T75: fixup, support ipv6

Author: hedrok

smoketest/scripts/cli/test_system_flow-accounting.py

@@ -32,26 +32,28 @@
 
 class TestSystemFlowAccounting(VyOSUnitTestSHIM.TestCase):
 
-    def _get_iptables_watched_interfaces(self, table, chain, column_name):
-        iptables_command = f'iptables -vn -t {table} -L {chain}'
+    def _get_iptables_watched_interfaces(self, command, table, chain, column_name):
+        iptables_command = f'{command} -vn -t {table} -L {chain}'
         data = cmd(iptables_command, message='Failed to get flows list')
         data = data.splitlines()
-        self.assertGreaterEqual(len(data), 2, "Unexpected output of iptables, should be at least two lines");
+        self.assertGreaterEqual(len(data), 2, "Unexpected output of {command}, should be at least two lines");
         column_index = data[1].split().index(column_name)
         interfaces = [line.split()[column_index] for line in data[2:] if 'NETFLOW' in line]
         return interfaces
 
-    def _get_iptables_watched_ingress_interfaces(self):
-        return self._get_iptables_watched_interfaces('raw', 'PREROUTING', 'in')
+    def _get_iptables_watched_ingress_interfaces(self, command):
+        return self._get_iptables_watched_interfaces(command, 'raw', 'PREROUTING', 'in')
 
-    def _get_iptables_watched_egress_interfaces(self):
-        return self._get_iptables_watched_interfaces('mangle', 'POSTROUTING', 'out')
+    def _get_iptables_watched_egress_interfaces(self, command):
+        return self._get_iptables_watched_interfaces(command, 'mangle', 'POSTROUTING', 'out')
 
     def _assert_ingress_interfaces(self, interfaces):
-        self.assertEqual(set(self._get_iptables_watched_ingress_interfaces()), set(interfaces))
+        for command in 'iptables', 'ip6tables':
+            self.assertEqual(set(self._get_iptables_watched_ingress_interfaces(command)), set(interfaces), command)
 
     def _assert_egress_interfaces(self, interfaces):
-        self.assertEqual(set(self._get_iptables_watched_egress_interfaces()), set(interfaces))
+        for command in 'iptables', 'ip6tables':
+            self.assertEqual(set(self._get_iptables_watched_egress_interfaces(command)), set(interfaces), command)
 
     @classmethod
     def setUpClass(cls):
@@ -94,7 +96,6 @@ def test_basic(self):
         self.cli_commit()
 
         # verify configuration
-        watched_interfaces = self._get_iptables_watched_ingress_interfaces()
         self._assert_ingress_interfaces(Section.interfaces('ethernet'))
         self._assert_egress_interfaces([])
 

src/conf_mode/system_flow-accounting.py

@@ -50,12 +50,12 @@
 
 
 # get iptables rule dict for chain in table
-def _iptables_get_rules(chain, table):
+def _iptables_get_rules(command, chain, table):
     # define list with rules
     rules = []
 
     # run iptables, save output and split it by lines
-    iptables_command = f'iptables -vn -t {table} -L {chain}'
+    iptables_command = f'{command} -vn -t {table} -L {chain}'
     tmp = cmd(iptables_command, message='Failed to get flows list')
     lines = tmp.splitlines()
 
@@ -67,9 +67,9 @@ def _iptables_get_rules(chain, table):
 
     # Check that format is as expected
     if len(lines) < 2:
-        raise ConfigError(f'Unexpected output from iptables, too few lines')
+        raise ConfigError(f'Unexpected output from {command}, too few lines')
     if not lines[0].startswith(f'Chain {chain}'):
-        raise ConfigError(f'Unexpected first line in output of iptables: "{lines[0]}"')
+        raise ConfigError(f'Unexpected first line in output of {command}: "{lines[0]}"')
     columns = lines[1].split();
 
     # parse each line and add information to list
@@ -94,7 +94,7 @@ def _iptables_get_rules(chain, table):
     # return list with rules
     return rules
 
-def _iptables_config(configured_ifaces, direction, length=None):
+def _iptables_config(command, configured_ifaces, direction):
     # define list of nftables commands to modify settings
     iptables_commands = []
 
@@ -113,7 +113,7 @@ def _iptables_config(configured_ifaces, direction, length=None):
         configured_ifaces_extended.append({ 'iface': iface })
 
     # get currently configured interfaces with iptables rules
-    active_rules = _iptables_get_rules(iptables_chain, iptables_table)
+    active_rules = _iptables_get_rules(command, iptables_chain, iptables_table)
 
     # compare current active list with configured one and delete excessive interfaces, add missed
     active_ifaces = []
@@ -132,7 +132,7 @@ def _iptables_config(configured_ifaces, direction, length=None):
     # rulenums are not changed
     rulenums_delete.sort(reverse=True)
     for rulenum in rulenums_delete:
-        iptables_commands.append(f'iptables -t {iptables_table} -D {iptables_chain} {rulenum}')
+        iptables_commands.append(f'{command} -t {iptables_table} -D {iptables_chain} {rulenum}')
 
     # do not create new rules for already configured interfaces
     for iface in active_ifaces:
@@ -144,13 +144,17 @@ def _iptables_config(configured_ifaces, direction, length=None):
         iface = iface_extended['iface']
         iface_option = "o" if direction == "egress" else "i"
         #iptables -t raw -A PREROUTING -j NETFLOW -i eth0
-        rule_definition = f'iptables -t {iptables_table} -A {iptables_chain} -j NETFLOW -{iface_option} {iface}'
+        rule_definition = f'{command} -t {iptables_table} -A {iptables_chain} -j NETFLOW -{iface_option} {iface}'
         iptables_commands.append(rule_definition)
 
     # change iptables
     for command in iptables_commands:
         cmd(command, raising=ConfigError)
 
+def _iptables_config_v4_and_v6(configured_ifaces, direction):
+    for command in 'iptables', 'ip6tables':
+        _iptables_config(command, configured_ifaces, direction)
+
 
 def get_config(config=None):
     if config:
@@ -268,8 +272,8 @@ def apply(flow_config):
     # all iptables usage of ipt_NETFLOW
     # When flow_config is disabled everything should be cleaned-up too
     if need_reload or not flow_config:
-        _iptables_config([], 'ingress')
-        _iptables_config([], 'egress')
+        _iptables_config_v4_and_v6([], 'ingress')
+        _iptables_config_v4_and_v6([], 'egress')
 
         # Stop flow-accounting module
         unload_kmod(module_name)
@@ -285,13 +289,13 @@ def apply(flow_config):
     # configure iptables for defined interfaces
     if 'interface' in flow_config['netflow']:
         interfaces = flow_config['netflow']['interface']
-        _iptables_config(interfaces, 'ingress')
+        _iptables_config_v4_and_v6(interfaces, 'ingress')
 
         # configure egress the same way if configured otherwise remove it
         if 'enable_egress' in flow_config:
-            _iptables_config(interfaces, 'egress')
+            _iptables_config_v4_and_v6(interfaces, 'egress')
         else:
-            _iptables_config([], 'egress')
+            _iptables_config_v4_and_v6([], 'egress')
 
 
 if __name__ == '__main__':