Re: [iptables PATCH] extensions: libxt_conntrack: Fail on untranslatable state match

[Phil Sutter <phil@nwl.cc>]

On Thu, Oct 08, 2026 at 08:23:51PM +0200, Phil Sutter wrote:
> Iptables' conntrack match supports combined matching on ct->state bits
> as well as the NAT bits in ct->status. The kernel extension matches if
> any of the bits is set, i.e. '-m conntrack --ctstate NEW,DNAT' matches
> packets in either NEW state or DNAT status or both. Therefore,
> translating this sample match into 'ct status dnat ct state new' is
> wrong: The nftables rule matches only if both statements match.
> 
> The only way to achieve this in nftables seems to be by duplicating the
> rule which is not feasible within the xlate infrastructure. So instead
> just abort the translation.
> 
> This is a partial revert of commit 1a13277f88099 ("extensions:
> libxt_conntrack: Fix for ignored ctstates in translation") which turned
> an incomplete translation into an incorrect one.
> 
> Cc: Balazs Gulacsi <m2gulbal@gmail.com>
> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1826
> Fixes: 26ec09bf6b9b6 ("extensions: libxt_conntrack: provide translation for DNAT and SNAT --ctstate")
> Signed-off-by: Phil Sutter <phil@nwl.cc>

Patch applied.