Firewall: T7475: Disable conntrack per firewall chain

- Added command to disable conntrack per firewall chain
- Added test_disable_conntrack_per_chain function to smoketest

1 files changed, 42 insertions, 0 deletions

diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2
index 39ef72059..894232125 100755
--- a/data/templates/firewall/nftables.j2
+++ b/data/templates/firewall/nftables.j2
@@ -140,6 +140,27 @@ table ip vyos_filter {
 {%         endfor %}
 {%     endif %}
 
+{%     if ipv4.forward.filter.disable_conntrack is vyos_defined or ipv4.input.filter.disable_conntrack is vyos_defined %}
+    chain VYOS_DISABLE_CONNTRACK_INP_FWD {
+        type filter hook prerouting priority -320; policy accept;
+{%         if ipv4.forward.filter.disable_conntrack is vyos_defined %}
+               fib daddr . iif type unicast notrack counter comment "DISABLE-CT-FWD"
+{%         endif %}
+{%         if ipv4.input.filter.disable_conntrack is vyos_defined %}
+               fib daddr . iif type local notrack counter comment "DISABLE-CT-INP"
+{%         endif %}
+    }
+{%     endif %}
+
+{%     if ipv4.output.filter.disable_conntrack is vyos_defined %}
+    chain VYOS_DISABLE_CONNTRACK_OUT {
+        type filter hook output priority -320; policy accept;
+{%         if ipv4.output.filter.disable_conntrack is vyos_defined %}
+               notrack counter comment "DISABLE-CT-OUT"
+{%         endif %}
+    }
+{%     endif %}
+
 {%     for set_name in ns.sets %}
     set RECENT_{{ set_name }} {
         type ipv4_addr
@@ -308,6 +329,27 @@ table ip6 vyos_filter {
 {%         endfor %}
 {%     endif %}
 
+{%     if ipv6.forward.filter.disable_conntrack is vyos_defined or ipv6.input.filter.disable_conntrack is vyos_defined %}
+    chain VYOS_DISABLE_CONNTRACK_INP_FWD_V6 {
+        type filter hook prerouting priority -320; policy accept;
+{%         if ipv6.forward.filter.disable_conntrack is vyos_defined %}
+               fib daddr . iif type unicast notrack counter comment "DISABLE-CT-FWD-V6"
+{%         endif %}
+{%         if ipv6.input.filter.disable_conntrack is vyos_defined %}
+               fib daddr . iif type local notrack counter comment "DISABLE-CT-INP-V6"
+{%         endif %}
+    }
+{%     endif %}
+
+{%     if ipv6.output.filter.disable_conntrack is vyos_defined %}
+    chain VYOS_DISABLE_CONNTRACK_OUT_V6 {
+        type filter hook output priority -320; policy accept;
+{%         if ipv6.output.filter.disable_conntrack is vyos_defined %}
+              notrack counter comment "DISABLE-CT-OUT-V6"
+{%         endif %}
+    }
+{%     endif %}
+
 {%     for set_name in ns.sets %}
     set RECENT6_{{ set_name }} {
         type ipv6_addr