Re: PROBLEM: Injected conntrack lost helper

[Pham Thanh Tuyen <phamtyn@gmail.com>]

When the conntrack is created, the extension is created before the 
conntrack is assigned confirmed and inserted into the hash table. But 
the function ctnetlink_setup_nat() causes loss of helper in the 
mentioned situation. I mention the template because it's seamless in the 
__nf_ct_try_assign_helper() function. Please double check.

On 1/31/22 18:20, Florian Westphal wrote:
> Pham Thanh Tuyen <phamtyn@gmail.com> wrote:
>
> [ moving to netfilter-devel ]
>
>>>> My name is Pham Thanh Tuyen. I found a bug related to the ctnetlink
>>>> and conntrack subsystems. Details are as follows:
>>>>
>>>> 1. Summary: Injected conntrack lost helper
>>>>
>>>> 2. Description: When a conntrack whose helper is injected from
>>>> userspace, the ctnetlink creates helper for it but NAT then loses
>>>> the helper in case the user defined helper explicitly with CT
>>>> target.
> Hmm.  If you insert a conntrack entry from userspace, it will already
> be confirmed, so nat rules will have no effect, and template CT rules
> are irrelevant wrt. to the helper, as extension can only be created if
> the conntrack is not in the hash yet.
>
> Can you describe the steps to reproduce this bug?