From 5a8e3089b35e2eca2f896a01410fcdf6ac928278 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Sun, 3 Sep 2023 13:08:00 +0200
Subject: conntrack: T4309: T4903: Refactor `system conntrack ignore` rule
generation, add IPv6 support and firewall groups
---
.../firewall/source-destination-group-ipv4.xml.i | 41 ++++
.../include/version/conntrack-version.xml.i | 2 +-
interface-definitions/system-conntrack.xml.in | 215 +++++++++++++++------
3 files changed, 197 insertions(+), 61 deletions(-)
create mode 100644 interface-definitions/include/firewall/source-destination-group-ipv4.xml.i
(limited to 'interface-definitions')
diff --git a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i
new file mode 100644
index 000000000..8c34fb933
--- /dev/null
+++ b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i
@@ -0,0 +1,41 @@
+
+
+
+ Group
+
+
+
+
+ Group of addresses
+
+ firewall group address-group
+
+
+
+
+
+ Group of domains
+
+ firewall group domain-group
+
+
+
+
+
+ Group of networks
+
+ firewall group network-group
+
+
+
+
+
+ Group of ports
+
+ firewall group port-group
+
+
+
+
+
+
diff --git a/interface-definitions/include/version/conntrack-version.xml.i b/interface-definitions/include/version/conntrack-version.xml.i
index 696f76362..c0f632c70 100644
--- a/interface-definitions/include/version/conntrack-version.xml.i
+++ b/interface-definitions/include/version/conntrack-version.xml.i
@@ -1,3 +1,3 @@
-
+
diff --git a/interface-definitions/system-conntrack.xml.in b/interface-definitions/system-conntrack.xml.in
index 8dad048b8..3abf9bbf0 100644
--- a/interface-definitions/system-conntrack.xml.in
+++ b/interface-definitions/system-conntrack.xml.in
@@ -40,82 +40,177 @@
Customized rules to ignore selective connection tracking
-
+
- Rule number
-
- u32:1-999999
- Number of conntrack ignore rule
-
-
-
-
- Ignore rule number must be between 1 and 999999
+ IPv4 rules
- #include
-
+
- Destination parameters
+ Rule number
+
+ u32:1-999999
+ Number of conntrack ignore rule
+
+
+
+
+ Ignore rule number must be between 1 and 999999
- #include
- #include
+ #include
+
+
+ Destination parameters
+
+
+ #include
+ #include
+ #include
+
+
+
+
+ Interface to ignore connections tracking on
+
+ any
+
+
+
+
+ #include
+
+
+ Protocol to match (protocol name, number, or "all")
+
+
+ all tcp_udp
+
+
+ all
+ All IP protocols
+
+
+ tcp_udp
+ Both TCP and UDP
+
+
+ u32:0-255
+ IP protocol number
+
+
+ <protocol>
+ IP protocol name
+
+
+ !<protocol>
+ IP protocol name
+
+
+
+
+
+
+
+
+ Source parameters
+
+
+ #include
+ #include
+ #include
+
+
-
-
-
- Interface to ignore connections tracking on
-
- any
-
-
-
-
- #include
-
+
+
+
+
+
+ IPv6 rules
+
+
+
- Protocol to match (protocol name, number, or "all")
-
-
- all tcp_udp
-
-
- all
- All IP protocols
-
-
- tcp_udp
- Both TCP and UDP
-
-
- u32:0-255
- IP protocol number
-
-
- <protocol>
- IP protocol name
-
+ Rule number
- !<protocol>
- IP protocol name
+ u32:1-999999
+ Number of conntrack ignore rule
-
+
-
-
-
-
- Source parameters
+ Ignore rule number must be between 1 and 999999
- #include
- #include
+ #include
+
+
+ Destination parameters
+
+
+ #include
+ #include
+ #include
+
+
+
+
+ Interface to ignore connections tracking on
+
+ any
+
+
+
+
+ #include
+
+
+ Protocol to match (protocol name, number, or "all")
+
+
+ all tcp_udp
+
+
+ all
+ All IP protocols
+
+
+ tcp_udp
+ Both TCP and UDP
+
+
+ u32:0-255
+ IP protocol number
+
+
+ <protocol>
+ IP protocol name
+
+
+ !<protocol>
+ IP protocol name
+
+
+
+
+
+
+
+
+ Source parameters
+
+
+ #include
+ #include
+ #include
+
+
-
+
-
+
+
--
cgit v1.2.3