diff --git a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py index 758cdfd8d669..c753350eaf52 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py @@ -223,14 +223,15 @@ def delete(self, rule): self.rules[:] = [x for x in self.rules if not x == rule] def add_ip6_chain(self, address_family, table, chain, hook, action): - chain_policy = "" - if hook: - chain_policy = "type filter hook %s priority 0;" % hook - if chain_policy and action: - chain_policy = "%s policy %s;" % (chain_policy, action) - CsHelper.execute("nft add chain %s %s %s '{ %s }'" % (address_family, table, chain, chain_policy)) - if hook == "input" or hook == "output": - CsHelper.execute("nft add rule %s %s %s icmpv6 type { echo-request, echo-reply, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept" % (address_family, table, chain)) + chain_policy = "" + if hook: + chain_policy = "type filter hook %s priority 0;" % hook + if chain_policy and action: + chain_policy = "%s policy %s;" % (chain_policy, action) + CsHelper.execute("nft add chain %s %s %s '{ %s }'" % (address_family, table, chain, chain_policy)) + if hook == "input" or hook == "output": + CsHelper.execute("nft add rule %s %s %s icmpv6 type { echo-request, echo-reply, \ + nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept" % (address_family, table, chain)) def apply_ip6_rules(self, rules, type): if len(rules) == 0: @@ -238,14 +239,14 @@ def apply_ip6_rules(self, rules, type): address_family = 'ip6' table = 'ip6_firewall' default_chains = [ - { "chain": "fw_input", "hook": "input", "action": "drop"}, - { "chain": "fw_forward", "hook": "forward", "action": "accept"} + {"chain": "fw_input", "hook": "input", "action": "drop"}, + {"chain": "fw_forward", "hook": "forward", "action": "accept"} ] if type == "acl": table = 'ip6_acl' default_chains = [ - { "chain": "acl_input", "hook": "input", "action": "drop" }, - { "chain": "acl_forward", "hook": "forward", "action": "accept"} + {"chain": "acl_input", "hook": "input", "action": "drop"}, + {"chain": "acl_forward", "hook": "forward", "action": "accept"} ] CsHelper.execute("nft add table %s %s" % (address_family, table)) for chain in default_chains: