T8186: netflow: disable IPv6 for protocol version5

2 files changed, 12 insertions, 7 deletions

diff --git a/python/vyos/ipt_netflow.py b/python/vyos/ipt_netflow.py
index b1630f30c..14d2a458d 100644
--- a/python/vyos/ipt_netflow.py
+++ b/python/vyos/ipt_netflow.py
@@ -140,14 +140,18 @@ def _iptables_config_v4_and_v6(configured_ifaces, direction):
         _iptables_config(command, configured_ifaces, direction)
 
 
-def set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces):
+def set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces, ipv6=True):
     """
     Update iptables and ip6tables rules so that ipt_NETFLOW watches
     exact list of interfaces in ingress_interfaces for ingress table/chain
     and egress_interfaces for egress table/chain
     """
-    _iptables_config_v4_and_v6(ingress_interfaces, 'ingress')
-    _iptables_config_v4_and_v6(egress_interfaces, 'egress')
+    commands = ['iptables']
+    if ipv6:
+        commands.append('ip6tables')
+    for command in commands:
+        _iptables_config(command, ingress_interfaces, 'ingress')
+        _iptables_config(command, egress_interfaces, 'egress')
 
 
 def stop():
@@ -160,7 +164,7 @@ def stop():
     unload_kmod(module_name)
 
 
-def start(ingress_interfaces, egress_interfaces):
+def start(ingress_interfaces, egress_interfaces, ipv6=True):
     """
     Start ipt_NETFLOW:
 
@@ -171,4 +175,4 @@ def start(ingress_interfaces, egress_interfaces):
 
     check_kmod(module_name)
 
-    set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces)
+    set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces, ipv6=ipv6)
diff --git a/src/conf_mode/system_flow-accounting.py b/src/conf_mode/system_flow-accounting.py
index b23ee77fd..3318ad465 100755
--- a/src/conf_mode/system_flow-accounting.py
+++ b/src/conf_mode/system_flow-accounting.py
@@ -183,11 +183,12 @@ def apply(flow_config):
         if 'enable_egress' in flow_config:
             egress_interfaces = ingress_interfaces
 
+    enable_ipv6 = flow_config['netflow']['version'] != '5'
     if need_reload:
-        ipt_netflow.start(ingress_interfaces, egress_interfaces)
+        ipt_netflow.start(ingress_interfaces, egress_interfaces, ipv6=enable_ipv6)
     else:
         ipt_netflow.set_watched_iptables_interfaces(
-            ingress_interfaces, egress_interfaces
+            ingress_interfaces, egress_interfaces, ipv6=enable_ipv6
         )