From 6611627f6a73af912082dc79c3039e6c492a6cc6 Mon Sep 17 00:00:00 2001
From: l0crian1 <ryan.claridge13@gmail.com>
Date: Fri, 5 Sep 2025 16:37:19 -0400
Subject: Firewall: T7475: Disable conntrack per firewall chain

- Added command to disable conntrack per firewall chain
- Added test_disable_conntrack_per_chain function to smoketest
---
 interface-definitions/include/firewall/disable-conntrack.xml.i | 8 ++++++++
 interface-definitions/include/firewall/ipv4-hook-forward.xml.i | 1 +
 interface-definitions/include/firewall/ipv4-hook-input.xml.i   | 1 +
 interface-definitions/include/firewall/ipv4-hook-output.xml.i  | 1 +
 interface-definitions/include/firewall/ipv6-hook-forward.xml.i | 1 +
 interface-definitions/include/firewall/ipv6-hook-input.xml.i   | 1 +
 interface-definitions/include/firewall/ipv6-hook-output.xml.i  | 1 +
 7 files changed, 14 insertions(+)
 create mode 100644 interface-definitions/include/firewall/disable-conntrack.xml.i

(limited to 'interface-definitions/include')

diff --git a/interface-definitions/include/firewall/disable-conntrack.xml.i b/interface-definitions/include/firewall/disable-conntrack.xml.i
new file mode 100644
index 000000000..96a692166
--- /dev/null
+++ b/interface-definitions/include/firewall/disable-conntrack.xml.i
@@ -0,0 +1,8 @@
+<!-- include start from firewall/disable-conntrack.xml.i -->
+<leafNode name="disable-conntrack">
+  <properties>
+    <help>Disable conntrack within this chain</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
index a2da4b701..8f04d6739 100644
--- a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
@@ -9,6 +9,7 @@
         <help>IPv4 firewall forward filter</help>
       </properties>
       <children>
+        #include <include/firewall/disable-conntrack.xml.i>
         #include <include/firewall/default-action-base-chains.xml.i>
         #include <include/firewall/default-log.xml.i>
         #include <include/generic-description.xml.i>
diff --git a/interface-definitions/include/firewall/ipv4-hook-input.xml.i b/interface-definitions/include/firewall/ipv4-hook-input.xml.i
index 491d1a9f3..64366eac0 100644
--- a/interface-definitions/include/firewall/ipv4-hook-input.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-input.xml.i
@@ -9,6 +9,7 @@
         <help>IPv4 firewall input filter</help>
       </properties>
       <children>
+        #include <include/firewall/disable-conntrack.xml.i>
         #include <include/firewall/default-action-base-chains.xml.i>
         #include <include/firewall/default-log.xml.i>
         #include <include/generic-description.xml.i>
diff --git a/interface-definitions/include/firewall/ipv4-hook-output.xml.i b/interface-definitions/include/firewall/ipv4-hook-output.xml.i
index f68136557..14ea1073b 100644
--- a/interface-definitions/include/firewall/ipv4-hook-output.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-output.xml.i
@@ -9,6 +9,7 @@
         <help>IPv4 firewall output filter</help>
       </properties>
       <children>
+        #include <include/firewall/disable-conntrack.xml.i>
         #include <include/firewall/default-action-base-chains.xml.i>
         #include <include/firewall/default-log.xml.i>
         #include <include/generic-description.xml.i>
diff --git a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
index 79898d691..0319c915a 100644
--- a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
@@ -9,6 +9,7 @@
         <help>IPv6 firewall forward filter</help>
       </properties>
       <children>
+        #include <include/firewall/disable-conntrack.xml.i>
         #include <include/firewall/default-action-base-chains.xml.i>
         #include <include/firewall/default-log.xml.i>
         #include <include/generic-description.xml.i>
diff --git a/interface-definitions/include/firewall/ipv6-hook-input.xml.i b/interface-definitions/include/firewall/ipv6-hook-input.xml.i
index 154b10259..ae78f8910 100644
--- a/interface-definitions/include/firewall/ipv6-hook-input.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-input.xml.i
@@ -9,6 +9,7 @@
         <help>IPv6 firewall input filter</help>
       </properties>
       <children>
+        #include <include/firewall/disable-conntrack.xml.i>
         #include <include/firewall/default-action-base-chains.xml.i>
         #include <include/firewall/default-log.xml.i>
         #include <include/generic-description.xml.i>
diff --git a/interface-definitions/include/firewall/ipv6-hook-output.xml.i b/interface-definitions/include/firewall/ipv6-hook-output.xml.i
index 9a6d0bb77..96976b4a8 100644
--- a/interface-definitions/include/firewall/ipv6-hook-output.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-output.xml.i
@@ -9,6 +9,7 @@
         <help>IPv6 firewall output filter</help>
       </properties>
       <children>
+        #include <include/firewall/disable-conntrack.xml.i>
         #include <include/firewall/default-action-base-chains.xml.i>
         #include <include/firewall/default-log.xml.i>
         #include <include/generic-description.xml.i>
-- 
cgit v1.2.3