diff options
| -rw-r--r-- | data/templates/firewall/nftables.j2 | 15 | ||||
| -rw-r--r-- | data/vyos-firewall-init.conf | 4 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 15 | ||||
| -rwxr-xr-x | src/conf_mode/firewall.py | 11 |
4 files changed, 43 insertions, 2 deletions
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index 84af0449a..0fbddfaa9 100644 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -2,6 +2,21 @@ {% import 'firewall/nftables-defines.j2' as group_tmpl %} +flush chain raw FW_CONNTRACK +flush chain ip6 raw FW_CONNTRACK + +table raw { + chain FW_CONNTRACK { + {{ ipv4_conntrack_action }} + } +} + +table ip6 raw { + chain FW_CONNTRACK { + {{ ipv6_conntrack_action }} + } +} + {% if first_install is not vyos_defined %} delete table inet vyos_global_rpfilter {% endif %} diff --git a/data/vyos-firewall-init.conf b/data/vyos-firewall-init.conf index ab25ab4bd..41e7627f5 100644 --- a/data/vyos-firewall-init.conf +++ b/data/vyos-firewall-init.conf @@ -73,7 +73,7 @@ table raw { } chain FW_CONNTRACK { - accept + return } } @@ -109,6 +109,6 @@ table ip6 raw { } chain FW_CONNTRACK { - accept + return } } diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index c6514210b..ee6ccb710 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -78,6 +78,17 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): break self.assertTrue(not matched if inverse else matched, msg=search) + def verify_nftables_chain(self, nftables_search, table, chain, inverse=False, args=''): + nftables_output = cmd(f'sudo nft {args} list chain {table} {chain}') + + for search in nftables_search: + matched = False + for line in nftables_output.split("\n"): + if all(item in line for item in search): + matched = True + break + self.assertTrue(not matched if inverse else matched, msg=search) + def wait_for_domain_resolver(self, table, set_name, element, max_wait=10): # Resolver no longer blocks commit, need to wait for daemon to populate set count = 0 @@ -511,6 +522,10 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') + # Check conntrack + self.verify_nftables_chain([['accept']], 'raw', 'FW_CONNTRACK') + self.verify_nftables_chain([['return']], 'ip6 raw', 'FW_CONNTRACK') + def test_source_validation(self): # Strict self.cli_set(['firewall', 'global-options', 'source-validation', 'strict']) diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py index c86d1b555..c3b1ee015 100755 --- a/src/conf_mode/firewall.py +++ b/src/conf_mode/firewall.py @@ -333,6 +333,17 @@ def generate(firewall): if not os.path.exists(nftables_conf): firewall['first_install'] = True + # Determine if conntrack is needed + firewall['ipv4_conntrack_action'] = 'return' + firewall['ipv6_conntrack_action'] = 'return' + + for rules, path in dict_search_recursive(firewall, 'rule'): + if any(('state' in rule_conf or 'connection_status' in rule_conf) for rule_conf in rules.values()): + if path[0] == 'ipv4': + firewall['ipv4_conntrack_action'] = 'accept' + elif path[0] == 'ipv6': + firewall['ipv6_conntrack_action'] = 'accept' + render(nftables_conf, 'firewall/nftables.j2', firewall) return None |