| Message ID | 1568745392.3595.107.camel@armitage.org.uk |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | extensions: fix iptables-{nft,translate} with conntrack EXPECTED | expand |
On Tue, Sep 17, 2019 at 07:36:32PM +0100, Quentin Armitage wrote: [...] > Removing the lines: > if (sinfo->status_mask == 1) > return 0; > resolves the problems, and > iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED > outputs: > nft add rule ip filter INPUT ct status expected counter > and > iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED > produces nft list output: > chain INPUT { > ct status expected counter packets 0 bytes 0 accept > } Applied, thanks.
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c index 1817d335..6f350393 100644 --- a/extensions/libxt_conntrack.c +++ b/extensions/libxt_conntrack.c @@ -1257,8 +1257,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl, } if (sinfo->match_flags & XT_CONNTRACK_STATUS) { - if (sinfo->status_mask == 1) - return 0; xt_xlate_add(xl, "%sct status %s", space, sinfo->invert_flags & XT_CONNTRACK_STATUS ? "!= " : ""); diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate index e35d5ce8..8a3d0181 100644 --- a/extensions/libxt_conntrack.txlate +++ b/extensions/libxt_conntrack.txlate @@ -28,6 +28,9 @@ nft add rule ip filter INPUT ct reply daddr 10.100.2.131 counter accept iptables-translate -t filter -A INPUT -m conntrack --ctproto tcp --ctorigsrcport 443:444 -j ACCEPT nft add rule ip filter INPUT ct original protocol 6 ct original proto-src 443-444 counter accept +iptables-translate -t filter -A INPUT -m conntrack --ctstatus EXPECTED -j ACCEPT +nft add rule ip filter INPUT ct status expected counter accept + iptables-translate -t filter -A INPUT -m conntrack ! --ctstatus CONFIRMED -j ACCEPT nft add rule ip filter INPUT ct status != confirmed counter accept
iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED,ASSURED outputs: nft add rule ip filter INPUT ct status expected,assured counter and iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED,ASSURED produces nft list output: chain INPUT { ct status expected,assured counter packets 0 bytes 0 accept } which are correct. However, iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED outputs: nft # -A INPUT -m conntrack --ctstatus EXPECTED and iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED produces nft list output: chain INPUT { counter packets 0 bytes 0 accept } neither of which is what is desired. Commit 6223ead0d - "extensions: libxt_conntrack: Add translation to nft" included the following code in _conntrack3_mt_xlate(): if (sinfo->match_flags & XT_CONNTRACK_STATUS) { if (sinfo->status_mask == 1) return 0; ... If the intention had been not to produce output when status_mask == 1, it would have been written as: if (sinfo->status_mask == IPS_EXPECTED) return 0; so it looks as though this is debugging code accidently left in the original patch. Removing the lines: if (sinfo->status_mask == 1) return 0; resolves the problems, and iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED outputs: nft add rule ip filter INPUT ct status expected counter and iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED produces nft list output: chain INPUT { ct status expected counter packets 0 bytes 0 accept } This commit also includes an additional txlate test to check when only the status EXPECTED is specified. Signed-off-by: Quentin Armitage <quentin@armitage.org.uk> --- extensions/libxt_conntrack.c | 2 -- extensions/libxt_conntrack.txlate | 3 +++ 2 files changed, 3 insertions(+), 2 deletions(-)