I am using this module to establish GRE tunnels.
Previously, I had this in my ip6tables rules:
ip6tables -N FW6-IN
ip6tables -A FW6-IN -m conntrack --ctstate established, related -j LOG --log-prefix '[FW6-IN-1-A]'
ip6tables -A FW6-IN -m conntrack --ctstate established, related -j RETURN
ip6tables -A FW6-IN -m conntrack --ctstate invalid -j LOG --log-prefix '[FW6-IN-2-D]'
ip6tables -A FW6-IN -m conntrack --ctstate invalid -j DROP
ip6tables -A FW6-IN -p gre -j LOG --log-prefix '[FW6-IN-3-A]'
ip6tables -A FW6-IN -p gre -j RETURN
ip6tables -A FW6-IN -p icmp -j LOG --log-prefix '[FW6-IN-4-A]'
ip6tables -A FW6-IN -p icmp -j RETURN
ip6tables -A FW6-IN -j LOG --log-prefix '[FW6-IN-DEFAULT-D]'
ip6tables -A FW6-IN -j DROP
ip6tables -A INPUT -j FW6-IN
Then a GRE interface:
ip link add name tun0 type ip6gre remote 2001:db8:1000::1 local 2001:db8:1000::2
ip address add 10.0.0.2/30 dev tun0
ip link set up dev tun0
When I enabled the GRE tunnel interface, I got a reject of GRE packets:
Mar 1 09:09:56 router1 kernel: [ 303.025798] [FW6-IN-2-D] IN=eth0 OUT= MAC=0c:d8:6a:66:03:00:0c:d8:6a:b7:90:00:86:dd SRC=2001:0db8:1000:0000:0000:0000:0000:0002 DST=2001:0db8:1000:0000:0000:0000:0000:0001 LEN=136 TC=0 HOPLIMIT=64 FLOWLBL=825134 PROTO=47
This unconditionally matched the invalid packets rule.
With the proposed patch, the rule '[FW6-IN-3-A]' is well matched when activating the GRE tunnel interface.
Likewise, the rule '[FW6-IN-1-A]' is matched for the flow passing through the GRE tunnel.
Regards,
----- Mail original -----
De: "Pablo Neira Ayuso" <pablo@xxxxxxxxxxxxx>
À: linuxludo@xxxxxxx
Cc: kadlec@xxxxxxxxxxxxx, fw@xxxxxxxxx, netfilter-devel@xxxxxxxxxxxxxxx, coreteam@xxxxxxxxxxxxx
Envoyé: Mercredi 3 Mars 2021 17:33:22
Objet: Re: [PATCH] netfilter: Fix GRE over IPv6 with conntrack module
Hi,
On Wed, Mar 03, 2021 at 11:21:11AM +0100, linuxludo@xxxxxxx wrote:
> Dear,
>
> I would provide you a small patch in order to fix a BUG when GRE over IPv6 is used with netfilter/conntrack module.
>
> This is my first contribution, not knowing the procedure well, thank you for being aware of this request.
>
> Regarding the proposed patch, here is a description of the encountered bug.
> Indeed, when an ip6tables rule dropping traffic due to an invalid packet (aka w/ conntrack module) is placed before a GRE protocol permit rule, the latter is never reached ; the packet is discarded via the previous rule.
>
> The proposed patch takes into account both IPv4 and IPv6 in conntrack module for GRE protocol.
> You will find this one at the end of this email.
The GRE protocol helper is tied to the PPTP conntrack helper which
does not support for IPv6. How are you using this update in your
infrastructure?
Thanks.
> --- nf_conntrack_proto_gre.c.orig 2021-03-03 05:03:37.034665100 -0500
> +++ nf_conntrack_proto_gre.c 2021-03-02 17:42:53.000000000 -0500
> @@ -219,7 +219,7 @@ int nf_conntrack_gre_packet(struct nf_co
> enum ip_conntrack_info ctinfo,
> const struct nf_hook_state *state)
> {
> - if (state->pf != NFPROTO_IPV4)
> + if (state->pf != NFPROTO_IPV4 && state->pf != NFPROTO_IPV6)
> return -NF_ACCEPT;
>
> if (!nf_ct_is_confirmed(ct)) {
>
