Re: [PATCH v4] selftests: netfilter: conntrack respect reject rules

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Antonio,

On Tue, Mar 18, 2025 at 04:35:29PM +0000, Antonio Ojea wrote:
> This test ensures that conntrack correctly applies reject rules to
> established connections after DNAT, even when those connections are
> persistent.
> 
> The test sets up three network namespaces: ns1, ns2, and nsrouter.
> nsrouter acts as a router with DNAT, exposing a service running in ns2
> via a virtual IP.
> 
> The test validates that is possible to filter and reject new and
> established connections to the DNATed IP in the prerouting and forward
> filters.

I am testing with different stable kernels to uncover timing issues.

With nf and nf-next kernels with instrumentions, **this works just fine**.

But I triggered a weird issue with Debian's 6.1.0-31-amd64:

# ./nft_conntrack_reject_established.sh
...
ERROR: backend filter-ip6: fail to connect to [dead:2::99]:8080
ERROR: backend filter-ip6: fail to connect over the established connection to [dead:4::a]:8080
ERROR: backend filter-ip6: fail to connect to [dead:4::a]:8080
ERROR: backend filter-ip6: fail to connect over the established connection to [dead:4::a]:8080
ERROR: backend filter-ip6: fail to connect to [dead:2::99]:8080

interestingly if I reversed the order, ie. I run ipv6 before ipv4
test, then ipv4 fails:

for testname in "${!testcases[@]}"; do
-      test_conntrack_reject_established "ip" "$testname" "${testcases[$testname]}"
       test_conntrack_reject_established "ip6" "$testname" "${testcases[$testname]}"
+      test_conntrack_reject_established "ip" "$testname" "${testcases[$testname]}"
done

also, running standalone ipv4 test, ie.:

for testname in "${!testcases[@]}"; do
      test_conntrack_reject_established "ip" "$testname" "${testcases[$testname]}"
done

or ipv6 test, ie.:

for testname in "${!testcases[@]}"; do
      test_conntrack_reject_established "ip6" "$testname" "${testcases[$testname]}"
done

works perfectly fine.

Hm, where is the issue? I have to double check, maybe -stable 6.1 is
missing a backport fix.

Thanks.