T5160: firewall refactor: new cli structure. Update jinja templates, python scripts and src firewall

2 files changed, 216 insertions, 149 deletions

diff --git a/data/templates/firewall/nftables-policy.j2 b/data/templates/firewall/nftables-policy.j2
index 1c9bda64f..699349e2b 100644
--- a/data/templates/firewall/nftables-policy.j2
+++ b/data/templates/firewall/nftables-policy.j2
@@ -25,7 +25,7 @@ table ip vyos_mangle {
     chain VYOS_PBR_UD_{{ route_text }} {
 {%         if conf.rule is vyos_defined %}
 {%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
-        {{ rule_conf | nft_rule(route_text, rule_id, 'ip') }}
+        {{ rule_conf | nft_rule('route', route_text, rule_id, 'ip') }}
 {%             endfor %}
 {%         endif %}
     }
@@ -54,7 +54,7 @@ table ip6 vyos_mangle {
     chain VYOS_PBR6_UD_{{ route_text }} {
 {%         if conf.rule is vyos_defined %}
 {%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
-        {{ rule_conf | nft_rule(route_text, rule_id, 'ip6') }}
+        {{ rule_conf | nft_rule('route6', route_text, rule_id, 'ip6') }}
 {%             endfor %}
 {%         endif %}
     }
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2
index 2c7115134..dcfe71a58 100644
--- a/data/templates/firewall/nftables.j2
+++ b/data/templates/firewall/nftables.j2
@@ -7,86 +7,147 @@
 delete table ip vyos_filter
 {% endif %}
 table ip vyos_filter {
-    chain VYOS_FW_FORWARD {
-        type filter hook forward priority 0; policy accept;
-{% if state_policy is vyos_defined %}
-        jump VYOS_STATE_POLICY
-{% endif %}
-{% if interface is vyos_defined %}
-{%     for ifname, ifconf in interface.items() %}
-{%         if ifconf.in is vyos_defined and ifconf.in.name is vyos_defined %}
-        iifname {{ ifname }} counter jump NAME_{{ ifconf.in.name }}
-{%         endif %}
-{%         if ifconf.out is vyos_defined and ifconf.out.name is vyos_defined %}
-        oifname {{ ifname }} counter jump NAME_{{ ifconf.out.name }}
-{%         endif %}
-{%     endfor %}
-{% endif %}
-        jump VYOS_POST_FW
+{% if ip is vyos_defined %}
+{%     if ip.forward is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for prior, conf in ip.forward.items() %}
+{%             set def_action = conf.default_action %}
+    chain VYOS_FORWARD_{{ prior }} {
+        type filter hook forward priority {{ prior }}; policy {{ def_action }};
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('FWD', prior, rule_id) }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['FWD_' + prior + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
     }
-    chain VYOS_FW_LOCAL {
-        type filter hook input priority 0; policy accept;
-{% if state_policy is vyos_defined %}
-        jump VYOS_STATE_POLICY
-{% endif %}
-{% if interface is vyos_defined %}
-{%     for ifname, ifconf in interface.items() %}
-{%         if ifconf.local is vyos_defined and ifconf.local.name is vyos_defined %}
-        iifname {{ ifname }} counter jump NAME_{{ ifconf.local.name }}
-{%         endif %}
-{%     endfor %}
-{% endif %}
-        jump VYOS_POST_FW
+{%         endfor %}
+{%         for set_name in ns.sets %}
+    set RECENT_{{ set_name }} {
+        type ipv4_addr
+        size 65535
+        flags dynamic
     }
-    chain VYOS_FW_OUTPUT {
-        type filter hook output priority 0; policy accept;
-{% if state_policy is vyos_defined %}
-        jump VYOS_STATE_POLICY
-{% endif %}
-        jump VYOS_POST_FW
+{%         endfor %}
+{%     endif %}
+
+{%     if ip.input is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for prior, conf in ip.input.items() %}
+{%             set def_action = conf.default_action %}
+    chain VYOS_INPUT_{{ prior }} {
+        type filter hook input priority {{ prior }}; policy {{ def_action }};
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('INP',prior, rule_id) }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['INP_' + prior + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
+    }
+{%         endfor %}
+{%         for set_name in ns.sets %}
+    set RECENT_{{ set_name }} {
+        type ipv4_addr
+        size 65535
+        flags dynamic
     }
-    chain VYOS_POST_FW {
-        return
+{%         endfor %}
+{%     endif %}
+
+{%     if ip.output is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for prior, conf in ip.output.items() %}
+{%             set def_action = conf.default_action %}
+    chain VYOS_OUTPUT_{{ prior }} {
+        type filter hook output priority {{ prior }}; policy {{ def_action }};
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('OUT', prior, rule_id) }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['OUT_' + prior + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
     }
+{%         endfor %}
+{%         for set_name in ns.sets %}
+    set RECENT_{{ set_name }} {
+        type ipv4_addr
+        size 65535
+        flags dynamic
+    }
+{%         endfor %}
+{%     endif %}
+
     chain VYOS_FRAG_MARK {
         type filter hook prerouting priority -450; policy accept;
         ip frag-off & 0x3fff != 0 meta mark set 0xffff1 return
     }
-{% if name is vyos_defined %}
-{%     set ns = namespace(sets=[]) %}
-{%     for name_text, conf in name.items() %}
-    chain NAME_{{ name_text }} {
-{%         if conf.rule is vyos_defined %}
-{%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
-        {{ rule_conf | nft_rule(name_text, rule_id) }}
-{%                 if rule_conf.recent is vyos_defined %}
-{%                     set ns.sets = ns.sets + [name_text + '_' + rule_id] %}
-{%                 endif %}
-{%             endfor %}
-{%         endif %}
-        {{ conf | nft_default_rule(name_text) }}
+{%     if ip.prerouting is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for prior, conf in ip.prerouting.items() %}
+    chain VYOS_PREROUTING_{{ prior }} {
+        type filter hook prerouting priority {{ prior }}; policy accept;
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('PRE', prior, rule_id) }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['PRE_' + prior + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
+        {{ conf | nft_default_rule(prior) }}
+        # jump VYOS_POST_FW
     }
-{%     endfor %}
-{%     for set_name in ip_fqdn %}
-    set FQDN_{{ set_name }} {
+{%         endfor %}
+{%         for set_name in ns.sets %}
+    set RECENT_{{ set_name }} {
         type ipv4_addr
-        flags interval
+        size 65535
+        flags dynamic
     }
-{%     endfor %}
-{%     for set_name in ns.sets %}
+{%         endfor %}
+{%     endif %}
+{%     if ip.name is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for name_text, conf in ip.name.items() %}
+    chain NAME_{{ name_text }} {
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('NAM', name_text, rule_id) }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['NAM_' + name_text + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
+        {{ conf | nft_default_rule(name_text) }}
+    }
+{%         endfor %}
+{%         for set_name in ns.sets %}
     set RECENT_{{ set_name }} {
         type ipv4_addr
         size 65535
         flags dynamic
     }
-{%     endfor %}
-{%     if geoip_updated.name is vyos_defined %}
-{%         for setname in geoip_updated.name %}
-    set {{ setname }} {
+{%         endfor %}
+{%         for set_name in ip_fqdn %}
+    set FQDN_{{ set_name }} {
         type ipv4_addr
         flags interval
     }
 {%         endfor %}
+{%         if geoip_updated.name is vyos_defined %}
+{%             for setname in geoip_updated.name %}
+    set {{ setname }} {
+        type ipv4_addr
+        flags interval
+    }
+{%             endfor %}
+{%         endif %}
 {%     endif %}
 {% endif %}
 
@@ -95,107 +156,128 @@ table ip vyos_filter {
 {% if zone is vyos_defined %}
 {{ zone_tmpl.zone_chains(zone, state_policy is vyos_defined, False) }}
 {% endif %}
-
-{% if state_policy is vyos_defined %}
-    chain VYOS_STATE_POLICY {
-{%     if state_policy.established is vyos_defined %}
-        {{ state_policy.established | nft_state_policy('established') }}
-{%     endif %}
-{%     if state_policy.invalid is vyos_defined %}
-        {{ state_policy.invalid | nft_state_policy('invalid') }}
-{%     endif %}
-{%     if state_policy.related is vyos_defined %}
-        {{ state_policy.related | nft_state_policy('related') }}
-{%     endif %}
-        return
-    }
-{% endif %}
 }
 
 {% if first_install is not vyos_defined %}
 delete table ip6 vyos_filter
 {% endif %}
 table ip6 vyos_filter {
-    chain VYOS_FW6_FORWARD {
-        type filter hook forward priority 0; policy accept;
-{% if state_policy is vyos_defined %}
-        jump VYOS_STATE_POLICY6
-{% endif %}
-{% if interface is vyos_defined %}
-{%     for ifname, ifconf in interface.items() %}
-{%         if ifconf.in is vyos_defined and ifconf.in.ipv6_name is vyos_defined %}
-        iifname {{ ifname }} counter jump NAME6_{{ ifconf.in.ipv6_name }}
-{%         endif %}
-{%         if ifconf.out is vyos_defined and ifconf.out.ipv6_name is vyos_defined %}
-        oifname {{ ifname }} counter jump NAME6_{{ ifconf.out.ipv6_name }}
-{%         endif %}
-{%     endfor %}
-{% endif %}
-        jump VYOS_POST_FW6
+{% if ipv6 is vyos_defined %}
+{%     if ipv6.forward is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for prior, conf in ipv6.forward.items() %}
+{%             set def_action = conf.default_action %}
+    chain VYOS_IPV6_FORWARD_{{ prior }} {
+        type filter hook forward priority {{ prior }}; policy {{ def_action }};
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('FWD', prior, rule_id ,'ip6') }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['FWD_' + prior + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
     }
-    chain VYOS_FW6_LOCAL {
-        type filter hook input priority 0; policy accept;
-{% if state_policy is vyos_defined %}
-        jump VYOS_STATE_POLICY6
-{% endif %}
-{% if interface is vyos_defined %}
-{%     for ifname, ifconf in interface.items() %}
-{%         if ifconf.local is vyos_defined and ifconf.local.ipv6_name is vyos_defined %}
-        iifname {{ ifname }} counter jump NAME6_{{ ifconf.local.ipv6_name }}
-{%         endif %}
-{%     endfor %}
-{% endif %}
-        jump VYOS_POST_FW6
+{%         endfor %}
+{%         for set_name in ns.sets %}
+    set RECENT6_{{ set_name }} {
+        type ipv6_addr
+        size 65535
+        flags dynamic
     }
-    chain VYOS_FW6_OUTPUT {
-        type filter hook output priority 0; policy accept;
-{% if state_policy is vyos_defined %}
-        jump VYOS_STATE_POLICY6
-{% endif %}
-        jump VYOS_POST_FW6
+{%         endfor %}
+{%     endif %}
+
+{%     if ipv6.input is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for prior, conf in ipv6.input.items() %}
+{%             set def_action = conf.default_action %}
+    chain VYOS_IPV6_INPUT_{{ prior }} {
+        type filter hook input priority {{ prior }}; policy {{ def_action }};
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('INP', prior, rule_id ,'ip6') }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['INP_' + prior + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
     }
-    chain VYOS_POST_FW6 {
-        return
+{%         endfor %}
+{%         for set_name in ns.sets %}
+    set RECENT6_{{ set_name }} {
+        type ipv6_addr
+        size 65535
+        flags dynamic
     }
+{%         endfor %}
+{%     endif %}
+
+{%     if ipv6.output is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for prior, conf in ipv6.output.items() %}
+{%             set def_action = conf.default_action %}
+    chain VYOS_IPV6_OUTPUT_{{ prior }} {
+        type filter hook output priority {{ prior }}; policy {{ def_action }};
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('OUT', prior, rule_id ,'ip6') }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['OUT_ ' + prior + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
+    }
+{%         endfor %}
+{%         for set_name in ns.sets %}
+    set RECENT6_{{ set_name }} {
+        type ipv6_addr
+        size 65535
+        flags dynamic
+    }
+{%         endfor %}
+{%     endif %}
     chain VYOS_FRAG6_MARK {
         type filter hook prerouting priority -450; policy accept;
         exthdr frag exists meta mark set 0xffff1 return
     }
-{% if ipv6_name is vyos_defined %}
-{%     set ns = namespace(sets=[]) %}
-{%     for name_text, conf in ipv6_name.items() %}
+
+{%     if ipv6.ipv6_name is vyos_defined %}
+{%         set ns = namespace(sets=[]) %}
+{%         for name_text, conf in ipv6.ipv6_name.items() %}
     chain NAME6_{{ name_text }} {
-{%         if conf.rule is vyos_defined %}
-{%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
-        {{ rule_conf | nft_rule(name_text, rule_id, 'ip6') }}
-{%                 if rule_conf.recent is vyos_defined %}
-{%                     set ns.sets = ns.sets + [name_text + '_' + rule_id] %}
-{%                 endif %}
-{%             endfor %}
-{%         endif %}
+{%             if conf.rule is vyos_defined %}
+{%                 for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('NAM', name_text, rule_id, 'ip6') }}
+{%                     if rule_conf.recent is vyos_defined %}
+{%                         set ns.sets = ns.sets + ['NAM_' + name_text + '_' + rule_id] %}
+{%                     endif %}
+{%                 endfor %}
+{%             endif %}
         {{ conf | nft_default_rule(name_text, ipv6=True) }}
     }
-{%     endfor %}
-{%     for set_name in ip6_fqdn %}
+{%         endfor %}
+{%         for set_name in ip6_fqdn %}
     set FQDN_{{ set_name }} {
         type ipv6_addr
         flags interval
     }
-{%     endfor %}
-{%     for set_name in ns.sets %}
+{%         endfor %}
+{%         for set_name in ns.sets %}
     set RECENT6_{{ set_name }} {
         type ipv6_addr
         size 65535
         flags dynamic
     }
-{%     endfor %}
-{%     if geoip_updated.ipv6_name is vyos_defined %}
-{%         for setname in geoip_updated.ipv6_name %}
+{%         endfor %}
+{%         if geoip_updated.ipv6_name is vyos_defined %}
+{%             for setname in geoip_updated.ipv6_name %}
     set {{ setname }} {
         type ipv6_addr
         flags interval
     }
-{%         endfor %}
+{%             endfor %}
+{%         endif %}
 {%     endif %}
 {% endif %}
 
@@ -204,19 +286,4 @@ table ip6 vyos_filter {
 {% if zone is vyos_defined %}
 {{ zone_tmpl.zone_chains(zone, state_policy is vyos_defined, True) }}
 {% endif %}
-
-{% if state_policy is vyos_defined %}
-    chain VYOS_STATE_POLICY6 {
-{%     if state_policy.established is vyos_defined %}
-        {{ state_policy.established | nft_state_policy('established') }}
-{%     endif %}
-{%     if state_policy.invalid is vyos_defined %}
-        {{ state_policy.invalid | nft_state_policy('invalid') }}
-{%     endif %}
-{%     if state_policy.related is vyos_defined %}
-        {{ state_policy.related | nft_state_policy('related') }}
-{%     endif %}
-        return
-    }
-{% endif %}
-}
+}
\ No newline at end of file