question on ip_conntrack log entries and behavior

question on ip_conntrack log entries and behavior

[Leonardo Rodrigues Magalhães]

[-- Attachment #1: Type: text/plain, Size: 1984 bytes --]


    Hello Guys,

    I got a firewall running kernel 2.4.20 with some p-o-m patches,
including tcp-window-tracking which allows me change timeout stuff in
runtime.

    Well ...... my /proc/net/ip_conntrack log is PLENTY of CLOSE
connections, just like:

tcp 6 386819 CLOSE src=192.168.1.2 dst=200.220.254.156 sport=47617 dport=80
src=200.220.254.156 dst=200.241.238.254 sport=80 dport=47617 use=1
tcp 6 21172 CLOSE src=192.168.1.2 dst=200.208.28.191 sport=41786 dport=80
src=200.208.28.191 dst=200.241.238.254 sport=80 dport=41786 use=1
tcp 6 340817 CLOSE src=192.168.1.2 dst=216.136.226.78 sport=60094 dport=80
src=216.136.226.78 dst=200.241.238.254 sport=80 dport=60094 use=1
tcp 6 87811 CLOSE src=192.168.1.2 dst=200.208.28.224 sport=58142 dport=80
src=200.208.28.224 dst=200.241.238.254 sport=80 dport=58142 use=1
tcp 6 399392 CLOSE src=192.168.1.2 dst=200.220.254.156 sport=52780 dport=80
src=200.220.254.156 dst=200.241.238.254 sport=80 dport=52780 use=1
tcp 6 379271 CLOSE src=192.168.1.2 dst=64.191.34.195 sport=44823 dport=80
src=64.191.34.195 dst=200.241.238.254 sport=80 dport=44823 use=1

    These entries seems to be NOT cleaned after timeout, which are:

[root@firewall netfilter]# pwd
/proc/sys/net/ipv4/netfilter
[root@firewall netfilter]# cat ip_conntrack_tcp_timeout_close
10
[root@firewall netfilter]# cat ip_conntrack_tcp_timeout_close_wait
300

    These timeout values are changed in the very beggining of script
firewall.

    Seems to me that connections are not being erased because i got NO night
traffic and amount of connections seems to be stable ( please check MRTG
graph attached ).

    And, the most strange at all, I got exactly same configuration ( kernel
version, kernel patchs, iptables 1.2.7a and firewall script ) running in
other machines that do NOT shows this problem ....

    Have you ever seen something like this ? Any hint ? Any configuration
change ? Any idea ? :)


    Sincerily and thanks for your replies,
    Leonardo Rodrigues

[-- Attachment #2: conexoes-day.png --]
[-- Type: image/png, Size: 2868 bytes --]

Re: question on ip_conntrack log entries and behavior

[Jozsef Kadlecsik]

On Thu, 20 Mar 2003, [iso-8859-1] Leonardo Rodrigues Magalhães wrote:

>     I got a firewall running kernel 2.4.20 with some p-o-m patches,
> including tcp-window-tracking which allows me change timeout stuff in
> runtime.
>
>     Well ...... my /proc/net/ip_conntrack log is PLENTY of CLOSE
> connections, just like:

This is a bug in 2.4.20. You need the submitted/10_confirm_fix.patch.help
patch from the most recent patch-o-matic.

Regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: question on ip_conntrack log entries and behavior

[Leonardo Rodrigues Magalhaes]

    OK ......... i downloaded latest patch-o-matic snapshot, get a new
kernel 2.4.20 source tree and tried to aplly the needed patchs. But, I got a
problem here ....

    Seems I need submitted/10_confirm_fix.patch to fix the CLOSE stuff .....
but I also need tcp-window-tracking.patch for allowing deal with conntrack
timeouts in kernel runtime. But both patchs seems to change the SAME line in
two files. So, I cannot apply the two. I can only apply one of them ( any
one ) and it will apply correctly. The other will always fail.

    Problem seems to be:

hunk from submitted/10_confirm_fix.patch

--- linux-2.4.20-base/net/ipv4/netfilter/ip_conntrack_proto_tcp.c       Tue
Feb 18 17:07:26 2003
+++ linux-2.4.20-del/net/ipv4/netfilter/ip_conntrack_proto_tcp.c        Fri
Feb 21 17:03:35 2003
@@ -192,7 +192,7 @@
           have an established connection: this is a fairly common
           problem case, so we can delete the conntrack
           immediately.  --RR */
-       if (!(conntrack->status & IPS_SEEN_REPLY) && tcph->rst) {
+       if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status) && tcph->rst)
{
                WRITE_UNLOCK(&tcp_lock);
                if (del_timer(&conntrack->timeout))
                        conntrack->timeout.function((unsigned
long)conntrack);

    in extra/tcp-window-tracking.patch file, I have, among several other
changes:

-       if (!(conntrack->status & IPS_SEEN_REPLY) && tcph->rst) {
+       if (!(conntrack->status & IPS_SEEN_REPLY)) {

    Question ...... and now, what should I do ?? :) It would be very
interesting to me having both patchs applied. Do the mainteners of these
patchs are subscribed to this list ? If yes, can you help me ?


    Sincerily,
    Leonardo Rodrigues

----- Original Message -----
From: "Jozsef Kadlecsik" <kadlec@blackhole.kfki.hu>
To: "Leonardo Rodrigues Magalhaes" <leolistas@solucoesip.net>
Cc: "netfilter ML" <netfilter@lists.samba.org>
Sent: Thursday, March 20, 2003 11:04 AM
Subject: Re: question on ip_conntrack log entries and behavior


On Thu, 20 Mar 2003, [iso-8859-1] Leonardo Rodrigues Magalhães wrote:

>     I got a firewall running kernel 2.4.20 with some p-o-m patches,
> including tcp-window-tracking which allows me change timeout stuff in
> runtime.
>
>     Well ...... my /proc/net/ip_conntrack log is PLENTY of CLOSE
> connections, just like:

This is a bug in 2.4.20. You need the submitted/10_confirm_fix.patch.help
patch from the most recent patch-o-matic.

Regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary