libnetfilter_queue/libnetfilter_conntrack: TCP packet reordering

libnetfilter_queue/libnetfilter_conntrack: TCP packet reordering

[Christian Priebe]

Hi all,

since Netfilter is working on the network level my understanding would 
be that in case one want to use libnetfilter_queue to get to the full 
content sent through a TCP connection, reassembly and reordering of TCP 
segments have to be done by yourself.

I've looked at the source code of the l7-filter [1] project which uses 
netfilter queues as well as conntrack to reassemble packets and do a 
regular expression search to be able to determine protocols based on 
application layer data. Apparently the only thing they do is to append 
data from incoming packets of the same connection to a buffer without 
ever looking at sequence numbers.

My question therefore is: Is my understanding wrong and Netfilter 
(potentially with enabled conntrack modules) already reorders TCP 
segments according to their sequence numbers or did I miss something and 
you would have to do it on your own?

[1] http://l7-filter.clearfoundation.com

Thanks in advance!


Best wishes,
Christian

Re: libnetfilter_queue/libnetfilter_conntrack: TCP packet reordering

[Florian Westphal]

Christian Priebe <chr.priebe@googlemail.com> wrote:
> since Netfilter is working on the network level my understanding
> would be that in case one want to use libnetfilter_queue to get to
> the full content sent through a TCP connection, reassembly and
> reordering of TCP segments have to be done by yourself.

Yes.

Depending on your requirements TPROXY could be an alternative.