From 6ff6950ab9ebd8e24fecb0ef588244e25f49bce8 Mon Sep 17 00:00:00 2001
From: Ryan Zuwala <ryanzuwala@gmail.com>
Date: Mon, 28 Jul 2025 21:39:58 -0400
Subject: conntrack: T7482: Fix custom timeouts

Fix custom conntrack timeout rules and add smoketests
---
 data/templates/conntrack/nftables-ct.j2 | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

(limited to 'data')

diff --git a/data/templates/conntrack/nftables-ct.j2 b/data/templates/conntrack/nftables-ct.j2
index c753e6bcb..9169c1f55 100644
--- a/data/templates/conntrack/nftables-ct.j2
+++ b/data/templates/conntrack/nftables-ct.j2
@@ -16,17 +16,15 @@ table ip vyos_conntrack {
 {% endif %}
          return
     }
-    chain VYOS_CT_TIMEOUT {
 {% if timeout.custom.ipv4.rule is vyos_defined %}
+    chain VYOS_CT_TIMEOUT {
 {%     for rule, rule_config in timeout.custom.ipv4.rule.items() %}
         # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
         {{ rule_config | conntrack_rule(rule, 'timeout', ipv6=False) }}
 {%     endfor %}
-{% endif %}
         return
     }
 
-{% if timeout.custom.ipv4.rule is vyos_defined %}
 {%     for rule, rule_config in timeout.custom.ipv4.rule.items() %}
     ct timeout ct-timeout-{{ rule }} {
         l3proto ip;
@@ -36,12 +34,21 @@ table ip vyos_conntrack {
 {%         endfor %}
     }
 {%     endfor %}
+
+    chain PREROUTING_CT_TIMEOUT {
+        type filter hook prerouting priority -199; policy accept;
+        counter jump VYOS_CT_TIMEOUT
+    }
+
+    chain OUTPUT_CT_TIMEOUT {
+        type filter hook output priority -199; policy accept;
+        counter jump VYOS_CT_TIMEOUT
+    }
 {% endif %}
 
     chain PREROUTING {
         type filter hook prerouting priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
-        counter jump VYOS_CT_TIMEOUT
         counter jump FW_CONNTRACK
         counter jump NAT_CONNTRACK
         counter jump WLB_CONNTRACK
@@ -58,7 +65,6 @@ table ip vyos_conntrack {
     chain OUTPUT {
         type filter hook output priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
-        counter jump VYOS_CT_TIMEOUT
         counter jump FW_CONNTRACK
         counter jump NAT_CONNTRACK
 {% if wlb_local_action %}
@@ -106,17 +112,15 @@ table ip6 vyos_conntrack {
 {% endif %}
         return
     }
-    chain VYOS_CT_TIMEOUT {
 {% if timeout.custom.ipv6.rule is vyos_defined %}
+    chain VYOS_CT_TIMEOUT {
 {%     for rule, rule_config in timeout.custom.ipv6.rule.items() %}
         # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
         {{ rule_config | conntrack_rule(rule, 'timeout', ipv6=True) }}
 {%     endfor %}
-{% endif %}
         return
     }
 
-{% if timeout.custom.ipv6.rule is vyos_defined %}
 {%     for rule, rule_config in timeout.custom.ipv6.rule.items() %}
     ct timeout ct-timeout-{{ rule }} {
         l3proto ip;
@@ -126,12 +130,21 @@ table ip6 vyos_conntrack {
 {%         endfor %}
     }
 {%     endfor %}
+
+    chain PREROUTING_CT_TIMEOUT {
+        type filter hook prerouting priority -199; policy accept;
+        counter jump VYOS_CT_TIMEOUT
+    }
+
+    chain OUTPUT_CT_TIMEOUT {
+        type filter hook output priority -199; policy accept;
+        counter jump VYOS_CT_TIMEOUT
+    }
 {% endif %}
 
     chain PREROUTING {
         type filter hook prerouting priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
-        counter jump VYOS_CT_TIMEOUT
         counter jump FW_CONNTRACK
         counter jump NAT_CONNTRACK
         notrack
@@ -147,7 +160,6 @@ table ip6 vyos_conntrack {
     chain OUTPUT {
         type filter hook output priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
-        counter jump VYOS_CT_TIMEOUT
         counter jump FW_CONNTRACK
         counter jump NAT_CONNTRACK
         notrack
-- 
cgit v1.2.3