Re: ct state vmap no longer works on 6.3 kernel

[Florian Westphal <fw@xxxxxxxxx>]

Rvfg <i@xxxxxxxx> wrote:
> On 5/3/23 14:19, Pablo Neira Ayuso wrote:
> > I don't see anything bad with this patch.
> > 
> > Did you enable conntrack logging to understand why conntrack is
> > marking your packets as invalid?
> > 
> > # sh -c 'echo 58 > /proc/sys/net/netfilter/nf_conntrack_log_invalid'
> > 
> > where 58 is ICMPv6.
> 
> Thanks for your reply. I tried enable conntrack logging. But nothing printed
> in dmesg. Actually on 6.2.13 kernel, those RA packets are untracked. Not
> invalid. Here's a trace on 6.2.13 kernel:

Thanks, the BREAK in the referenced patch is the problem.

Please give this fix a try:

diff --git a/net/netfilter/nft_ct_fast.c b/net/netfilter/nft_ct_fast.c
--- a/net/netfilter/nft_ct_fast.c
+++ b/net/netfilter/nft_ct_fast.c
@@ -15,10 +15,6 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr,
 	unsigned int state;
 
 	ct = nf_ct_get(pkt->skb, &ctinfo);
-	if (!ct) {
-		regs->verdict.code = NFT_BREAK;
-		return;
-	}
 
 	switch (priv->key) {
 	case NFT_CT_STATE:
@@ -30,6 +26,16 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr,
 			state = NF_CT_STATE_INVALID_BIT;
 		*dest = state;
 		return;
+	default:
+		break;
+	}
+
+	if (!ct) {
+		regs->verdict.code = NFT_BREAK;
+		return;
+	}
+
+	switch (priv->key) {
 	case NFT_CT_DIRECTION:
 		nft_reg_store8(dest, CTINFO2DIR(ctinfo));
 		return;