Bug in conntrack -U

Bug in conntrack -U

[Eric Leblond]

Hi,

I've found a problem with conntrack-tools. Running :
conntrack -U -m 20 -s 192.168.50.140 -d 192.168.50.129 -p tcp --orig-port-src 43515 --orig-port-dst 22
returns
Operation failed: invalid parameters

Problem has been verified with kernel 2.6.20 and 2.6.17 with subversion
compiled libraries and conntrack-tools on 32bits and 64bits system. I
did not find the time to test it on latest kernel.

BR,
-- 
Eric Leblond <eric@inl.fr>
INL SARL

Re: Bug in conntrack -U

[Pablo Neira Ayuso]

[-- Attachment #1: Type: text/plain, Size: 695 bytes --]

Eric Leblond wrote:
> I've found a problem with conntrack-tools. Running :
> conntrack -U -m 20 -s 192.168.50.140 -d 192.168.50.129 -p tcp --orig-port-src 43515 --orig-port-dst 22
> returns
> Operation failed: invalid parameters
> 
> Problem has been verified with kernel 2.6.20 and 2.6.17 with subversion
> compiled libraries and conntrack-tools on 32bits and 64bits system. I
> did not find the time to test it on latest kernel.

The problem seems to be in libnetfilter_conntrack. The patch attached
should fix the problem. Thanks for the report.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 730 bytes --]

Index: src/conntrack/build.c
===================================================================
--- src/conntrack/build.c	(revisión: 6840)
+++ src/conntrack/build.c	(copia de trabajo)
@@ -252,8 +252,13 @@
 	__build_tuple(req, size, &ct->tuple[__DIR_ORIG], CTA_TUPLE_ORIG);
 	__build_tuple(req, size, &ct->tuple[__DIR_REPL], CTA_TUPLE_REPLY);
 
-	/* always build IPS_CONFIRMED */
-	__build_status(req, size, ct);
+	if (test_bit(ATTR_STATUS, ct->set))
+		__build_status(req, size, ct);
+	else {
+		/* build IPS_CONFIRMED if we're creating a new conntrack */
+		if (type == IPCTNL_MSG_CT_NEW && flags & NLM_F_CREATE)
+			__build_status(req, size, ct);
+	}
 
 	if (test_bit(ATTR_TIMEOUT, ct->set))
 		__build_timeout(req, size, ct);

Re: Bug in conntrack -U

[Eric Leblond]

Hi,

> Eric Leblond wrote:
>> I've found a problem with conntrack-tools. Running :
>> conntrack -U -m 20 -s 192.168.50.140 -d 192.168.50.129 -p tcp
>> --orig-port-src 43515 --orig-port-dst 22
>> returns
>
> The problem seems to be in libnetfilter_conntrack. The patch attached
> should fix the problem. Thanks for the report.

It works great ! Good work from you as usual !

BR,
--
Eric