firewall: T8546: Fix conntrack_required for global state-policy

2 files changed, 22 insertions, 12 deletions

diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py
index c655e2de8..c4f6d0936 100755
--- a/python/vyos/firewall.py
+++ b/python/vyos/firewall.py
@@ -37,6 +37,9 @@ def conntrack_required(conf):
     firewall = conf.get_config_dict(['firewall'], key_mangling=('-', '_'),
                                     no_tag_node_value_mangle=True, get_first_key=True)
 
+    if dict_search_args(firewall, 'global_options', 'state_policy'):
+        return True
+
     for rules, path in dict_search_recursive(firewall, 'rule'):
         if any(('state' in rule_conf or 'connection_status' in rule_conf or 'offload_target' in rule_conf) for rule_conf in rules.values()):
             return True
diff --git a/smoketest/scripts/cli/test_vrf.py b/smoketest/scripts/cli/test_vrf.py
index 902308b9b..458c5f3dd 100755
--- a/smoketest/scripts/cli/test_vrf.py
+++ b/smoketest/scripts/cli/test_vrf.py
@@ -662,9 +662,6 @@ class VRFTest(VyOSUnitTestSHIM.TestCase):
         for chain, rule in nftables_rules.items():
             self.verify_nftables_chain(rule, 'inet vrf_zones', chain, inverse=True)
 
-        # conntrack is only enabled once NAT, NAT66 or firewalling is enabled
-        self.cli_set(['nat'])
-
         for vrf in vrfs:
             base = base_path + ['name', vrf]
             self.cli_set(base + ['table', table])
@@ -672,17 +669,27 @@ class VRFTest(VyOSUnitTestSHIM.TestCase):
             # We need the commit inside the loop to trigger the bug in T6603
             self.cli_commit()
 
-        # Conntrack rules should now be present
-        for chain, rule in nftables_rules.items():
-            self.verify_nftables_chain(rule, 'inet vrf_zones', chain, inverse=False)
+        check_paths = [
+            ['nat'],
+            ['firewall', 'global-options', 'state-policy', 'established', 'action', 'accept']
+        ]
+
+        # conntrack is only enabled once NAT, NAT66 or firewalling is enabled
+        for path in check_paths:
+            self.cli_set(path)
+            self.cli_commit()
+
+            # Conntrack rules should now be present
+            for chain, rule in nftables_rules.items():
+                self.verify_nftables_chain(rule, 'inet vrf_zones', chain, inverse=False)
 
-        # T6603: there should be only ONE entry for the iifname/oifname in the chains
-        tmp = loads(cmd('sudo nft -j list table inet vrf_zones'))
-        num_rules = len(search("nftables[].rule[].chain", tmp))
-        # ['vrf_zones_ct_in', 'vrf_zones_ct_out']
-        self.assertEqual(num_rules, 2)
+            # T6603: there should be only ONE entry for the iifname/oifname in the chains
+            tmp = loads(cmd('sudo nft -j list table inet vrf_zones'))
+            num_rules = len(search("nftables[].rule[].chain", tmp))
+            # ['vrf_zones_ct_in', 'vrf_zones_ct_out']
+            self.assertEqual(num_rules, 2)
 
-        self.cli_delete(['nat'])
+            self.cli_delete([path[0]])
 
     def test_vrf_policy_based_route(self):
         vrf_name = 'test-pbr_123'