From 2a5273e650ce1242bc22e992e5a3104961ec1295 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Tue, 25 Oct 2022 12:29:03 +0200
Subject: nat: T4764: Remove tables on NAT deletion

---
 src/conf_mode/nat.py | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'src')

diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py
index 8b1a5a720..1e807753d 100755
--- a/src/conf_mode/nat.py
+++ b/src/conf_mode/nat.py
@@ -204,6 +204,10 @@ def apply(nat):
     cmd(f'nft -f {nftables_nat_config}')
     cmd(f'nft -f {nftables_static_nat_conf}')
 
+    if not nat or 'deleted' in nat:
+        os.unlink(nftables_nat_config)
+        os.unlink(nftables_static_nat_conf)
+
     return None
 
 if __name__ == '__main__':
-- 
cgit v1.2.3


From 16207f7a8ffdbc93fcfcc4b6ba783940a1e40e33 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Tue, 25 Oct 2022 22:41:55 +0200
Subject: nat: T4706: Verify translation address or port exists

---
 src/conf_mode/nat.py | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'src')

diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py
index 1e807753d..978c043e9 100755
--- a/src/conf_mode/nat.py
+++ b/src/conf_mode/nat.py
@@ -146,6 +146,10 @@ def verify(nat):
             if config['outbound_interface'] not in 'any' and config['outbound_interface'] not in interfaces():
                 Warning(f'rule "{rule}" interface "{config["outbound_interface"]}" does not exist on this system')
 
+            if not dict_search('translation.address', config) and not dict_search('translation.port', config):
+                if 'exclude' not in config:
+                    raise ConfigError(f'{err_msg} translation requires address and/or port')
+
             addr = dict_search('translation.address', config)
             if addr != None and addr != 'masquerade' and not is_ip_network(addr):
                 for ip in addr.split('-'):
@@ -166,6 +170,10 @@ def verify(nat):
             elif config['inbound_interface'] not in 'any' and config['inbound_interface'] not in interfaces():
                 Warning(f'rule "{rule}" interface "{config["inbound_interface"]}" does not exist on this system')
 
+            if not dict_search('translation.address', config) and not dict_search('translation.port', config):
+                if 'exclude' not in config:
+                    raise ConfigError(f'{err_msg} translation requires address and/or port')
+
             # common rule verification
             verify_rule(config, err_msg)
 
-- 
cgit v1.2.3