Re: [PATCH v3 1/1] nft_ct: Added nfct_seqadj_ext_add() for NAT'ed conntrack.

[Andrii Melnychenko]

Hi all,

> I think this needs something like this:
>
>       if (!nfct_seqadj_ext_add(ct))
>            regs->verdict.code = NF_DROP;

Okay - I'll update it. I'm planning a proper test.

Apparently, I need to provide a simple test FTP server/client, not
fully functional,
but sufficient to "trigger" nf_conntrack_ftp.


On Tue, Oct 21, 2025 at 4:34 PM Florian Westphal <fw@xxxxxxxxx> wrote:
>
> Andrii Melnychenko <a.melnychenko@xxxxxxx> wrote:
> >
> >  struct nft_ct_helper_obj  {
> >       struct nf_conntrack_helper *helper4;
> > @@ -1173,6 +1174,9 @@ static void nft_ct_helper_obj_eval(struct nft_object *obj,
> >       if (help) {
> >               rcu_assign_pointer(help->helper, to_assign);
> >               set_bit(IPS_HELPER_BIT, &ct->status);
> > +
> > +             if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
> > +                     nfct_seqadj_ext_add(ct);
>
> Any reason why you removed the drop logic of earlier versions?
>
> I think this needs something like this:
>
>         if (!nfct_seqadj_ext_add(ct))
>            regs->verdict.code = NF_DROP;
>
> so client will eventually retransmit the connection request.
>
> I can also mangle this locally, let me know.



-- 

Andrii Melnychenko

Phone +1 844 980 2188

Email a.melnychenko@xxxxxxx

Website vyos.io

linkedin.com/company/vyos

vyosofficial

x.com/vyos_dev

reddit.com/r/vyos/

youtube.com/@VyOSPlatform

Subscribe to Our Blog Keep up with VyOS