From e6ba98a85ca72abc7e7e2001d208bcd1806c2c13 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Tue, 20 Sep 2022 17:16:43 +0200
Subject: nat66: T4605: Refactor NAT66 to use python module for parsing rules

* Rename table to vyos_nat
* Refactor tests to use `verify_nftables` format
---
 src/conf_mode/nat66.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'src/conf_mode')

diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py
index f64102d88..d8f913b0c 100755
--- a/src/conf_mode/nat66.py
+++ b/src/conf_mode/nat66.py
@@ -36,7 +36,7 @@ airbag.enable()
 
 k_mod = ['nft_nat', 'nft_chain_nat']
 
-nftables_nat66_config = '/tmp/vyos-nat66-rules.nft'
+nftables_nat66_config = '/run/nftables_nat66.nft'
 ndppd_config = '/run/ndppd/ndppd.conf'
 
 def get_handler(json, chain, target):
@@ -147,6 +147,9 @@ def verify(nat):
     return None
 
 def generate(nat):
+    if not os.path.exists(nftables_nat66_config):
+        nat['first_install'] = True
+
     render(nftables_nat66_config, 'firewall/nftables-nat66.j2', nat, permission=0o755)
     render(ndppd_config, 'ndppd/ndppd.conf.j2', nat, permission=0o755)
     return None
@@ -154,15 +157,15 @@ def generate(nat):
 def apply(nat):
     if not nat:
         return None
-    cmd(f'{nftables_nat66_config}')
+
+    cmd(f'nft -f {nftables_nat66_config}')
+
     if 'deleted' in nat or not dict_search('source.rule', nat):
         cmd('systemctl stop ndppd')
         if os.path.isfile(ndppd_config):
             os.unlink(ndppd_config)
     else:
         cmd('systemctl restart ndppd')
-    if os.path.isfile(nftables_nat66_config):
-        os.unlink(nftables_nat66_config)
 
     return None
 
-- 
cgit v1.2.3