Merge pull request #1206 from sarthurdev/T4209

firewall: T4209: Fix support for rule `recent` matches

1 files changed, 22 insertions, 0 deletions

diff --git a/data/templates/firewall/nftables.tmpl b/data/templates/firewall/nftables.tmpl
index 468a5a32f..0cc977cf9 100644
--- a/data/templates/firewall/nftables.tmpl
+++ b/data/templates/firewall/nftables.tmpl
@@ -31,16 +31,27 @@ table ip filter {
     }
 {% endif %}
 {% if name is defined %}
+{%   set ns = namespace(sets=[]) %}
 {%   for name_text, conf in name.items() %}
     chain NAME_{{ name_text }} {
 {%     if conf.rule is defined %}
 {%       for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not defined %}
         {{ rule_conf | nft_rule(name_text, rule_id) }}
+{%         if rule_conf.recent is defined %}
+{%           set ns.sets = ns.sets + [name_text + '_' + rule_id] %}
+{%         endif %}
 {%       endfor %}
 {%     endif %}
         {{ conf | nft_default_rule(name_text) }}
     }
 {%   endfor %}
+{%   for set_name in ns.sets %}
+    set RECENT_{{ set_name }} {
+        type ipv4_addr
+        size 65535
+        flags dynamic
+    }
+{%   endfor %}
 {% endif %}
 {% if state_policy is defined %}
     chain VYOS_STATE_POLICY {
@@ -81,16 +92,27 @@ table ip6 filter {
     }
 {% endif %}
 {% if ipv6_name is defined %}
+{%   set ns = namespace(sets=[]) %}
 {%   for name_text, conf in ipv6_name.items() %}
     chain NAME6_{{ name_text }} {
 {%     if conf.rule is defined %}
 {%       for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not defined %}
         {{ rule_conf | nft_rule(name_text, rule_id, 'ip6') }}
+{%         if rule_conf.recent is defined %}
+{%           set ns.sets = ns.sets + [name_text + '_' + rule_id] %}
+{%         endif %}
 {%       endfor %}
 {%     endif %}
         {{ conf | nft_default_rule(name_text) }}
     }
 {%   endfor %}
+{%   for set_name in ns.sets %}
+    set RECENT6_{{ set_name }} {
+        type ipv6_addr
+        size 65535
+        flags dynamic
+    }
+{%   endfor %}
 {% endif %}
 {% if state_policy is defined %}
     chain VYOS_STATE_POLICY6 {