ruleset: fix conntrack helpers
authorStijn Tintel <stijn@linux-ipv6.be>
Mon, 13 Jun 2022 15:00:26 +0000 (18:00 +0300)
committerJo-Philipp Wich <jo@mein.io>
Tue, 14 Jun 2022 14:26:07 +0000 (16:26 +0200)
commita063317d96c6c85e4c909eab017ef2813f93ff05
tree3567707486afe21223792f5c4ca2f9238d3d0d05
parente35e26b965ffdacd8fb21721a42d68efca9a3ced
ruleset: fix conntrack helpers

In nftables, helper assignments need to be performed after the conntrack
lookup has completed. Using the raw priority results in the assignment
being done before the conntrack lookup, which breaks conntrack helpers.

Fix this by moving the jumps helper rule chains to a new toplevel
`prerouting` and the existing `output` chain respectively.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
[new toplevel `prerouting` chain + reuse existing `output` chain]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
20 files changed:
root/usr/share/firewall4/templates/ruleset.uc
tests/01_configuration/01_ruleset
tests/01_configuration/02_rule_order
tests/02_zones/01_policies
tests/02_zones/02_masq
tests/02_zones/03_masq_src_dest_restrictions
tests/02_zones/04_wildcard_devices
tests/02_zones/05_subnet_mask_matches
tests/02_zones/06_family_selections
tests/02_zones/07_helpers
tests/03_rules/01_direction
tests/03_rules/02_enabled
tests/03_rules/03_constraints
tests/03_rules/04_icmp
tests/03_rules/05_mangle
tests/03_rules/06_subnet_mask_matches
tests/03_rules/07_redirect
tests/03_rules/08_family_inheritance
tests/03_rules/09_time
tests/04_forwardings/01_family_selections