From 450ca9a9b46d69036af432ddad316d4ddb126085 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Tue, 30 Aug 2022 11:46:16 +0200
Subject: firewall: T2199: Refactor firewall + zone-policy, move interfaces
 under firewall node

* Refactor firewall and zone-policy rule creation and cleanup
* Migrate interface firewall values to `firewall interfaces <name> <direction> name/ipv6-name <name>`
* Remove `firewall-interface.py` conf script
---
 data/templates/zone_policy/nftables6.j2 | 77 +++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 data/templates/zone_policy/nftables6.j2

(limited to 'data/templates/zone_policy/nftables6.j2')

diff --git a/data/templates/zone_policy/nftables6.j2 b/data/templates/zone_policy/nftables6.j2
new file mode 100644
index 000000000..f7123d63d
--- /dev/null
+++ b/data/templates/zone_policy/nftables6.j2
@@ -0,0 +1,77 @@
+#!/usr/sbin/nft -f
+
+{% if zone is vyos_defined %}
+    chain VYOS_ZONE6_FORWARD {
+        type filter hook forward priority -1; policy accept;
+{%     if state_policy is vyos_defined %}
+        jump VYOS_STATE_POLICY6
+{%     endif %}
+{%     for zone_name, zone_conf in zone.items() %}
+{%         if zone_conf.ipv6 %}
+{%             if 'local_zone' not in zone_conf %}
+        oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE6_{{ zone_name }}
+{%             endif %}
+{%         endif %}
+{%     endfor %}
+    }
+    chain VYOS_ZONE6_LOCAL {
+        type filter hook input priority -1; policy accept;
+{%     if firewall.state_policy is vyos_defined %}
+        jump VYOS_STATE_POLICY6
+{%     endif %}
+{%     for zone_name, zone_conf in zone.items() %}
+{%         if zone_conf.ipv6 %}
+{%             if 'local_zone' in zone_conf %}
+        counter jump VZONE6_{{ zone_name }}_IN
+{%             endif %}
+{%         endif %}
+{%     endfor %}
+    }
+    chain VYOS_ZONE6_OUTPUT {
+        type filter hook output priority -1; policy accept;
+{%     if firewall.state_policy is vyos_defined %}
+        jump VYOS_STATE_POLICY6
+{%     endif %}
+{%     for zone_name, zone_conf in zone.items() %}
+{%         if zone_conf.ipv6 %}
+{%             if 'local_zone' in zone_conf %}
+        counter jump VZONE6_{{ zone_name }}_OUT
+{%             endif %}
+{%         endif %}
+{%     endfor %}
+    }
+{%     for zone_name, zone_conf in zone.items() if zone_conf.ipv6 %}
+{%         if zone_conf.local_zone is vyos_defined %}
+    chain VZONE6_{{ zone_name }}_IN {
+        iifname lo counter return
+{%             for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.ipv6_name is vyos_defined %}
+        iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }}
+        iifname { {{ zone[from_zone].interface | join(",") }} } counter return
+{%             endfor %}
+        {{ zone_conf | nft_default_rule('zone6_' + zone_name) }}
+    }
+    chain VZONE6_{{ zone_name }}_OUT {
+        oifname lo counter return
+{%             for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall.ipv6_name is vyos_defined %}
+        oifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }}
+        oifname { {{ zone[from_zone].interface | join(",") }} } counter return
+{%             endfor %}
+        {{ zone_conf | nft_default_rule('zone6_' + zone_name) }}
+    }
+{%         else %}
+    chain VZONE6_{{ zone_name }} {
+        iifname { {{ zone_conf.interface | join(",") }} } counter {{ zone_conf | nft_intra_zone_action(ipv6=True) }}
+{%             if zone_conf.intra_zone_filtering is vyos_defined %}
+        iifname { {{ zone_conf.interface | join(",") }} } counter return
+{%             endif %}
+{%             for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.ipv6_name is vyos_defined %}
+{%                 if zone[from_zone].local_zone is not defined %}
+        iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }}
+        iifname { {{ zone[from_zone].interface | join(",") }} } counter return
+{%                 endif %}
+{%             endfor %}
+        {{ zone_conf | nft_default_rule('zone6_' + zone_name) }}
+    }
+{%         endif %}
+{%     endfor %}
+{% endif %}
-- 
cgit v1.2.3