Re: remove connections notification by conntrack?

[Thomas Mader <thezema@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 4453 bytes --]

Hi Pablo,
we figured out what the problem was some time ago, sorry for the delay. We 
forgot to put it back as you said earlier.
We want to publish our code soon here on the mailinglist to finish this topic 
and to help others with our code as an example but we don't find out how to 
send ICMP packets from kernelspace.
Maybe you or somebody else could point us to some code example or something so 
we can implement it? We searched the kernel code and the net for examples but 
we wasn't successful at finding working examples.
We want to send an ICMP echo request to the destination of the UDP flows and 
measure the round-trip-time with the returning echo reply.
Here is something of what we tried to send such a request.

									struct sk_buff *buf;
									struct iphdr* iph = (struct iphdr*)kmalloc(sizeof(struct iphdr), 
GFP_KERNEL);
									struct icmphdr* icmph = (struct icmphdr*)kmalloc(sizeof(struct 
icmphdr), GFP_KERNEL);
									if (!iph || !icmph)
										printk("Could not allocate iph or icmph\n");
								

									buf = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr)+ 
2*(skb->dev->addr_len+4)
											                                 + LL_RESERVED_SPACE(skb->dev), 
GFP_ATOMIC);

									//buf = dev_alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr));
									if(!buf)
										printk("error\n");
									
									skb_reserve(buf, LL_RESERVED_SPACE(skb->dev));
									buf->nh.iph = buf->data;
									icmph = (struct icmphdr *) skb_put(buf,sizeof(struct iphdr) + 
sizeof(struct icmphdr) + 2*(skb->dev->addr_len+4));
									buf->dev = skb->dev;
									buf->protocol = htons(ETH_P_IP);
									buf->sk = skb->sk;
									
									icmph->type = ICMP_ECHO; //8
									icmph->code = ICMP_ECHO; //0
									icmph->checksum = 0;
									icmph->un.echo.id = connection_id;
									icmph->un.echo.sequence = 0;
									
									iph->version = 4;
									iph->ihl = 5;
									iph->tos = 0;
									iph->tot_len = sizeof(struct iphdr) + sizeof(struct icmphdr);
									iph->id = htons(0);
									iph->frag_off = 0;
									iph->ttl = 64;
									iph->protocol = IPPROTO_ICMP;
	//								iph->check //in_cksum((unsigned short *)ip, sizeof(struct iphdr));
									iph->saddr = skb->nh.iph->daddr;
									iph->daddr = skb->nh.iph->saddr;

	//								buf.mac.raw =
	//								buf.cb = NULL;

									buf->h.icmph = icmph;
									buf->nh.iph = iph;
									
									p->echo_request = 1;*/
									//TODO send ICMP echo request
									// We are getting a warning for the first arg here, dunno why
									//icmp_send(buf, 8, 0, 0);
									//icmp_send(buf, ICMP_ECHO , ICMP_ECHO , 0);
									skb->sk = icmp_socket->sk;
									icmp_send(skb, ICMP_ECHO, ICMP_ECHO, 0);
									//kfree(buf);
									//kfree(iph);
									//kfree(icmph);

best regards,
Thomas

On Sunday 24 September 2006 17:34, you wrote:
> Thomas Mader wrote:
> > On Sunday 24 September 2006 05:10, Pablo Neira Ayuso wrote:
> >> events & IPCT_DESTROY
> >>
> >>> 		printk("We have been notified that connection %d was deleted!\n",
> >>> ct->id); }
> >>>
> >>> 	return 0;
> >>> }
> >>>
> >>>
> >>> static struct notifier_block ctnl_notifier = {
> >>> 	.notifier_call = ipaddr_conntrack_event,
> >>> };
> >>>
> >>>
> >>> static int __init init(void)
> >>> {
> >>> 	int ret;
> >>> 	need_conntrack();
> >>> 	ret = ip_conntrack_register_notifier(&ctnl_notifier);
> >>> 	if (ret < 0) {
> >>> 		printk("ipaddr_init: cannot register notifier.\n");
> >>> 		goto err_unreg_notifier;
> >>> 	}
> >>> 	//ip_conntrack_destroyed = destroyed_connect;
> >>>
> >>> 	printk(KERN_CRIT "init!\n");
> >>>    	return ipt_register_match(&ipaddr_match);
> >>>
> >>> err_unreg_notifier:
> >>> 		ip_conntrack_unregister_notifier(&ctnl_notifier);
> >>> 		return 1;
> >>> }
> >>>
> >>> But the problem remains the same. It works for TCP and I get properly
> >>> notified about those but not about UDP.
> >>
> >> Try with what I told you above and let me know if it works
> >
> > No it doesn't. I tried "events & IPCT_DESTROY" already and it didn't
> > work. Now I tested it once again with same result.
>
> Works fine here with the toy module attached:
>
> Sep 24 17:30:52 Decadence kernel: protonum=17
> Sep 24 17:31:26 Decadence last message repeated 2 times
> Sep 24 17:31:47 Decadence kernel: protonum=6

[-- Attachment #2: Type: application/pgp-signature, Size: 827 bytes --]