lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-13 16:14:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

backend: template helpers. Add physical_interface and physical_interfaces as helper functions to remove the need for a separate macro to map interface names. Eventually we might consider removing the macro as well, but since the plugins use it heavily, we can't do that right now.

Browse Source 
The new physical_interfaces() helper simplifies the constructions where we just need a list of configured device names, skipping the ones that don't exist.
Refactor existing core templates to remove the use of the interface.macro file.
This commit is contained in:
Ad Schellevis 2023-10-22 17:46:34 +02:00
parent 71e8201e5a
commit a99f2600a5
9 changed files with 36 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/opnsense/service/modules/addons/template_helpers.py
View File

@ -135,6 +135,23 @@ class Helpers(object):
"""
return self._template_in_data['__uuid__'].get(uuid, {})
def physical_interface(self, name):
"""
:param name: interface technical name [lan, wan, opt]
:return: device name (e.g. em0), input name when not found
"""
return self.getNodeByTag('interfaces.'+name+'.if') or name
def physical_interfaces(self, names):
"""
:param names: list of interface technical names [lan, wan, opt]
:return: device names (e.g. ['em0']), skips missing entries
"""
result = []
for name in names:
result.append(self.getNodeByTag('interfaces.'+name+'.if'))
return list(filter(None, result))
@staticmethod
def getIPNetwork(network):
"""

3
src/opnsense/service/templates/OPNsense/Filter/filter_tables.conf
View File

@ -5,7 +5,6 @@
{% endif %}
</general>
{% set new_style_aliases = 0 %}
{% from 'OPNsense/Macros/interface.macro' import physical_interface %}
{% if helpers.exists('OPNsense.Firewall.Alias.aliases.alias') %}
{% set new_style_aliases = OPNsense.Firewall.Alias.aliases.alias|length %}
{% for alias in helpers.toList('OPNsense.Firewall.Alias.aliases.alias') %}
@ -23,7 +22,7 @@
{% elif alias.content %}
<address>{{ alias.content|e|encode_idna }}</address>
{% endif %}{% if alias.interface and alias.type == 'dynipv6host' %}
<interface>{{ physical_interface(alias.interface)|default('LAN')}}</interface>
<interface>{{ helpers.physical_interface(alias.interface)|default('LAN')}}</interface>
{% endif %}{% if alias.proto %}
<proto>{{ alias.proto|e }}</proto>
{% endif %}{% if alias.updatefreq %}

4
src/opnsense/service/templates/OPNsense/IDS/rc.conf.d
View File

@ -1,5 +1,3 @@
{# Macro import #}
{% from 'OPNsense/Macros/interface.macro' import physical_interface %}
{% if not helpers.empty('OPNsense.IDS.general.enabled') %}
suricata_setup="/usr/local/opnsense/scripts/suricata/setup.sh"
suricata_enable="YES"
@ -14,7 +12,7 @@ suricata_netmap="YES"
{% set addFlags=[] %}
{% for intfName in OPNsense.IDS.general.interfaces.split(',') %}
{# store additional interfaces to addFlags #}
{% do addFlags.append(physical_interface(intfName)) %}
{% do addFlags.append(helpers.physical_interface(intfName)) %}
{% endfor %}
suricata_interface="{{ addFlags|join(' ') }}"
{% endif %}

10
src/opnsense/service/templates/OPNsense/IDS/suricata.yaml
View File

@ -1,5 +1,3 @@
{# Macro import #}
{% from 'OPNsense/Macros/interface.macro' import physical_interface %}
%YAML 1.1
---
@ -1710,11 +1708,11 @@ netmap:
{% if helpers.exists('OPNsense.IDS.general.interfaces') %}
{% for intfName in OPNsense.IDS.general.interfaces.split(',') %}
- interface: {{physical_interface(intfName)}}
copy-iface: {{physical_interface(intfName)}}^
- interface: {{helpers.physical_interface(intfName)}}
copy-iface: {{helpers.physical_interface(intfName)}}^
- interface: {{physical_interface(intfName)}}^
copy-iface: {{physical_interface(intfName)}}
- interface: {{helpers.physical_interface(intfName)}}^
copy-iface: {{helpers.physical_interface(intfName)}}
{% endfor %}
{% endif %}

13
src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf
View File

@ -1,5 +1,4 @@
{# Macro import #}
{% from 'OPNsense/Macros/interface.macro' import physical_interface %}
{% from 'OPNsense/IPFW/rules.macro' import convert_address %}
{# collect interfaces list (with / without captive portal enabled) #}
{% set cp_interface_list = [] %}
@ -157,12 +156,12 @@ add 60000 return via any
{% if helpers.exists('OPNsense.TrafficShaper.rules.rule') %}
{% for rule in helpers.toList('OPNsense.TrafficShaper.rules.rule', 'sequence', 'int') %}
{% if helpers.getUUIDtag(rule.target) in ['pipe','queue'] %}
{% if physical_interface(rule.interface) and rule.enabled|default('0') == '1' %}
{% if helpers.physical_interface(rule.interface) and rule.enabled|default('0') == '1' %}
{% if helpers.getUUID(rule.target).enabled|default('0') == '1' %}
{% if helpers.getUUIDtag(rule.target) == 'pipe' or
helpers.getUUID(helpers.getUUID(rule.target).pipe).enabled|default('0') == '1'
%}
{% if rule.interface2 and physical_interface(rule.interface2) %}
{% if rule.interface2 and helpers.physical_interface(rule.interface2) %}
{# 2 interface defined, use both to match packets (2 rules) #}
{% if rule.direction == 'in' or not rule.direction %}
add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
@ -170,11 +169,11 @@ add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
if rule.source_not|default('0') == '1' %}not {% endif %}{{ convert_address(rule, 'source') }} to {%
if rule.destination_not|default('0') == '1' %}not {% endif %}{{convert_address(rule, 'destination')
}} src-port {{ rule.src_port }} dst-port {{ rule.dst_port }} recv {{
physical_interface(rule.interface) }} {%
helpers.physical_interface(rule.interface) }} {%
if rule.proto.split('_')[1]|default('') == 'ack' %} {{ rule.proto.split('_')[2]|default('') }} tcpflags ack {% endif %}{%
if rule.iplen|default('') != '' %} iplen 1-{{ rule.iplen }}{% endif %}{%
if rule.dscp|default('') != '' %} dscp {{ rule.dscp }}{% endif %}
xmit {{physical_interface(rule.interface2)
xmit {{helpers.physical_interface(rule.interface2)
}} // {{ (rule['@uuid'] + " " + rule.interface + " -> " + rule.interface2 + ": " + helpers.getUUID(rule.target).description)[0:78] }}
{% endif %}
{% if rule.direction == 'out' or not rule.direction %}
@ -187,7 +186,7 @@ add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
if rule.proto.split('_')[1]|default('') == 'ack' %} {{ rule.proto.split('_')[2]|default('') }} tcpflags ack {% endif %}{%
if rule.iplen|default('') != '' %} iplen 1-{{ rule.iplen }}{% endif %}{%
if rule.dscp|default('') != '' %} dscp {{ rule.dscp }}{% endif %}
recv {{physical_interface(rule.interface2)
recv {{helpers.physical_interface(rule.interface2)
}} // {{ (rule['@uuid'] + " " + rule.interface2 + " -> " + rule.interface + ": " + helpers.getUUID(rule.target).description)[0:78] }}
{% endif %}
{% else %}
@ -200,7 +199,7 @@ add {{loop.index + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
if rule.proto.split('_')[1]|default('') == 'ack' %}{{ rule.proto.split('_')[2]|default('') }} tcpflags ack {% endif %} {%
if rule.iplen|default('') != '' %} iplen 1-{{ rule.iplen }}{% endif %}{%
if rule.dscp|default('') != '' %} dscp {{ rule.dscp }}{% endif %} via {{
physical_interface(rule.interface)
helpers.physical_interface(rule.interface)
}} // {{ (rule['@uuid'] + " " + rule.interface + ": " + helpers.getUUID(rule.target).description)[0:78] }}
{% endif %}
{% endif %}

3
src/opnsense/service/templates/OPNsense/Monit/monitrc
View File

@ -1,6 +1,5 @@
# DO NOT EDIT THIS FILE -- OPNsense auto-generated file
{% from 'OPNsense/Macros/interface.macro' import physical_interface %}
{% if helpers.exists('OPNsense.monit.general') %}
{% if helpers.exists('OPNsense.monit.general.httpdEnabled') and OPNsense.monit.general.httpdEnabled|default('0') == '1' %}
{% set httpdCredentials = OPNsense.monit.general.httpdUsername ~ ':"' ~ OPNsense.monit.general.httpdPassword ~ '"' %}
@ -111,7 +110,7 @@ check {{ service.type }} {{ service.name }} {{ address }}
{% if service.address|default('') != '' %}
{% set address = "address " ~ service.address %}
{% elif service.interface|default('') != '' %}
{% set interface = "interface " ~ physical_interface(service.interface) %}
{% set interface = "interface " ~ helpers.physical_interface(service.interface) %}
{% endif %}
check {{ service.type }} {{ service.name }} {{ address }} {{ interface }}
{% elif service.type == 'system' %}

5
src/opnsense/service/templates/OPNsense/Netflow/netflow.conf
View File

@ -2,7 +2,6 @@
# Automatic generated configuration for netflow.
# Do not edit this file manually.
#
{% from 'OPNsense/Macros/interface.macro' import physical_interface %}
{%
if helpers.exists('OPNsense.Netflow.capture.interfaces')
and
@ -14,12 +13,12 @@
%}
netflow_interfaces="{% for interface in OPNsense.Netflow.capture.interfaces.split(',')
%}{{
physical_interface(interface)
helpers.physical_interface(interface)
}} {%
endfor%}"
netflow_egress_only="{% if OPNsense.Netflow.capture.egress_only %}{% for interface in OPNsense.Netflow.capture.egress_only.split(',')
%}{{
physical_interface(interface)
helpers.physical_interface(interface)
}} {%
endfor%} {%endif%}"
netflow_version="{%if OPNsense.Netflow.capture.version == 'v9' %}9{% else %}5{%endif%}"

4
src/opnsense/service/templates/OPNsense/Sample/example_simple_page.txt
View File

@ -18,9 +18,11 @@ list of configured network interfaces :
{% endfor %}
Physical interface connected to "lan" : {{ helpers.physical_interface('lan') }} or both lan and wan {{ helpers.physical_interfaces(['lan', 'wan']) }}
and a short list of firewall rules created (multiple rule items in filter section):
{% for item in filter.rule%}
{% for item in filter.rule %}
descr : {{ item.descr }}
type : {{ item.type }}
interface : {{ item.interface }}

1
src/opnsense/service/tests/template.py
View File

@ -96,6 +96,7 @@ class TestTemplateMethods(unittest.TestCase):
generated_filenames = self.tmpl.generate('OPNsense/Sample')
self.assertEqual(len(generated_filenames), 4, 'number of output files not 4')
@unittest.skip("Very fragile test, only works on clean install")
def test_all(self):
""" Test if all expected templates are created, can only find test for static defined cases.
Calls "generate *" and compares that to all defined templates in all +TARGET files