Re: PPTP connection tracker

Re: PPTP connection tracker

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1546 bytes --]

On Mon, Jul 21, 2003 at 07:15:23PM -0400, Joshua Jackson wrote:
> Greetings,
> 
> Just curious if you have had any feedback on the PPTP connection
> tracking code in the 20030107 patch-o-matic.  I implemented it in a
> firewall product of mine for a while and had numerous complaints that
> all PPTP connectivity through the firewall was broken.

without a verbose description about the exact problem, I cannot debug
the problem.  I need to know

- client and server OS/version
- information about the network
- configuration of the PPTP-related ruleset
- log of erroneously dropped packets (if any)
- behaviour of expectations and GRE entries in /proc/net/ip_conntrack
  while session was established
- probably also packet dumps/traces (tcpdump, ethereal) needed.

> I have removed the code from the kernel for now, but still get a lot of 
> complaints about only being able to use a single PPTP session.

of course, since you cannot support more than one session without the
PPTP helper.

> If there have been any updates to this code, is there a place I can download 
> it?

yes, check out patch-o-matic from CVS, or go to
http://netfilter.org/documentation/pomlist/pom-extra.html#pptp-conntrack-nat


> Joshua Jackson
> Vortech Consulting
> http://www.vortech.net

-- 
- Harald Welte <laforge@gnumonks.org>               http://www.gnumonks.org/
============================================================================
Programming is like sex: One mistake and you have to support it your lifetime

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: PPTP connection tracker

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 3584 bytes --]

On Fri, Jul 25, 2003 at 07:59:28PM -0400, Joshua Jackson wrote:
> While I can sympathize with the "it must be your problem" response,
> you didn't actually answer the question... 

I did not mean to imply that it is your problem.  I was meaning: Please
provide me with more information so I can debug it.

> I was just curious if you had any feedback about it not working and if
> it was a known problem with the Jan 07 POM. If ANYONE has gotten it
> working, then I would know that it was something I needed to debug
> myself. I have a whole lot of other patches, many of which are network
> related, that go into the Wolverine kernel and just want to confirm
> wether the module is known to work or not.

Astaro Inc. (http://www.astaro.com/) is shipping the code in
patch-o-matic CVS to thousands of customers.  Only very occasionally, I
get problem reports.

> -The server version is Wolverine v1.1 from http://www.coyotelinux.com.

So it's poptop.

> -Nobody has submitted a log/conntrack output to me as the solution most of 
> them took was to simply unload the PPTP connection tracker so they could at 
> least get a single connection

> If the POM code is known to work, I will probably work a little more at 
> debugging it, otherwise I will focus on the CVS code. If all else fails will 
> try to round up some log/packet dumps to send you. This is a commercial 
> product and getting customers to modify and bring down production firewalls 
> is roughly equivalent to asking them to pull out a tooth and send it to me.

To be honest, I don't remember about the bugs/status/issues of the
version contained in a version from more than six months ago.

Well, if you cannot reproduce yourself it in some known setup/scenario, I doubt
I can start reproducing it at my site.

> > - probably also packet dumps/traces (tcpdump, ethereal) needed.
> 
> tcpdump, maybe... it is an embedded application that is typically installed 
> onto small flash drives - not a whole lot of flexibility for utility 
> installations and space for packet dumps. If need be I'll see if I can find 
> someone with it installed in a hard drive that is having the problems.

I'm sorry, but you sound a bit like a customer who has bought a certain
product with guaranteed features that are now not fullfilled.  Please be
aware there is a reason the code in patch-o-matic is in the 'extra'
repository, marked as status 'Beta' and still receives updates.

> As for the CVS POM, the web interface lists the pptp-conntrack stuff as 
> predating the 01/07 release, 

Where did you get that information from?
http://cvs.netfilter.org/netfilter/patch-o-matic/extra/pptp-conntrack-nat.patch
lists the changelog, and clearly indicates that pom-20030107 contains
version 1.11, whereas CVS contains version 1.12

> grabbed the /netfilter-extensions/helpers/pptp/ stuff and manually wedged it 
> into 2.4.21, but can not push that out to production customers until I have 
> done enough testing to be certain I didn't break anything else in the 
> netfilter code during the process.

sure.  But in order to know if your particular bug/problem was solved,
you would need a known-to-fail-with-the-old-code setup against which you
can verify.

> Joshua Jackson
> Vortech Consulting
> http://www.vortech.net

-- 
- Harald Welte <laforge@gnumonks.org>               http://www.gnumonks.org/
============================================================================
Programming is like sex: One mistake and you have to support it your lifetime

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]