unkin/tomswall
4
0
Fork 0
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Treat conntrack SOURCE all/any as global like an omitted source
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details

Browse Source
This commit is contained in:
Unkin Agent
2026-10-03 23:54:37 +10:00
parent 90d2875301
commit da65c5d0a8
2 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/nftables/compiler.go
+3
View File
@@ -228,6 +228,9 @@ func (c *Compiler) compileConntrack(state *FirewallState) error {
}
for _, src := range srcs {
if src.Zone == "all" || src.Zone == "any" {
src.Zone = ""
}
chains := []string{"raw_prerouting"}
switch {
case ct.Chain == config.ConntrackOutput && src.Zone != fwZone && src.Zone != "":
internal/nftables/compiler_test.go
+20
View File
@@ -2476,6 +2476,26 @@ func TestCompile_ConntrackZones(t *testing.T) {
ct: config.ConntrackRule{Action: config.ConntrackNoTrack, Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
},
{
name: "all source with chain both is global in both chains",
ct: config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
},
{
name: "all source with chain output is global in raw_output",
ct: config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "all", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackOutput},
want: map[string][]string{"raw_output": {""}},
},
{
name: "any source with chain both is global in both chains",
ct: config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},
want: map[string][]string{"raw_prerouting": {""}, "raw_output": {""}},
},
{
name: "any source with chain output is global in raw_output",
ct: config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "any", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackOutput},
want: map[string][]string{"raw_output": {""}},
},
{
name: "chain both with non-fw source emits prerouting only",
ct: config.ConntrackRule{Action: config.ConntrackNoTrack, Source: "net", Dest: "fw", Proto: "udp", DPort: config.PortSpec{"53"}, Chain: config.ConntrackBoth},