Re: [PATCH v3 1/1] nft_ct: Added nfct_seqadj_ext_add() for NAT'ed conntrack.

[Florian Westphal]

Andrii Melnychenko <a.melnychenko@xxxxxxx> wrote:
> Client has to connect to the router (192.168.100.2 -> 192.168.100.2),
> while the FTP server would receive the connection from the client
> (192.168.100.2 -> 192.168.33.2).
> So the connection hits SNAT when it's already established and confirmed.
> 
> > This sets up snat which calls nf_nat_setup_info which adds the
> > seqadj extension.
> 
> So, we still need to add seqadj allocation for DNAT.
> I will propose a new patch v4 with `regs->verdict.code = NF_DROP;`.

Yes, just resend your previous patch with the DROP added to force
rexmit rather than ending up with a non-working/stuck connection.

> And later, I can provide a new ruleset for tests in `nft_ftp` for `nftables`.

Thank you.

> Any suggestions?

You can send the bug fix now and followup with a different config later,
you can just extend the existing test case or, if you think your scenario
differs too much, add a new one.