Pablo Neira Ayuso wrote:
Rui Sousa wrote:
I believe so, but I having a hard time understanding what I'm seeing.
AFAICT, I'm exercising the state transition sNo->sES->sES, my
procedure is:
PC1 -> linux router -> PC2
1. establish TCP connection between two PC's (using iperf). PC1 is the
client, PC2 is the server.
2. On the router, ifdown of output interface (the interface on PC2 side)
3. On the router, manual destroy of connection in kernel
4. On the router, ifup of output interface
5. wait for iperf to start sending packets again. The connection
between the endpoints is always established.
Between 3 and 4 I receive a NFCT_DESTROY event (from
libnetfilter_conntrack).
During 5. I get two events, both NFCT_UPDATEs, the first with
conntrack status CONFIRMED/SEEN_REPLY, the second with conntrack
status ASSURED. Both are missing the TCP protoinfo. In this is my
problem, the kernel correctly picked up the on going TCP connection
but never sends enough information to userspace about it.
Good analysis. Since Linux kernel 2.6.30, you should see a NFCT_NEW
event (for conntracks that have been created via ctnetlink) before you
get the two NFCT_UPDATE events. The NFCT_NEW contains the TCP protocol
state.
Oh, I read your email badly, sorry. Your using the pickup facility of
the TCP tracking.
I cannot reproduce the problem following your steps, I'm using conntrack
-F, the loopback device and some netcat commands:
[DESTROY] tcp 6 src=127.0.0.1 dst=127.0.0.1 sport=58383 dport=8000
packets=2 bytes=112 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383
packets=1 bytes=60 [ASSURED]
[NEW] tcp 6 432000 ESTABLISHED src=127.0.0.1 dst=127.0.0.1
sport=58383 dport=8000 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1
sport=8000 dport=58383
[UPDATE] tcp 6 432000 src=127.0.0.1 dst=127.0.0.1 sport=58383
dport=8000 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383
[UPDATE] tcp 6 300 src=127.0.0.1 dst=127.0.0.1 sport=58383
dport=8000 src=127.0.0.1 dst=127.0.0.1 sport=8000 dport=58383 [ASSURED]
I'm using a git snapshot from the current Linux kernel development version.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
