diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2022-09-20 17:16:43 +0200 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2022-09-21 20:53:49 +0200 |
| commit | e6ba98a85ca72abc7e7e2001d208bcd1806c2c13 (patch) | |
| tree | dc36b04502efdab35b3ab9612e36c4fc008068f4 /src | |
| parent | 448d4f6db9cf6dfceffccf988301e5f4d04c9afa (diff) | |
| download | vyos-1x-e6ba98a85ca72abc7e7e2001d208bcd1806c2c13.tar.gz vyos-1x-e6ba98a85ca72abc7e7e2001d208bcd1806c2c13.zip | |
nat66: T4605: Refactor NAT66 to use python module for parsing rules
* Rename table to vyos_nat
* Refactor tests to use `verify_nftables` format
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/nat66.py | 11 | ||||
| -rwxr-xr-x | src/op_mode/show_nat66_statistics.py | 2 |
2 files changed, 8 insertions, 5 deletions
diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py index f64102d88..d8f913b0c 100755 --- a/src/conf_mode/nat66.py +++ b/src/conf_mode/nat66.py @@ -36,7 +36,7 @@ airbag.enable() k_mod = ['nft_nat', 'nft_chain_nat'] -nftables_nat66_config = '/tmp/vyos-nat66-rules.nft' +nftables_nat66_config = '/run/nftables_nat66.nft' ndppd_config = '/run/ndppd/ndppd.conf' def get_handler(json, chain, target): @@ -147,6 +147,9 @@ def verify(nat): return None def generate(nat): + if not os.path.exists(nftables_nat66_config): + nat['first_install'] = True + render(nftables_nat66_config, 'firewall/nftables-nat66.j2', nat, permission=0o755) render(ndppd_config, 'ndppd/ndppd.conf.j2', nat, permission=0o755) return None @@ -154,15 +157,15 @@ def generate(nat): def apply(nat): if not nat: return None - cmd(f'{nftables_nat66_config}') + + cmd(f'nft -f {nftables_nat66_config}') + if 'deleted' in nat or not dict_search('source.rule', nat): cmd('systemctl stop ndppd') if os.path.isfile(ndppd_config): os.unlink(ndppd_config) else: cmd('systemctl restart ndppd') - if os.path.isfile(nftables_nat66_config): - os.unlink(nftables_nat66_config) return None diff --git a/src/op_mode/show_nat66_statistics.py b/src/op_mode/show_nat66_statistics.py index bc81692ae..cb10aed9f 100755 --- a/src/op_mode/show_nat66_statistics.py +++ b/src/op_mode/show_nat66_statistics.py @@ -44,7 +44,7 @@ group.add_argument("--destination", help="Show statistics for configured destina args = parser.parse_args() if args.source or args.destination: - tmp = cmd('sudo nft -j list table ip6 nat') + tmp = cmd('sudo nft -j list table ip6 vyos_nat') tmp = json.loads(tmp) source = r"nftables[?rule.chain=='POSTROUTING'].rule.{chain: chain, handle: handle, comment: comment, counter: expr[].counter | [0], interface: expr[].match.right | [0] }" |