Skip to content

Commit

Permalink
T5729: T5590: T5616: backport to sagita fwall marks, fix on firewall …
Browse files Browse the repository at this point in the history
…logs parsing, and migration to valueless node for log and state matchers
  • Loading branch information
nicolas-fort committed Nov 14, 2023
1 parent 9f92b9f commit 9e05326
Show file tree
Hide file tree
Showing 17 changed files with 309 additions and 300 deletions.
124 changes: 3 additions & 121 deletions interface-definitions/include/firewall/common-rule-inet.xml.i
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
#include <include/generic-description.xml.i>
#include <include/firewall/dscp.xml.i>
#include <include/firewall/packet-options.xml.i>
#include <include/firewall/firewall-mark.xml.i>
#include <include/firewall/connection-mark.xml.i>
#include <include/firewall/conntrack-helper.xml.i>
#include <include/firewall/nft-queue.xml.i>
Expand Down Expand Up @@ -81,44 +82,7 @@
</leafNode>
</children>
</node>
<leafNode name="log">
<properties>
<help>Option to log packets matching rule</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable log</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable log</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="log">
<properties>
<help>Option to log packets matching rule</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable log</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable log</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
#include <include/firewall/rule-log-options.xml.i>
<node name="connection-status">
<properties>
Expand Down Expand Up @@ -220,89 +184,7 @@
</leafNode>
</children>
</node>
<node name="state">
<properties>
<help>Session state</help>
</properties>
<children>
<leafNode name="established">
<properties>
<help>Established state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="invalid">
<properties>
<help>Invalid state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="new">
<properties>
<help>New state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="related">
<properties>
<help>Related state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
</children>
</node>
#include <include/firewall/state.xml.i>
#include <include/firewall/tcp-flags.xml.i>
<node name="time">
<properties>
Expand Down
26 changes: 26 additions & 0 deletions interface-definitions/include/firewall/firewall-mark.xml.i
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
<!-- include start from firewall/firewall-mark.xml.i -->
<leafNode name="mark">
<properties>
<help>Firewall mark</help>
<valueHelp>
<format>u32:0-2147483647</format>
<description>Firewall mark to match</description>
</valueHelp>
<valueHelp>
<format>!u32:0-2147483647</format>
<description>Inverted Firewall mark to match</description>
</valueHelp>
<valueHelp>
<format>&lt;start-end&gt;</format>
<description>Firewall mark range to match</description>
</valueHelp>
<valueHelp>
<format>!&lt;start-end&gt;</format>
<description>Firewall mark inverted range to match</description>
</valueHelp>
<constraint>
<validator name="numeric-exclude" argument="--allow-range --range 0-2147483647"/>
</constraint>
</properties>
</leafNode>
<!-- include end -->
16 changes: 4 additions & 12 deletions interface-definitions/include/firewall/log.xml.i
Original file line number Diff line number Diff line change
@@ -1,15 +1,7 @@
<!-- include start from firewall/log.xml.i -->
<node name="log">
<leafNode name="log">
<properties>
<help>Option to log packets</help>
<help>Enable log</help>
<valueless/>
</properties>
<children>
<leafNode name="enable">
<properties>
<help>Enable logging</help>
<valueless/>
</properties>
</leafNode>
</children>
</node>
<!-- include end -->
</leafNode>
30 changes: 30 additions & 0 deletions interface-definitions/include/firewall/state.xml.i
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
<!-- include start from firewall/state.xml.i -->
<leafNode name="state">
<properties>
<help>Session state</help>
<completionHelp>
<list>established invalid new related</list>
</completionHelp>
<valueHelp>
<format>established</format>
<description>Established state</description>
</valueHelp>
<valueHelp>
<format>invalid</format>
<description>Invalid state</description>
</valueHelp>
<valueHelp>
<format>new</format>
<description>New state</description>
</valueHelp>
<valueHelp>
<format>related</format>
<description>Related state</description>
</valueHelp>
<constraint>
<regex>(established|invalid|new|related)</regex>
</constraint>
<multi/>
</properties>
</leafNode>
<!-- include end -->
7 changes: 1 addition & 6 deletions interface-definitions/include/nat-rule.xml.i
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,7 @@
#include <include/firewall/nat-balance.xml.i>
</children>
</node>
<leafNode name="log">
<properties>
<help>NAT rule logging</help>
<valueless/>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
<leafNode name="packet-type">
<properties>
<help>Packet type</help>
Expand Down
105 changes: 3 additions & 102 deletions interface-definitions/include/policy/route-common.xml.i
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
<!-- include start from policy/route-common.xml.i -->
#include <include/policy/route-rule-action.xml.i>
#include <include/generic-description.xml.i>
#include <include/firewall/firewall-mark.xml.i>
<leafNode name="disable">
<properties>
<help>Option to disable firewall rule</help>
Expand Down Expand Up @@ -76,25 +77,7 @@
</leafNode>
</children>
</node>
<leafNode name="log">
<properties>
<help>Option to log packets matching rule</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable log</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable log</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
<leafNode name="protocol">
<properties>
<help>Protocol to match (protocol name, number, or "all")</help>
Expand Down Expand Up @@ -230,89 +213,7 @@
</leafNode>
</children>
</node>
<node name="state">
<properties>
<help>Session state</help>
</properties>
<children>
<leafNode name="established">
<properties>
<help>Established state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="invalid">
<properties>
<help>Invalid state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="new">
<properties>
<help>New state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
<leafNode name="related">
<properties>
<help>Related state</help>
<completionHelp>
<list>enable disable</list>
</completionHelp>
<valueHelp>
<format>enable</format>
<description>Enable</description>
</valueHelp>
<valueHelp>
<format>disable</format>
<description>Disable</description>
</valueHelp>
<constraint>
<regex>(enable|disable)</regex>
</constraint>
</properties>
</leafNode>
</children>
</node>
#include <include/firewall/state.xml.i>
#include <include/firewall/tcp-flags.xml.i>
<node name="time">
<properties>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
<!-- include start from include/version/firewall-version.xml.i -->
<syntaxVersion component='firewall' version='12'></syntaxVersion>
<syntaxVersion component='firewall' version='13'></syntaxVersion>
<!-- include end -->
2 changes: 1 addition & 1 deletion interface-definitions/include/version/policy-version.xml.i
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
<!-- include start from include/version/policy-version.xml.i -->
<syntaxVersion component='policy' version='6'></syntaxVersion>
<syntaxVersion component='policy' version='7'></syntaxVersion>
<!-- include end -->
7 changes: 1 addition & 6 deletions interface-definitions/nat66.xml.in
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,7 @@
</properties>
</leafNode>
#include <include/nat-exclude.xml.i>
<leafNode name="log">
<properties>
<help>NAT66 rule logging</help>
<valueless/>
</properties>
</leafNode>
#include <include/firewall/log.xml.i>
#include <include/firewall/outbound-interface-no-group.xml.i>
#include <include/nat/protocol.xml.i>
<node name="destination">
Expand Down

0 comments on commit 9e05326

Please sign in to comment.