Re: [RFC PATCH -next] netfilter: nf_ct_sctp: validate vtag for new conntrack entries

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Nov 26, 2015 at 03:24:11PM +0000, Patrick McHardy wrote:
> Consider:
> 
> -i eth0 -j CT --track
> -i eth0 -p sctp --dport 1234 -j ACCEPT
> -i eth0 -m state --state ESTABLISHED -j ACCEPT
> 
> The explicit tracking rule *still* has no knowledge that the SCTP module
> is required. Depending on how the rule is built, there's no difference to
> automatic tracking since it might simply be a catch all rule.
> 
> Sure, you could require users to enable it manually for each and every
> protocol, but I expect we agree that this is not a very nice way.
> 
> What we have to do is:
> 
> *If* we're using stateful tracking, *and* it is possible that connection
> state is based on a user selected connection identity (by using the protocol
> specific matches), then we have to enable connection tracking for that
> protocol to make sure we don't mix up connections with different identities.

There are OSPF routers in active-active HA setups outthere that still
need to rely on stateless filtering. Think of asymmetric paths.
Conntrack needs to see packets in both directions.

IMO we should skip enabling things by default. When we enable things
by default someone else follow up later on with some scenario we
didn't consider and then we've got problems. I think we should go in
the direction of explicit configurations, we already do this for
conntrack helpers.