From 9ab63d484741b513894f16e4925f164f0264789c Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Fri, 7 Oct 2022 20:48:13 +0200
Subject: firewall: T3907: Fix firewall state-policy logging

When log-level was introduced node `state-policy x log` was removed without migrator. This commit adds it back and improves log handling.
---
 python/vyos/template.py | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

(limited to 'python/vyos')

diff --git a/python/vyos/template.py b/python/vyos/template.py
index 0870a0523..2a4135f9e 100644
--- a/python/vyos/template.py
+++ b/python/vyos/template.py
@@ -566,12 +566,17 @@ def nft_default_rule(fw_conf, fw_name, ipv6=False):
     return " ".join(output)
 
 @register_filter('nft_state_policy')
-def nft_state_policy(conf, state, ipv6=False):
+def nft_state_policy(conf, state):
     out = [f'ct state {state}']
 
-    if 'log' in conf:
-        log_level = conf['log']
-        out.append(f'log level {log_level}')
+    if 'log' in conf and 'enable' in conf['log']:
+        log_state = state[:3].upper()
+        log_action = (conf['action'] if 'action' in conf else 'accept')[:1].upper()
+        out.append(f'log prefix "[STATE-POLICY-{log_state}-{log_action}]"')
+
+        if 'log_level' in conf:
+            log_level = conf['log_level']
+            out.append(f'level {log_level}')
 
     out.append('counter')
 
-- 
cgit v1.2.3