Re: [PATCH] conntrack event missing TCP protoinfo

[Pablo Neira Ayuso <pablo@netfilter.org>]

Pablo Neira Ayuso wrote:
> Rui Sousa wrote:
>> I believe so, but I having a hard time understanding what I'm seeing.
>> AFAICT, I'm exercising the state transition sNo->sES->sES, my 
>> procedure is:
>>
>> PC1 -> linux router -> PC2
>>
>> 1. establish TCP connection between two PC's (using iperf). PC1 is the 
>> client, PC2 is the server.
>> 2. On the router, ifdown of output interface (the interface on PC2 side)
>> 3. On the router, manual destroy of connection in kernel
>> 4. On the router, ifup of output interface
>> 5. wait for iperf to start sending packets again. The connection 
>> between the endpoints is always established.
>>
>> Between 3 and 4 I receive a NFCT_DESTROY event (from 
>> libnetfilter_conntrack).
>> During 5. I get two events, both NFCT_UPDATEs, the first with 
>> conntrack status CONFIRMED/SEEN_REPLY, the second with conntrack 
>> status ASSURED. Both are missing the TCP protoinfo. In this is my 
>> problem, the kernel correctly picked up the on going TCP connection 
>> but never sends enough information to userspace about it.
> 
> Good analysis. Since Linux kernel 2.6.30, you should see a NFCT_NEW 
> event (for conntracks that have been created via ctnetlink) before you 
> get the two NFCT_UPDATE events. The NFCT_NEW contains the TCP protocol 
> state.

Oh, I read your email badly, sorry. Your using the pickup facility of 
the TCP tracking.

I cannot reproduce the problem following your steps, I'm using conntrack 
-F, the loopback device and some netcat commands:

[DESTROY] tcp      6 src=127.0.0.1 dst=127.0.0.1 sport=58383 dport=8000 
packets=2 bytes=112 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383 
packets=1 bytes=60 [ASSURED]
  [NEW] tcp      6 432000 ESTABLISHED src=127.0.0.1 dst=127.0.0.1 
sport=58383 dport=8000 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 
sport=8000 dport=58383
  [UPDATE] tcp      6 432000 src=127.0.0.1 dst=127.0.0.1 sport=58383 
dport=8000 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383
  [UPDATE] tcp      6 300 src=127.0.0.1 dst=127.0.0.1 sport=58383 
dport=8000 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383 [ASSURED]

I'm using a git snapshot from the current Linux kernel development version.