Merge branch 'nat-nftables' of github.com:c-po/vyos-1x into current

* 'nat-nftables' of github.com:c-po/vyos-1x: (27 commits)
  nat: T2198: remove "tcp_udp" from "show nat dest stat"x
  Debian: add required dependency on systemd
  nat: T2198: add common ip-protocol validator
  nat: T2198: use Jinja2 macro for common ruleset for SNAT and DNAT
  nat: T2198: restructure DNAT template part for less duplicated code
  nat: T2198: add support for SNAT based on source addresses
  nat: T2198: set default protocol to all to be backwards compatible
  nat: T2198: sync generated SNAT rules with VyOS 1.2
  nat: T2198: sync generated DNAT rules with VyOS 1.2
  nat: T2198: do not run DNAT rule if rule is disabled
  nat: T2198: restructure DNAT template
  nat: T2198: verify translation address for SNAT and DNAT
  nat: T2198: extend verify() for destination ports
  nat: T2198: migrate "log enable" node to only "log"
  nat: T2198: add protocol completion helper and regex constraint
  nat: T2198: migrate "show nat" commands to XML and Python
  nat: T2198: add some basic verify() rules
  nat: T2198: split nat-address-port include into individual files
  nat: T2198: add ipv4-{address,prefix,rage}-exclude validators
  nat: T2198: add new ipv4-range validator
  ...

1 files changed, 63 insertions, 0 deletions

diff --git a/src/op_mode/show_nat_statistics.py b/src/op_mode/show_nat_statistics.py
new file mode 100755
index 000000000..0b53112f2
--- /dev/null
+++ b/src/op_mode/show_nat_statistics.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import jmespath
+import json
+
+from argparse import ArgumentParser
+from jinja2 import Template
+from sys import exit
+from vyos.util import cmd
+
+OUT_TMPL_SRC="""
+rule      pkts        bytes   interface
+----      ----        -----   ---------
+{% for r in output %}
+{%- if r.comment -%}
+{%- set packets   = r.counter.packets -%}
+{%- set bytes     = r.counter.bytes -%}
+{%- set interface = r.interface -%}
+{# remove rule comment prefix #}
+{%- set comment   = r.comment | replace('SRC-NAT-', '') | replace('DST-NAT-', '') | replace(' tcp_udp', '') -%}
+{{ "%-4s" | format(comment) }} {{ "%9s" | format(packets) }} {{ "%12s" | format(bytes) }}   {{ interface }}
+{%- endif %}
+{% endfor %}
+"""
+
+parser = ArgumentParser()
+group = parser.add_mutually_exclusive_group()
+group.add_argument("--source", help="Show statistics for configured source NAT rules", action="store_true")
+group.add_argument("--destination", help="Show statistics for configured destination NAT rules", action="store_true")
+args = parser.parse_args()
+
+if args.source or args.destination:
+    tmp = cmd('sudo nft -j list table nat')
+    tmp = json.loads(tmp)
+
+    source = r"nftables[?rule.chain=='POSTROUTING'].rule.{chain: chain, handle: handle, comment: comment, counter: expr[].counter | [0], interface: expr[].match.right | [0] }"
+    destination = r"nftables[?rule.chain=='PREROUTING'].rule.{chain: chain, handle: handle, comment: comment, counter: expr[].counter | [0], interface: expr[].match.right | [0] }"
+    data = {
+        'output' : jmespath.search(source if args.source else destination, tmp),
+        'direction' : 'source' if args.source else 'destination'
+    }
+
+    tmpl = Template(OUT_TMPL_SRC, lstrip_blocks=True)
+    print(tmpl.render(data))
+    exit(0)
+else:
+    parser.print_help()
+    exit(1)
+