Re: BUG/CONFLICT conntrack with preroute/postroute mangle table

[Pablo Neira <pablo@eurodev.net>]

Amin Azez wrote:
> Further to the problem below, skb->nfcache is having the lower 2 bits 
> clobbered by net/ipv4/netfilter/ip_tables.c around line 316 (2.6.11.7)
> 
>         back = get_entry(table_base, table->private->underflow[hook]);
> 
>         do {
>                 IP_NF_ASSERT(e);
>                 IP_NF_ASSERT(back);
> 
> //THIS IS THE CULPRIT!
>                 (*pskb)->nfcache |= e->nfcache;
> 
> 
> e->nfcache has been observed at 0,1,2,0x4000
> 1 and 2 are IPCT_NEW and IPCT_RELATED and these are causing the damage.

This bug can be reproduced if you use iptables < 1.3.1, since I 
personally sent a patch to remove any nfcache references in iptables code.

https://lists.netfilter.org/pipermail/netfilter-devel/2005-February/018463.html

Yes, It's a matter of removing that line. thanks for pointing out this.

Krisztian, I think that this could be source of weird behaviours in 
ct_sync if your users use old iptables versions.

--
Pablo