summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-07-03 21:07:01 +0200
committerGitHub <noreply@github.com>2023-07-03 21:07:01 +0200
commitf1b50757f816ad7a11077656c8fcf54d21bf1888 (patch)
tree75390cbdfa235d55aaedc020fb31c9cbce9d4b6b
parentfbb4f315eee8cd701aade8845ea842567a56dc64 (diff)
parent5cf503955377d138c626b2c8157eab71b1fa8fad (diff)
downloadvyos-1x-f1b50757f816ad7a11077656c8fcf54d21bf1888.tar.gz
vyos-1x-f1b50757f816ad7a11077656c8fcf54d21bf1888.zip
Merge pull request #2069 from sever-sever/T5333
T5333: Set prefix UD for PBR generated user-defined chain names
-rw-r--r--data/templates/firewall/nftables-policy.j28
-rwxr-xr-xsmoketest/scripts/cli/test_policy_route.py16
2 files changed, 12 insertions, 12 deletions
diff --git a/data/templates/firewall/nftables-policy.j2 b/data/templates/firewall/nftables-policy.j2
index 7a89d29e4..1c9bda64f 100644
--- a/data/templates/firewall/nftables-policy.j2
+++ b/data/templates/firewall/nftables-policy.j2
@@ -11,7 +11,7 @@ table ip vyos_mangle {
type filter hook prerouting priority -150; policy accept;
{% if route is vyos_defined %}
{% for route_text, conf in route.items() if conf.interface is vyos_defined %}
- iifname { {{ conf.interface | join(",") }} } counter jump VYOS_PBR_{{ route_text }}
+ iifname { {{ conf.interface | join(",") }} } counter jump VYOS_PBR_UD_{{ route_text }}
{% endfor %}
{% endif %}
}
@@ -22,7 +22,7 @@ table ip vyos_mangle {
{% if route is vyos_defined %}
{% for route_text, conf in route.items() %}
- chain VYOS_PBR_{{ route_text }} {
+ chain VYOS_PBR_UD_{{ route_text }} {
{% if conf.rule is vyos_defined %}
{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
{{ rule_conf | nft_rule(route_text, rule_id, 'ip') }}
@@ -40,7 +40,7 @@ table ip6 vyos_mangle {
type filter hook prerouting priority -150; policy accept;
{% if route6 is vyos_defined %}
{% for route_text, conf in route6.items() if conf.interface is vyos_defined %}
- iifname { {{ ",".join(conf.interface) }} } counter jump VYOS_PBR6_{{ route_text }}
+ iifname { {{ ",".join(conf.interface) }} } counter jump VYOS_PBR6_UD_{{ route_text }}
{% endfor %}
{% endif %}
}
@@ -51,7 +51,7 @@ table ip6 vyos_mangle {
{% if route6 is vyos_defined %}
{% for route_text, conf in route6.items() %}
- chain VYOS_PBR6_{{ route_text }} {
+ chain VYOS_PBR6_UD_{{ route_text }} {
{% if conf.rule is vyos_defined %}
{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
{{ rule_conf | nft_rule(route_text, rule_id, 'ip6') }}
diff --git a/smoketest/scripts/cli/test_policy_route.py b/smoketest/scripts/cli/test_policy_route.py
index a3df6bf4d..c83e633b2 100755
--- a/smoketest/scripts/cli/test_policy_route.py
+++ b/smoketest/scripts/cli/test_policy_route.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python3
#
-# Copyright (C) 2021-2022 VyOS maintainers and contributors
+# Copyright (C) 2021-2023 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
@@ -100,7 +100,7 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
self.cli_commit()
nftables_search = [
- [f'iifname "{interface}"','jump VYOS_PBR_smoketest'],
+ [f'iifname "{interface}"','jump VYOS_PBR_UD_smoketest'],
['ip daddr @N_smoketest_network1', 'ip saddr @N_smoketest_network'],
]
@@ -119,7 +119,7 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
mark_hex = "{0:#010x}".format(int(mark))
nftables_search = [
- [f'iifname "{interface}"','jump VYOS_PBR_smoketest'],
+ [f'iifname "{interface}"','jump VYOS_PBR_UD_smoketest'],
['ip daddr 172.16.10.10', 'ip saddr 172.16.20.10', 'meta mark set ' + mark_hex],
]
@@ -138,7 +138,7 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
mark_hex_set = "{0:#010x}".format(int(conn_mark_set))
nftables_search = [
- [f'iifname "{interface}"','jump VYOS_PBR_smoketest'],
+ [f'iifname "{interface}"','jump VYOS_PBR_UD_smoketest'],
['ip daddr 172.16.10.10', 'ip saddr 172.16.20.10', 'ct mark ' + mark_hex, 'ct mark set ' + mark_hex_set],
]
@@ -164,7 +164,7 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
# IPv4
nftables_search = [
- [f'iifname "{interface}"', 'jump VYOS_PBR_smoketest'],
+ [f'iifname "{interface}"', 'jump VYOS_PBR_UD_smoketest'],
['tcp flags syn / syn,ack', 'tcp dport 8888', 'meta mark set ' + mark_hex]
]
@@ -173,7 +173,7 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
# IPv6
nftables6_search = [
- [f'iifname "{interface}"', 'jump VYOS_PBR6_smoketest'],
+ [f'iifname "{interface}"', 'jump VYOS_PBR6_UD_smoketest'],
['meta l4proto { tcp, udp }', 'th dport 8888', 'meta mark set ' + mark_hex]
]
@@ -246,7 +246,7 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
# IPv4
nftables_search = [
- ['iifname { "' + interface + '", "' + interface_wc + '" }', 'jump VYOS_PBR_smoketest'],
+ ['iifname { "' + interface + '", "' + interface_wc + '" }', 'jump VYOS_PBR_UD_smoketest'],
['meta l4proto udp', 'drop'],
['tcp flags syn / syn,ack', 'meta mark set ' + mark_hex],
['ct state new', 'tcp dport 22', 'ip saddr 198.51.100.0/24', 'ip ttl > 2', 'meta mark set ' + mark_hex],
@@ -258,7 +258,7 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
# IPv6
nftables6_search = [
- [f'iifname "{interface_wc}"', 'jump VYOS_PBR6_smoketest'],
+ [f'iifname "{interface_wc}"', 'jump VYOS_PBR6_UD_smoketest'],
['meta l4proto udp', 'drop'],
['tcp flags syn / syn,ack', 'meta mark set ' + mark_hex],
['ct state new', 'tcp dport 22', 'ip6 saddr 2001:db8::/64', 'ip6 hoplimit > 2', 'meta mark set ' + mark_hex],