(self, direction, rule_list)
| 499 | self.nft_ipv4_acl.append({'type': "", 'chain': chain, 'rule': rstr}) |
| 500 | |
| 501 | def __process_ip6(self, direction, rule_list): |
| 502 | if not self.ip6_cidr: |
| 503 | return |
| 504 | tier_cidr = self.ip6_cidr |
| 505 | chain = "%s_%s_policy" % (self.device, direction) |
| 506 | parent_chain = "acl_forward" |
| 507 | cidr_key = "saddr" |
| 508 | if direction == "ingress": |
| 509 | cidr_key = "daddr" |
| 510 | parent_chain_rule = "ip6 %s %s jump %s" % (cidr_key, tier_cidr, chain) |
| 511 | self.ipv6_acl.insert(0, {'type': "", 'chain': parent_chain, 'rule': parent_chain_rule}) |
| 512 | self.ipv6_acl.insert(0, {'type': "chain", 'chain': chain}) |
| 513 | for rule in rule_list: |
| 514 | cidr = rule['cidr'] |
| 515 | if cidr is not None and cidr != "": |
| 516 | cidr = removeUndesiredCidrs(cidr, 4) |
| 517 | if cidr is None or cidr == "": |
| 518 | continue |
| 519 | addr = "" |
| 520 | if cidr: |
| 521 | addr = "ip6 daddr " + cidr |
| 522 | if direction == "ingress": |
| 523 | addr = "ip6 saddr " + cidr |
| 524 | |
| 525 | proto = "" |
| 526 | protocol = rule['type'] |
| 527 | if protocol != "all": |
| 528 | icmp_type = "" |
| 529 | if protocol == "protocol": |
| 530 | protocol = "ip6 nexthdr %d" % rule['protocol'] |
| 531 | proto = protocol |
| 532 | if proto == "icmp": |
| 533 | proto = proto_str = "icmpv6" |
| 534 | icmp_type = ICMPV6_TYPE_ANY |
| 535 | if 'icmp_type' in rule and rule['icmp_type'] != -1: |
| 536 | icmp_type = str(rule['icmp_type']) |
| 537 | proto = "%s type %s" % (proto_str, icmp_type) |
| 538 | if 'icmp_code' in rule and rule['icmp_code'] != -1: |
| 539 | proto = "%s %s code %d" % (proto, proto_str, rule['icmp_code']) |
| 540 | |
| 541 | first_port = "" |
| 542 | last_port = "" |
| 543 | if 'first_port' in rule: |
| 544 | first_port = rule['first_port'] |
| 545 | if 'last_port' in rule: |
| 546 | last_port = rule['last_port'] |
| 547 | port = "" |
| 548 | if first_port: |
| 549 | port = first_port |
| 550 | if last_port and port and \ |
| 551 | last_port != first_port: |
| 552 | port = "{%s-%s}" % (port, last_port) |
| 553 | if (protocol == "tcp" or protocol == "udp") and not port: |
| 554 | port = TCP_UDP_PORT_ANY |
| 555 | if port: |
| 556 | proto = "%s dport %s" % (proto, port) |
| 557 | |
| 558 | action = "drop" |
no test coverage detected