From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Cc: netfilter-devel@vger.kernel.org, linux-sctp@vger.kernel.org,
Vlad Yasevich <vyasevich@gmail.com>,
Neil Horman <nhorman@tuxdriver.com>,
mkubecek@suse.cz
Subject: Re: [PATCH] netfilter: nf_ct_sctp: validate vtag for new conntrack entries
Date: Thu, 10 Dec 2015 13:02:33 +0100 [thread overview]
Message-ID: <20151210120233.GA2084@salvia> (raw)
In-Reply-To: <85c8c8c570bdbf6f20f56fdef96d8017fea3cc4c.1449579256.git.marcelo.leitner@gmail.com>
Hi Marcelo,
On Tue, Dec 08, 2015 at 11:11:10AM -0200, Marcelo Ricardo Leitner wrote:
> Commit d7ee35190427 ("netfilter: nf_ct_sctp: minimal multihoming
> support") allowed creating conntrack entries based on the heartbeat
> exchange, so that we can track secondary paths too.
>
> This patch adds a vtag verification to that. That is, in order to allow
> a HEARTBEAT or a HEARTBEAT_ACK through, the tuple (src port, dst port,
> vtag) must be already known.
This infrastructure that you're adding in this patch looks very
similar to me to conntrack expectations.
Did you evaluate this possibility?
The idea would be to add the vtag to the tuples since it allows us to
uniquely identify the SCTP flow. Then, if you see the hearbeat, you
can register an expectation for the tuple (any-src-ip, any-dst-ip,
sctp, specific-sport, specific-dport, specific-vtag-value).
Then, any secondary STCP flow matching that expectation in the future
will be accepted as RELATED traffic.
next prev parent reply other threads:[~2015-12-10 12:02 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-08 13:11 [PATCH] netfilter: nf_ct_sctp: validate vtag for new conntrack entries Marcelo Ricardo Leitner
2015-12-10 12:02 ` Pablo Neira Ayuso [this message]
2015-12-10 13:16 ` Marcelo Ricardo Leitner
2015-12-10 13:42 ` Pablo Neira Ayuso
2015-12-10 14:06 ` Marcelo Ricardo Leitner
2015-12-10 17:06 ` Pablo Neira Ayuso
2015-12-15 19:03 ` Marcelo Ricardo Leitner
2015-12-17 11:05 ` Pablo Neira Ayuso
2015-12-24 12:50 ` Marcelo Ricardo Leitner
2015-12-30 0:03 ` Pablo Neira Ayuso
2015-12-30 11:49 ` Marcelo Ricardo Leitner
2016-01-04 12:11 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20151210120233.GA2084@salvia \
--to=pablo@netfilter.org \
--cc=linux-sctp@vger.kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=mkubecek@suse.cz \
--cc=netfilter-devel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).