Linux Netfilter discussions
 help / color / mirror / Atom feed
* Conntrack helper problems (patch-o-matic-20030107)
@ 2003-02-27 16:16 Robert Allmeroth
  2003-02-27 16:54 ` Justin Piszcz
  2003-02-27 22:35 ` Filip Sneppe (Cronos)
  0 siblings, 2 replies; 4+ messages in thread
From: Robert Allmeroth @ 2003-02-27 16:16 UTC (permalink / raw)
  To: netfilter

hello,

I try to get a kernel 2.4.18 with patch-o-matic-20030107 running.
But i have some problems with the conntrack helpers. They simply
don't work .. *sigh*

i tried ftp, irc and h323. I compiled as module and kernel included,
same result..

normal masqerade works, i can do passive FTP, irc, http, normal stateful
inspection, etc..

i hope anybody can help me..

-------------

here is what i have / see:

FTP conntrack problem:
bash-2.05# cat /proc/net/ip_conntrack
tcp      6 431573 ESTABLISHED src=172.30.255.1 dst=10.20.0.17 sport=1572 dport=21 src=10.20.0.17 dst=10.20.10.197 sport=21
dport=1572 [ASSURED] use=1
EXPECTING: - use=1 proto=6 src=10.20.0.17 dst=10.20.10.197 sport=0 dport=1573

The sport=0 seems wrong to me..

my system:

bash-2.05# iptables -vnL PreStateful
Chain PreStateful (3 references)
 pkts bytes target     prot opt in     out     source               destination

  259 66567 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0
     state RELATED,ESTABLISHED
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0
     state INVALID
    0     0 DROP       all  --  eth1   *       0.0.0.0/0            0.0.0.0/0

bash-2.05# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 476 packets, 60290 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 3 packets, 447 bytes)
 pkts bytes target     prot opt in     out     source               destination

   24 13346 MASQUERADE  all  --  *      eth1    0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 7 packets, 1028 bytes)
 pkts bytes target     prot opt in     out     source               destination


Already applied: submitted/01_2.4.19
                 submitted/02_2.4.20
                 submitted/ipt_ULOG-mac_len-fix
                 submitted/ipt_multiport-invfix
                 pending/01_ip_conntrack_proto_tcp-lockfix
                 pending/02_newnat-udp-helper
                 pending/03_REJECT-fwspotting-phrack60-fix
                 pending/04_ftp-conntrack-msg-fix
                 pending/05_ECN-tcpchecksum-littleendian-fix
                 base/IPV4OPTSSTRIP
                 base/mport
                 base/psd
                 extra/eggdrop-conntrack
                 extra/h323-conntrack-nat
                 extra/ip_tables-proc
                 extra/mms-conntrack-nat
                 extra/pptp-conntrack-nat
                 extra/quake3-conntrack
                 extra/string

bash-2.05# cat /proc/net/ip_tables_matches
tcpmss
string
unclean
conntrack
state
ttl
length
esp
ah
dscp
ecn
psd
tos
owner
mport
multiport
pkttype
mac
mark
limit
helper
tcp
udp
icmp

bash-2.05# cat /proc/net/ip_tables_targets
TCPMSS
ULOG
IPV4OPTSSTRIP
LOG
REDIRECT
MASQUERADE
MARK
DSCP
ECN
TOS
MIRROR
REJECT
DNAT
SNAT

ERROR

best regards
  Robert

------------------
Epygi Labs DE           |  Herrenstrafle 23
Robert Allmeroth        |  76133 Karlsruhe
Tel: +49 721 20596 43   |  Fax: +49 721 20596 59



^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: Conntrack helper problems (patch-o-matic-20030107)
@ 2003-02-27 22:38 Robert Allmeroth
  0 siblings, 0 replies; 4+ messages in thread
From: Robert Allmeroth @ 2003-02-27 22:38 UTC (permalink / raw)
  To: netfilter

rehi :)

> On Thu, 2003-02-27 at 17:16, Robert Allmeroth wrote:
>>
>> here is what i have / see:
>>
>> FTP conntrack problem:
>> bash-2.05# cat /proc/net/ip_conntrack
>> tcp      6 431573 ESTABLISHED src=172.30.255.1 dst=10.20.0.17 sport=1572 dport=21 src=10.20.0.17 dst=10.20.10.197 sport=21
>> dport=1572 [ASSURED] use=1
>> EXPECTING: - use=1 proto=6 src=10.20.0.17 dst=10.20.10.197 sport=0 dport=1573
>>
>> The sport=0 seems wrong to me..
>>
> Hi Robert,

> It's not necessarily wrong. Basically a conntrack helper
> will tell connection tracking what connection to expect
> based on IP/TCP header and packet payload info from the
> "master" connection.

> Often, it will get both IP addresses, plus one port
> (destination port is the obvious candidate). With this
> info, the expectation will be set up. The other port
> is "random" (ie. picked by the client) and can't
> really be predicted.

> When a conntrack helper sets up an expecation, it
> fills in the necessary values and also uses a mask
> to point out the relevant info.

> The sport=0 here basically means "any port" and is
> probably the result of the mask being set to 0 for
> the sport of the expectation.

ok.. got it.. :-)

> About your problem, are all relevant conntrack + nat
> modules loaded (check with lsmod) ?

here it is.. everything not listed in the modules dir is
compiled into the kernel..

bash-2.05# lsmod
Module                  Size  Used by
ip_nat_h323             3872   0  (unused)
ip_conntrack_h323       3632   1  [ip_nat_h323]
ip_nat_irc              3792   0  (unused)
ip_conntrack_irc        4336   1  [ip_nat_irc]
ip_nat_ftp              4896   0  (unused)
ip_conntrack_ftp        5472   1  [ip_nat_ftp]

bash-2.05# ls -al /lib/modules/2.4.18/kernel/net/ipv4/netfilter/               
-rw-------    1 0        0          184508 Jan  1  1970 ip_conntrack_egg.o
-rw-------    1 0        0          190900 Jan  1  1970 ip_conntrack_ftp.o
-rw-------    1 0        0          187412 Jan  1  1970 ip_conntrack_h323.o
-rw-------    1 0        0          187672 Jan  1  1970 ip_conntrack_irc.o
-rw-------    1 0        0          188176 Jan  1  1970 ip_conntrack_mms.o
-rw-------    1 0        0          187912 Jan  1  1970 ip_conntrack_pptp.o
-rw-------    1 0        0          147400 Jan  1  1970 ip_conntrack_proto_gre.o
-rw-------    1 0        0          138068 Jan  1  1970 ip_conntrack_quake3.o
-rw-------    1 0        0          191184 Jan  1  1970 ip_nat_ftp.o
-rw-------    1 0        0          191496 Jan  1  1970 ip_nat_h323.o
-rw-------    1 0        0          188216 Jan  1  1970 ip_nat_irc.o
-rw-------    1 0        0          189364 Jan  1  1970 ip_nat_mms.o
-rw-------    1 0        0          188972 Jan  1  1970 ip_nat_pptp.o
-rw-------    1 0        0          139188 Jan  1  1970 ip_nat_proto_gre.o
-rw-------    1 0        0          139372 Jan  1  1970 ip_nat_quake3.o

--------

i also checked again an old software version with 2.4.18 and iptables-1.2.5 with
everything compiled into the kernel.. in that version everything worked fine.
except h323 and pptp ;-) these two modules are the reason why i do all that :)

we cannot simply go to a kernel version > 2.4.18. Its an embedded system (PPC) with
many self programmed addons.. *sigh*.. 

regards
  Robert




^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2003-02-27 22:38 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-02-27 16:16 Conntrack helper problems (patch-o-matic-20030107) Robert Allmeroth
2003-02-27 16:54 ` Justin Piszcz
2003-02-27 22:35 ` Filip Sneppe (Cronos)
  -- strict thread matches above, loose matches on Subject: below --
2003-02-27 22:38 Robert Allmeroth

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox