vrf: conntrack: T6073: Populate VRF zoning chains only while conntrack is required

[sarthurdev]

Change Summary

• Remove VRF conntrack rules when conntrack is not in use
• Deduplicate nftables verify functions in smoketests, used by several tests

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T6073

Related PR(s)

Component(s) name

conntrack, vrf

Proposed changes

• Adds conntrack_required function to vyos.firewall
• Remove VRF conntrack rules on boot, added later only if required
• Add conntrack dependency on vrf to ensure VRF rules are updated if conntrack status changes

How to test

Added smoketest to verify nftables rules are only present based on conntrack requirements

Smoketest result

DEBUG - Running Testcase: /usr/libexec/vyos/tests/smoke/cli/test_vrf.py
DEBUG - test_vrf_assign_interface (__main__.VRFTest.test_vrf_assign_interface) ... ok
DEBUG - test_vrf_bind_all (__main__.VRFTest.test_vrf_bind_all) ... ok
DEBUG - test_vrf_conntrack (__main__.VRFTest.test_vrf_conntrack) ... ok
DEBUG - test_vrf_disable_forwarding (__main__.VRFTest.test_vrf_disable_forwarding) ... ok
DEBUG - test_vrf_ip_ipv6_nht (__main__.VRFTest.test_vrf_ip_ipv6_nht) ... ok
DEBUG - test_vrf_ip_ipv6_protocol_non_existing_route_map (__main__.VRFTest.test_vrf_ip_ipv6_protocol_non_existing_route_map) ... ok
DEBUG - test_vrf_ip_protocol_route_map (__main__.VRFTest.test_vrf_ip_protocol_route_map) ... ok
DEBUG - test_vrf_ipv6_protocol_route_map (__main__.VRFTest.test_vrf_ipv6_protocol_route_map) ... ok
DEBUG - test_vrf_link_local_ip_addresses (__main__.VRFTest.test_vrf_link_local_ip_addresses) ... ok
DEBUG - test_vrf_loopbacks_ips (__main__.VRFTest.test_vrf_loopbacks_ips) ... ok
DEBUG - test_vrf_static_route (__main__.VRFTest.test_vrf_static_route) ... ok
DEBUG - test_vrf_table_id_is_unalterable (__main__.VRFTest.test_vrf_table_id_is_unalterable) ... ok
DEBUG - test_vrf_vni_add_change_remove (__main__.VRFTest.test_vrf_vni_add_change_remove) ... ok
DEBUG - test_vrf_vni_and_table_id (__main__.VRFTest.test_vrf_vni_and_table_id) ... ok
DEBUG - test_vrf_vni_duplicates (__main__.VRFTest.test_vrf_vni_duplicates) ... ok
DEBUG -
DEBUG - ----------------------------------------------------------------------
DEBUG - Ran 15 tests in 239.216s
DEBUG -
DEBUG - OK

(Other verify_nftables.. dependent smoketests were tested and passed after function move)

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[c-po]

All tests passsed

[c-po]

@Mergifyio backport sagitta

[mergify]

backport sagitta

✅ Backports have been created

• #3059 vrf: conntrack: T6073: Populate VRF zoning chains only while conntrack is required (backport #3055) has been created for branch sagitta