diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2022-01-20 00:27:53 +0100 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2022-01-20 11:14:43 +0100 |
| commit | d1d0150b6a40252700181530ca87c5699a4bd0b4 (patch) | |
| tree | b61b5943369de9f185dea682e933e195f2d91cf4 /python/vyos/template.py | |
| parent | 569dfa77f07cb707dec4b29ed3e2a350e214af80 (diff) | |
| download | vyos-1x-d1d0150b6a40252700181530ca87c5699a4bd0b4.tar.gz vyos-1x-d1d0150b6a40252700181530ca87c5699a4bd0b4.zip | |
firewall: T2199: Add log prefix to match legacy perl behaviour
Example syslog: [FWNAME-default-D] ...
* Also clean-up firewall default-action
Diffstat (limited to 'python/vyos/template.py')
| -rw-r--r-- | python/vyos/template.py | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/python/vyos/template.py b/python/vyos/template.py index 6f65c6c98..633b28ade 100644 --- a/python/vyos/template.py +++ b/python/vyos/template.py @@ -516,6 +516,19 @@ def nft_rule(rule_conf, fw_name, rule_id, ip_name='ip'): from vyos.firewall import parse_rule return parse_rule(rule_conf, fw_name, rule_id, ip_name) +@register_filter('nft_default_rule') +def nft_default_rule(fw_conf, fw_name): + output = ['counter'] + default_action = fw_conf.get('default_action', 'accept') + + if 'enable_default_log' in fw_conf: + action_suffix = default_action[:1].upper() + output.append(f'log prefix "[{fw_name[:19]}-default-{action_suffix}] "') + + output.append(nft_action(default_action)) + output.append(f'comment "{fw_name} default-action {default_action}"') + return " ".join(output) + @register_filter('nft_state_policy') def nft_state_policy(conf, state, ipv6=False): out = [f'ct state {state}'] |