conntrack: T3579: prepare for "conntrack timeout custom rule" CLI commands

2 files changed, 21 insertions, 5 deletions

diff --git a/data/templates/conntrack/nftables-ct-ignore.tmpl b/data/templates/conntrack/nftables-ct.tmpl
index 4ec133680..c0fe5297d 100644
--- a/data/templates/conntrack/nftables-ct-ignore.tmpl
+++ b/data/templates/conntrack/nftables-ct.tmpl
@@ -1,9 +1,13 @@
 #!/usr/sbin/nft -f
 
-# we first flush the chains content and then render the new statements from CLI
-# if applicable
 {% set nft_ct_ignore_name = 'VYOS_CT_IGNORE' %}
+{% set nft_ct_timeout_name = 'VYOS_CT_TIMEOUT' %}
+
+# we first flush all chains and render the content from scratch - this makes
+# any delta check obsolete
 flush chain raw {{ nft_ct_ignore_name }}
+flush chain raw {{ nft_ct_timeout_name }}
+
 table raw {
     chain {{ nft_ct_ignore_name }} {
 {% if ignore is defined and ignore.rule is defined and ignore.rule is not none %}
@@ -37,4 +41,12 @@ table raw {
 {% endif %}
         return
     }
+    chain {{ nft_ct_timeout_name }} {
+{% if timeout is defined and timeout.custom is defined and timeout.custom.rule is defined and timeout.custom.rule is not none %}
+{%   for rule, rule_config in timeout.custom.rule.items() %}
+        # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is defined and rule_config.description is not none }}
+{%   endfor %}
+{% endif %}
+        return
+    }
 }
diff --git a/src/conf_mode/conntrack.py b/src/conf_mode/conntrack.py
index 3cb0dd1e2..b9eb8071d 100755
--- a/src/conf_mode/conntrack.py
+++ b/src/conf_mode/conntrack.py
@@ -35,7 +35,7 @@ airbag.enable()
 
 conntrack_config = r'/etc/modprobe.d/vyatta_nf_conntrack.conf'
 sysctl_file = r'/run/sysctl/10-vyos-conntrack.conf'
-nftables_ct_ignore_file = r'/run/nftables-ct-ignore.conf'
+nftables_ct_file = r'/run/nftables-ct.conf'
 
 # Every ALG (Application Layer Gateway) consists of either a Kernel Object
 # also called a Kernel Module/Driver or some rules present in iptables
@@ -82,6 +82,10 @@ def get_config(config=None):
     # We have gathered the dict representation of the CLI, but there are default
     # options which we need to update into the dictionary retrived.
     default_values = defaults(base)
+    # XXX: T2665: we can not safely rely on the defaults() when there are
+    # tagNodes in place, it is better to blend in the defaults manually.
+    if 'timeout' in default_values and 'custom' in default_values['timeout']:
+        del default_values['timeout']['custom']
     conntrack = dict_merge(default_values, conntrack)
 
     return conntrack
@@ -99,7 +103,7 @@ def verify(conntrack):
 def generate(conntrack):
     render(conntrack_config, 'conntrack/vyos_nf_conntrack.conf.tmpl', conntrack)
     render(sysctl_file, 'conntrack/sysctl.conf.tmpl', conntrack)
-    render(nftables_ct_ignore_file, 'conntrack/nftables-ct-ignore.tmpl', conntrack)
+    render(nftables_ct_file, 'conntrack/nftables-ct.tmpl', conntrack)
 
     return None
 
@@ -137,7 +141,7 @@ def apply(conntrack):
                         cmd(f'nft insert rule ip raw VYOS_CT_HELPER {rule}')
 
     # Load new nftables ruleset
-    cmd(f'nft -f {nftables_ct_ignore_file}')
+    cmd(f'nft -f {nftables_ct_file}')
 
     if process_named_running('conntrackd'):
         # Reload conntrack-sync daemon to fetch new sysctl values