-definitions') diff --git a/interface-definitions/include/firewall/common-rule.xml.i b/interface-definitions/include/firewall/common-rule.xml.i deleted file mode 100644 index 7417a3c58..000000000 --- a/interface-definitions/include/firewall/common-rule.xml.i +++ /dev/null @@ -1,386 +0,0 @@ - -#include -#include - - - Destination parameters - - - #include - - - - - Option to disable firewall rule - - - - - - IP fragment match - - - - - Second and further fragments of fragmented packets - - - - - - Head fragments or unfragmented packets - - - - - - - - Match inbound-interface - - - #include - - - - - Match outbound-interface - - - #include - - - - - Inbound IPsec packets - - - - - Inbound IPsec packets - - - - - - Inbound non-IPsec packets - - - - - - - - Rate limit using a token bucket filter - - - - - Maximum number of packets to allow in excess of rate - - u32:0-4294967295 - Maximum number of packets to allow in excess of rate - - - - - - - - - Maximum average matching rate - - txt - integer/unit (Example: 5/minute) - - - \d+/(second|minute|hour|day) - - - - - - - - Option to log packets matching rule - - enable disable - - - enable - Enable log - - - disable - Disable log - - - (enable|disable) - - - -#include - - - Connection status - - - - - NAT connection status - - destination source - - - destination - Match connections that are subject to destination NAT - - - source - Match connections that are subject to source NAT - - - ^(destination|source)$ - - - - - - - - Protocol to match (protocol name, number, or "all") - - - all tcp_udp - - - all - All IP protocols - - - tcp_udp - Both TCP and UDP - - - u32:0-255 - IP protocol number - - - <protocol> - IP protocol name - - - !<protocol> - IP protocol name - - - - - - - - - Parameters for matching recently seen sources - - - - - Source addresses seen more than N times - - u32:1-255 - Source addresses seen more than N times - - - - - - - - - Source addresses seen in the last second/minute/hour - - second minute hour - - - second - Source addresses seen COUNT times in the last second - - - minute - Source addresses seen COUNT times in the last minute - - - hour - Source addresses seen COUNT times in the last hour - - - (second|minute|hour) - - - - - - - - Source parameters - - - #include - #include - #include - #include - - - - - Session state - - - - - Established state - - enable disable - - - enable - Enable - - - disable - Disable - - - (enable|disable) - - - - - - Invalid state - - enable disable - - - enable - Enable - - - disable - Disable - - - (enable|disable) - - - - - - New state - - enable disable - - - enable - Enable - - - disable - Disable - - - (enable|disable) - - - - - - Related state - - enable disable - - - enable - Enable - - - disable - Disable - - - (enable|disable) - - - - - -#include - - - Time to match rule - - - - - Date to start matching rule - - txt - Enter date using following notation - YYYY-MM-DD - - - (\d{4}\-\d{2}\-\d{2}) - - - - - - Time of day to start matching rule - - txt - Enter time using using 24 hour notation - hh:mm:ss - - - ([0-2][0-9](\:[0-5][0-9]){1,2}) - - - - - - Date to stop matching rule - - txt - Enter date using following notation - YYYY-MM-DD - - - (\d{4}\-\d{2}\-\d{2}) - - - - - - Time of day to stop matching rule - - txt - Enter time using using 24 hour notation - hh:mm:ss - - - ([0-2][0-9](\:[0-5][0-9]){1,2}) - - - - - - Comma separated weekdays to match rule on - - txt - Name of day (Monday, Tuesday, Wednesday, Thursdays, Friday, Saturday, Sunday) - - - u32:0-6 - Day number (0 = Sunday ... 6 = Saturday) - - - - - - -- cgit v1.2.3 From 57faafc8f8597f62d5edb5529349a565d7d2e865 Mon Sep 17 00:00:00 2001 From: Indrajit Raychaudhuri Date: Fri, 22 Dec 2023 17:22:20 -0600 Subject: firewall: T5834: Improve log message and simplify log-option include `include/firewall/rule-log-options.xml.i` is now more aptly renamed to `include/firewall/log-options.xml.i`. (cherry picked from commit 53a48f499ae9bcc2f657136bb7779b38aad1c242) --- .../include/firewall/common-rule-bridge.xml.i | 4 +- .../include/firewall/common-rule-inet.xml.i | 2 +- .../include/firewall/common-rule-ipv4-raw.xml.i | 2 +- .../include/firewall/log-options.xml.i | 89 ++++++++++++++++++++++ interface-definitions/include/firewall/log.xml.i | 2 +- .../include/firewall/rule-log-options.xml.i | 89 ---------------------- 6 files changed, 94 insertions(+), 94 deletions(-) create mode 100644 interface-definitions/include/firewall/log-options.xml.i delete mode 100644 interface-definitions/include/firewall/rule-log-options.xml.i (limited to 'interface-definitions') diff --git a/interface-definitions/include/firewall/common-rule-bridge.xml.i b/interface-definitions/include/firewall/common-rule-bridge.xml.i index ebf95a111..dcdd970ac 100644 --- a/interface-definitions/include/firewall/common-rule-bridge.xml.i +++ b/interface-definitions/include/firewall/common-rule-bridge.xml.i @@ -19,7 +19,7 @@ #include -#include +#include Source parameters @@ -31,4 +31,4 @@ #include #include #include - \ No newline at end of file + diff --git a/interface-definitions/include/firewall/common-rule-inet.xml.i b/interface-definitions/include/firewall/common-rule-inet.xml.i index 030adfe7c..3b5cb724d 100644 --- a/interface-definitions/include/firewall/common-rule-inet.xml.i +++ b/interface-definitions/include/firewall/common-rule-inet.xml.i @@ -78,7 +78,7 @@ #include -#include +#include Connection status diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i index a1071a09a..b253ee048 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i @@ -144,7 +144,7 @@ -#include +#include Connection status diff --git a/interface-definitions/include/firewall/log-options.xml.i b/interface-definitions/include/firewall/log-options.xml.i new file mode 100644 index 000000000..e8b0cdec3 --- /dev/null +++ b/interface-definitions/include/firewall/log-options.xml.i @@ -0,0 +1,89 @@ + + + + Log options + + + + + Set log group + + u32:0-65535 + Log group to send messages to + + + + + + + + + Length of packet payload to include in netlink message + + u32:0-9000 + Length of packet payload to include in netlink message + + + + + + + + + Number of packets to queue inside the kernel before sending them to userspace + + u32:0-65535 + Number of packets to queue inside the kernel before sending them to userspace + + + + + + + + + Set log-level + + emerg alert crit err warn notice info debug + + + emerg + Emerg log level + + + alert + Alert log level + + + crit + Critical log level + + + err + Error log level + + + warn + Warning log level + + + notice + Notice log level + + + info + Info log level + + + debug + Debug log level + + + (emerg|alert|crit|err|warn|notice|info|debug) + + level must be alert, crit, debug, emerg, err, info, notice or warn + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/log.xml.i b/interface-definitions/include/firewall/log.xml.i index 8f3fae1be..795ed77be 100644 --- a/interface-definitions/include/firewall/log.xml.i +++ b/interface-definitions/include/firewall/log.xml.i @@ -1,7 +1,7 @@ - Enable log + Log packets hitting this rule \ No newline at end of file diff --git a/interface-definitions/include/firewall/rule-log-options.xml.i b/interface-definitions/include/firewall/rule-log-options.xml.i deleted file mode 100644 index e8b0cdec3..000000000 --- a/interface-definitions/include/firewall/rule-log-options.xml.i +++ /dev/null @@ -1,89 +0,0 @@ - - - - Log options - - - - - Set log group - - u32:0-65535 - Log group to send messages to - - - - - - - - - Length of packet payload to include in netlink message - - u32:0-9000 - Length of packet payload to include in netlink message - - - - - - - - - Number of packets to queue inside the kernel before sending them to userspace - - u32:0-65535 - Number of packets to queue inside the kernel before sending them to userspace - - - - - - - - - Set log-level - - emerg alert crit err warn notice info debug - - - emerg - Emerg log level - - - alert - Alert log level - - - crit - Critical log level - - - err - Error log level - - - warn - Warning log level - - - notice - Notice log level - - - info - Info log level - - - debug - Debug log level - - - (emerg|alert|crit|err|warn|notice|info|debug) - - level must be alert, crit, debug, emerg, err, info, notice or warn - - - - - \ No newline at end of file -- cgit v1.2.3