Merge pull request #5035 from hedrok/T8186-fix-netflow-v5

T8186: netflow: disable IPv6 for netflow protocol version 5

3 files changed, 26 insertions, 7 deletions

diff --git a/python/vyos/ipt_netflow.py b/python/vyos/ipt_netflow.py
index b1630f30c..14d2a458d 100644
--- a/python/vyos/ipt_netflow.py
+++ b/python/vyos/ipt_netflow.py
@@ -140,14 +140,18 @@ def _iptables_config_v4_and_v6(configured_ifaces, direction):
         _iptables_config(command, configured_ifaces, direction)
 
 
-def set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces):
+def set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces, ipv6=True):
     """
     Update iptables and ip6tables rules so that ipt_NETFLOW watches
     exact list of interfaces in ingress_interfaces for ingress table/chain
     and egress_interfaces for egress table/chain
     """
-    _iptables_config_v4_and_v6(ingress_interfaces, 'ingress')
-    _iptables_config_v4_and_v6(egress_interfaces, 'egress')
+    commands = ['iptables']
+    if ipv6:
+        commands.append('ip6tables')
+    for command in commands:
+        _iptables_config(command, ingress_interfaces, 'ingress')
+        _iptables_config(command, egress_interfaces, 'egress')
 
 
 def stop():
@@ -160,7 +164,7 @@ def stop():
     unload_kmod(module_name)
 
 
-def start(ingress_interfaces, egress_interfaces):
+def start(ingress_interfaces, egress_interfaces, ipv6=True):
     """
     Start ipt_NETFLOW:
 
@@ -171,4 +175,4 @@ def start(ingress_interfaces, egress_interfaces):
 
     check_kmod(module_name)
 
-    set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces)
+    set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces, ipv6=ipv6)
diff --git a/smoketest/scripts/cli/test_system_flow-accounting.py b/smoketest/scripts/cli/test_system_flow-accounting.py
index 7de865b72..a5ab9b1fd 100755
--- a/smoketest/scripts/cli/test_system_flow-accounting.py
+++ b/smoketest/scripts/cli/test_system_flow-accounting.py
@@ -280,5 +280,19 @@ class TestSystemFlowAccounting(VyOSUnitTestSHIM.TestCase):
         )
 
 
+    def test_netflow_v5(self):
+        version = '5'
+        netflow_server = '203.0.113.27'
+
+        for interface in Section.interfaces('ethernet'):
+            self.cli_set(base_path + ['netflow', 'interface', interface])
+
+        self.cli_set(base_path + ['netflow', 'version', version])
+        self.cli_set(base_path + ['netflow', 'server', netflow_server])
+
+        # commit changes
+        self.cli_commit()
+
+
 if __name__ == '__main__':
     unittest.main(verbosity=2, failfast=VyOSUnitTestSHIM.TestCase.debug_on())
diff --git a/src/conf_mode/system_flow-accounting.py b/src/conf_mode/system_flow-accounting.py
index b23ee77fd..3318ad465 100755
--- a/src/conf_mode/system_flow-accounting.py
+++ b/src/conf_mode/system_flow-accounting.py
@@ -183,11 +183,12 @@ def apply(flow_config):
         if 'enable_egress' in flow_config:
             egress_interfaces = ingress_interfaces
 
+    enable_ipv6 = flow_config['netflow']['version'] != '5'
     if need_reload:
-        ipt_netflow.start(ingress_interfaces, egress_interfaces)
+        ipt_netflow.start(ingress_interfaces, egress_interfaces, ipv6=enable_ipv6)
     else:
         ipt_netflow.set_watched_iptables_interfaces(
-            ingress_interfaces, egress_interfaces
+            ingress_interfaces, egress_interfaces, ipv6=enable_ipv6
         )