Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

T6636: firewall: fix firewall template in order print logs for default-action #3982

Merged
merged 1 commit into from
Aug 15, 2024

Conversation

nicolas-fort
Copy link
Contributor

Change Summary

Firewall: fix firewall template in order to write logs for default-action in order to match same structure as in rules. This way op-mode command for showing firewall log prints logs for default-actions too

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes)
  • Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
  • Other (please describe):

Related Task(s)

https://vyos.dev/T6636

Related PR(s)

Component(s) name

firewall

Proposed changes

How to test

vyos@T6646:~$ show config commands | grep firewall
set firewall ipv4 name FOO default-action 'accept'
set firewall ipv4 name FOO default-log
set firewall ipv4 name FOO rule 9 action 'accept'
set firewall ipv4 name FOO rule 9 log
set firewall ipv4 name FOO rule 9 protocol 'icmp'
set firewall ipv4 output filter rule 99 action 'accept'
set firewall ipv4 output filter rule 99 log
set firewall ipv4 output filter rule 99 protocol 'tcp'
set firewall ipv4 output filter rule 150 action 'jump'
set firewall ipv4 output filter rule 150 jump-target 'FOO'
set firewall ipv6 name v6-asd-adv default-log
set firewall ipv6 name v6-asd-adv rule 1 action 'accept'

Logs for ipv4:

vyos@T6646:~$ show log firewall ipv4 name FOO 
Aug 14 14:50:23 kernel: [ipv4-NAM-FOO-default-A]IN= OUT=eth0 SRC=192.168.77.22 DST=8.8.8.8 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52996 DF PROTO=UDP SPT=42672 DPT=53 LEN=40 
Aug 14 14:50:23 kernel: [ipv4-NAM-FOO-default-A]IN= OUT=eth0 SRC=192.168.77.22 DST=8.8.8.8 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52997 DF PROTO=UDP SPT=42672 DPT=53 LEN=40 
Aug 14 14:50:23 kernel: [ipv4-NAM-FOO-9-A]IN= OUT=eth0 SRC=192.168.77.22 DST=142.251.134.36 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=11989 DF PROTO=ICMP TYPE=8 CODE=0 ID=38567 SEQ=1 
Aug 14 14:50:23 kernel: [ipv4-NAM-FOO-default-A]IN= OUT=eth0 SRC=192.168.77.22 DST=8.8.8.8 LEN=73 TOS=0x00 PREC=0x00 TTL=64 ID=33408 DF PROTO=UDP SPT=50066 DPT=53 LEN=53 
Aug 14 14:50:24 kernel: [ipv4-NAM-FOO-9-A]IN= OUT=eth0 SRC=192.168.77.22 DST=142.251.134.36 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=12759 DF PROTO=ICMP TYPE=8 CODE=0 ID=38567 SEQ=2 
Aug 14 14:50:24 kernel: [ipv4-NAM-FOO-default-A]IN= OUT=eth0 SRC=192.168.77.22 DST=8.8.8.8 LEN=73 TOS=0x00 PREC=0x00 TTL=64 ID=49379 DF PROTO=UDP SPT=37078 DPT=53 LEN=53 

Ipv6 rules:

        chain NAME6_v6-asd-adv {
                counter packets 0 bytes 0 accept comment "ipv6-NAM-v6-asd-adv-1"
                counter packets 0 bytes 0 log prefix "[ipv6-NAM-v6-asd-adv-default-D]" drop comment "NAM-v6-asd-adv default-action drop"
        }

Smoketest result

test_firewall --> OK

Checklist:

  • I have read the CONTRIBUTING document
  • I have linked this PR to one or more Phabricator Task(s)
  • I have run the components SMOKETESTS if applicable
  • My commit headlines contain a valid Task id
  • My change requires a change to the documentation
  • I have updated the documentation accordingly

…ault-action in order to match same structure as in rules. This way op-mode command for showing firewall log prints logs for default-actions too
Copy link

👍
No issues in PR Title / Commit Title

@c-po c-po enabled auto-merge August 14, 2024 20:48
@c-po
Copy link
Member

c-po commented Aug 14, 2024

@nicolas-fort do we need backports for circinus and sagitta?

@c-po c-po merged commit ada962d into vyos:current Aug 15, 2024
13 of 14 checks passed
@nicolas-fort
Copy link
Contributor Author

@nicolas-fort do we need backports for circinus and sagitta?

I think yes!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

Successfully merging this pull request may close these issues.

3 participants