summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2024-03-04 14:50:16 +0100
committerGitHub <noreply@github.com>2024-03-04 14:50:16 +0100
commitd9047062977f029322d1e91002a748b2d17c5825 (patch)
tree84213392cf052ed45997ba5475606f75e51dbd66
parent70cf2388a184eacc6fb52d9edfb1c930de3bbb6a (diff)
parenta7a0c90404d03f7deccb74a46d0fe1f99116907a (diff)
downloadvyos-1x-d9047062977f029322d1e91002a748b2d17c5825.tar.gz
vyos-1x-d9047062977f029322d1e91002a748b2d17c5825.zip
Merge pull request #3080 from nicolas-fort/T6086
T6086: NAT: fix nat rules when using source-groups and translation address is a network.
-rw-r--r--python/vyos/nat.py11
-rwxr-xr-xsmoketest/scripts/cli/test_nat.py17
2 files changed, 19 insertions, 9 deletions
diff --git a/python/vyos/nat.py b/python/vyos/nat.py
index 7215aac88..da2613b16 100644
--- a/python/vyos/nat.py
+++ b/python/vyos/nat.py
@@ -89,11 +89,14 @@ def parse_nat_rule(rule_conf, rule_id, nat_type, ipv6=False):
if addr and is_ip_network(addr):
if not ipv6:
map_addr = dict_search_args(rule_conf, nat_type, 'address')
- if port:
- translation_output.append(f'{ip_prefix} prefix to {ip_prefix} {translation_prefix}addr map {{ {map_addr} : {addr} . {port} }}')
+ if map_addr:
+ if port:
+ translation_output.append(f'{ip_prefix} prefix to {ip_prefix} {translation_prefix}addr map {{ {map_addr} : {addr} . {port} }}')
+ else:
+ translation_output.append(f'{ip_prefix} prefix to {ip_prefix} {translation_prefix}addr map {{ {map_addr} : {addr} }}')
+ ignore_type_addr = True
else:
- translation_output.append(f'{ip_prefix} prefix to {ip_prefix} {translation_prefix}addr map {{ {map_addr} : {addr} }}')
- ignore_type_addr = True
+ translation_output.append(f'prefix to {addr}')
else:
translation_output.append(f'prefix to {addr}')
elif addr == 'masquerade':
diff --git a/smoketest/scripts/cli/test_nat.py b/smoketest/scripts/cli/test_nat.py
index 4f1c3cb4f..43e374398 100755
--- a/smoketest/scripts/cli/test_nat.py
+++ b/smoketest/scripts/cli/test_nat.py
@@ -87,21 +87,28 @@ class TestNAT(VyOSUnitTestSHIM.TestCase):
address_group_member = '192.0.2.1'
interface_group = 'smoketest_ifaces'
interface_group_member = 'bond.99'
- rule = '100'
self.cli_set(['firewall', 'group', 'address-group', address_group, 'address', address_group_member])
self.cli_set(['firewall', 'group', 'interface-group', interface_group, 'interface', interface_group_member])
- self.cli_set(src_path + ['rule', rule, 'source', 'group', 'address-group', address_group])
- self.cli_set(src_path + ['rule', rule, 'outbound-interface', 'group', interface_group])
- self.cli_set(src_path + ['rule', rule, 'translation', 'address', 'masquerade'])
+ self.cli_set(src_path + ['rule', '100', 'source', 'group', 'address-group', address_group])
+ self.cli_set(src_path + ['rule', '100', 'outbound-interface', 'group', interface_group])
+ self.cli_set(src_path + ['rule', '100', 'translation', 'address', 'masquerade'])
+
+ self.cli_set(src_path + ['rule', '110', 'source', 'group', 'address-group', address_group])
+ self.cli_set(src_path + ['rule', '110', 'translation', 'address', '203.0.113.1'])
+
+ self.cli_set(src_path + ['rule', '120', 'source', 'group', 'address-group', address_group])
+ self.cli_set(src_path + ['rule', '120', 'translation', 'address', '203.0.113.111/32'])
self.cli_commit()
nftables_search = [
[f'set A_{address_group}'],
[f'elements = {{ {address_group_member} }}'],
- [f'ip saddr @A_{address_group}', f'oifname @I_{interface_group}', 'masquerade']
+ [f'ip saddr @A_{address_group}', f'oifname @I_{interface_group}', 'masquerade'],
+ [f'ip saddr @A_{address_group}', 'snat to 203.0.113.1'],
+ [f'ip saddr @A_{address_group}', 'snat prefix to 203.0.113.111/32']
]
self.verify_nftables(nftables_search, 'ip vyos_nat')