firewall: validate that conntrack timeouts are strictly positive (#1984)

firewall_test.go

@@ -58,6 +58,31 @@ func TestNewFirewall(t *testing.T) {
 	assert.Equal(t, 3602, conntrack.TimerWheel.wheelLen)
 }
 
+func TestNewFirewall_ZeroOrNegativeTimeout(t *testing.T) {
+	l := test.NewLogger()
+	c := &dummyCert{}
+	cs := &CertState{v2Cert: c, initiatingVersion: cert.Version2}
+
+	cases := map[string]string{
+		"tcp_timeout zero":         "firewall:\n  conntrack:\n    tcp_timeout: 0s\n",
+		"tcp_timeout negative":     "firewall:\n  conntrack:\n    tcp_timeout: -5s\n",
+		"udp_timeout zero":         "firewall:\n  conntrack:\n    udp_timeout: 0s\n",
+		"udp_timeout negative":     "firewall:\n  conntrack:\n    udp_timeout: -5s\n",
+		"default_timeout zero":     "firewall:\n  conntrack:\n    default_timeout: 0s\n",
+		"default_timeout negative": "firewall:\n  conntrack:\n    default_timeout: -5s\n",
+	}
+
+	for name, cfgStr := range cases {
+		t.Run(name, func(t *testing.T) {
+			cfg := config.NewC(l)
+			require.NoError(t, cfg.LoadString(cfgStr))
+			_, err := NewFirewallFromConfig(l, cs, cfg)
+			require.Error(t, err, "expected error for non-positive timeout duration")
+			assert.ErrorContains(t, err, "must be greater than 0")
+		})
+	}
+}
+
 func TestFirewall_AddRule(t *testing.T) {
 	ob := &bytes.Buffer{}
 	l := test.NewLoggerWithOutput(ob)