Re: "ip_conntrack_core: Frag of proto 17." error

[c0g <c0g@wp.pl>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

|>I'm getting lots of these errors. I read in ip_conntrack_core.c it
|>should "never happen" (so it's kind of assertion). Why does this
|>assertion fail?
|
|
| Indeed.  It seems like you have fragmens inside connection tracking.
| However, all packets are defragmented before connection tracking
| happens.
|
| Can you please tell us more about your setup?  Something special with
| regard to networking?  Tunnels? IPSec?
|
| Maybe you can add a printk to print out the address information (or use
| DUMP_TUPLE on the tuple) of the packet... maybe this way you can
| identify where it came from (through which interface[s], processing,
| ...).

Hi. My setup is simple. This is box with 5 nics, which is primary a PPTP
server for authorizing LAN users:
eth0 - 192.168.0.200/18 - users lan (big)
eth1 - 192.168.64.200/24 - users lan2 (small)
eth2 - 192.168.80.200/24 - dmz
eth3 - 192.168.72.200/24 - default route
eth4 - 192.168.112.200/24 - net containing loghost (tcpdump showed most
of fragments was syslog messages)

Transparent proxying, qos, nat is being done on next hops on default
route - outside this box.

For now, PPTP is used only on eth1 - there was no fragments from this
net (except some tests with icmp I have done). So PPTP is not important.

I attached tcpdump to every interface with a rule to catch fragments:
tcpdump -c 1000 -s 65000 -w ethx-frags.dump -pni eth1 ip[6:2] & 0x1fff != 0

Then I parsed kern.log* to find out when "frag of proto" warning and
subsequent "last message repeated x times" was appearing.

And then I compared times when:
- - fragments was captured by tcpdump
- - "Frag of proto" message was logged

It seems kernel barks only on fragments destined to Internet from lan at
eth0. It ignores fragments generated by syslog messages, because they
source and destination address is local.
So it confirms that problem is in raw table, because in my setup raw
table catches only local<->remote packets.

How to simply repeat the bug:
Host A and host B are separated by router.
On router: insert netfilter rule in raw table which does NOTRACK on
packets from A to B.
# iptables -t raw -I PREROUTING -s HOST_A -d HOST_B -j NOTRACK
On host A: send fragments to B.
# ping -s 2000 HOST_B

Result: Router logs "Frag of proto" message.

- --
c0g@wp.pl
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE/br/EPqmVt5WhbA8RAqLxAKCADuQ/A17uNSCjsk2oImoEJj/KfQCgjF4K
2kVIHqMDlT/LWaMtW6XqkgU=
=Ocpj
-----END PGP SIGNATURE-----