iptables 1.8.8 misses -j CT calls

iptables 1.8.8 misses -j CT calls

[Jan Engelhardt]

Bug report.

Input
=====
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -i lo -j CT --notrack
-A PREROUTING -i ve-+ -p tcp --dport 21 -j CT --helper ftp
COMMIT


Output
======
# Translated by iptables-restore-translate v1.8.8 on Thu Jul 21 16:18:58 2022
add table ip raw
add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; }
add chain ip raw OUTPUT { type filter hook output priority -300; policy accept; }
add rule ip raw PREROUTING iifname "lo" counter notrack
# -t raw -A PREROUTING -i ve-+ -p tcp --dport 21 -j CT --helper ftp
# Completed on Thu Jul 21 16:18:58 2022


Expected output
===============
An nft rule involving port 21.

Re: iptables 1.8.8 misses -j CT calls

[Pablo Neira Ayuso]

On Thu, Jul 21, 2022 at 04:20:32PM +0200, Jan Engelhardt wrote:
> 
> Bug report.
> 
> Input
> =====
> *raw
> :PREROUTING ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> -A PREROUTING -i lo -j CT --notrack
> -A PREROUTING -i ve-+ -p tcp --dport 21 -j CT --helper ftp
> COMMIT
> 
> 
> Output
> ======
> # Translated by iptables-restore-translate v1.8.8 on Thu Jul 21 16:18:58 2022
> add table ip raw
> add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; }
> add chain ip raw OUTPUT { type filter hook output priority -300; policy accept; }
> add rule ip raw PREROUTING iifname "lo" counter notrack
> # -t raw -A PREROUTING -i ve-+ -p tcp --dport 21 -j CT --helper ftp
> # Completed on Thu Jul 21 16:18:58 2022

the problem with this translation is that nftables expects the helper
to be set after the input conntrack hook.

IIRC Florian preferred not to use the conntrack template (which is
used before the conntrack object is attached to the skb). Instead, the
help is attached once after the conntrack lookup.

> Expected output
> ===============
> An nft rule involving port 21.

Re: iptables 1.8.8 misses -j CT calls

[Pablo Neira Ayuso]

On Sat, Jul 23, 2022 at 09:48:56AM +0200, Pablo Neira Ayuso wrote:
> On Thu, Jul 21, 2022 at 04:20:32PM +0200, Jan Engelhardt wrote:
> > 
> > Bug report.
> > 
> > Input
> > =====
> > *raw
> > :PREROUTING ACCEPT [0:0]
> > :OUTPUT ACCEPT [0:0]
> > -A PREROUTING -i lo -j CT --notrack
> > -A PREROUTING -i ve-+ -p tcp --dport 21 -j CT --helper ftp
> > COMMIT
> > 
> > 
> > Output
> > ======
> > # Translated by iptables-restore-translate v1.8.8 on Thu Jul 21 16:18:58 2022
> > add table ip raw
> > add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; }
> > add chain ip raw OUTPUT { type filter hook output priority -300; policy accept; }
> > add rule ip raw PREROUTING iifname "lo" counter notrack
> > # -t raw -A PREROUTING -i ve-+ -p tcp --dport 21 -j CT --helper ftp
> > # Completed on Thu Jul 21 16:18:58 2022
> 
> the problem with this translation is that nftables expects the helper
> to be set after the input conntrack hook.

for the sake of clarity:

NF_IP_PRI_CONNTRACK = -200 in the prerouting hook.

which is coming _after_ the NF_IP_PRI_RAW = -300

> IIRC Florian preferred not to use the conntrack template (which is
> used before the conntrack object is attached to the skb). Instead, the
> help is attached once after the conntrack lookup.
> 
> > Expected output
> > ===============
> > An nft rule involving port 21.