Skip to content

Commit 312e575

Browse files
jonathanunderwoodjonathanunderwood
committed
[openwrt] Add more parameters to firewall defaults schema
Signed-off-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>
1 parent 657f03b commit 312e575

File tree

3 files changed

+177
-3
lines changed

3 files changed

+177
-3
lines changed

‎netjsonconfig/backends/openwrt/converters/firewall.py‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,9 +177,25 @@ def to_netjson_loop(self, block, result, index):
177177
return self.type_cast(result)
178178

179179
def __netjson_defaults(self, defaults):
180-
for param in ["synflood_protect"]:
180+
for param in [
181+
"drop_invalid",
182+
"synflood_protect",
183+
"tcp_syncookies",
184+
"tcp_ecn",
185+
"tcp_window_scaling",
186+
"accept_redirects",
187+
"accept_source_route",
188+
"custom_chains",
189+
"disable_ipv6",
190+
"flow_offloading",
191+
"flow_offloading_hw",
192+
"auto_helper",
193+
]:
181194
if param in defaults:
182195
defaults[param] = self.__netjson_generic_boolean(defaults[param])
196+
for param in ["synflood_limit", "synflood_burst"]:
197+
if param in defaults:
198+
defaults[param] = int(defaults[param])
183199
return self.type_cast(defaults)
184200

185201
def __netjson_rule(self, rule):

‎netjsonconfig/backends/openwrt/schema.py‎

Lines changed: 108 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1058,13 +1058,120 @@
10581058
},
10591059
]
10601060
},
1061+
"drop_invalid": {
1062+
"type": "boolean",
1063+
"title": "Drop invalid packets.",
1064+
"description": "If True then any invalid packets will be dropped.",
1065+
"default": False,
1066+
"format": "checkbox",
1067+
"propertyOrder": 4,
1068+
},
10611069
"synflood_protect": {
10621070
"type": "boolean",
10631071
"title": "Enable SYN flood protection.",
10641072
"description": "Enables SYN flood protection.",
10651073
"default": False,
10661074
"format": "checkbox",
1067-
"propertyOrder": 4,
1075+
"propertyOrder": 5,
1076+
},
1077+
"synflood_rate": {
1078+
"type": "integer",
1079+
"title": "Rate limit (packets/second) for SYN packets above which the traffic is considered a flood.",
1080+
"description": "Number of packets/second for SYN packets above which the traffic is considered a "
1081+
"flood.",
1082+
"default": 25,
1083+
"propertyOrder": 6,
1084+
},
1085+
"synflood_burst": {
1086+
"type": "integer",
1087+
"title": "Burst limit (packets/second) for SYN packets above which the traffic is considered a "
1088+
"flood.",
1089+
"description": "Set burst limit for SYN packets above which the traffic is considered a flood if it "
1090+
"exceeds the allowed rate.",
1091+
"default": 50,
1092+
"propertyOrder": 7,
1093+
},
1094+
"tcp_syncookies": {
1095+
"type": "boolean",
1096+
"title": "Enable the use of TCP SYN cookies.",
1097+
"description": "If True, enables the use of SYN cookies.",
1098+
"default": True,
1099+
"format": "checkbox",
1100+
"propertyOrder": 8,
1101+
},
1102+
"tcp_ecn": {
1103+
"type": "boolean",
1104+
"title": "Enable Explicit Congestion Notification.",
1105+
"description": "If True, enables Explicit Congestion Notification.",
1106+
"default": False,
1107+
"format": "checkbox",
1108+
"propertyOrder": 9,
1109+
},
1110+
"tcp_window_scaling": {
1111+
"type": "boolean",
1112+
"title": "Enable TCP window scaling.",
1113+
"description": "If True, enables TCP window scaling.",
1114+
"default": True,
1115+
"format": "checkbox",
1116+
"propertyOrder": 10,
1117+
},
1118+
"accept_redirects": {
1119+
"type": "boolean",
1120+
"title": "Accept redirects.",
1121+
"description": "If True, accept redirects.",
1122+
"default": False,
1123+
"format": "checkbox",
1124+
"propertyOrder": 11,
1125+
},
1126+
"accept_source_route": {
1127+
"type": "boolean",
1128+
"title": "Accept source routes.",
1129+
"description": "If True, accept source routes.",
1130+
"default": False,
1131+
"format": "checkbox",
1132+
"propertyOrder": 12,
1133+
},
1134+
"custom_chains": {
1135+
"type": "boolean",
1136+
"title": "Enable generation of custom rule chain hooks for user generated rules.",
1137+
"description": "If True, enable generation of custom rule chain hooks for user generated rules. "
1138+
"User rules would be typically stored in firewall.user but some packages e.g. BCP38 also make use "
1139+
"of these hooks.",
1140+
"default": True,
1141+
"format": "checkbox",
1142+
"propertyOrder": 13,
1143+
},
1144+
"disable_ipv6": {
1145+
"type": "boolean",
1146+
"title": "Disable IPv6 firewall rules.",
1147+
"description": "If True, disable IPv6 firewall rules.",
1148+
"default": False,
1149+
"format": "checkbox",
1150+
"propertyOrder": 14,
1151+
},
1152+
"flow_offlocaing": {
1153+
"type": "boolean",
1154+
"title": "Enable software flow offloading for connections.",
1155+
"description": "If True, enable software flow offloading for connections.",
1156+
"default": False,
1157+
"format": "checkbox",
1158+
"propertyOrder": 15,
1159+
},
1160+
"flow_offlocaing_hw": {
1161+
"type": "boolean",
1162+
"title": "Enable hardware flow offloading for connections.",
1163+
"description": "If True, enable hardware flow offloading for connections.",
1164+
"default": False,
1165+
"format": "checkbox",
1166+
"propertyOrder": 16,
1167+
},
1168+
"auto_helper": {
1169+
"type": "boolean",
1170+
"title": "Enable Conntrack helpers ",
1171+
"description": "If True, enable Conntrack helpers ",
1172+
"default": True,
1173+
"format": "checkbox",
1174+
"propertyOrder": 17,
10681175
},
10691176
}
10701177

@@ -1075,7 +1182,6 @@
10751182
"description": "Defaults for the fireall",
10761183
"propertyOrder": 4,
10771184
"properties": firewall_defaults,
1078-
"required": ["input", "output", "forward", "synflood_protect"],
10791185
},
10801186
"forwardings": {
10811187
"type": "array",

‎tests/openwrt/test_firewall.py‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,58 @@ def test_parse_defaults_1(self):
4141
o = OpenWrt(native=self._defaults_1_uci)
4242
self.assertEqual(o.config, self._defaults_1_netjson)
4343

44+
_defaults_2_netjson = {
45+
"firewall": {
46+
"defaults": {
47+
"input": "ACCEPT",
48+
"output": "ACCEPT",
49+
"forward": "REJECT",
50+
"custom_chains": True,
51+
"drop_invalid": True,
52+
"synflood_protect": True,
53+
"synflood_burst": 50,
54+
"tcp_ecn": True,
55+
"tcp_syncookies": True,
56+
"tcp_window_scaling": True,
57+
"disable_ipv6": False,
58+
"flow_offloading": False,
59+
"flow_offloading_hw": False,
60+
"auto_helper": True,
61+
}
62+
}
63+
}
64+
65+
_defaults_2_uci = textwrap.dedent(
66+
"""\
67+
package firewall
68+
69+
config defaults 'defaults'
70+
option input 'ACCEPT'
71+
option output 'ACCEPT'
72+
option forward 'REJECT'
73+
option custom_chains '1'
74+
option drop_invalid '1'
75+
option synflood_protect '1'
76+
option synflood_burst '50'
77+
option tcp_ecn '1'
78+
option tcp_syncookies '1'
79+
option tcp_window_scaling '1'
80+
option disable_ipv6 '0'
81+
option flow_offloading '0'
82+
option flow_offloading_hw '0'
83+
option auto_helper '1'
84+
"""
85+
)
86+
87+
def test_render_defaults_2(self):
88+
o = OpenWrt(self._defaults_2_netjson)
89+
expected = self._tabs(self._defaults_2_uci)
90+
self.assertEqual(o.render(), expected)
91+
92+
def test_parse_defaults_2(self):
93+
o = OpenWrt(native=self._defaults_2_uci)
94+
self.assertEqual(o.config, self._defaults_2_netjson)
95+
4496
_rule_1_netjson = {
4597
"firewall": {
4698
"rules": [

0 commit comments

Comments
 (0)