Using conntrack to create new expectation entry

Using conntrack to create new expectation entry

[GLAUME Vincent]

Hi there,

I'm currently trying to figure out how the whole libnetfilter_conntrack 
works, and more precisely the expect part of the lib.
My aim is to be able to create new expectation entries with this lib in 
an application that would inspect packets (either coming from a 
pcap-based sniffer or from netfilter via the nfqueue mechanism) : thus 
I'd like to allow connections related to the inspected (and already 
allowed) connections.

My various tests make me think that to create such an expectation entry, 
a kernel module related to the master connection is required: am I right?
For instance, the "expect_create" app in the libnetfilter_conntrack 
"utils" subdirectory works fine, unless I modify the destination port of 
the master conntrack structure... then it's no longer related to the FTP 
conntrack mechanism...
Same thing happens when using the conntrack app. from the conntrack-tools.

So, I'd like to know how to do this the right way, without coding the 
whole inspection thing in a kernel module (if this is possible). Is 
there any generic tcp conntrack system that could help here?
As I'm not too sure to fully understand the whole mechanism of expected 
connection creation, any hint is welcome!
I hope this is not too confused... Thanks,

-- 
V.

Re: Using conntrack to create new expectation entry

[Pablo Neira Ayuso]

GLAUME Vincent wrote:
> Hi there,
> 
> I'm currently trying to figure out how the whole libnetfilter_conntrack
> works, and more precisely the expect part of the lib.
> My aim is to be able to create new expectation entries with this lib in
> an application that would inspect packets (either coming from a
> pcap-based sniffer or from netfilter via the nfqueue mechanism) : thus
> I'd like to allow connections related to the inspected (and already
> allowed) connections.
> 
> My various tests make me think that to create such an expectation entry,
> a kernel module related to the master connection is required: am I right?
> For instance, the "expect_create" app in the libnetfilter_conntrack
> "utils" subdirectory works fine, unless I modify the destination port of
> the master conntrack structure... then it's no longer related to the FTP
> conntrack mechanism...
> Same thing happens when using the conntrack app. from the conntrack-tools.
> 
> So, I'd like to know how to do this the right way, without coding the
> whole inspection thing in a kernel module (if this is possible). Is
> there any generic tcp conntrack system that could help here?
> As I'm not too sure to fully understand the whole mechanism of expected
> connection creation, any hint is welcome!
> I hope this is not too confused... Thanks,

IIRC, this requires a couple of patches for the kernel to fully support
conntrack helpers in user-space, which seems to be what you need. So
this is not support until the appropriate patches go into the kernel.

Re: Using conntrack to create new expectation entry

[GLAUME Vincent]

Pablo Neira Ayuso a écrit :
> GLAUME Vincent wrote:
>   
>> Hi there,
>>
>> I'm currently trying to figure out how the whole libnetfilter_conntrack
>> works, and more precisely the expect part of the lib.
>> My aim is to be able to create new expectation entries with this lib in
>> an application that would inspect packets (either coming from a
>> pcap-based sniffer or from netfilter via the nfqueue mechanism) : thus
>> I'd like to allow connections related to the inspected (and already
>> allowed) connections.
>>
>> My various tests make me think that to create such an expectation entry,
>> a kernel module related to the master connection is required: am I right?
>> For instance, the "expect_create" app in the libnetfilter_conntrack
>> "utils" subdirectory works fine, unless I modify the destination port of
>> the master conntrack structure... then it's no longer related to the FTP
>> conntrack mechanism...
>> Same thing happens when using the conntrack app. from the conntrack-tools.
>>
>> So, I'd like to know how to do this the right way, without coding the
>> whole inspection thing in a kernel module (if this is possible). Is
>> there any generic tcp conntrack system that could help here?
>> As I'm not too sure to fully understand the whole mechanism of expected
>> connection creation, any hint is welcome!
>> I hope this is not too confused... Thanks,
>>     
>
> IIRC, this requires a couple of patches for the kernel to fully support
> conntrack helpers in user-space, which seems to be what you need. So
> this is not support until the appropriate patches go into the kernel.
>   

Thank you for this hint, I'm going to dig it...
I wish I could understand why/how it works pretty well with the FTP 
conntrack though!