Skip to content

Commit

Permalink
Merge pull request #2471 from nicolas-fort/T5729
Browse files Browse the repository at this point in the history 
T5729: firewall: switch to valueless in
  • Loading branch information
@c-po
c-po authored Nov 11, 2023
2 parents 2ca0ac6 + c4409d6 commit e5a53d4
Show file tree
Hide file tree
Showing 16 changed files with 229 additions and 293 deletions.
20 changes: 1 addition & 19 deletions interface-definitions/include/firewall/common-rule-bridge.xml.i
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,25 +23,7 @@
</completionHelp>
</properties>
</leafNode>
<leafNode name="log">
<properties>
<help>Option to log packets matching rule</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable log</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable log</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
#include <include/firewall/rule-log-options.xml.i>
<node name="source">
<properties>
Expand Down
123 changes: 2 additions & 121 deletions interface-definitions/include/firewall/common-rule-inet.xml.i
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82,44 +82,7 @@
</leafNode>
</children>
</node>
<leafNode name="log">
<properties>
<help>Option to log packets matching rule</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable log</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable log</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="log">
<properties>
<help>Option to log packets matching rule</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable log</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable log</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
#include <include/firewall/rule-log-options.xml.i>
<node name="connection-status">
<properties>
Expand Down Expand Up @@ -222,89 +185,7 @@
</children>
</node>
#include <include/firewall/synproxy.xml.i>
<node name="state">
<properties>
<help>Session state</help>
</properties>
<children>
<leafNode name="established">
<properties>
<help>Established state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="invalid">
<properties>
<help>Invalid state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="new">
<properties>
<help>New state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="related">
<properties>
<help>Related state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
</children>
</node>
#include <include/firewall/state.xml.i>
#include <include/firewall/tcp-flags.xml.i>
#include <include/firewall/tcp-mss.xml.i>
<node name="time">
Expand Down
15 changes: 4 additions & 11 deletions interface-definitions/include/firewall/log.xml.i
View file
Original file line number Diff line number Diff line change
@@ -1,15 +1,8 @@
<!-- include start from firewall/log.xml.i -->
<node name="log">
<leafNode name="log">
<properties>
<help>Option to log packets</help>
<help>Enable log</help>
<valueless/>
</properties>
<children>
<leafNode name="enable">
<properties>
<help>Enable logging</help>
<valueless/>
</properties>
</leafNode>
</children>
</node>
</leafNode>
<!-- include end -->
30 changes: 30 additions & 0 deletions interface-definitions/include/firewall/state.xml.i
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
<!-- include start from firewall/state.xml.i -->
<leafNode name="state">
<properties>
<help>Session state</help>
<completionHelp>
<list>established invalid new related</list>
</completionHelp>
<valueHelp>
<format>established</format>
<description>Established state</description>
</valueHelp>
<valueHelp>
<format>invalid</format>
<description>Invalid state</description>
</valueHelp>
<valueHelp>
<format>new</format>
<description>New state</description>
</valueHelp>
<valueHelp>
<format>related</format>
<description>Related state</description>
</valueHelp>
<constraint>
<regex>(established|invalid|new|related)</regex>
</constraint>
<multi/>
</properties>
</leafNode>
<!-- include end -->
7 changes: 1 addition & 6 deletions interface-definitions/include/nat-rule.xml.i
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,7 @@
#include <include/firewall/nat-balance.xml.i>
</children>
</node>
<leafNode name="log">
<properties>
<help>NAT rule logging</help>
<valueless/>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
<leafNode name="packet-type">
<properties>
<help>Packet type</help>
Expand Down
104 changes: 2 additions & 102 deletions interface-definitions/include/policy/route-common.xml.i
View file
Original file line number Diff line number Diff line change
Expand Up @@ -77,25 +77,7 @@
</leafNode>
</children>
</node>
<leafNode name="log">
<properties>
<help>Option to log packets matching rule</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable log</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable log</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
<leafNode name="protocol">
<properties>
<help>Protocol to match (protocol name, number, or "all")</help>
Expand Down Expand Up @@ -231,89 +213,7 @@
</leafNode>
</children>
</node>
<node name="state">
<properties>
<help>Session state</help>
</properties>
<children>
<leafNode name="established">
<properties>
<help>Established state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="invalid">
<properties>
<help>Invalid state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="new">
<properties>
<help>New state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="related">
<properties>
<help>Related state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
</children>
</node>
#include <include/firewall/state.xml.i>
#include <include/firewall/tcp-flags.xml.i>
#include <include/firewall/tcp-mss.xml.i>
<node name="time">
Expand Down
2 changes: 1 addition & 1 deletion interface-definitions/include/version/firewall-version.xml.i
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
<!-- include start from include/version/firewall-version.xml.i -->
<syntaxVersion component='firewall' version='12'></syntaxVersion>
<syntaxVersion component='firewall' version='13'></syntaxVersion>
<!-- include end -->
2 changes: 1 addition & 1 deletion interface-definitions/include/version/policy-version.xml.i
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
<!-- include start from include/version/policy-version.xml.i -->
<syntaxVersion component='policy' version='6'></syntaxVersion>
<syntaxVersion component='policy' version='7'></syntaxVersion>
<!-- include end -->
7 changes: 1 addition & 6 deletions interface-definitions/nat66.xml.in
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,7 @@
</properties>
</leafNode>
#include <include/nat-exclude.xml.i>
<leafNode name="log">
<properties>
<help>NAT66 rule logging</help>
<valueless/>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
#include <include/firewall/outbound-interface-no-group.xml.i>
#include <include/nat/protocol.xml.i>
<node name="destination">
Expand Down
5 changes: 2 additions & 3 deletions python/vyos/firewall.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,6 @@ def nft_action(vyos_action):

def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
output = []
#def_suffix = '6' if ip_name == 'ip6' else ''

if ip_name == 'ip6':
def_suffix = '6'
Expand All @@ -97,7 +96,7 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
family = 'bri' if ip_name == 'bri' else 'ipv4'

if 'state' in rule_conf and rule_conf['state']:
states = ",".join([s for s, v in rule_conf['state'].items() if v == 'enable'])
states = ",".join([s for s in rule_conf['state']])

if states:
output.append(f'ct state {{{states}}}')
Expand Down Expand Up @@ -395,7 +394,7 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
if 'priority' in rule_conf['vlan']:
output.append(f'vlan pcp {rule_conf["vlan"]["priority"]}')

if 'log' in rule_conf and rule_conf['log'] == 'enable':
if 'log' in rule_conf:
action = rule_conf['action'] if 'action' in rule_conf else 'accept'
#output.append(f'log prefix "[{fw_name[:19]}-{rule_id}-{action[:1].upper()}]"')
output.append(f'log prefix "[{family}-{hook}-{fw_name}-{rule_id}-{action[:1].upper()}]"')
Expand Down
Loading

0 comments on commit e5a53d4

Please sign in to comment.