Re: [PATCH] netfilter: nf_ct_sctp: validate vtag for new conntrack entries

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Marcelo,

On Thu, Dec 24, 2015 at 10:50:28AM -0200, Marcelo Ricardo Leitner wrote:
> I can see how it would work for the vtag-tracking scenario, I think. I'm
> just not seeing the non-tracking one (routers in the middle) yet.
> It doesn't seem it can fit the helper way because it can't prepare
> expectations as it doesn't see the packets in the initial path,
> meaning that we would have to have 2 ways of handling such new
> entries.

We assume that conntrack sees all traffic in our existing helpers,
think of tcp. Otherwise, we may classify packets as invalid if we
don't all packets that belong to the flow.

> It would work like: if the helper is not present, allow heartbeats with any
> vtag like it currently is. Otherwise, for validating vtag too, only allow
> them via expectations.

I'm starting to think the lazy multihoming support is problematic
since you can actually allow pushing holes into the firewall, how easy
would be to push holes with this mode?

You can probably achieve the same effect by allowing heartbearts go
through via NOTRACK and then have some connection pickup from the
middle feature. That, however, would make the user fully aware of the
limitations since it would require explicit configuration.