diff options
author | Christian Breunig <christian@breunig.cc> | 2023-09-19 18:48:09 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-09-19 18:48:09 +0200 |
commit | e570044ff8a81cbcfc340df5c8a33763a6962af3 (patch) | |
tree | 1ba3123b08fdb08dfc45295091a461cc39046dc0 /data | |
parent | 38cab26959ded78a737db2272fe25106a2de47b0 (diff) | |
parent | 0984a36f6d6427bb6cb665002be3e67c4a72ff9d (diff) | |
download | vyos-1x-e570044ff8a81cbcfc340df5c8a33763a6962af3.tar.gz vyos-1x-e570044ff8a81cbcfc340df5c8a33763a6962af3.zip |
Merge pull request #2288 from sarthurdev/flowtable
firewall: T4502: Update to flowtable CLI
Diffstat (limited to 'data')
-rw-r--r-- | data/templates/firewall/nftables-offload.j2 | 16 | ||||
-rw-r--r-- | data/templates/firewall/nftables.j2 | 36 |
2 files changed, 20 insertions, 32 deletions
diff --git a/data/templates/firewall/nftables-offload.j2 b/data/templates/firewall/nftables-offload.j2 index 6afcd79f7..a893e05b2 100644 --- a/data/templates/firewall/nftables-offload.j2 +++ b/data/templates/firewall/nftables-offload.j2 @@ -1,11 +1,9 @@ -{% macro render_flowtable(name, devices, priority='filter', hardware_offload=false, with_counter=true) %} -flowtable {{ name }} { - hook ingress priority {{ priority }}; devices = { {{ devices | join(', ') }} }; -{% if hardware_offload %} - flags offload; +{% macro flowtable(name, config) %} + flowtable VYOS_FLOWTABLE_{{ name }} { + hook ingress priority 0; devices = { {{ config.interface | join(', ') }} }; +{% if config.offload is vyos_defined('hardware') %} + flags offload; {% endif %} -{% if with_counter %} - counter -{% endif %} -} + counter + } {% endmacro %} diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index 1564b3ef8..75800ee3d 100644 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -2,7 +2,7 @@ {% import 'firewall/nftables-defines.j2' as group_tmpl %} {% import 'firewall/nftables-bridge.j2' as bridge_tmpl %} -{% import 'firewall/nftables-offload.j2' as offload %} +{% import 'firewall/nftables-offload.j2' as offload_tmpl %} flush chain raw vyos_global_rpfilter flush chain ip6 raw vyos_global_rpfilter @@ -34,6 +34,12 @@ delete table ip vyos_filter {% endif %} table ip vyos_filter { {% if ipv4 is vyos_defined %} +{% if flowtable is vyos_defined %} +{% for name, flowtable_conf in flowtable.items() %} +{{ offload_tmpl.flowtable(name, flowtable_conf) }} +{% endfor %} +{% endif %} + {% set ns = namespace(sets=[]) %} {% if ipv4.forward is vyos_defined %} {% for prior, conf in ipv4.forward.items() %} @@ -153,6 +159,12 @@ delete table ip6 vyos_filter {% endif %} table ip6 vyos_filter { {% if ipv6 is vyos_defined %} +{% if flowtable is vyos_defined %} +{% for name, flowtable_conf in flowtable.items() %} +{{ offload_tmpl.flowtable(name, flowtable_conf) }} +{% endfor %} +{% endif %} + {% set ns = namespace(sets=[]) %} {% if ipv6.forward is vyos_defined %} {% for prior, conf in ipv6.forward.items() %} @@ -255,29 +267,7 @@ table ip6 vyos_filter { {% if first_install is not vyos_defined %} delete table bridge vyos_filter {% endif %} -{% if bridge is vyos_defined %} table bridge vyos_filter { {{ bridge_tmpl.bridge(bridge) }} {{ group_tmpl.groups(group, False, False) }} } -{% endif %} - -{% if first_install is not vyos_defined %} -delete table inet vyos_offload -{% endif %} -table inet vyos_offload { -{% if global_options.flow_offload.hardware.interface is vyos_defined %} - {{- offload.render_flowtable('VYOS_FLOWTABLE_hardware', global_options.flow_offload.hardware.interface | list, priority='filter - 2', hardware_offload=true) }} - chain VYOS_OFFLOAD_hardware { - type filter hook forward priority filter - 2; policy accept; - ct state { established, related } meta l4proto { tcp, udp } flow add @VYOS_FLOWTABLE_hardware - } -{% endif %} -{% if global_options.flow_offload.software.interface is vyos_defined %} - {{- offload.render_flowtable('VYOS_FLOWTABLE_software', global_options.flow_offload.software.interface | list, priority='filter - 1') }} - chain VYOS_OFFLOAD_software { - type filter hook forward priority filter - 1; policy accept; - ct state { established, related } meta l4proto { tcp, udp } flow add @VYOS_FLOWTABLE_software - } -{% endif %} -} |