diff mbox series

[iptables,2/3] extensions: libxt_conntrack: Fix for ignored ctstates in translation

Message ID 20261002124916.2264622-2-phil@nwl.cc
State New
Headers show
Series [iptables,1/3] extensions: libxt_conntrack: Fix inverted ctstate translation | expand

Commit Message

Phil Sutter Oct. 2, 2026, 12:49 p.m. UTC 
Balazs writes:
> iptables-translate ignores the RELATED,ESTABLISHED states, when DNAT
> is also present:
> # iptables-translate -A SOMECHAIN -m conntrack \
>                      --ctstate RELATED,ESTABLISHED,DNAT -j DROP
> nft 'add rule ip filter SOMECHAIN ct status dnat counter drop'
> # iptables-translate -A SOMECHAIN -m conntrack \
>                      --ctstate RELATED,ESTABLISHED -j DROP
> nft 'add rule ip filter SOMECHAIN ct state related,established counter drop'

Reported-by: Balazs Gulacsi <m2gulbal@gmail.com>
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1827
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 extensions/libxt_conntrack.c      |  4 +++-
 extensions/libxt_conntrack.txlate | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index 2b41213edb0e4..4ac4fba00c9c5 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -1233,7 +1233,9 @@  static int _conntrack3_mt_xlate(struct xt_xlate *xl,
 				     sinfo->invert_flags & XT_CONNTRACK_STATE ? "!= " : "",
 				     sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat");
 			space = " ";
-		} else {
+		}
+		if (sinfo->state_mask & ~(XT_CONNTRACK_STATE_SNAT |
+					  XT_CONNTRACK_STATE_DNAT)) {
 			xt_xlate_add(xl, "%sct state ", space);
 			state_xlate_print(xl, sinfo->state_mask,
 					  sinfo->invert_flags & XT_CONNTRACK_STATE);
diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
index 79b34df9e3586..e7255e2a516fd 100644
--- a/extensions/libxt_conntrack.txlate
+++ b/extensions/libxt_conntrack.txlate
@@ -64,3 +64,17 @@  nft 'add rule ip filter INPUT ct status dnat counter accept'
 iptables-translate -t filter -A INPUT -m conntrack ! --ctstate DNAT -j ACCEPT
 nft 'add rule ip filter INPUT ct status != dnat counter accept'
 
+iptables-translate -t filter -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT
+nft 'add rule ip filter INPUT ct status dnat ct state related,established counter accept'
+
+iptables-translate -t filter -A INPUT -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT
+nft 'add rule ip filter INPUT ct status != dnat ct state ! related,established counter accept'
+
+iptables-translate -t filter -A INPUT -m conntrack --ctstate ESTABLISHED,DNAT --ctstatus CONFIRMED -j ACCEPT
+nft 'add rule ip filter INPUT ct status dnat ct state established ct status confirmed counter accept'
+
+iptables-translate -t filter -A INPUT -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT --ctstatus CONFIRMED -j ACCEPT
+nft 'add rule ip filter INPUT ct status != dnat ct state ! related,established ct status confirmed counter accept'
+
+iptables-translate -t filter -A INPUT -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT ! --ctstatus CONFIRMED -j ACCEPT
+nft 'add rule ip filter INPUT ct status != dnat ct state ! related,established ct status ! confirmed counter accept'