summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorsarthurdev <965089+sarthurdev@users.noreply.github.com>2022-01-11 00:20:36 +0100
committersarthurdev <965089+sarthurdev@users.noreply.github.com>2022-01-11 11:57:56 +0100
commit1292a69a5fe9fe931676a475e011dece578233df (patch)
treef7964d16853cff25008b912f15fc06bc469f2788
parent5334ca6fc758c3e9c86dfcb3d4ace5d54ab8878a (diff)
downloadvyos-1x-1292a69a5fe9fe931676a475e011dece578233df.tar.gz
vyos-1x-1292a69a5fe9fe931676a475e011dece578233df.zip
firewall: policy: T2199: Reload policy route script if `firewall group` node is changed
-rwxr-xr-xsrc/conf_mode/firewall.py14
1 files changed, 14 insertions, 0 deletions
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 06e6a1ed4..bca5afb2e 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -22,6 +22,7 @@ from sys import exit
from vyos.config import Config
from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
from vyos.configdiff import get_config_diff, Diff
from vyos.template import render
from vyos.util import cmd
@@ -33,6 +34,8 @@ from vyos import ConfigError
from vyos import airbag
airbag.enable()
+policy_route_conf_script = '/usr/libexec/vyos/conf_mode/policy-route.py'
+
nftables_conf = '/run/nftables.conf'
nftables_defines_conf = '/run/nftables_defines.conf'
@@ -111,6 +114,7 @@ def get_config(config=None):
default_values = defaults(base)
firewall = dict_merge(default_values, firewall)
+ firewall['policy_resync'] = bool('group' in firewall or node_changed(conf, base + ['group']))
firewall['interfaces'] = get_firewall_interfaces(conf)
if 'config_trap' in firewall and firewall['config_trap'] == 'enable':
@@ -119,6 +123,7 @@ def get_config(config=None):
firewall['trap_targets'] = conf.get_config_dict(['service', 'snmp', 'trap-target'],
key_mangling=('-', '_'), get_first_key=True,
no_tag_node_value_mangle=True)
+
return firewall
def verify_rule(firewall, rule_conf, ipv6):
@@ -301,6 +306,12 @@ def state_policy_rule_exists():
search_str = cmd(f'nft list chain ip filter VYOS_FW_FORWARD')
return 'VYOS_STATE_POLICY' in search_str
+def resync_policy_route():
+ # Update policy route as firewall groups were updated
+ tmp = run(policy_route_conf_script)
+ if tmp > 0:
+ print('Warning: Failed to re-apply policy route configuration')
+
def apply(firewall):
if 'first_install' in firewall:
run('nfct helper add rpc inet tcp')
@@ -320,6 +331,9 @@ def apply(firewall):
apply_sysfs(firewall)
+ if firewall['policy_resync']:
+ resync_policy_route()
+
post_apply_trap(firewall)
return None