conntrack/state with QUEUE target

conntrack/state with QUEUE target

[Udo Schneider]

All,

I'm a little confused whether the combination of conntrack/state with 
QUEUE targets is supported.

I have a usermode app which processes packets via libNFQ which works 
fine. Up to know we had a very simple setup like

-t mangle -A FORWARD -p tcp --dport 80 -j QUEUE
-t mangle -A FORWARD -p tcp --sport 80 -j QUEUE

This worked fine. Now however we have the requirement for more granular 
"stateful" Rules. I though it should be possible to combine 
state/conntrack with the QUEUE target ... but this doesn't seem to work.

-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED 
-j QUEUE

However using this rule no (http) connection goes through.

Any pointers?

CU,

Udo

Re: conntrack/state with QUEUE target

[Udo Schneider]

All,

> This worked fine. Now however we have the requirement for more granular 
> "stateful" Rules. I though it should be possible to combine 
> state/conntrack with the QUEUE target ... but this doesn't seem to work.
> 
> -t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED 
> -j QUEUE

I think I got it.

-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED 
-j QUEUE
-t mangle -A FORWARD -p tcp --sport 80 -m state --state ESTABLISHED
-j QUEUE

This combination seems to work. Coming from a Check Point Background I 
assumed that the statefulness provided by state/conntrack means that I 
only have to specify the initiating connection - replies are 
accepted/queued automagically based on connection data.

However I seem to be wrong - or did I completely miss the point?

CU,

Udo

Re: conntrack/state with QUEUE target

[Mart Frauenlob]

Udo Schneider wrote:
> All,
>
>> This worked fine. Now however we have the requirement for more 
>> granular "stateful" Rules. I though it should be possible to combine 
>> state/conntrack with the QUEUE target ... but this doesn't seem to work.
>>
>> -t mangle -A FORWARD -p tcp --dport 80 -m state --state 
>> NEW,ESTABLISHED -j QUEUE
>
> I think I got it.
>
> -t mangle -A FORWARD -p tcp --dport 80 -m state --state 
> NEW,ESTABLISHED -j QUEUE
> -t mangle -A FORWARD -p tcp --sport 80 -m state --state ESTABLISHED
> -j QUEUE
>
> This combination seems to work. Coming from a Check Point Background I 
> assumed that the statefulness provided by state/conntrack means that I 
> only have to specify the initiating connection - replies are 
> accepted/queued automagically based on connection data.
>
> However I seem to be wrong - or did I completely miss the point?
>
Hello,

the connection tracking itself will never do anything with a packet, 
than tracking it.
What is done with the state information, that is put onto the packet, is 
totally up to the user.
NO automagic is done.
i.e. what if you don't want replies in your queue, etc...

Also take care about state 'INVALID' and 'UNTRACKED' packets, your queue 
will not see them...
btw: NFQUEUE is the successor of QUEUE.

Regards

Mart