summaryrefslogtreecommitdiff
path: root/python/vyos
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2024-02-28 20:56:54 +0100
committerGitHub <noreply@github.com>2024-02-28 20:56:54 +0100
commit5896eacd12f16d1b9810b325c205179a1606c885 (patch)
tree90f70d19c3c44f3671c1d77417308356fcbfd7f7 /python/vyos
parentfdfe194634f7a15c2299a3a3bffbe64fe578f466 (diff)
parent88dfa47ded706ea53a7b10ed058ddd5023226896 (diff)
downloadvyos-1x-5896eacd12f16d1b9810b325c205179a1606c885.tar.gz
vyos-1x-5896eacd12f16d1b9810b325c205179a1606c885.zip
Merge pull request #3059 from vyos/mergify/bp/sagitta/pr-3055
vrf: conntrack: T6073: Populate VRF zoning chains only while conntrack is required (backport #3055)
Diffstat (limited to 'python/vyos')
-rw-r--r--python/vyos/firewall.py18
1 files changed, 18 insertions, 0 deletions
diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py
index eee11bd2d..49e095946 100644
--- a/python/vyos/firewall.py
+++ b/python/vyos/firewall.py
@@ -34,6 +34,24 @@ from vyos.utils.process import call
from vyos.utils.process import cmd
from vyos.utils.process import run
+# Conntrack
+
+def conntrack_required(conf):
+ required_nodes = ['nat', 'nat66', 'load-balancing wan']
+
+ for path in required_nodes:
+ if conf.exists(path):
+ return True
+
+ firewall = conf.get_config_dict(['firewall'], key_mangling=('-', '_'),
+ no_tag_node_value_mangle=True, get_first_key=True)
+
+ for rules, path in dict_search_recursive(firewall, 'rule'):
+ if any(('state' in rule_conf or 'connection_status' in rule_conf or 'offload_target' in rule_conf) for rule_conf in rules.values()):
+ return True
+
+ return False
+
# Domain Resolver
def fqdn_config_parse(firewall):