summaryrefslogtreecommitdiff
path: root/src/conf_mode/firewall.py
diff options
context:
space:
mode:
authorViacheslav Hletenko <v.gletenko@vyos.io>2023-09-18 21:44:29 +0300
committerGitHub <noreply@github.com>2023-09-18 21:44:29 +0300
commitcf4759be20c475bd34edab9604f7371ff5857723 (patch)
tree36fc16b2ca818110bbbe4c144be5380b7bb0fa90 /src/conf_mode/firewall.py
parent404fc9090629a61bc2110af7a2ec80ff30ec3608 (diff)
parentfb3ef9af5e394aa25692003fb3c185bfedefe3cb (diff)
downloadvyos-1x-cf4759be20c475bd34edab9604f7371ff5857723.tar.gz
vyos-1x-cf4759be20c475bd34edab9604f7371ff5857723.zip
Merge pull request #2276 from sarthurdev/conntrack
conntrack: T5571: Refactor conntrack using vyos.configdep
Diffstat (limited to 'src/conf_mode/firewall.py')
-rwxr-xr-xsrc/conf_mode/firewall.py24
1 files changed, 2 insertions, 22 deletions
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 769cc598f..d999b2a64 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -141,13 +141,7 @@ def get_config(config=None):
fqdn_config_parse(firewall)
- firewall['flowtable_enabled'] = False
- flow_offload = dict_search_args(firewall, 'global_options', 'flow_offload')
- if flow_offload and 'disable' not in flow_offload:
- for offload_type in ('software', 'hardware'):
- if dict_search_args(flow_offload, offload_type, 'interface'):
- firewall['flowtable_enabled'] = True
- break
+ set_dependents('conntrack', conf)
return firewall
@@ -350,19 +344,6 @@ def generate(firewall):
if not os.path.exists(nftables_conf):
firewall['first_install'] = True
- # Determine if conntrack is needed
- firewall['ipv4_conntrack_action'] = 'return'
- firewall['ipv6_conntrack_action'] = 'return'
- if firewall['flowtable_enabled']: # Netfilter's flowtable offload requires conntrack
- firewall['ipv4_conntrack_action'] = 'accept'
- firewall['ipv6_conntrack_action'] = 'accept'
- else: # Check if conntrack is needed by firewall rules
- for proto in ('ipv4', 'ipv6'):
- for rules, _ in dict_search_recursive(firewall.get(proto, {}), 'rule'):
- if any(('state' in rule_conf or 'connection_status' in rule_conf) for rule_conf in rules.values()):
- firewall[f'{proto}_conntrack_action'] = 'accept'
- break
-
render(nftables_conf, 'firewall/nftables.j2', firewall)
return None
@@ -392,8 +373,7 @@ def apply(firewall):
apply_sysfs(firewall)
- if firewall['group_resync']:
- call_dependents()
+ call_dependents()
# T970 Enable a resolver (systemd daemon) that checks
# domain-group/fqdn addresses and update entries for domains by timeout