extensions: fix iptables-{nft,translate} with conntrack EXPECTED

iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED,ASSURED
  outputs:
nft add rule ip filter INPUT ct status expected,assured counter
  and
iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED,ASSURED
  produces nft list output:
chain INPUT {
	ct status expected,assured counter packets 0 bytes 0 accept
}
which are correct.

However,
iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED
  outputs:
nft # -A INPUT -m conntrack --ctstatus EXPECTED
  and
iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED
  produces nft list output:
chain INPUT {
          counter packets 0 bytes 0 accept
}
neither of which is what is desired.

Commit 6223ead0d - "extensions: libxt_conntrack: Add translation to nft"
included the following code in _conntrack3_mt_xlate():
	if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
		if (sinfo->status_mask == 1)
			return 0;
		...

If the intention had been not to produce output when status_mask == 1,
it would have been written as:
                if (sinfo->status_mask == IPS_EXPECTED)
                        return 0;
so it looks as though this is debugging code accidently left in the
original patch.

Removing the lines:
                if (sinfo->status_mask == 1)
                        return 0;
resolves the problems, and
iptables-translate -A INPUT -m conntrack --ctstatus EXPECTED
  outputs:
nft add rule ip filter INPUT ct status expected counter
  and
iptables-nft -A INPUT -m conntrack --ctstatus EXPECTED
  produces nft list output:
chain INPUT {
        ct status expected counter packets 0 bytes 0 accept
}

This commit also includes an additional txlate test to check when
only the status EXPECTED is specified.

Fixes: 6223ead0d06b ("extensions: libxt_conntrack: Add translation to nft")
Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index 1817d335cb19e034270754c97a7ea438a1c8980c..6f3503933e6648170676f4c1be4ac32e8184ddf9 100644 (file)
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -1257,8 +1257,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
        }
 
        if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
-               if (sinfo->status_mask == 1)
-                       return 0;
                xt_xlate_add(xl, "%sct status %s", space,
                             sinfo->invert_flags & XT_CONNTRACK_STATUS ?
                             "!= " : "");

diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
index e35d5ce87c34e011c78e3e690ad35c76e4a7f134..8a3d0181c71efadaf916b391e4f09539acc59244 100644 (file)
--- a/extensions/libxt_conntrack.txlate
+++ b/extensions/libxt_conntrack.txlate
@@ -28,6 +28,9 @@ nft add rule ip filter INPUT ct reply daddr 10.100.2.131 counter accept
 iptables-translate -t filter -A INPUT -m conntrack --ctproto tcp --ctorigsrcport 443:444 -j ACCEPT
 nft add rule ip filter INPUT ct original protocol 6 ct original proto-src 443-444 counter accept
 
+iptables-translate -t filter -A INPUT -m conntrack --ctstatus EXPECTED -j ACCEPT
+nft add rule ip filter INPUT ct status expected counter accept
+
 iptables-translate -t filter -A INPUT -m conntrack ! --ctstatus CONFIRMED -j ACCEPT
 nft add rule ip filter INPUT ct status != confirmed counter accept