netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/firewall - NPTv6 add track interface and validations for https://github.com/opnsense/core/issues/6383

Browse Source
This commit is contained in:
Ad Schellevis
2024-01-04 12:03:55 +01:00
parent 6143ea9bf7
commit ab8853c434
5 changed files with 36 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/NptController.php
+1 -1
View File
@@ -39,7 +39,7 @@ class NptController extends FilterBaseController
};
return $this->searchBase(
"npt.rule",
['enabled', 'sequence', 'source_net', 'destination_net', 'description'],
['enabled', 'sequence', 'source_net', 'destination_net', 'trackif', 'description'],
"sequence",
$filter_funct
);
net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/NptController.php
+3
View File
@@ -47,6 +47,9 @@ class NptController extends \OPNsense\Base\IndexController
[
'id' => 'destination_net', 'heading' => gettext('External IPv6 Prefix')
],
[
'id' => 'trackif', 'heading' => gettext('Track if')
],
[
'id' => 'description', 'heading' => gettext('Description')
]
net/firewall/src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+13
View File
@@ -10,6 +10,12 @@
<label>Sequence</label>
<type>text</type>
</field>
<field>
<id>rule.log</id>
<label>Log</label>
<type>checkbox</type>
<help>Log packets that are handled by this rule</help>
</field>
<field>
<id>rule.interface</id>
<label>Interface</label>
@@ -24,6 +30,13 @@
<id>rule.destination_net</id>
<label>External IPv6 Prefix (target)</label>
<type>text</type>
<help>Enter the external IPv6 prefix for this network prefix translation. Leave empty to auto-detect the prefix address using the specified tracking interface instead. The prefix size specified for the internal prefix will also be applied to the external prefix.</help>
</field>
<field>
<id>rule.trackif</id>
<label>Track interface</label>
<type>dropdown</type>
<help>Use prefix defined on the selected interface instead of the interface this rule applies to when target prefix is not provided.</help>
</field>
<field>
<id>rule.categories</id>
net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+13 -5
View File
@@ -97,14 +97,22 @@ class Filter extends BaseModel
}
foreach ($this->npt->rule->iterateItems() as $rule) {
if ($validateFullModel || $rule->isFieldChanged()) {
$src_is_addr = Util::isSubnet($rule->source_net) || Util::isIpAddress($rule->source_net);
$src_proto = strpos($rule->source_net, ':') === false ? "inet" : "inet6";
if ($src_is_addr && $src_proto != 'inet6') {
if (!empty((string)$rule->destination_net) && !empty((string)$rule->trackif)) {
$messages->appendMessage(new Message(
gettext("You can not use IPv4 addresses in IPv6 rules."),
$rule->source_net->__reference
gettext("A track interface is only allowed without an extrenal prefix."),
$rule->trackif->__reference
));
}
if (!empty((string)$rule->destination_net) && !empty((string)$rule->source_net)) {
$dparts = explode('/', (string)$rule->destination_net);
$sparts = explode('/', (string)$rule->source_net);
if (count($dparts) == 2 && count($sparts) == 2 && $dparts[1] != $sparts[1]) {
$messages->appendMessage(new Message(
gettext("External subnet should match internal subnet."),
$rule->destination_net->__reference
));
}
}
}
}
return $messages;
net/firewall/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+6
View File
@@ -219,6 +219,10 @@
<Default>1</Default>
<Required>Y</Required>
</enabled>
<log type="BooleanField">
<Default>0</Default>
<Required>Y</Required>
</log>
<sequence type="IntegerField">
<MinimumValue>1</MinimumValue>
<MaximumValue>99999</MaximumValue>
@@ -242,6 +246,8 @@
<NetMaskRequired>Y</NetMaskRequired>
<WildcardEnabled>N</WildcardEnabled>
</destination_net>
<trackif type="InterfaceField">
</trackif>
<categories type="ModelRelationField">
<Model>
<rulesets>