summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2022-01-10 23:05:59 +0100
committerChristian Poessinger <christian@poessinger.com>2022-01-10 23:06:10 +0100
commit9bc2f5db25c74f7a4c10c10cf0bbdc2f1879c2db (patch)
treea168c0fcc88d9fb6f2705b2bed04c1e98b32dfb2 /src/conf_mode
parent465939d9c9b413c7033c8833cbb4ebc30b9bcf66 (diff)
downloadvyos-1x-9bc2f5db25c74f7a4c10c10cf0bbdc2f1879c2db.tar.gz
vyos-1x-9bc2f5db25c74f7a4c10c10cf0bbdc2f1879c2db.zip
conntrack: T3579: prepare for "conntrack timeout custom rule" CLI commands
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/conntrack.py10
1 files changed, 7 insertions, 3 deletions
diff --git a/src/conf_mode/conntrack.py b/src/conf_mode/conntrack.py
index 3cb0dd1e2..b9eb8071d 100755
--- a/src/conf_mode/conntrack.py
+++ b/src/conf_mode/conntrack.py
@@ -35,7 +35,7 @@ airbag.enable()
conntrack_config = r'/etc/modprobe.d/vyatta_nf_conntrack.conf'
sysctl_file = r'/run/sysctl/10-vyos-conntrack.conf'
-nftables_ct_ignore_file = r'/run/nftables-ct-ignore.conf'
+nftables_ct_file = r'/run/nftables-ct.conf'
# Every ALG (Application Layer Gateway) consists of either a Kernel Object
# also called a Kernel Module/Driver or some rules present in iptables
@@ -82,6 +82,10 @@ def get_config(config=None):
# We have gathered the dict representation of the CLI, but there are default
# options which we need to update into the dictionary retrived.
default_values = defaults(base)
+ # XXX: T2665: we can not safely rely on the defaults() when there are
+ # tagNodes in place, it is better to blend in the defaults manually.
+ if 'timeout' in default_values and 'custom' in default_values['timeout']:
+ del default_values['timeout']['custom']
conntrack = dict_merge(default_values, conntrack)
return conntrack
@@ -99,7 +103,7 @@ def verify(conntrack):
def generate(conntrack):
render(conntrack_config, 'conntrack/vyos_nf_conntrack.conf.tmpl', conntrack)
render(sysctl_file, 'conntrack/sysctl.conf.tmpl', conntrack)
- render(nftables_ct_ignore_file, 'conntrack/nftables-ct-ignore.tmpl', conntrack)
+ render(nftables_ct_file, 'conntrack/nftables-ct.tmpl', conntrack)
return None
@@ -137,7 +141,7 @@ def apply(conntrack):
cmd(f'nft insert rule ip raw VYOS_CT_HELPER {rule}')
# Load new nftables ruleset
- cmd(f'nft -f {nftables_ct_ignore_file}')
+ cmd(f'nft -f {nftables_ct_file}')
if process_named_running('conntrackd'):
# Reload conntrack-sync daemon to fetch new sysctl values