From mboxrd@z Thu Jan 1 00:00:00 1970 From: c0g Subject: Re: "ip_conntrack_core: Frag of proto 17." error Date: Mon, 22 Sep 2003 11:26:15 +0200 Sender: netfilter-devel-admin@lists.netfilter.org Message-ID: <3F6EC037.2040702@wp.pl> References: <3F69CFF6.1060505@wp.pl> <20030921144557.GB22223@sunbeam.de.gnumonks.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: netfilter-devel@lists.netfilter.org Return-path: To: Harald Welte In-Reply-To: <20030921144557.GB22223@sunbeam.de.gnumonks.org> Errors-To: netfilter-devel-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Unsubscribe: , List-Archive: List-Id: netfilter-devel.vger.kernel.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 |>I'm getting lots of these errors. I read in ip_conntrack_core.c it |>should "never happen" (so it's kind of assertion). Why does this |>assertion fail? | | | Indeed. It seems like you have fragmens inside connection tracking. | However, all packets are defragmented before connection tracking | happens. | | Can you please tell us more about your setup? Something special with | regard to networking? Tunnels? IPSec? | | Maybe you can add a printk to print out the address information (or use | DUMP_TUPLE on the tuple) of the packet... maybe this way you can | identify where it came from (through which interface[s], processing, | ...). Hi. My setup is simple. This is box with 5 nics, which is primary a PPTP server for authorizing LAN users: eth0 - 192.168.0.200/18 - users lan (big) eth1 - 192.168.64.200/24 - users lan2 (small) eth2 - 192.168.80.200/24 - dmz eth3 - 192.168.72.200/24 - default route eth4 - 192.168.112.200/24 - net containing loghost (tcpdump showed most of fragments was syslog messages) Transparent proxying, qos, nat is being done on next hops on default route - outside this box. For now, PPTP is used only on eth1 - there was no fragments from this net (except some tests with icmp I have done). So PPTP is not important. I attached tcpdump to every interface with a rule to catch fragments: tcpdump -c 1000 -s 65000 -w ethx-frags.dump -pni eth1 ip[6:2] & 0x1fff != 0 Then I parsed kern.log* to find out when "frag of proto" warning and subsequent "last message repeated x times" was appearing. And then I compared times when: - - fragments was captured by tcpdump - - "Frag of proto" message was logged It seems kernel barks only on fragments destined to Internet from lan at eth0. It ignores fragments generated by syslog messages, because they source and destination address is local. So it confirms that problem is in raw table, because in my setup raw table catches only local<->remote packets. How to simply repeat the bug: Host A and host B are separated by router. On router: insert netfilter rule in raw table which does NOTRACK on packets from A to B. # iptables -t raw -I PREROUTING -s HOST_A -d HOST_B -j NOTRACK On host A: send fragments to B. # ping -s 2000 HOST_B Result: Router logs "Frag of proto" message. - -- c0g@wp.pl -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE/br/EPqmVt5WhbA8RAqLxAKCADuQ/A17uNSCjsk2oImoEJj/KfQCgjF4K 2kVIHqMDlT/LWaMtW6XqkgU= =Ocpj -----END PGP SIGNATURE-----