diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2022-01-20 00:27:53 +0100 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2022-01-20 11:14:43 +0100 |
| commit | d1d0150b6a40252700181530ca87c5699a4bd0b4 (patch) | |
| tree | b61b5943369de9f185dea682e933e195f2d91cf4 /python | |
| parent | 569dfa77f07cb707dec4b29ed3e2a350e214af80 (diff) | |
| download | vyos-1x-d1d0150b6a40252700181530ca87c5699a4bd0b4.tar.gz vyos-1x-d1d0150b6a40252700181530ca87c5699a4bd0b4.zip | |
firewall: T2199: Add log prefix to match legacy perl behaviour
Example syslog: [FWNAME-default-D] ...
* Also clean-up firewall default-action
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/firewall.py | 3 | ||||
| -rw-r--r-- | python/vyos/template.py | 13 |
2 files changed, 15 insertions, 1 deletions
diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index 2ab78ff18..808e90e38 100644 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -121,7 +121,8 @@ def parse_rule(rule_conf, fw_name, rule_id, ip_name): output.append(f'{proto} {prefix}port $P_{group_name}') if 'log' in rule_conf and rule_conf['log'] == 'enable': - output.append('log') + action = rule_conf['action'] if 'action' in rule_conf else 'accept' + output.append(f'log prefix "[{fw_name[:19]}-{rule_id}-{action[:1].upper()}] "') if 'hop_limit' in rule_conf: operators = {'eq': '==', 'gt': '>', 'lt': '<'} diff --git a/python/vyos/template.py b/python/vyos/template.py index 6f65c6c98..633b28ade 100644 --- a/python/vyos/template.py +++ b/python/vyos/template.py @@ -516,6 +516,19 @@ def nft_rule(rule_conf, fw_name, rule_id, ip_name='ip'): from vyos.firewall import parse_rule return parse_rule(rule_conf, fw_name, rule_id, ip_name) +@register_filter('nft_default_rule') +def nft_default_rule(fw_conf, fw_name): + output = ['counter'] + default_action = fw_conf.get('default_action', 'accept') + + if 'enable_default_log' in fw_conf: + action_suffix = default_action[:1].upper() + output.append(f'log prefix "[{fw_name[:19]}-default-{action_suffix}] "') + + output.append(nft_action(default_action)) + output.append(f'comment "{fw_name} default-action {default_action}"') + return " ".join(output) + @register_filter('nft_state_policy') def nft_state_policy(conf, state, ipv6=False): out = [f'ct state {state}'] |