Add conntrack chain to snippet for a hook point

thelegy · Mar 2, 2024 · 133a8f0 · 133a8f0
1 parent 3bf23ae
commit 133a8f0
Show file tree

Hide file tree

Showing 5 changed files with 17 additions and 9 deletions.
diff --git a/checks/testCommon.nix b/checks/testCommon.nix
@@ -18,15 +18,15 @@ machineTest ({config, ...}: {
 
         chain forward {
           type filter hook forward priority 0; policy drop;
-          ct state {established, related} accept
+          ct state {established, related} accept  # inlined: conntrack
           ct state invalid drop
           counter drop
         }
 
         chain input {
           type filter hook input priority 0; policy drop
           iifname { lo } accept
-          ct state {established, related} accept
+          ct state {established, related} accept  # inlined: conntrack
           ct state invalid drop
           jump traverse-from-all-zone-to-fw-zone-rule
           counter drop

diff --git a/checks/testNat.nix b/checks/testNat.nix
@@ -26,15 +26,15 @@ machineTest ({config, ...}: {
 
         chain forward {
           type filter hook forward priority 0; policy drop;
-          ct state {established, related} accept
+          ct state {established, related} accept  # inlined: conntrack
           ct state invalid drop
           counter drop
         }
 
         chain input {
           type filter hook input priority 0; policy drop
           iifname { lo } accept
-          ct state {established, related} accept
+          ct state {established, related} accept  # inlined: conntrack
           ct state invalid drop
           jump traverse-from-all-zone-to-fw-zone-rule
           counter drop

diff --git a/checks/testWebserver.nix b/checks/testWebserver.nix
@@ -23,15 +23,15 @@ machineTest ({config, ...}: {
 
         chain forward {
           type filter hook forward priority 0; policy drop;
-          ct state {established, related} accept
+          ct state {established, related} accept  # inlined: conntrack
           ct state invalid drop
           counter drop
         }
 
         chain input {
           type filter hook input priority 0; policy drop
           iifname { lo } accept
-          ct state {established, related} accept
+          ct state {established, related} accept  # inlined: conntrack
           ct state invalid drop
           jump traverse-from-all-zone-to-fw-zone-rule
           counter drop

diff --git a/checks/testZoneExpressions.nix b/checks/testZoneExpressions.nix
@@ -27,7 +27,7 @@ machineTest ({config, ...}: {
 
         chain forward {
           type filter hook forward priority 0; policy drop;
-          ct state {established, related} accept
+          ct state {established, related} accept  # inlined: conntrack
           ct state invalid drop
           jump traverse-from-all-subzones-to-all-subzones-rule
           counter drop
@@ -36,7 +36,7 @@ machineTest ({config, ...}: {
         chain input {
           type filter hook input priority 0; policy drop
           iifname { lo } accept
-          ct state {established, related} accept
+          ct state {established, related} accept  # inlined: conntrack
           ct state invalid drop
           jump traverse-from-all-zone-to-fw-zone-rule
           counter drop

diff --git a/modules/snippets/nnf-conntrack.nix b/modules/snippets/nnf-conntrack.nix
@@ -18,13 +18,21 @@ in
           after = mkForce ["veryEarly"];
           before = ["early"];
           rules = [
-            "ct state {established, related} accept"
+            {
+              onExpression = "ct state {established, related}";
+              jump = "conntrack";
+            }
             "ct state invalid drop"
           ];
         };
       in {
         input.conntrack = conntrackRule;
         forward.conntrack = conntrackRule;
+        conntrack.accept = {
+          after = ["late"];
+          before = mkForce ["veryLate"];
+          rules = ["accept"];
+        };
       };
     };
   }