From 2ae3de0848dee0f3da28727fc30e2beeecd412e1 Mon Sep 17 00:00:00 2001 From: Nicolas Fort Date: Wed, 27 Sep 2023 17:41:14 +0000 Subject: T5616: firewall: add option to be able to match firewall marks in firewall filter and in policy route. --- python/vyos/firewall.py | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'python/vyos/firewall.py') diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index 9122e264e..c07ed1adf 100644 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -381,6 +381,14 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name): conn_mark_str = ','.join(rule_conf['connection_mark']) output.append(f'ct mark {{{conn_mark_str}}}') + if 'mark' in rule_conf: + mark = rule_conf['mark'] + operator = '' + if mark[0] == '!': + operator = '!=' + mark = mark[1:] + output.append(f'meta mark {operator} {{{mark}}}') + if 'vlan' in rule_conf: if 'id' in rule_conf['vlan']: output.append(f'vlan id {rule_conf["vlan"]["id"]}') -- cgit v1.2.3