deleting a conntrack record

deleting a conntrack record

[Tobias DiPasquale]

Hello all,

I have a module that exports a /proc entry which takes a string with 4
args in it (src IP/port and dst IP/port) and then attempts to delete
the conntrack entry for the TCP connection associated with those
arguments. Here's the code in question (keep reading past the code for
a description of the problem I'm having):

<code>
static inline int kill_ct_record( const struct ip_conntrack *c, void *p)
{
       struct ip_conntrack *q = (struct ip_conntrack *)p;

       if (!memcmp( &c->tuplehash[IP_CT_DIR_ORIGINAL],
                    &q->tuplehash[IP_CT_DIR_ORIGINAL],
                    sizeof( struct ip_conntrack_tuple_hash))) {
               ip_conntrack_put( q);
               return 1;
       }
       return 0;
}

static int delete_ct_record( u_int32_t src, u_int16_t sport, u_int32_t
dst, u_int16_t dport)
{
       struct ip_conntrack_tuple tuple;
       struct ip_conntrack_tuple_hash *h;

       memset( &tuple, 0, sizeof( tuple));
       tuple.src.ip = src;
       tuple.src.u.tcp.port = sport;
       tuple.dst.ip = dst;
       tuple.dst.u.tcp.port = dport;
       tuple.dst.protonum = IPPROTO_TCP;
       h = ip_conntrack_find_get( &tuple, NULL);
       if (!h)
               return -ENOENT;
       ip_ct_selective_cleanup( kill_ct_record, h->ctrack);
       return 1;
}
</code>

The problem is as follows:

There is a userspace script that runs from cron every 5 minutes. It
looks through the /proc/net/ip_conntrack listing to see if any 
connections are "stale" (i.e. haven't seen a packet from them in
some amount of time). It then feeds their connection information
into my module's /proc entry so that those conntrack records can
be destroyed.

In the kill_ct_record() function in the module, if the 
ip_conntrack_put() call is not commented out, this causes the box 
to go into some infinite loop after some unspecified amount of time. 
There is no LKCD dump and I don't know what happened since I wasn't 
physically present for the crash in any of the instances.

On the other hand, when the ip_conntrack_put() call _is_ commented
out, the system leaks memory from conntrack as indicated in the
ip_conntrack line in /proc/slabinfo. But the crash doesn't happen
under that condition.

So, is there a cleaner way to hand-delete a conntrack record? Or is
this the only method? Or is there some error in the way that I am
doing the above?

By the way, this is almost exactly what ctnetlink does to delete a
conntrack record so any errors discovered here will almost surely have
to be fixed there, as well.

-- 
[ Tobias DiPasquale ]
0x636f6465736c696e67657240676d61696c2e636f6d

Re: deleting a conntrack record

[Antony Stone]

On Thursday 17 June 2004 4:07 pm, Tobias DiPasquale wrote:

> Hello all,
>
> I have a module that exports a /proc entry which takes a string with 4
> args in it (src IP/port and dst IP/port) and then attempts to delete
> the conntrack entry for the TCP connection associated with those
> arguments.
>
> The problem is as follows:
>
> There is a userspace script that runs from cron every 5 minutes. It
> looks through the /proc/net/ip_conntrack listing to see if any
> connections are "stale" (i.e. haven't seen a packet from them in
> some amount of time). It then feeds their connection information
> into my module's /proc entry so that those conntrack records can
> be destroyed.

Why not just use the built-in timeouts to delete stale entries from the 
conntrack table?

You can adjust the timeout settings using entries in 
/proc/sys/net/ipv4/netfilter and I believe there may be a p-o-m update to 
give even further fine-grained control.

Regards,

Antony.

-- 
I own three Windows books, published by O'Reilly.   They are "Windows 
Annoyances", "Office 97 Annoyances" and "Windows 98 Annoyances".   That 
pretty much sums it up for me.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: deleting a conntrack record

[Tobias DiPasquale]

On Thu, 17 Jun 2004 16:20:23 +0100, Antony Stone
<antony@soft-solutions.co.uk> wrote:
> Why not just use the built-in timeouts to delete stale entries from the
> conntrack table?
> 
> You can adjust the timeout settings using entries in
> /proc/sys/net/ipv4/netfilter and I believe there may be a p-o-m update to
> give even further fine-grained control.

Because I only want to delete conntrack records for certain
connections, so timing out all TCP connections early is no good. As
well, I can't just do that alone also because other operations have to
be performed aside from deleting the conntrack record.
 
-- 
[ Tobias DiPasquale ]
0x636f6465736c696e67657240676d61696c2e636f6d