[PATCH] conntrack event missing TCP protoinfo

[PATCH] conntrack event missing TCP protoinfo

[Rui Sousa]

Hi all,

Under some conditions it's possible to send a conntrack netlink event to 
userspace which is missing the TCP connection state 
(CDA_PROTOINFO_TCP_STATE) even though it is well defined.
This one liner should fix the problem. What do you think?

Br,
Rui

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 3c96437..a514f5f 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1045,6 +1045,7 @@ static int tcp_packet(struct nf_conn *ct,
 		   after SYN_RECV or a valid answer for a picked up
 		   connection. */
 		set_bit(IPS_ASSURED_BIT, &ct->status);
+		nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
 		nf_conntrack_event_cache(IPCT_STATUS, ct);
 	}
 	nf_ct_refresh_acct(ct, ctinfo, skb, timeout);

Re: [PATCH] conntrack event missing TCP protoinfo

[Pablo Neira Ayuso]

Hi,

Rui Sousa wrote:
> Hi all,
> 
> Under some conditions it's possible to send a conntrack netlink event to 
> userspace which is missing the TCP connection state 
> (CDA_PROTOINFO_TCP_STATE) even though it is well defined.
> This one liner should fix the problem. What do you think?

I see, I had to look at the code to find the condition that you mention, 
that it is the following:

if (!test_bit(IPS_ASSURED_BIT, &ct->status)
     && (old_state == TCP_CONNTRACK_SYN_RECV
         || old_state == TCP_CONNTRACK_ESTABLISHED)
     && new_state == TCP_CONNTRACK_ESTABLISHED)
        /* Set ASSURED if we see see valid ack in ESTABLISHED
           after SYN_RECV or a valid answer for a picked up
           connection. */

However, the policy is to include the TCP protocol state iff it has changed.

Re: [PATCH] conntrack event missing TCP protoinfo

[Rui Sousa]

On Thursday 31 December 2009 19:09:34 Pablo Neira Ayuso wrote:
> Hi,

Hi Pablo,

> Rui Sousa wrote:
> > Hi all,
> >
> > Under some conditions it's possible to send a conntrack netlink event to
> > userspace which is missing the TCP connection state
> > (CDA_PROTOINFO_TCP_STATE) even though it is well defined.
> > This one liner should fix the problem. What do you think?
>
> I see, I had to look at the code to find the condition that you mention,
> that it is the following:
>
> if (!test_bit(IPS_ASSURED_BIT, &ct->status)
>      && (old_state == TCP_CONNTRACK_SYN_RECV
>
>          || old_state == TCP_CONNTRACK_ESTABLISHED)
>
>      && new_state == TCP_CONNTRACK_ESTABLISHED)
>         /* Set ASSURED if we see see valid ack in ESTABLISHED
>            after SYN_RECV or a valid answer for a picked up
>            connection. */

I believe so, but I having a hard time understanding what I'm seeing.
AFAICT, I'm exercising the state transition sNo->sES->sES, my procedure is:

PC1 -> linux router -> PC2

1. establish TCP connection between two PC's (using iperf). PC1 is the client, 
PC2 is the server.
2. On the router, ifdown of output interface (the interface on PC2 side)
3. On the router, manual destroy of connection in kernel
4. On the router, ifup of output interface
5. wait for iperf to start sending packets again. The connection between the 
endpoints is always established.

Between 3 and 4 I receive a NFCT_DESTROY event (from libnetfilter_conntrack).
During 5. I get two events, both NFCT_UPDATEs, the first with conntrack status 
CONFIRMED/SEEN_REPLY, the second with conntrack status ASSURED. Both are 
missing the TCP protoinfo. In this is my problem, the kernel correctly picked 
up the on going TCP connection but never sends enough information to 
userspace about it.

> However, the policy is to include the TCP protocol state iff it has
> changed.

But in my case it does change and I never get a protocol state indication.

Br,
Rui

Re: [PATCH] conntrack event missing TCP protoinfo

[Pablo Neira Ayuso]

Hi Rui,

Rui Sousa wrote:
> I believe so, but I having a hard time understanding what I'm seeing.
> AFAICT, I'm exercising the state transition sNo->sES->sES, my procedure is:
> 
> PC1 -> linux router -> PC2
> 
> 1. establish TCP connection between two PC's (using iperf). PC1 is the client, 
> PC2 is the server.
> 2. On the router, ifdown of output interface (the interface on PC2 side)
> 3. On the router, manual destroy of connection in kernel
> 4. On the router, ifup of output interface
> 5. wait for iperf to start sending packets again. The connection between the 
> endpoints is always established.
> 
> Between 3 and 4 I receive a NFCT_DESTROY event (from libnetfilter_conntrack).
> During 5. I get two events, both NFCT_UPDATEs, the first with conntrack status 
> CONFIRMED/SEEN_REPLY, the second with conntrack status ASSURED. Both are 
> missing the TCP protoinfo. In this is my problem, the kernel correctly picked 
> up the on going TCP connection but never sends enough information to 
> userspace about it.

Good analysis. Since Linux kernel 2.6.30, you should see a NFCT_NEW 
event (for conntracks that have been created via ctnetlink) before you 
get the two NFCT_UPDATE events. The NFCT_NEW contains the TCP protocol 
state.

I guess that you're using an older Linux kernel.

Re: [PATCH] conntrack event missing TCP protoinfo

[Pablo Neira Ayuso]

Pablo Neira Ayuso wrote:
> Rui Sousa wrote:
>> I believe so, but I having a hard time understanding what I'm seeing.
>> AFAICT, I'm exercising the state transition sNo->sES->sES, my 
>> procedure is:
>>
>> PC1 -> linux router -> PC2
>>
>> 1. establish TCP connection between two PC's (using iperf). PC1 is the 
>> client, PC2 is the server.
>> 2. On the router, ifdown of output interface (the interface on PC2 side)
>> 3. On the router, manual destroy of connection in kernel
>> 4. On the router, ifup of output interface
>> 5. wait for iperf to start sending packets again. The connection 
>> between the endpoints is always established.
>>
>> Between 3 and 4 I receive a NFCT_DESTROY event (from 
>> libnetfilter_conntrack).
>> During 5. I get two events, both NFCT_UPDATEs, the first with 
>> conntrack status CONFIRMED/SEEN_REPLY, the second with conntrack 
>> status ASSURED. Both are missing the TCP protoinfo. In this is my 
>> problem, the kernel correctly picked up the on going TCP connection 
>> but never sends enough information to userspace about it.
> 
> Good analysis. Since Linux kernel 2.6.30, you should see a NFCT_NEW 
> event (for conntracks that have been created via ctnetlink) before you 
> get the two NFCT_UPDATE events. The NFCT_NEW contains the TCP protocol 
> state.

Oh, I read your email badly, sorry. Your using the pickup facility of 
the TCP tracking.

I cannot reproduce the problem following your steps, I'm using conntrack 
-F, the loopback device and some netcat commands:

[DESTROY] tcp      6 src=127.0.0.1 dst=127.0.0.1 sport=58383 dport=8000 
packets=2 bytes=112 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383 
packets=1 bytes=60 [ASSURED]
  [NEW] tcp      6 432000 ESTABLISHED src=127.0.0.1 dst=127.0.0.1 
sport=58383 dport=8000 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 
sport=8000 dport=58383
  [UPDATE] tcp      6 432000 src=127.0.0.1 dst=127.0.0.1 sport=58383 
dport=8000 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383
  [UPDATE] tcp      6 300 src=127.0.0.1 dst=127.0.0.1 sport=58383 
dport=8000 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383 [ASSURED]

I'm using a git snapshot from the current Linux kernel development version.