diff options
| -rw-r--r-- | data/templates/firewall/nftables-nat66.tmpl | 17 | ||||
| -rw-r--r-- | interface-definitions/nat66.xml.in | 19 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_nat66.py | 35 | ||||
| -rwxr-xr-x | src/conf_mode/nat66.py | 9 | ||||
| -rwxr-xr-x | src/migration-scripts/nat66/0-to-1 | 2 |
5 files changed, 67 insertions, 15 deletions
diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl index b1a8f7a16..cdaeaad6a 100644 --- a/data/templates/firewall/nftables-nat66.tmpl +++ b/data/templates/firewall/nftables-nat66.tmpl @@ -13,8 +13,20 @@ {% endif %} {% set trns_address = dnat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} {% elif chain == "POSTROUTING" %} +{% if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} +{% if config.translation.address == 'masquerade' %} +{% set trns_address = config.translation.address %} +{% else %} +{% if config.translation.address | is_ip_network %} +{# support 1:1 network translation #} +{% set snat_type = "snat prefix to " %} +{% else %} +{% set snat_type = "snat to " %} +{% endif %} +{% set trns_address = snat_type + config.translation.address %} +{% endif %} +{% endif %} {% set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined else '' %} -{% set trns_prefix = "snat prefix to " + config.translation.prefix if config.translation is defined and config.translation.prefix is defined and config.translation.prefix is not none %} {% endif %} {% set comment = "NPT-NAT-" + rule %} {% if rule.log %} @@ -35,9 +47,6 @@ {% if dest_address %} {% set output = output + " " + dest_address %} {% endif %} -{% if trns_prefix %} -{% set output = output + " " + trns_prefix %} -{% endif %} {% if trns_address %} {% set output = output + " " + trns_address %} {% endif %} diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in index b45ebc0a8..d5e1226f9 100644 --- a/interface-definitions/nat66.xml.in +++ b/interface-definitions/nat66.xml.in @@ -70,18 +70,31 @@ </node> <node name="translation"> <properties> - <help>Translated IPv6 prefix options</help> + <help>Translated IPv6 address options</help> </properties> <children> - <leafNode name="prefix"> + <leafNode name="address"> <properties> - <help>IPv6 prefix to translate to</help> + <help>IPv6 address to translate to</help> + <completionHelp> + <list>masquerade</list> + </completionHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address</description> + </valueHelp> <valueHelp> <format>ipv6net</format> <description>IPv6 prefix</description> </valueHelp> + <valueHelp> + <format>masquerade</format> + <description>NAT to the primary address of outbound-interface</description> + </valueHelp> <constraint> + <validator name="ipv6-address"/> <validator name="ipv6-prefix"/> + <regex>(masquerade)</regex> </constraint> </properties> </leafNode> diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py index ccc4196e0..4838fb8d8 100755 --- a/smoketest/scripts/cli/test_nat66.py +++ b/smoketest/scripts/cli/test_nat66.py @@ -44,7 +44,7 @@ class TestNAT66(unittest.TestCase): translation_prefix = 'fc01::/64' self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1']) self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix]) - self.session.set(src_path + ['rule', '1', 'translation', 'prefix', translation_prefix]) + self.session.set(src_path + ['rule', '1', 'translation', 'address', translation_prefix]) # check validate() - outbound-interface must be defined self.session.commit() @@ -70,6 +70,36 @@ class TestNAT66(unittest.TestCase): self.assertEqual(f'{translation_address}/{translation_mask}', translation_prefix) self.assertEqual(f'{address}/{mask}', source_prefix) + def test_source_nat66_address(self): + source_prefix = 'fc00::/64' + translation_address = 'fc00::1' + self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1']) + self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix]) + self.session.set(src_path + ['rule', '1', 'translation', 'address', translation_address]) + + # check validate() - outbound-interface must be defined + self.session.commit() + + tmp = cmd('sudo nft -j list table ip6 nat') + data_json = jmespath.search('nftables[?rule].rule[?chain]', json.loads(tmp)) + + for idx in range(0, len(data_json)): + data = data_json[idx] + + self.assertEqual(data['chain'], 'POSTROUTING') + self.assertEqual(data['family'], 'ip6') + self.assertEqual(data['table'], 'nat') + + iface = dict_search('match.right', data['expr'][0]) + address = dict_search('match.right.prefix.addr', data['expr'][2]) + mask = dict_search('match.right.prefix.len', data['expr'][2]) + snat_address = dict_search('snat.addr', data['expr'][3]) + + self.assertEqual(iface, 'eth1') + # check for translation address + self.assertEqual(snat_address, translation_address) + self.assertEqual(f'{address}/{mask}', source_prefix) + def test_destination_nat66(self): destination_address = 'fc00::1' translation_address = 'fc01::1' @@ -127,7 +157,6 @@ class TestNAT66(unittest.TestCase): # T2813: Ensure translation address is specified rule = '5' source_prefix = 'fc00::/64' - translation_prefix = 'fc00:2::/64' self.session.set(src_path + ['rule', rule, 'source', 'prefix', source_prefix]) # check validate() - outbound-interface must be defined @@ -139,7 +168,7 @@ class TestNAT66(unittest.TestCase): with self.assertRaises(ConfigSessionError): self.session.commit() - self.session.set(src_path + ['rule', rule, 'translation', 'prefix', translation_prefix]) + self.session.set(src_path + ['rule', rule, 'translation', 'address', 'masquerade']) self.session.commit() def test_nat66_no_rules(self): diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py index dc3cd550c..ce1db316c 100755 --- a/src/conf_mode/nat66.py +++ b/src/conf_mode/nat66.py @@ -28,6 +28,7 @@ from vyos.util import cmd from vyos.util import check_kmod from vyos.util import dict_search from vyos.template import is_ipv6 +from vyos.template import is_ip_network from vyos.xml import defaults from vyos import ConfigError from vyos import airbag @@ -116,10 +117,10 @@ def verify(nat): if config['outbound_interface'] not in interfaces(): print(f'WARNING: rule "{rule}" interface "{config["outbound_interface"]}" does not exist on this system') - prefix = dict_search('translation.prefix', config) - if prefix != None: - if not is_ipv6(prefix): - raise ConfigError(f'Warning: IPv6 prefix {prefix} is not a valid address prefix') + addr = dict_search('translation.address', config) + if addr != None: + if addr != 'masquerade' and not is_ipv6(addr): + raise ConfigError(f'Warning: IPv6 address {addr} is not a valid address') prefix = dict_search('source.prefix', config) if prefix != None: diff --git a/src/migration-scripts/nat66/0-to-1 b/src/migration-scripts/nat66/0-to-1 index 74d64c07b..83b421926 100755 --- a/src/migration-scripts/nat66/0-to-1 +++ b/src/migration-scripts/nat66/0-to-1 @@ -49,7 +49,7 @@ def merge_npt(config,base,rule): if config.exists(base + ['translation','prefix']): tmp = config.return_value(base + ['translation','prefix']) - config.set(merge_base + ['translation','prefix'],value=tmp) + config.set(merge_base + ['translation','address'],value=tmp) if not config.exists(['nat', 'nptv6']): # Nothing to do |