T6061: fix rule parsing when connection-status is used

[nicolas-fort]

Change Summary

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T6061
• https://vyos.dev/T6094

Related PR(s)

Component(s) name

firewall

Proposed changes

How to test

vyos@T6058:~$ show config comm | grep "nat\|firewall"
set firewall global-options state-policy established action 'accept'
set firewall global-options state-policy invalid action 'drop'
set firewall global-options state-policy related action 'accept'
set firewall ipv4 forward filter default-action 'drop'
set firewall ipv4 forward filter rule 10 action 'accept'
set firewall ipv4 forward filter rule 10 connection-status nat 'destination'
set firewall ipv4 forward filter rule 10 log
set nat destination rule 10 destination port '9999'
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 log
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '198.51.100.1'
set nat destination rule 10 translation port '22'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 translation address 'masquerade'
vyos@T6058:~$ sudo nft list chain ip vyos_filter VYOS_FORWARD_filter
table ip vyos_filter {
        chain VYOS_FORWARD_filter {
                type filter hook forward priority filter; policy accept;
                jump VYOS_STATE_POLICY
                ct status dnat log prefix "[ipv4-FWD-filter-10-A]" counter packets 2 bytes 148 accept comment "ipv4-FWD-filter-10"
                counter packets 4 bytes 304 drop comment "FWD-filter default-action drop"
        }
}
vyos@T6058:~$ sudo conntrack -L | grep tcp
conntrack v1.4.6 (conntrack-tools): 7 flow entries have been shown.
tcp      6 103 TIME_WAIT src=192.168.77.39 dst=192.168.0.141 sport=57776 dport=9999 src=198.51.100.1 dst=192.168.77.39 sport=22 dport=57776 [ASSURED] mark=0 helper=ftp use=1
tcp      6 431986 ESTABLISHED src=192.168.77.39 dst=192.168.0.141 sport=40018 dport=9999 src=198.51.100.1 dst=192.168.77.39 sport=22 dport=40018 [ASSURED] mark=0 helper=ftp use=1
vyos@T6058:~$ 

Smoketest result

From firewall.py smoketest:

test_ipv4_state_and_status_rules (__main__.TestFirewall.test_ipv4_state_and_status_rules) ... ok

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[c-po]

@Mergifyio backport sagitta

[mergify]

backport sagitta

🟠 Pending

• Backport to branch sagitta in progress

[mergify]

backport sagitta

✅ Backports have been created

• #3095 T6061: fix rule parsing when connection-status is used (backport #3087) has been created for branch sagitta