-
Notifications
You must be signed in to change notification settings - Fork 10
/
Copy pathChanges
2427 lines (2001 loc) · 104 KB
/
Changes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{{$NEXT}}
6.078 2025-02-24 14:42:54+01:00 Europe/Berlin
- New commandline programs export-netvis and print-path have been added.
These tools output information as JSON to be used in
a graph visualization.
export-netvis creates a list of all networks and routers
of the given topology with information useful for visualizing
the topology.
print-path analyzes the given topology and creates a list of
names of network nodes (routers and networks) between source and
destination passed via command line.
To create the list, print-path uses the same path-walk algorithm
as used in netspoc main program to create ruleset for devices.
- Aggregate with IPv4 IP 0.0.0.0/0 no longer matches IPv6 addresses.
Aggregate with IPv6 IP ::/0 no longer matches IPv4 addresses.
- Fixed split service from auto intf with IPv4, IPv6
- Command 'export-netspoc' no longer strips comments and ";"
from description in details of exported service.
6.077 2025-01-27 11:24:26+01:00 Europe/Berlin
- Allow dual stack service to have protocols icmp and icmpv6 together.
Generated rules automatically will use icmp for IPv4 and icmpv6 for IPv6.
- Removed support for separate IPv6 topology in subdirectory 'ipv6/'.
- Removed options '--ipv6', '-6'.
- Removed support for NAT of IPv6 objects.
After changing attributes of IPv6 addresses from 'ip' to 'ip6',
supporting NAT for IPv6 would need to change NAT attributes
to 'ip6', 'hidden6', 'identity6' as well.
This seems to be superflous, since nobody uses NAT for IPv6.
- Fixed duplicate hosts in print-group from wrong IPv4 network
in IPv6 aggregate.
- Fixed panic in print-group from wrong IPv4 network in IPv6 hosts
generated by 'auto_ipv6_hosts'.
- Fixed panic in export-netspoc with rule from IPv4 network to
combined IPv4/v6 auto interface.
- Changed 'format-netspoc' to print attributes "ip" and "ip6" in
one line, if object has no more than 3 attributes.
6.076 2025-01-10 09:39:54+01:00 Europe/Berlin
- Fixed dual stack bridge. IPv4 and IPv6 interfaces were accidently
processed together.
6.075 2024-12-19 11:53:37+01:00 Europe/Berlin
- Fix: Attribute 'policy_distribution_point' at dual stack router
is only used for matching IPv4/IPv6 part of this router.
- Fixed command 'export-netspoc'.
Show IPv4 areas for combined zone. Must not accidently overwrite
IPv4 areas by IPv6 areas, when combined zones have same name.
6.074 2024-12-16 11:52:23+01:00 Europe/Berlin
- Fixed wrong error on duplicate interface from router in ipv6/ directory.
6.073 2024-12-16 10:16:33+01:00 Europe/Berlin
- Added support for dual stack objects, having both, IPv4 and IPv6 addresses.
This simplifies the modeling of a dual stack toplology.
It is no longer neccessary to model a separate IPv4 and IPv6 topology.
Rules between dual stack objects will generate ACls for IPv4 and IPv6.
Rules between dual stack object and pure IPv4 object will silently ignore
IPv6 address and generate only ACL for IPv4.
New attributes have been introduced to define dual stack objects:
- 'ip6' at network, host, interface and aggregate.
- 'range6' at host.
- 'unnumbered6' at network and interface.
- 'negotiated6' at interface.
Other changes resulting from use of dual stack objects:
- If dual stack objects are used as border or inclusive border of an area,
this defines two areas with identical name:
one in IPv4 topology and one in IPv6 topology.
- If dual stack objects are used as interfaces of an pathrestriction,
this also defines two pathrestrictions in IPv4 and IPv6 topology.
If the second pathrestriction has only one interface or only interfaces
outside of a loop, it is silently ignored.
- New attributes 'ipv4_only' and 'ipv6_only' may be used at service or area.
This will enable only IPv4 or IPv6 part of dual stack objects.
- The following attributes are applied only to IPv4 part
if used in dual stack objects:
'nat', 'bind_nat', 'subnet_of, 'hub', 'spoke'.
- Command 'export-netspoc' has been changed to show IPv6 address of
dual stack objects in attribute 'ip6'.
- Added new attribute 'auto_ipv6_hosts' to automatically generate
dual stack hosts from pure IPv4 hosts.
It will generate IPv6 addresses for hosts
by combining its IPv4 adress with the IPv6 address of its network.
These attribute values are provided:
- auto_ipv6_hosts = readable
network: ip6 = 2001:db8:1:1::/64;
hosts: ip = 172.17.1.48;
==> 2001:db8:1:1:172:17:1:48
- auto_ipv6_hosts = binary
network: ip6 = 2001:db8:1:1::/64;
hosts: ip = 172.17.1.48;
==> 2001:db8:1:1::ac11:130
- auto_ipv6_hosts = none
No IPv6 address is generated
This attribute can be used at network, area and host.
- Fixed command 'cut-netspoc':
Full path to management_instance is marked now.
6.072 2024-09-05 10:22:13+02:00 Europe/Berlin
- Fixed command 'remove-from-netspoc'.
A service is no longer removed accidently, if only some rules of
a service become empty, but other rules remain.
- Message "swap objects of 'user' and objects of rules" is shown
even if no attribute multi_owner is given.
- Fixed check for NAT network being subnet of some other network.
If multiple networks have dynamic NAT to same address,
now a warning is given for each network.
- Fixed check for useless attribute 'subnet_of'
where supernet has attribute 'has_subnets'.
6.071 2024-07-29 16:47:58+02:00 Europe/Berlin
- Fixed generated ACL at router R with managed=local for rule where
- source or destination is some aggregate G,
- G has IP address matching "filter_only" of R,
- G has no subnetworks in its zone,
- other side of rule is located inside managed-local cluster of R.
Previously no ACL was generated for this rule at R.
This has been fixed.
- Added new check for unexpected access from supernet rule at router
with 'managed=local':
1. Checks rule where
- source or destination is some supernet,
- this supernet is located inside some managed=local cluster
- and other side of rule is outside of managed=local cluster.
In this case, the rule would not be filtered inside managed=local cluster
and hence access from/to subnets in same cluster
would be allowed by accident.
2. Checks path of rule at router with managed=local where
- both sides of rule are located outside of managed=local cluster,
- source or destination is some supernet,
- subnet of this supernet is located in managed=local cluster,
In this case, the rule would not be filtered inside managed=local cluster
and hence access from/to subnets in same cluster
would be allowed by accident.
6.070 2024-06-26 15:33:44+02:00 Europe/Berlin
- Fixed mixed managed=local/managed in VRFs of one device.
Previously, the filter_only value of first VRF was used for other VRFs,
leading to incorrect ACLs.
6.069 2024-06-18 10:37:48+02:00 Europe/Berlin
- Fix: No longer show error message "host:x needs static translation"
if dynamic NAT is applied at ASA firewall, because ASA filters real IP
and not NAT IP.
- Fixed generated ACLs for device with 'managed=local' and 'model=NSX'.
- Attribute 'no_check_supernet_rules' given at zone now also checks
that no vip and loopback interfaces are defined inside this zone.
Previously only hosts were checked.
6.068 2024-04-15 17:58:21+02:00 Europe/Berlin
- Fixed command 'cut-netspoc'.
- Only retain management_instance of used router.
- Ignore area with only inherited NAT.
- Find new anchor even if it is subnet of unused network.
- Support 'user' in nested element.
- Prevent error message
"Must not use any:[..] .. because it has address of network"
- Intersection of nested elements of different type.
6.067 2024-02-26 10:13:31+01:00 Europe/Berlin
- Hidden NAT may be applied multiple times to the same network now.
6.066 2024-01-29 15:07:57+01:00 Europe/Berlin
- Fixed check that disables secondary optimization.
A corresponding supernet rule is found now, even if networks are
not identical, but in relation 'subnet in zone'.
- Removed support for EZVPN at Cisco devices.
- Syntax of loopback interfaces is checked more thoroughly.
- Program 'cut-netspoc' now collects "management_instance"
for routers of type NSX and PAN-OS.
6.065 2023-11-13 11:45:12+01:00 Europe/Berlin
- Added new command 'export-netspoc-syntax'
Usage: export-netspoc-syntax FILE|DIR [TYPE:|TYPE:NAME ...]
This writes selected or all toplevel definitions as JSON to Stdout.
Each definition is written as JSON object with key value pairs.
Definitions are grouped by TYPE, accessible with key "TYPE",
e.g. "service".
6.064 2023-10-04 12:30:29+02:00 Europe/Berlin
- Fixed attribute "log_deny" for device with multiple VRFs.
Different values of "log_deny" configured at multiple VRFs are now
respected.
- Two separate commands are used now to set security-association
lifetime for seconds and kilobytes in generated code for ASA and IOS.
Previously a single command was used, that was split by
Netspoc-Approve into separate commands.
6.063 2023-09-07 13:58:15+02:00 Europe/Berlin
- Command 'format-netspoc' now also sorts IPv6 addresses:
- vip interfaces by IPv6 address
- hosts by IPv6 address
- elements of groups by IPv6 address embedded in name,
where colons of address are repaced by underscore:
NAME-dddd_dddd_dddd_dddd_dddd_dddd_dddd_dddd
- Header is no longer written to code files.
File DEVICE.info is unsed instead.
- All raw files must be placed in "netspoc/raw/" now.
Directory "netspoc/raw/ipv6/" is ignored.
- A warning is shown, if different NAT tags are bound to
the identical set of interfaces.
These NAT tags should be merged into single NAT definition.
6.062 2023-08-07 15:25:55+02:00 Europe/Berlin
- Meta data for each device is written to new file DEVICE.info .
This JSON file will substitute the header data,
which is written into code file currently.
Header will be removed in next version, after updating Netspoc-Approve.
- Mixed use of static and dynamic NAT at the same NAT tag is allowed again.
- Fixed panic in command 'print-group' when called with option '--unused'.
- For aggregates (objects of type 'any:...') we now always assume
that they have subnets in other zone.
This may lead to less optimizations, but allows faster analysis
of subnet relation, leading to decreased runtime by about 5%.
6.061 2023-07-28 11:20:23+02:00 Europe/Berlin
- Fixed missing warnings about undeclared subnet relation.
- Add header [ Policy_distribution_point = IP ] to generated code,
if a policy_distribution_point is defined for this device.
Will be used to check if proxy is needed in upcoming release
of Netspoc-Approve.
6.060 2023-06-30 10:27:01+02:00 Europe/Berlin
- Fixed PAN-OS: Must not use colons in object names.
6.059 2023-06-27 12:39:32+02:00 Europe/Berlin
- Fixed NSX and PAN-OS: Use IPv4 management instance for IPv6 context
if no v6 management instance present and vice versa.
6.058 2023-03-30 16:41:54+02:00 Europe/Berlin
- IP address is no longer moved in ACL when combining subnets.
6.057 2023-03-07 14:17:29+01:00 Europe/Berlin
- Added new option '--check_empty_files=0|warn|err'.
It is enabled by default with value 'warn'.
If this option is disabled, warnings about files with no content
are no longer shown.
This is useful, if files may become empty when definitions
are deleted via Netspoc-API.
- Added new option '--check_service_empty_user=0|warn|err''.
It is enabled by default with value 'warn'.
If this option is disabled, warnings about services with empty user
are no longer shown.
This is useful, if services are modified via Netspoc-API.
6.056 2023-01-30 12:02:02+01:00 Europe/Berlin
- Added new option '--check_service_useless_attribute=0|warn|err'.
It is enabled by default with value 'warn'.
If this option is disabled, warnings about useless attributes
has_unenforceable|identical_body|multi_owner|overlaps|unknown_owner
in services are no longer shown.
This is useful, if services are modified via Netspoc-API.
A script misc/get-rm-useless-svc-attr-job was added to parse warnings
about useless attributes and create API job to remove them.
- Netspoc-API has been changed to remove an attribute, if its value
list becomes empty.
6.055 2023-01-18 11:15:31+01:00 Europe/Berlin
- Command 'export-netspoc' now uses prefixlen instead of mask
in IPv4 addresses to get same behaviour as for IPv6.
- Command 'transpose-service' now handles multiple services at once,
either given as arguments or read from file.
- Attributes 'log_default', 'log_deny' are supported on all devices now
that can do logging.
- Added support for log modifier 'tag:<LABEL>' at model NSX.
- Netspoc no longer accepts service definition with mixed
user-user rule and normal rule.
- Generated code file for NSX now gets header lines starting with '#'.
6.054 2022-12-21 11:07:23+01:00 Europe/Berlin
- Fixed NSX and PAN-OS: Call local optimization to prevent duplicate
and redundant IP addresses in rules.
6.053 2022-12-20 12:16:11+01:00 Europe/Berlin
- Fixed NSX: ICMPTypeServiceEntry
6.052 2022-12-15 12:08:51+01:00 Europe/Berlin
- NSX:
- Changed extension from Tier-0/1 to T0/T1.
- Set source_ports even if empty.
- Add "profiles": [ "ANY" ] to rules.
- Set attribute ip_protocol to IPV4 or IPV6.
6.051 2022-11-21 16:02:15+01:00 Europe/Berlin
- Added suport for "aes-gcm", "aes-gcm-192", "aes-gcm-256"
at attribute "encryption" of isakmp definition.
- Added support for
"aes-gcm", "aes-gcm-192", "aes-gcm-256",
"aes-gmac", "aes-gmac-192", "aes-gmac-256"
at attribute "esp_encryption" of ipsec definition.
- Added support for other value than email address
in attribute "id" of router definition.
In this case the generated "crypto ca certificate map"
no longer checks for email: "subject-name attr ea eq <id>"
but for common name: "subject-name attr cn eq <id>".
It is supported to use an IP address as "id".
- Changed handling of attribute "esp_authentication" of ipsec definition.
If this attribute is not given, a value of "null" is generated
in "protocol esp integrity" of ASA anyway.
- Removed attribute "disabled" at interface definition.
6.050 2022-10-13 16:13:31+02:00 Europe/Berlin
- Added new option '-i' / '--ip' to command 'print-service'.
If given together with option '-n' / '--name', it shows IP address
together with name for source and destination of each rule.
Output format is:
name:action src-ip src-name dst-ip dst-name protocol.
- Fixed generated IPv6 code for PAN-OS:
IPv6 rules use separate name space now to prevent name clashes between
IPv4 and IPv6 rules.
It is supported now to generate IPv4 and IPv6 rules for the same VSYS.
6.049 2022-09-06 17:12:38+02:00 Europe/Berlin
- Reverted optimized parallel execution from version 6.046,
causing rare occurrences of
"fatal error: concurrent map read and map write".
- Netspoc-API gives better error message on invalid job now.
6.048 2022-08-24 17:42:10+02:00 Europe/Berlin
- Fixed missing ACL for subnets in other part of zone cluster.
Accidentally, only the first zone cluster with subnets in other
part was marked.
- Changes in Netspoc-API:
- Elements of group and pathrestriction are no longer given directly,
but as value of attribute 'elements'.
- Removed API methods:
- create_toplevel
- delete_toplevel
- modify_owner
- delete_owner
6.047 2022-08-17 09:49:08+02:00 Europe/Berlin
- Fixed bug that duplicated comment lines located before a short
interface definition.
This caused duplication of comment lines in output of
'format-netspoc' and other programs that print a modified
netspoc configuration.
6.046 2022-08-15 15:22:05+02:00 Europe/Berlin
- Fixed missing error message "No valid path" for rules from/to zone
cluster with subnets and pathrestrictions.
- Better parallel execution in command "netspoc".
- Changes in Netspoc-API:
- Method "replace" is aclled "set" now.
- New value in "value" must be given as JSON;
Netspoc syntax is no longer accepted.
6.045 2022-07-29 10:21:38+02:00 Europe/Berlin
- Command 'format-netspoc' now sorts lists case insensitively.
Value lists of attributes are sorted also now.
- Added new generic methods to Netspoc-API: add, delete, replace
Parameters are
- path: specifies the to be changed item; a comma separated list of names.
- value: the new value, given either as JSON object or in Netspoc syntax.
- ok_if_exists: suppresses error message if an added toplevel object
already exists.
6.044 2022-05-09 08:57:41+02:00 Europe/Berlin
- Added new option '-d' / '--delete' to command 'remove-from-netspoc'.
This also removes definition of given objects, if object is host or
unmanaged loopback/vip interface.
- Attribute "has_subnets" has been restricted to:
- the internet, i.e. network with prefix length 0,
- networks in same zone,
- loopback interfaces at border of zone, where supernet is located.
6.043 2022-04-07 15:05:24+02:00 Europe/Berlin
- New radius-attribute
"anyconnect-custom_dynamic-split-exclude-domains = dom ..."
generates "anyconnect-custom dynamic-split-exclude-domains value dom ..."
in group-policy attributes.
- If a network N with IP/prefix inside a zone cluster with pathrestrictions
has subnets in the same zone cluster, but inside a different zone
and N is used in a rule,
this rule is extended with aggregates any:[ip = IP/prefix & ...]
for each zone with some subnet of N.
This is needed to get access-lists and static routes
generated for all subnets of N in zone cluster.
- Fixed subnet relation in zone if it is different from zone cluster.
- Fixed owner of secondary interface at managed router.
- Fixed missing secondary interfaces in export.
6.042 2022-03-28 10:06:57+02:00 Europe/Berlin
- Attribute "subnet_of" at NAT definition is inherited now
to enclosed networks.
- A warning is shown on useless use of attribute "subnet_of".
- Added new parameter "rule_count" in methods add_to_rule,
remove_from_rule, delete_rule of Netspoc-API.
Specifies the number of expected rules of this service.
Job is aborted if expected and real number differ.
This is only checked if parameter is given and value is not 0.
6.041 2022-02-28 14:08:05+01:00 Europe/Berlin
- Better error message on unenforceable rule.
- Fixed non determinism in generated address list for PAN-OS.
6.040 2022-02-16 15:12:58+01:00 Europe/Berlin
- Added router attribute 'merge_tunnelspecified = IP/PREFIX, ...'.
The given list of ip/prefix is used to optimize generated
split-tunnel ACL. Networks that are subnet of ip/prefix list are
removed and list of ip/prefix is added to ACL.
- Generated default route is deterministic now.
If two different next hop interfaces are eligible as default route,
one of them is selected deterministically.
- Inheritance of attributes from network to subnet didn't work in rare cases.
This has been fixed.
- Better warning is shown when finding redundant attributes during
inheritance.
- Fixed corrupt file in generated code when reusing output directory
and new file size is smaller than previous one.
- Added new option '--debug_pass2 DEVICE' for debugging and testing
pass2 of program netspoc.
6.039 2022-01-25 15:11:50+01:00 Europe/Berlin
- Fixed command 'transpose-service':
- Actually remove service from overlaps in multiple files.
- Fixed error message.
- Enhanced command 'remove-from-netspoc':
- Remove service that becomes empty.
- Intersection is handled as well.
6.038 2022-01-18 11:15:47+01:00 Europe/Berlin
- Fixed optimization of destination interface at router with
'managed = secondary'. In this case optimization is disabled
to prevent unexpected access.
- Fix: Owner can be defined now for router with 'managed = routing_only'.
- Command 'netspoc' better cleans up existing directory 'code/.prev'.
- Fixed command 'cut-netspoc' to also handle complex topology.
6.037 2021-12-20 14:46:06+01:00 Europe/Berlin
- Added new command 'transpose-service'
Usage: transpose-service [options] FILE|DIR [service:]NAME
This changes the syntactical representation of a service:
- keyword "user" is moved from "src/dst" to "dst/src",
- previous definition of "user" is inserted at "src/dst"
- definition of "user" is changed to previous definition of "dst/src".
Command aborts on service with multiple rules.
Result is undefined on service with user-user rule.
- A warning is shown for automatic group without any elements.
E.g. network:[] or interface:[].[all]
6.036 2021-12-14 10:51:49+01:00 Europe/Berlin
- PAN-OS:
- Support log:<name> with one or more values of:
start, end, setting:VALUE,
.i.e log:tag = start, setting:my_Panorama;
- Support new attribute 'log_default' with one or more log values.
- No longer add deny rule at end of rules,
because this is handled at device level already.
- Enhanced command 'expand-group'.
Simple intersections are expanded now.
6.035 2021-11-22 15:48:55+01:00 Europe/Berlin
- Added new command 'remove-service'
Usage: remove-service [options] FILE|DIR [service:]NAME ...
-f, --file string Read SERVICES from file
-q, --quiet Don't show changed files
- Added support for Palo-Alto: model = PAN-OS
Different VSYS are modelled as router:NAME@VSYS
New attributes 'management_instance', 'backup_of' to reference
Palo-Alto host system(s) from VSYS instances.
- Fixed: Some duplicate or overlapping areas were not detected.
6.034 2021-08-17 13:22:38+02:00 Europe/Berlin
- Fixed warning for supernet rule permitting unexpected access
at router with attribute 'no_in_acl'.
- Fixed command 'netspoc' which didn't close filehandles
when reading intermediated code.
- Command 'export-netspoc' no longer generates indented JSON files.
This leads to about 7.5% smaller export directory.
- Minor fixes.
6.033 2021-07-21 14:41:17+02:00 Europe/Berlin
- No longer show warning 'has unenforceable rule' for user-user rule.
- Added new command 'modify-netspoc-api'.
Usage: modify-netspoc-api [-q] FILE|DIR JOB ...
This command applies change-jobs to Netspoc configuration files.
It is used by Netspoc-API and other automation tasks.
Job format is described at https://github.com/hknutzen/Netspoc-API#jobs
6.032 2021-07-01 13:57:06+02:00 Europe/Berlin
- Fix: Must not ignore directory "." when given as argument to
commands netspoc, format-netspoc, ...
- Reverted secondary optimization in one case that could lead to
incorrect ACL.
6.031 2021-06-30 16:08:38+02:00 Europe/Berlin
- Improved secondary optimization.
Conflicts with aggregate rules are analyzed more accurately now,
leading to better performance and more optimized rules.
- Fixed 'format-netspoc':
- No longer remove comment before complex host and interface.
- Sort order of intersection is determined by first element now.
- Fixed 'export-netspoc':
Print owner name with "owner:" in error messages and warnings.
- Fix: Numbered protocol is now recognized as redundant to 'ip'.
- Commands 'export-netspoc' and 'print-service'
had slow runtime performance since version 6.029. This has been fixed.
6.030 2021-05-20 13:29:29+02:00 Europe/Berlin
- A warning is shown again, if list of objects in service after
'user', 'src', 'dst' is empty.
- A warning is shown, if some file is empty or contains only comments.
- Fixed automatic groups with interfaces:
- Interfaces of subnet are added if supernet is in same zone.
- External interface of crypto router is removed
if automatic group only contains encryptes parts.
- Attributes 'overlaps|unknown_owner|multi_owner|has_unenforceable'
with value 'restrict|enable|ok'
are supported at additional places now:
- at owner and
- at aggregate with IP address
Attribute at owner has higher priority than attribute inherited
from network, aggregate or area.
- Fixed command 'expand-group'.
It aborts now, if group definition isn't found.
Previously it substituted an empty list.
- Command 'format-netspoc' now ignores leading and trailing whitespace
in description and also trailing ';'.
6.029 2021-04-27 14:51:36+02:00 Europe/Berlin
- Fixed 'export-netspoc':
- NAT is observed again when exporting host with IP range.
- Data is generated, even if errors occur.
- No need to call c.splitSemiManagedRouter().
- Fixed check for aggregate with IP of NAT network:
Now aggregate that is subnet of NAT network is also checked.
- Fixed inheritance of NAT from network to subnet in zone.
Now inheritance works, even if zone is split by pathrestriction.
6.028 2021-04-22 15:17:29+02:00 Europe/Berlin
-Fixed 'export-netspoc'.
Newly introduced function c.splitSemiManagedRouter wasn't called.
6.027 2021-04-21 14:44:49+02:00 Europe/Berlin
- Added new command 'expand-group'
Usage: expand-group [-f file] netspoc GROUP ...
This command substitutes references to specified groups by its elements
and removes group definition afterwards.
Occurrences of group in intersection or complement can't be replaced.
In this case, the defintion isn't removed.
- Changed behaviour of command 'remove-from-netspoc':
If references to a group are removed, the defifinition of that group
is removed also.
- List of objects in service after 'user', 'src', 'dst' can be empty now.
Previously a warning was shown, but it was and is still valid to use a group
with empty list of elements.
- Runtime of compiler is 15 to 20% faster.
- Intermediate code is printed concurrently.
- Generation static routes.
- Lookup of NAT addresses.
6.026 2021-03-10 16:03:48+01:00 Europe/Berlin
- Fixed check for duplicate routes at VPN router.
- Added check for useless single NAT tag.
- "netspoc" is no longer a shell script, but a Go program.
Commands "spoc1", "spoc2" are gone.
6.025 2021-02-18 10:44:32+01:00 Europe/Berlin
- Added new command 'check-acl'
Usage: check-acl [-f file] code/router acl ['ip1 ip2 tcp|udp port']...
This command checks if given packets would be permitted or denied
by specified ACL.
ACL is read from code file that was generated by Netspoc for given router.
Packet descriptions are given on command line or read from file.
Each packet description is written to STDOUT,
prefixed with "permit" or "deny".
- Added check for rules with identical service body.
Two services have identical body, if rule definitions are equal
and lists of users could be combined into a single list.
This check is enabled with option
'--check_identical_services=0|warn|err'.
Default is off.
Printing of warn messages is controlled with attribute 'identical_body'.
A)
Warning for two identical services s1, s2 can be suppressed by
adding attribute 'identical_body = service:s2' to service:s1
or 'identical_body = service:s1' to service:s2.
B)
Attribute 'identical_body = enable|restrict|ok;'
at area, zone or network controls printing of warn messages.
The attribute is inherited to all objects contained in
given area, zone or network.
- If at least one object used in rule definitions of identical services
has attribute 'identical_body = restrict',
identical body is forbidden and warning can't be disabled.
- If all objects have attribute 'identical_body =ok',
identical body is allowed and no warning is shown.
- Otherwise a warning is shown that can be suppressed.
- Changed output of command 'export-netspoc'
IP of any:... is now written as 0.0.0.0/0.0.0.0 and not as 0.0.0.0
6.024 2021-02-02 15:10:10+01:00 Europe/Berlin
- Support new radius attribute "group-lock".
If set, attribute 'group-lock value <TUNNEL-GROUP-NAME>'
is added to generated group-policy of ASA.
- Better error message is shown, if '}' is missing after toplevel definition.
- Performance has been improved for hosts with very large IP range.
6.023 2021-01-22 12:44:54+01:00 Europe/Berlin
- NAT for ASA is supported now with more than two interfaces.
- Fixed 'bind_nat' at crypto definition for ASA.
- Attribute 'acl_use_real_ip' is enabled for ASA per default.
This attribute will be removed after next version.
- Attribute 'bind_nat' must no longer be used at crypto hub interface.
Move 'bind_nat' to crypto definition instead.
- Protocol 'icmp' is rejected in IPv6 service and
'icmpv6' is rejected in IPv4 service.
- Networks of locally attached zone are added to routing_only devices.
This is needed because routes between networks inside zone can't be
derived from packet filter rules.
- Fix: Version number is added to generated code again.
6.022 2020-11-10 12:37:40+01:00 Europe/Berlin
- Added support for attribute 'bind_nat' at crypto definition
for use at crypto hub.
Now NAT must no longer be equal for all tunnels at crypto hub,
but can be defined individually for each crypto definition.
Syntax for this experimental feature will change.
- Improved performance by concurrent execution of compiler stage
"Checking for redundant rules".
- Program 'export-netspoc' now exports additional JSON files
master_owner, zone2areas for use in internal proggram 'kmprep'.
- Fix: When checking for missing supernet rules, some networks may
not been shown when using pathrestrictions or bind_nat inside a zone.
- Show warning if 'filter_only' is used without 'managed = local'.
- Show warning of VRFs of a single router use different values
for 'policy_distribution_point'.
6.021 2020-10-21 09:56:09+02:00 Europe/Berlin
- Fixed 'add-to-group':
Don't print comment from first line of file after newly inserted element.
- Fixed intermediate code:
- Version number is written again.
- Missing prefix length /32 is printed for filter_only.
- Language change:
Source port for TCP and UDP is no longer applicable to unnamed protocol
but only to named protocol now.
6.020 2020-10-12 12:46:49+02:00 Europe/Berlin
- Migrated remaining parts from Perl to Go:
- Parsing files and directories
- Arranging protocols
- Linking topology
- Attribute 'identity' is no longer supported in isakmp definition.
Was ignored anyway.
6.019 2020-08-26 11:00:46+02:00 Europe/Berlin
- Fixed nil pointer dereference in 'rename-netspoc' caused by
area having only border or only inclusive_border.
This bug was introduced in previous version.
- No longer ignore interface in border of area,
if it is also used as inclusive_border.
6.018 2020-08-24 10:39:04+02:00 Europe/Berlin
- Fixed 'rename-netspoc': Interface in border or inclusive_border of area
is renamed now, when renaming network or router,.
- Migrated more parts from Perl to Go:
- Marking disabled parts of topology
- Preparing security zones and areas
- Private configuration contexts are no longer supported.
- Attribute 'auto_border' at area is no longer supported.
6.017 2020-08-11 12:55:04+02:00 Europe/Berlin
- The subnet relation between two networks was not checked in NAT domain
consisting only of an unnumbered network.
Under certain conditions this led to an invalid error message
"network:a is no longer supernet of network:b".
This has been fixed.
6.016 2020-08-10 17:28:01+02:00 Europe/Berlin
- A wrong number of changed elements was shown from
'add-to-netspoc', 'remove-from-netspoc' and 'rename-netspoc'.
This has been fixed.
Unchanged files are no longer reformatted.
6.015 2020-08-07 14:49:37+02:00 Europe/Berlin
- Improved secondary optimization.
- Improved error messages if no valid path was found between source
and destination. All affected rules are shown now. Previously only
the first one was shown.
- Fixed command 'print-group'. It no longer hangs if more than 64k
is written to STDERR.
- New command 'format-netspoc' pretty prints netspoc files.
- Commands 'add-to-netspoc', 'remove-from-netspoc' and 'rename-netspoc'
now output pretty printed files.
6.014 2020-07-10 14:50:58+02:00 Europe/Berlin
- Fixed option '-admins' of command 'print-group':
Now shows admins of an object, even if owner was inherited.
- Command 'print-group' now shows
- unnumbered and bridged interfaces from automatic group and
- crosslink networks.
- Command 'print-group' now shows result unsorted, in original order.
- Command 'add-to-netspoc' now allows to add multiple elements
to the same object in one run,
e.g. "add-to-netspoc file group:g host:a group:g host:b"
- Simplified syntax of Netspoc for easier migration from Perl to Go.
- 'radius_attributes' and 'router_attributes' are only accepted
if not empty.
- Attribute 'description' is only accepted at toplevel definitions.
It is no longer valid at host and interface definition.
- Migrated more parts from Perl to Go:
- Preparing fast path traversal
6.013 2020-04-23 16:54:09+02:00 Europe/Berlin
- Use hardlink when reusing code file from prevoious run.
- Added new option '-admins' to command 'print-group'
to show admins of owners of elements as comma separated list.
- Fixed options '-name' and '-ip' of command 'print-group'.
6.012 2020-04-06 13:46:43+02:00 Europe/Berlin
- Migrated more parts from Perl to Go:
- Most parts of program 'print-group'
- Most parts of program 'print-service'
- Most parts of program 'cut-netspoc'
- 'print-group' no longer supports option '-f'.
- Prevent duplicate hosts from zone cluster in area
in automatic group 'host:[area:some-area]'.
- 'export-netspoc' no longer generates files 'no_nat_set',
because Netspoc-Web only uses 'nat_set' now.
- 'export-netspoc' creates shorter file 'emails'.
Owners that are visible from wildcard address already,
are not added for emails matching that wildcard.
Netspoc-Web now merges owners of wildcard address for matching owners.
6.011 2020-03-16 09:13:38+01:00 Europe/Berlin
- Migrated more parts from Perl to Go:
- Distributing NAT
- Most parts of program 'export-netspoc'
- Fixed minor bug in check for identical network in other NAT domain.
This prevented an optimization in few cases.
- export-netspoc now generates files 'nat_set' additionally to 'no_nat_set'
for each owner, in preparation for equivalent change in Netspoc-Web.
6.010 2020-02-26 12:16:00+01:00 Europe/Berlin
- New radius-attribute "password-management_password-expire-in-days = NUM"
generates "password-management password-expire-in-days NUM"
in tunnel-group general-attributes
- Improved runtime performance for commands
add-to-netspoc and remove-from netspoc.
6.009 2020-02-24 12:00:10+01:00 Europe/Berlin
- Fixed check for unexpected subnet relation.
With network:n1 < any:a2 < network:n3, relation n1 < n3 is recognized now.
- Migrated program 'remove-from-netspoc' from Perl to Go.
6.008 2020-01-27 16:53:30+01:00 Europe/Berlin
- Fixed panic when accessing unknown object in group or rule.
Shows readable error message again:
"Error: Can't resolve ... in ..."
6.007 2020-01-24 11:56:11+01:00 Europe/Berlin
- Migrated more parts from Perl to Go:
- Finding subnets in zone
- Normalizing services (with expandGroup)
- Checking service owner
- LinkReroutePermit
- Removed support for managed hosts,
i.e Netspoc no longer generates iptables rules for Linux servers.
- Fixed RemoveSimpleDuplicateRules, now really removes.
6.006 2019-11-26 12:43:20+01:00 Europe/Berlin
- Attribute 'owner' is supported now at aggregate with IP.
All matching networks inherit owner from enclosing aggregate.
6.005 2019-11-19 16:12:38+01:00 Europe/Berlin
- Fixed bug in combineSubnets after migration from Perl to Go.
List of addresses is no longer changed in place.
The same list of addresses may be referenced by different rules.
If the same list was changed multiple times in place, this
sometimes led to duplicate or even missing elements in list.
6.004 2019-11-13 10:54:53+01:00 Europe/Berlin
- Adjacent IP networks are now combined also for IOS.
This leads to shorter ACLs.
- More redundant rules are found, because adjacent subnets are
combined later, after check for redundant rules now.
- Migrated another part from Perl to Go:
- Converting hosts to subnets
6.003 2019-11-01 12:24:45+01:00 Europe/Berlin
- map-value of ldap attribute-map is written as double quoted string now.
6.002 2019-10-22 16:20:00+02:00 Europe/Berlin
- Migrated more parts from Perl to Go:
- Finding subnets in NAT domains
- Checking rules for unstable subnet relation
- Marking topology for managed = local
- Checking rules with hidden or dynamic NAT
- Setting policy distribution IP
- Expanding crypto rules
- Copy raw files
- Improved secondary optimization in context with dynamic NAT.
- Removed debug messages in add-to-netspoc and rename-netspoc.
6.001 2019-10-07 13:50:09+02:00 Europe/Berlin
- Migrated more parts from Perl to Go:
- Checking supernet rules
- Finding routes
- Generating reverse rules for stateless routers
- Fixed bugs in migrated programs add-to-netspoc and rename-netspoc:
- Fixed processing of directories.
- Fixed very bad runtime performance.
- Fixed add-to-netspoc to process elements of group with umlauts in
group name.
6.000 2019-09-27 13:55:04+02:00 Europe/Berlin
- Started migration of Netspoc from Perl to Go (golang).
Some parts have already been migrated with identical functionality:
- Checking for redundant rules
- Marking rules for secondary optimization
- Rules distribution
- Printing intermediate code
- Pass2, generating code
5.054 2019-08-14 14:30:11+02:00 Europe/Berlin
- Now also network supports attributes
overlaps | unknown_owner | multi_owner | has_unenforceable
with value restrict | enable | ok.
- Changed priority of attributes 'overlaps' and 'has_unenforceable':
restrict < enable < ok
- 'restrict' is applied only if given at src AND dst.
- 'ok' is applied if given at src OR dst.
- Old syntax "has_unenforceable;" without value is no longer supported.
5.053 2019-05-22 15:44:21+02:00 Europe/Berlin
- New radius-attribute "anyconnect-custom_perapp = NAME"
generates "anyconnect-custom perapp value NAME"
in group-policy attributes
- Changed "#!/usr/bin/perl" to "#!/usr/bin/env perl" in scripts
to enable running files during tests, without installation.
5.052 2019-04-04 10:53:41+02:00 Europe/Berlin
- Netspoc generates ldap attribute-map at ASA now.
Define software client as ordinary host (not ID host) and add attribute
'ldap_id' with some LDAP attribute as value.
Add attribute 'cert_id' with some certificate pattern as value
at corresponding network.
Optionally move common postfix string of ldap_id,
that is identical for all hosts of a network,
to attribe 'ldap_append' of that network.
- Fixed command "remove-from-netspoc" for group with description.
- Fixed command "cut-netspoc" to not accidentally change
attribute 'unknown_owner' when removing 'owner' from input.
5.051 2019-03-08 12:20:02+01:00 Europe/Berlin
- Introduced new attributes at zone and area:
overlaps | unknown_owner | multi_owner | has_unenforceable
with value
restrict | enable | ok
These attributes control if corresponding attributes at service
are permitted.
- restrict: Attribute is not allowed at service
- enable: Attribute is allowed at service
- ok: No attribute needed at service to suppress warning.
Warning about unknown owner is restricted, if object with unknown owner is
located inside marked zone.
Warning about multiple owners is restricted, if objects with multiple
owners are located inside marked zone.
Warning about unenforceable rule is restricted, if src and dst are
located inside marked zone.
Warning about redundant or duplicate rule is restricted, if those both
zones are marked where src and dst are located.
Attribute is inherited from area to enclosing area and zone.
5.050 2019-02-28 12:50:47+01:00 Europe/Berlin
- Fixed bug in processing of NAT. Attribute bind_nat was ignored at unmanaged router if
- at least one interface has pathrestriction,
- at least two interfaces have no pathrestriction and
- bind_nat is placed at interface without pathrestriction.
5.049 2019-02-26 16:02:34+01:00 Europe/Berlin
- New warning on useless attribute 'multi_owner' is shown
- if 'user' objects belong to single owner and
- if multi owner could be avoided by swapping objects of 'user'
and objects of rules.
5.048 2019-01-24 13:48:47+01:00 Europe/Berlin
- Duplicate elements from automatic interfaces are silently ignored now.
- Useless attribute 'overlaps' is shown even if protocol has
modifier 'overlaps'.
- Fixed check for 'multi-owner' in service with mixed coupling rule
and normal rule.
5.047 2018-11-26 16:22:17+01:00 Europe/Berlin
- New option "CONTEXT" in
model = "ASA, VPN, CONTEXT" or model = "ASA, CONTEXT".
With this option set, line "ikev1 user-authentication none"
is no longer generated for "tunnel-group NAME ipsec-attributes".
- It is now valid, to define two areas, that only differ in a single
managed router. Previously this was rejected as "duplicate areas".
5.046 2018-10-26 12:57:43+02:00 Europe/Berlin
- Fix: Attribute acl_use_real_ip is now also applied to outgoing ACL.
- Rules from general_permit are no longer applied to loopback interfaces.
5.045 2018-10-24 17:02:28+02:00 Europe/Berlin
- Fix: No longer accidentally ignore zone having only a single
network at loopback interface of unmanaged router. This may occur
for zone having unnumbered or tunnel networks.