netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

NET/FRR: Added OSPFv3 firewall rules for floating ruleset / optional rules. (#3537)

Browse Source 
* Added OSPFv3 firewall rule generation for:
- OSPFv3 IPv6 Multicasts
  -- Router Multicasts fe02::5
  -- Designated Router Multicasts fe02::6
- OSPFv3 IPv6 Unicasts
  -- Local Link network fe80::0/10

* net/frr - add toggle to disable automatic firewall rules, simplify logic and make sure the gui reflects the proper descriptions. default logging should be hooked to choices in System: Settings: Logging. ref https://github.com/opnsense/plugins/pull/3531

---------

Co-authored-by: Bill Gertz <bill.gertz@blockfish.net>
This commit is contained in:
Ad Schellevis
2023-08-12 16:36:56 +02:00
committed by GitHub
co-authored by Bill Gertz
parent 8a51b2f61c
commit 69499ffc80
3 changed files with 135 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/frr/src/etc/inc/plugins.inc.d/frr.inc
+122 -45
View File
@@ -42,74 +42,151 @@ function frr_carp_enabled()
function frr_firewall($fw)
{
global $config;
if (empty((string)(new \OPNsense\Quagga\General())->fwrules)) {
// automatic rules disabled
return;
}
$ospf = new \OPNsense\Quagga\OSPF();
if ((string)$ospf->enabled == '1') {
$ospf_default = [
'ipprotocol' => 'inet',
'protocol' => 'ospf',
'statetype' => 'keep',
'type' => 'pass',
'disablereplyto' => 1,
'quick' => true,
'log' => !isset($config['syslog']['nologdefaultpass']),
'#ref' => 'ui/quagga/general/index',
];
foreach ($ospf->networks->network->iterateItems() as $network) {
if ((string)$network->enabled == '1') {
$fw->registerFilterRule(
1, /* priority */
array(
'ipprotocol' => 'inet',
'protocol' => 'ospf',
'statetype' => 'keep',
'label' => 'Pass OSPF (autogenerated)',
[
'descr' => 'Pass OSPF (autogenerated)',
'from' => $network->ipaddr . '/' . $network->netmask,
'to' => '224.0.0.0/24',
'direction' => 'in',
'type' => 'pass',
'disablereplyto' => 1,
'quick' => true
),
null
'direction' => 'in'
],
$ospf_default
);
$fw->registerFilterRule(
1,
array(
'ipprotocol' => 'inet',
'protocol' => 'ospf',
'statetype' => 'keep',
'label' => 'Pass OSPF UNICAST (autogenerated)',
[
'descr' => 'Pass OSPF UNICAST (autogenerated)',
'from' => $network->ipaddr . '/' . $network->netmask,
'to' => '(self)',
'direction' => 'in',
'type' => 'pass',
'disablereplyto' => 1,
'quick' => true
),
null
'direction' => 'in'
],
$ospf_default
);
$fw->registerFilterRule(
1,
array(
'ipprotocol' => 'inet',
'protocol' => 'ospf',
'statetype' => 'keep',
'label' => 'Pass OSPF (autogenerated)',
'from' => '224.0.0.0/24',
'to' => $network->ipaddr . '/' . $network->netmask,
'direction' => 'out',
'type' => 'pass',
'disablereplyto' => 1,
'quick' => true
),
null
[
'descr' => 'Pass OSPF (autogenerated)',
'from' => '(self)'
'to' => '224.0.0.0/24',
'direction' => 'out'
],
$ospf_default
);
$fw->registerFilterRule(
1,
array(
'ipprotocol' => 'inet',
'protocol' => 'ospf',
'statetype' => 'keep',
'label' => 'Pass OSPF UNICAST (autogenerated)',
[
'descr' => 'Pass OSPF UNICAST (autogenerated)',
'from' => '(self)',
'to' => $network->ipaddr . '/' . $network->netmask,
'direction' => 'out',
'type' => 'pass',
'disablereplyto' => 1,
'quick' => true
),
null
],
$ospf_default
);
}
}
}
$ospf6 = new \OPNsense\Quagga\OSPF6();
if ((string)$ospf6->enabled == '1') {
$ospf6_default = [
'ipprotocol' => 'inet6',
'protocol' => 'ospf',
'statetype' => 'keep',
'type' => 'pass',
'disablereplyto' => 1,
'quick' => true,
'log' => !isset($config['syslog']['nologdefaultpass']),
'#ref' => 'ui/quagga/general/index',
];
foreach ($ospf6->interfaces->interface->iterateItems() as $interface) {
if ((string)$interface->enabled == '1') {
$fw->registerFilterRule(
1, /* priority */
[
'interface' => $interface->interfacename,
'descr' => 'Pass OSPF6 MULTICAST (autogenerated)',
'from' => 'fe80::0/10',
'to' => 'ff02::5/128',
'direction' => 'in'
],
$ospf6_default
);
$fw->registerFilterRule(
1, /* priority */
[
'interface' => $interface->interfacename,
'descr' => 'Pass OSPF6 MULTICAST DR (autogenerated)',
'from' => 'fe80::0/10',
'to' => 'ff02::6/128',
'direction' => 'in'
],
$ospf6_default
);
$fw->registerFilterRule(
1,
[
'interface' => $interface->interfacename,
'descr' => 'Pass OSPF6 UNICAST (autogenerated)',
'from' => 'fe80::0/10',
'to' => '(self)',
'direction' => 'in'
],
$ospf6_default
);
$fw->registerFilterRule(
1,
[
'interface' => $interface->interfacename,
'descr' => 'Pass OSPF6 MULTICAST (autogenerated)',
'from' => '(self)',
'to' => 'ff02::5/128',
'direction' => 'out'
],
$ospf6_default
);
$fw->registerFilterRule(
1,
[
'interface' => $interface->interfacename,
'descr' => 'Pass OSPF6 MULTICAST DR (autogenerated)',
'from' => '(self)',
'to' => 'ff02::6/128',
'direction' => 'out'
],
$ospf6_default
);
$fw->registerFilterRule(
1,
[
'interface' => $interface->interfacename,
'descr' => 'Pass OSPF6 UNICAST (autogenerated)',
'from' => '(self)',
'to' => 'fe80::0/10',
'direction' => 'out'
],
$ospf6_default
);
}
}
net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/general.xml
+8
View File
@@ -36,4 +36,12 @@
<type>dropdown</type>
<help>This is the detail level of the log. A higher level means more data is logged.</help>
</field>
<field>
<id>general.fwrules</id>
<label>Firewall rules</label>
<type>checkbox</type>
<help>Enable automatically created firewall rules, when additional policies are needed, disable this and define
your own custom policies in the Firewall section.
</help>
</field>
</form>
net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/General.xml
+5 -1
View File
@@ -1,7 +1,7 @@
<model>
<mount>//OPNsense/quagga/general</mount>
<description>Quagga Routing configuration</description>
<version>1.0.2</version>
<version>1.0.3</version>
<items>
<enabled type="BooleanField">
<default>0</default>
@@ -43,5 +43,9 @@
<debugging>Debugging</debugging>
</OptionValues>
</sysloglevel>
<fwrules type="BooleanField">
<default>1</default>
<Required>Y</Required>
</fwrules>
</items>
</model>