Balazs writes: > iptables-translate ignores the RELATED,ESTABLISHED states, when DNAT > is also present: > # iptables-translate -A SOMECHAIN -m conntrack \ > --ctstate RELATED,ESTABLISHED,DNAT -j DROP > nft 'add rule ip filter SOMECHAIN ct status dnat counter drop' > # iptables-translate -A SOMECHAIN -m conntrack \ > --ctstate RELATED,ESTABLISHED -j DROP > nft 'add rule ip filter SOMECHAIN ct state related,established counter drop' Reported-by: Balazs Gulacsi Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1827 Signed-off-by: Phil Sutter --- extensions/libxt_conntrack.c | 4 +++- extensions/libxt_conntrack.txlate | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c index 2b41213edb0e4..4ac4fba00c9c5 100644 --- a/extensions/libxt_conntrack.c +++ b/extensions/libxt_conntrack.c @@ -1233,7 +1233,9 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl, sinfo->invert_flags & XT_CONNTRACK_STATE ? "!= " : "", sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat"); space = " "; - } else { + } + if (sinfo->state_mask & ~(XT_CONNTRACK_STATE_SNAT | + XT_CONNTRACK_STATE_DNAT)) { xt_xlate_add(xl, "%sct state ", space); state_xlate_print(xl, sinfo->state_mask, sinfo->invert_flags & XT_CONNTRACK_STATE); diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate index 79b34df9e3586..e7255e2a516fd 100644 --- a/extensions/libxt_conntrack.txlate +++ b/extensions/libxt_conntrack.txlate @@ -64,3 +64,17 @@ nft 'add rule ip filter INPUT ct status dnat counter accept' iptables-translate -t filter -A INPUT -m conntrack ! --ctstate DNAT -j ACCEPT nft 'add rule ip filter INPUT ct status != dnat counter accept' +iptables-translate -t filter -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT +nft 'add rule ip filter INPUT ct status dnat ct state related,established counter accept' + +iptables-translate -t filter -A INPUT -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT +nft 'add rule ip filter INPUT ct status != dnat ct state ! related,established counter accept' + +iptables-translate -t filter -A INPUT -m conntrack --ctstate ESTABLISHED,DNAT --ctstatus CONFIRMED -j ACCEPT +nft 'add rule ip filter INPUT ct status dnat ct state established ct status confirmed counter accept' + +iptables-translate -t filter -A INPUT -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT --ctstatus CONFIRMED -j ACCEPT +nft 'add rule ip filter INPUT ct status != dnat ct state ! related,established ct status confirmed counter accept' + +iptables-translate -t filter -A INPUT -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT ! --ctstatus CONFIRMED -j ACCEPT +nft 'add rule ip filter INPUT ct status != dnat ct state ! related,established ct status ! confirmed counter accept' -- 2.54.0