nhrp: T2199: Use separate table in nftables for NHRP rules

2 files changed, 31 insertions, 18 deletions

diff --git a/data/templates/nhrp/nftables.conf.j2 b/data/templates/nhrp/nftables.conf.j2
new file mode 100644
index 000000000..a0d1f6d4c
--- /dev/null
+++ b/data/templates/nhrp/nftables.conf.j2
@@ -0,0 +1,17 @@
+#!/usr/sbin/nft -f
+
+{% if first_install is not vyos_defined %}
+delete table ip vyos_nhrp_filter
+{% endif %}
+table ip vyos_nhrp_filter {
+    chain VYOS_NHRP_OUTPUT {
+        type filter hook output priority 10; policy accept;
+{% if tunnel is vyos_defined %}
+{%     for tun, tunnel_conf in tunnel.items() %}
+{%         if if_tunnel[tun].source_address is vyos_defined %}
+        ip protocol gre ip saddr {{ if_tunnel[tun].source_address }} ip daddr 224.0.0.0/4 counter drop comment "VYOS_NHRP_{{ tun }}"
+{%         endif %}
+{%     endfor %}
+{% endif %}
+    }
+}
diff --git a/src/conf_mode/protocols_nhrp.py b/src/conf_mode/protocols_nhrp.py
index 991fcc7eb..d28ced4fd 100755
--- a/src/conf_mode/protocols_nhrp.py
+++ b/src/conf_mode/protocols_nhrp.py
@@ -14,10 +14,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import os
+
 from vyos.config import Config
 from vyos.configdict import node_changed
-from vyos.firewall import find_nftables_rule
-from vyos.firewall import remove_nftables_rule
 from vyos.template import render
 from vyos.util import process_named_running
 from vyos.util import run
@@ -26,6 +26,7 @@ from vyos import airbag
 airbag.enable()
 
 opennhrp_conf = '/run/opennhrp/opennhrp.conf'
+nhrp_nftables_conf = '/run/nftables_nhrp.conf'
 
 def get_config(config=None):
     if config:
@@ -84,28 +85,23 @@ def verify(nhrp):
     return None
 
 def generate(nhrp):
+    if not os.path.exists(nhrp_nftables_conf):
+        nhrp['first_install'] = True
+
     render(opennhrp_conf, 'nhrp/opennhrp.conf.j2', nhrp)
+    render(nhrp_nftables_conf, 'nhrp/nftables.conf.j2', nhrp)
     return None
 
 def apply(nhrp):
-    if 'tunnel' in nhrp:
-        for tunnel, tunnel_conf in nhrp['tunnel'].items():
-            if 'source_address' in nhrp['if_tunnel'][tunnel]:
-                comment = f'VYOS_NHRP_{tunnel}'
-                source_address = nhrp['if_tunnel'][tunnel]['source_address']
-
-                rule_handle = find_nftables_rule('ip vyos_filter', 'VYOS_FW_OUTPUT', ['ip protocol gre', f'ip saddr {source_address}', 'ip daddr 224.0.0.0/4'])
-                if not rule_handle:
-                    run(f'sudo nft insert rule ip vyos_filter VYOS_FW_OUTPUT ip protocol gre ip saddr {source_address} ip daddr 224.0.0.0/4 counter drop comment "{comment}"')
-
-    for tunnel in nhrp['del_tunnels']:
-        comment = f'VYOS_NHRP_{tunnel}'
-        rule_handle = find_nftables_rule('ip vyos_filter', 'VYOS_FW_OUTPUT', [f'comment "{comment}"'])
-        if rule_handle:
-            remove_nftables_rule('ip vyos_filter', 'VYOS_FW_OUTPUT', rule_handle)
+    nft_rc = run(f'nft -f {nhrp_nftables_conf}')
+    if nft_rc != 0:
+        raise ConfigError('Failed to apply NHRP tunnel firewall rules')
 
     action = 'restart' if nhrp and 'tunnel' in nhrp else 'stop'
-    run(f'systemctl {action} opennhrp.service')
+    service_rc = run(f'systemctl {action} opennhrp.service')
+    if service_rc != 0:
+        raise ConfigError(f'Failed to {action} the NHRP service')
+
     return None
 
 if __name__ == '__main__':