linux 3.12 regression - snat problem with ftp helper

linux 3.12 regression - snat problem with ftp helper

[Dawid Stawiarski - nazwa.pl]

hello,

after upgrade to mainline kernel v. 3.12 our machines are not able to 
connect to ftp service (from inside of the lxc containters). Mainline 
kernel 3.11.8 works fine.

Containters use private IP class and are SNATed on host machine to one 
IP address.

this is part of the session captured with tcpdump when the problem occurs:

1 B.21 > A.59236: Flags [P.], seq 23:60, ack 17, win 1120, length 37
2 A.59236 > B.21: Flags [P.], seq 17:33, ack 60, win 58, length 16
3 B.21 > A.59236: Flags [.], ack 33, win 1120, length 0
4 B.21 > A.59236: Flags [P.], seq 60:90, ack 33, win 1120, length 30
5 B.21: Flags [P.], seq 33:41, ack 90, win 58, length 8
6 B.21 > A.59236: Flags [.], ack 41, win 1120, length 0
7 B.21 > A.59236: Flags [P.], seq 90:109, ack 41, win 1120, length 19
8 A.59236 > B.21: Flags [P.], seq 42:70, ack 109, win 58, length 28
9 B.21 > A.59236: Flags [.], ack 41, win 1120, options [nop,nop,sack 1 
{42:70}], length 0
10 A.59236 > B.21: Flags [R], seq 4097123445, win 0, length 0
11 A.59236 > B.21: Flags [P.], seq 42:70, ack 109, win 58, length 28
12 B.21 > A.59236: Flags [R], seq 2304960165, win 0, length 0

in packet 8 host sends rewriten PORT command (with changed private to 
public IP) - however the packet has incorrect sequence number (should 
have 41).
the ftp server responds with SACK but the host resets the connection.

cheers,
Dawid Stawiarski

Re: linux 3.12 regression - snat problem with ftp helper

[Phil Oester]

[-- Attachment #1: Type: text/plain, Size: 552 bytes --]

On Fri, Nov 15, 2013 at 02:48:08PM +0100, Dawid Stawiarski - nazwa.pl wrote:
> hello,
> 
> after upgrade to mainline kernel v. 3.12 our machines are not able
> to connect to ftp service (from inside of the lxc containters).
> Mainline kernel 3.11.8 works fine.
> 
> in packet 8 host sends rewriten PORT command (with changed private
> to public IP) - however the packet has incorrect sequence number
> (should have 41).
> the ftp server responds with SACK but the host resets the connection.

Does the attached patch solve the problem for you?

Phil



[-- Attachment #2: patch-seqadj --]
[-- Type: text/plain, Size: 679 bytes --]

diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 5f9bfd0..17c1bcb 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 	spin_lock_bh(&ct->lock);
 	this_way = &seqadj->seq[dir];
 	if (this_way->offset_before == this_way->offset_after ||
-	    before(this_way->correction_pos, seq)) {
-		this_way->correction_pos = seq;
+	    before(this_way->correction_pos, ntohl(seq))) {
+		this_way->correction_pos = ntohl(seq);
 		this_way->offset_before	 = this_way->offset_after;
 		this_way->offset_after	+= off;
 	}

Re: linux 3.12 regression - snat problem with ftp helper

[Pablo Neira Ayuso]

On Fri, Nov 15, 2013 at 12:09:29PM -0800, Phil Oester wrote:
> On Fri, Nov 15, 2013 at 02:48:08PM +0100, Dawid Stawiarski - nazwa.pl wrote:
> > hello,
> > 
> > after upgrade to mainline kernel v. 3.12 our machines are not able
> > to connect to ftp service (from inside of the lxc containters).
> > Mainline kernel 3.11.8 works fine.
> > 
> > in packet 8 host sends rewriten PORT command (with changed private
> > to public IP) - however the packet has incorrect sequence number
> > (should have 41).
> > the ftp server responds with SACK but the host resets the connection.
> 
> Does the attached patch solve the problem for you?

This fix works here in my testbed. Will revisit this tomorrow again.

Thanks Phil.

Re: linux 3.12 regression - snat problem with ftp helper

[Dawid Stawiarski - nazwa.pl]

W dniu 15.11.2013 21:09, Phil Oester pisze:
>> in packet 8 host sends rewriten PORT command (with changed private
>> to public IP) - however the packet has incorrect sequence number
>> (should have 41).
>> the ftp server responds with SACK but the host resets the connection.
>
> Does the attached patch solve the problem for you?

yes, I can confirm that the kernel with your patch applied works as 
expected. Thank you for quick reply and the fix.

Dawid