Re: [PATCH] Orphaned expectations

[Pablo Neira <pablo@eurodev.net>]

Hi Chris,

Chris Wilson wrote:

>>So now, with only an udp packet, we have a conntrack which is not 
>>confirmed with an expectation associated, and as Phil pointed out, if 
>>this conntrack is destroyed the expectation keeps there forever.
>>    
>>
>
>Thanks very much for your explanation. So, to prevent this from happening, 
>what is the best thing to do?
>
>1. Audit all helpers to check that they don't create expectations to 
>unconfirmed conntracks
>  
>

I think that this assumption is wrong for udp based helpers. When 
connection tracking sees udp packet which has a helper associated for 
first time, a conntrack (not confirmed yet) and its respective 
expectation are created, and surely this conntrack will be confirmed later.

>2. Modify destroy_conntrack to destroy any associated expectations, 
>whether or not the conntrack is confirmed (presumably right now it only 
>does so if the conntrack is confirmed? hence the problem?)
>  
>

yes, I think that Phil's solution is ok, this could also prevent any 
other weird combinations.

regards,
Pablo