* [PATCH] extensions: fix iptables-{nft,translate} with conntrack EXPECTED
@ 2019-09-17 18:36 Quentin Armitage
2019-09-20 9:44 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Quentin Armitage @ 2019-09-17 18:36 UTC (permalink / raw)
To: netfilter-devel; +Cc: Quentin Armitage
iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED,ASSURED
outputs:
nft add rule ip filter INPUT ct status expected,assured counter
and
iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED,ASSURED
produces nft list output:
chain INPUT {
ct status expected,assured counter packets 0 bytes 0 accept
}
which are correct.
However,
iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED
outputs:
nft # -A INPUT -m conntrack --ctstatus EXPECTED
and
iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED
produces nft list output:
chain INPUT {
counter packets 0 bytes 0 accept
}
neither of which is what is desired.
Commit 6223ead0d - "extensions: libxt_conntrack: Add translation to nft"
included the following code in _conntrack3_mt_xlate():
if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
if (sinfo->status_mask == 1)
return 0;
...
If the intention had been not to produce output when status_mask == 1,
it would have been written as:
if (sinfo->status_mask == IPS_EXPECTED)
return 0;
so it looks as though this is debugging code accidently left in the
original patch.
Removing the lines:
if (sinfo->status_mask == 1)
return 0;
resolves the problems, and
iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED
outputs:
nft add rule ip filter INPUT ct status expected counter
and
iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED
produces nft list output:
chain INPUT {
ct status expected counter packets 0 bytes 0 accept
}
This commit also includes an additional txlate test to check when
only the status EXPECTED is specified.
Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
---
extensions/libxt_conntrack.c | 2 --
extensions/libxt_conntrack.txlate | 3 +++
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index 1817d335..6f350393 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -1257,8 +1257,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
}
if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
- if (sinfo->status_mask == 1)
- return 0;
xt_xlate_add(xl, "%sct status %s", space,
sinfo->invert_flags & XT_CONNTRACK_STATUS ?
"!= " : "");
diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
index e35d5ce8..8a3d0181 100644
--- a/extensions/libxt_conntrack.txlate
+++ b/extensions/libxt_conntrack.txlate
@@ -28,6 +28,9 @@ nft add rule ip filter INPUT ct reply daddr 10.100.2.131 counter accept
iptables-translate -t filter -A INPUT -m conntrack --ctproto tcp --ctorigsrcport 443:444 -j ACCEPT
nft add rule ip filter INPUT ct original protocol 6 ct original proto-src 443-444 counter accept
+iptables-translate -t filter -A INPUT -m conntrack --ctstatus EXPECTED -j ACCEPT
+nft add rule ip filter INPUT ct status expected counter accept
+
iptables-translate -t filter -A INPUT -m conntrack ! --ctstatus CONFIRMED -j ACCEPT
nft add rule ip filter INPUT ct status != confirmed counter accept
--
2.23.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] extensions: fix iptables-{nft,translate} with conntrack EXPECTED
2019-09-17 18:36 [PATCH] extensions: fix iptables-{nft,translate} with conntrack EXPECTED Quentin Armitage
@ 2019-09-20 9:44 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2019-09-20 9:44 UTC (permalink / raw)
To: Quentin Armitage; +Cc: netfilter-devel
On Tue, Sep 17, 2019 at 07:36:32PM +0100, Quentin Armitage wrote:
[...]
> Removing the lines:
> if (sinfo->status_mask == 1)
> return 0;
> resolves the problems, and
> iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED
> outputs:
> nft add rule ip filter INPUT ct status expected counter
> and
> iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED
> produces nft list output:
> chain INPUT {
> ct status expected counter packets 0 bytes 0 accept
> }
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-09-20 9:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-17 18:36 [PATCH] extensions: fix iptables-{nft,translate} with conntrack EXPECTED Quentin Armitage
2019-09-20 9:44 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).