diff options
| author | Ryan Zuwala <ryanzuwala@gmail.com> | 2025-07-28 21:39:58 -0400 |
|---|---|---|
| committer | Ryan Zuwala <ryanzuwala@gmail.com> | 2025-08-02 07:40:17 -0400 |
| commit | 6ff6950ab9ebd8e24fecb0ef588244e25f49bce8 (patch) | |
| tree | 2e2a3cd3b3e96f3d3048fde6916080b14d34a861 /data | |
| parent | eff4470d5cd6a099c42875df6f3a9cea9e9a1b3e (diff) | |
| download | vyos-1x-6ff6950ab9ebd8e24fecb0ef588244e25f49bce8.tar.gz vyos-1x-6ff6950ab9ebd8e24fecb0ef588244e25f49bce8.zip | |
conntrack: T7482: Fix custom timeouts
Fix custom conntrack timeout rules and add smoketests
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/conntrack/nftables-ct.j2 | 32 |
1 files changed, 22 insertions, 10 deletions
diff --git a/data/templates/conntrack/nftables-ct.j2 b/data/templates/conntrack/nftables-ct.j2 index c753e6bcb..9169c1f55 100644 --- a/data/templates/conntrack/nftables-ct.j2 +++ b/data/templates/conntrack/nftables-ct.j2 @@ -16,17 +16,15 @@ table ip vyos_conntrack { {% endif %} return } - chain VYOS_CT_TIMEOUT { {% if timeout.custom.ipv4.rule is vyos_defined %} + chain VYOS_CT_TIMEOUT { {% for rule, rule_config in timeout.custom.ipv4.rule.items() %} # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }} {{ rule_config | conntrack_rule(rule, 'timeout', ipv6=False) }} {% endfor %} -{% endif %} return } -{% if timeout.custom.ipv4.rule is vyos_defined %} {% for rule, rule_config in timeout.custom.ipv4.rule.items() %} ct timeout ct-timeout-{{ rule }} { l3proto ip; @@ -36,12 +34,21 @@ table ip vyos_conntrack { {% endfor %} } {% endfor %} + + chain PREROUTING_CT_TIMEOUT { + type filter hook prerouting priority -199; policy accept; + counter jump VYOS_CT_TIMEOUT + } + + chain OUTPUT_CT_TIMEOUT { + type filter hook output priority -199; policy accept; + counter jump VYOS_CT_TIMEOUT + } {% endif %} chain PREROUTING { type filter hook prerouting priority -300; policy accept; counter jump VYOS_CT_IGNORE - counter jump VYOS_CT_TIMEOUT counter jump FW_CONNTRACK counter jump NAT_CONNTRACK counter jump WLB_CONNTRACK @@ -58,7 +65,6 @@ table ip vyos_conntrack { chain OUTPUT { type filter hook output priority -300; policy accept; counter jump VYOS_CT_IGNORE - counter jump VYOS_CT_TIMEOUT counter jump FW_CONNTRACK counter jump NAT_CONNTRACK {% if wlb_local_action %} @@ -106,17 +112,15 @@ table ip6 vyos_conntrack { {% endif %} return } - chain VYOS_CT_TIMEOUT { {% if timeout.custom.ipv6.rule is vyos_defined %} + chain VYOS_CT_TIMEOUT { {% for rule, rule_config in timeout.custom.ipv6.rule.items() %} # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }} {{ rule_config | conntrack_rule(rule, 'timeout', ipv6=True) }} {% endfor %} -{% endif %} return } -{% if timeout.custom.ipv6.rule is vyos_defined %} {% for rule, rule_config in timeout.custom.ipv6.rule.items() %} ct timeout ct-timeout-{{ rule }} { l3proto ip; @@ -126,12 +130,21 @@ table ip6 vyos_conntrack { {% endfor %} } {% endfor %} + + chain PREROUTING_CT_TIMEOUT { + type filter hook prerouting priority -199; policy accept; + counter jump VYOS_CT_TIMEOUT + } + + chain OUTPUT_CT_TIMEOUT { + type filter hook output priority -199; policy accept; + counter jump VYOS_CT_TIMEOUT + } {% endif %} chain PREROUTING { type filter hook prerouting priority -300; policy accept; counter jump VYOS_CT_IGNORE - counter jump VYOS_CT_TIMEOUT counter jump FW_CONNTRACK counter jump NAT_CONNTRACK notrack @@ -147,7 +160,6 @@ table ip6 vyos_conntrack { chain OUTPUT { type filter hook output priority -300; policy accept; counter jump VYOS_CT_IGNORE - counter jump VYOS_CT_TIMEOUT counter jump FW_CONNTRACK counter jump NAT_CONNTRACK notrack |