Re: [PATCH 1/4][CONNTRACK] Introduce flag facilities to take over TCP connections

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Jozsef,

Jozsef Kadlecsik wrote:
> On Fri, 10 Nov 2006, Pablo Neira Ayuso wrote:
> 
>> This patch introduces two new flags called IPS_PICKUP that forces the
>> protocol handler to pick up the window of valid TCP packets and
>> IPS_IN_WINDOW to by pass window checkings.
> 
> Who can set and by what these flags? 
> 
> I suppose IPS_IN_WINDOW could be set by the conntrack tool. But what 
> about IPS_PICKUP - is it planned to set by conntrackd when switching from 
> slave to master?

Indeed, conntrackd requires tcp window tracking disabled at the moment
and I want to get rid of this limitation. The idea is to inject as much
TCP connection state information in the conntrack as possible and force
a pickup for the sequence tracking since I think that it is not feasible
to replicate every window state change because of performance issues:
generation of tons of messages, therefore the idea is to introduce a
tradeoff between security and availability.

About IPS_IN_WINDOW, it could be used by the conntrack tool/iptables
target to workaround possible problems related to broken boxes. We've
been discussed lately in netfilter-failover about session sharing
scenarios like the one described here where the connection can bounce
between nodes in an unpredictible manner:

http://lists.netfilter.org/pipermail/netfilter-failover/2006-October/000648.html

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris