From b98a0d161f0c7dc773cf3bd53e00ae12810882d3 Mon Sep 17 00:00:00 2001 From: Ryan Zuwala Date: Wed, 10 Sep 2025 12:24:26 -0400 Subject: conntrack: T7700: Prevent empty policy generation Only print policy in nftables-ct.conf if protocol config is defined --- data/templates/conntrack/nftables-ct.j2 | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'data') diff --git a/data/templates/conntrack/nftables-ct.j2 b/data/templates/conntrack/nftables-ct.j2 index 9169c1f55..0f0c49c76 100644 --- a/data/templates/conntrack/nftables-ct.j2 +++ b/data/templates/conntrack/nftables-ct.j2 @@ -30,7 +30,9 @@ table ip vyos_conntrack { l3proto ip; {% for protocol, protocol_config in rule_config.protocol.items() %} protocol {{ protocol }}; +{% if protocol_config | count > 0 %} policy = { {{ protocol_config | conntrack_ct_policy() }} } +{% endif %} {% endfor %} } {% endfor %} @@ -126,7 +128,9 @@ table ip6 vyos_conntrack { l3proto ip; {% for protocol, protocol_config in rule_config.protocol.items() %} protocol {{ protocol }}; +{% if protocol_config | count > 0 %} policy = { {{ protocol_config | conntrack_ct_policy() }} } +{% endif %} {% endfor %} } {% endfor %} -- cgit v1.2.3