From 2a90b963e1f1f399f2173ba1b4f4a289960c8f7d Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Sat, 7 Mar 2026 08:50:05 +0200 Subject: T8186: netflow: add test for ver5 + IPv6 ipt_NETFLOW protocol version 5 is incompatible with IPv6. Add simple test for version 5. --- smoketest/scripts/cli/test_system_flow-accounting.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/smoketest/scripts/cli/test_system_flow-accounting.py b/smoketest/scripts/cli/test_system_flow-accounting.py index 7de865b72..a5ab9b1fd 100755 --- a/smoketest/scripts/cli/test_system_flow-accounting.py +++ b/smoketest/scripts/cli/test_system_flow-accounting.py @@ -280,5 +280,19 @@ class TestSystemFlowAccounting(VyOSUnitTestSHIM.TestCase): ) + def test_netflow_v5(self): + version = '5' + netflow_server = '203.0.113.27' + + for interface in Section.interfaces('ethernet'): + self.cli_set(base_path + ['netflow', 'interface', interface]) + + self.cli_set(base_path + ['netflow', 'version', version]) + self.cli_set(base_path + ['netflow', 'server', netflow_server]) + + # commit changes + self.cli_commit() + + if __name__ == '__main__': unittest.main(verbosity=2, failfast=VyOSUnitTestSHIM.TestCase.debug_on()) -- cgit v1.2.3 From 9e2d972d5d4940efa28be38a1b55b3d6e4b4be7a Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Sat, 7 Mar 2026 21:58:39 +0200 Subject: T8186: netflow: disable IPv6 for protocol version5 --- python/vyos/ipt_netflow.py | 14 +++++++++----- src/conf_mode/system_flow-accounting.py | 5 +++-- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/python/vyos/ipt_netflow.py b/python/vyos/ipt_netflow.py index b1630f30c..14d2a458d 100644 --- a/python/vyos/ipt_netflow.py +++ b/python/vyos/ipt_netflow.py @@ -140,14 +140,18 @@ def _iptables_config_v4_and_v6(configured_ifaces, direction): _iptables_config(command, configured_ifaces, direction) -def set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces): +def set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces, ipv6=True): """ Update iptables and ip6tables rules so that ipt_NETFLOW watches exact list of interfaces in ingress_interfaces for ingress table/chain and egress_interfaces for egress table/chain """ - _iptables_config_v4_and_v6(ingress_interfaces, 'ingress') - _iptables_config_v4_and_v6(egress_interfaces, 'egress') + commands = ['iptables'] + if ipv6: + commands.append('ip6tables') + for command in commands: + _iptables_config(command, ingress_interfaces, 'ingress') + _iptables_config(command, egress_interfaces, 'egress') def stop(): @@ -160,7 +164,7 @@ def stop(): unload_kmod(module_name) -def start(ingress_interfaces, egress_interfaces): +def start(ingress_interfaces, egress_interfaces, ipv6=True): """ Start ipt_NETFLOW: @@ -171,4 +175,4 @@ def start(ingress_interfaces, egress_interfaces): check_kmod(module_name) - set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces) + set_watched_iptables_interfaces(ingress_interfaces, egress_interfaces, ipv6=ipv6) diff --git a/src/conf_mode/system_flow-accounting.py b/src/conf_mode/system_flow-accounting.py index b23ee77fd..3318ad465 100755 --- a/src/conf_mode/system_flow-accounting.py +++ b/src/conf_mode/system_flow-accounting.py @@ -183,11 +183,12 @@ def apply(flow_config): if 'enable_egress' in flow_config: egress_interfaces = ingress_interfaces + enable_ipv6 = flow_config['netflow']['version'] != '5' if need_reload: - ipt_netflow.start(ingress_interfaces, egress_interfaces) + ipt_netflow.start(ingress_interfaces, egress_interfaces, ipv6=enable_ipv6) else: ipt_netflow.set_watched_iptables_interfaces( - ingress_interfaces, egress_interfaces + ingress_interfaces, egress_interfaces, ipv6=enable_ipv6 ) -- cgit v1.2.3