(self)
| 725 | CsHelper.execute("nft delete table %s %s" % (address_family, table)) |
| 726 | |
| 727 | def process(self): |
| 728 | fw = self.config.get_ipv6_fw() |
| 729 | logging.info("Processing IPv6 firewall rules %s; %s" % (self.dbag, fw)) |
| 730 | chains_added = False |
| 731 | egress_policy = None |
| 732 | for item in self.dbag: |
| 733 | if item == "id": |
| 734 | continue |
| 735 | rule = self.dbag[item] |
| 736 | |
| 737 | if chains_added is False: |
| 738 | guest_cidr = rule['guest_ip6_cidr'] |
| 739 | parent_chain = "fw_forward" |
| 740 | chain = "fw_chain_egress" |
| 741 | parent_chain_rule = "ip6 saddr %s jump %s" % (guest_cidr, chain) |
| 742 | fw.append({'type': "chain", 'chain': chain}) |
| 743 | fw.append({'type': "", 'chain': parent_chain, 'rule': parent_chain_rule}) |
| 744 | chain = "fw_chain_ingress" |
| 745 | parent_chain_rule = "ip6 daddr %s jump %s" % (guest_cidr, chain) |
| 746 | fw.append({'type': "chain", 'chain': chain}) |
| 747 | fw.append({'type': "", 'chain': parent_chain, 'rule': parent_chain_rule}) |
| 748 | if rule['default_egress_policy']: |
| 749 | egress_policy = "accept" |
| 750 | else: |
| 751 | egress_policy = "drop" |
| 752 | chains_added = True |
| 753 | |
| 754 | rstr = "" |
| 755 | |
| 756 | chain = "fw_chain_ingress" |
| 757 | if 'traffic_type' in rule and rule['traffic_type'].lower() == "egress": |
| 758 | chain = "fw_chain_egress" |
| 759 | |
| 760 | saddr = "" |
| 761 | if 'source_cidr_list' in rule and len(rule['source_cidr_list']) > 0: |
| 762 | source_cidrs = rule['source_cidr_list'] |
| 763 | if len(source_cidrs) == 1: |
| 764 | source_cidrs = source_cidrs[0] |
| 765 | else: |
| 766 | source_cidrs = "{" + (",".join(source_cidrs)) + "}" |
| 767 | saddr = "ip6 saddr " + source_cidrs |
| 768 | daddr = "" |
| 769 | if 'dest_cidr_list' in rule and len(rule['dest_cidr_list']) > 0: |
| 770 | dest_cidrs = rule['dest_cidr_list'] |
| 771 | if len(dest_cidrs) == 1: |
| 772 | dest_cidrs = dest_cidrs[0] |
| 773 | else: |
| 774 | dest_cidrs = "{" + (",".join(dest_cidrs)) + "}" |
| 775 | daddr = "ip6 daddr " + dest_cidrs |
| 776 | |
| 777 | proto = "" |
| 778 | protocol = rule['protocol'] |
| 779 | if protocol != "all": |
| 780 | icmp_type = "" |
| 781 | proto = protocol |
| 782 | if proto == "icmp": |
| 783 | proto = proto_str = "icmpv6" |
| 784 | icmp_type = ICMPV6_TYPE_ANY |
no test coverage detected