Add support for NAT sequence adjustments

PATCH Applied Pablo Neira Ayuso 2 participants 5 messages Dec 9, 2007 – Dec 12, 2007

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Pablo Neira Ayuso

author maintainer

2007-12-09 18:13 UTC #0 lore raw

PATCH 1/5 Add support for NAT sequence adjustments

The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see:

http://people.netfilter.org/pablo/conntrack-tools/

Signed-off-by Pablo Neira Ayuso <[email protected]>

Signature · 1 line

"Los honestos son inadaptados sociales" -- Les Luthiers

[PATCH][CTNETLINK] Add support for NAT sequence adjustments

http://people.netfilter.org/pablo/conntrack-tools/

Signed-off-by Pablo Neira Ayuso <[email protected]>

include/linux/netfilter/nf_conntrack_common.h +4 -0

Index: net-2.6.git/include/linux/netfilter/nf_conntrack_common.h
===================================================================
@@ -129,6 +129,10 @@ enum ip_conntrack_events
 	/* Mark is set */
 	IPCT_MARK_BIT = 12,
 	IPCT_MARK = (1 << IPCT_MARK_BIT),
+
+	/* NAT sequence adjustment */
+	IPCT_NATSEQADJ_BIT = 13,
+	IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),
 };
 
 enum ip_conntrack_expect_events {

include/linux/netfilter/nfnetlink_conntrack.h +10 -0

Index: net-2.6.git/include/linux/netfilter/nfnetlink_conntrack.h
===================================================================
@@ -37,6 +37,8 @@ enum ctattr_type {
 	CTA_ID,
 	CTA_NAT_DST,
 	CTA_TUPLE_MASTER,
+	CTA_NAT_SEQ_ADJ_ORIG,
+	CTA_NAT_SEQ_ADJ_REPLY,
 	__CTA_MAX
 };
 #define CTA_MAX (__CTA_MAX - 1)

@@ -119,6 +121,14 @@ enum ctattr_protonat {
 };
 #define CTA_PROTONAT_MAX (__CTA_PROTONAT_MAX - 1)
 
+enum ctattr_natseqadj {
+	CTA_NAT_SEQ_CUR,
+	CTA_NAT_OFFSET_BEFORE,
+	CTA_NAT_OFFSET_AFTER,
+	__CTA_NAT_SEQ_MAX
+};
+#define CTA_NAT_SEQ_MAX (__CTA_NAT_SEQ_MAX - 1)
+
 enum ctattr_expect {
 	CTA_EXPECT_UNSPEC,
 	CTA_EXPECT_MASTER,

net/ipv4/netfilter/nf_nat_helper.c +3 -0

Index: net-2.6.git/net/ipv4/netfilter/nf_nat_helper.c
===================================================================
@@ -20,6 +20,7 @@
 #include <linux/netfilter_ipv4.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_protocol.h>

@@ -191,6 +192,8 @@ nf_nat_mangle_tcp_packet(struct sk_buff 
 		/* Tell TCP window tracking about seq change */
 		nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
 					ct, CTINFO2DIR(ctinfo));
+
+		nf_conntrack_event_cache(IPCT_NATSEQADJ, skb);
 	}
 	return 1;
 }

net/netfilter/nf_conntrack_netlink.c +123 -1

154 lines not on this page · raw message

Patrick McHardy

2007-12-09 19:09 UTC #1 lore raw

Quoted 6 lines · Pablo Neira Ayuso

The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see:

+ /* NAT sequence adjustment */
+ IPCT_NATSEQADJ_BIT = 13,
+ IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),

You don't seem to be using this bit for anything.

Pablo Neira Ayuso

author maintainer

2007-12-11 15:56 UTC #2 lore raw

Quoted 11 lines · Patrick McHardy

Quoted 6 lines · Pablo Neira Ayuso
The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see:
include/linux/netfilter/nf_conntrack_common.h +3 -0
+    /* NAT sequence adjustment */
+    IPCT_NATSEQADJ_BIT = 13,
+    IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),

Quoted 1 line

You don't seem to be using this bit for anything.

Hm, I think I did.

net/ipv4/netfilter/nf_nat_helper.c nf_nat_mangle_tcp_packet(struct sk_buff · line 196

Quoted 6 lines

net/ipv4/netfilter/nf_nat_helper.c +2 -0

@@ -191,6 +192,8 @@ nf_nat_mangle_tcp_packet(struct sk_buff 
 		/* Tell TCP window tracking about seq change */
 		nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
 					ct, CTINFO2DIR(ctinfo));
+
+		nf_conntrack_event_cache(IPCT_NATSEQADJ, skb);

Here we cache the NAT sequence adjustment event.

net/netfilter/nf_conntrack_netlink.c static int ctnetlink_conntrack_event(str · line 480

Quoted 11 lines

===================================================================

net/netfilter/nf_conntrack_netlink.c +4 -0

@@ -424,6 +474,10 @@ static int ctnetlink_conntrack_event(str
 		    (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
 		     ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
 			goto nla_put_failure;
+
+		if (events & IPCT_NATSEQADJ &&
+		    ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
+			goto nla_put_failure;

And here we dump it.

Patrick McHardy

2007-12-11 16:48 UTC #3 lore raw

Quoted 8 lines · Pablo Neira Ayuso

Quoted 7 lines · Patrick McHardy
Quoted 6 lines · Pablo Neira Ayuso
The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see:

Quoted 8 lines

Quoted 5 lines
include/linux/netfilter/nf_conntrack_common.h +3 -0
+    /* NAT sequence adjustment */
+    IPCT_NATSEQADJ_BIT = 13,
+    IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),
You don't seem to be using this bit for anything.
Hm, I think I did.

Right, I mistook it for a status bit and didn't pay attention to the events. Let me look at this again :)

Patrick McHardy

Applied

2007-12-12 08:29 UTC #4 lore raw

In reply to Pablo Neira Ayuso

Quoted 4 lines · Pablo Neira Ayuso

The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see:

Applied, thanks Pablo. I did some minor renaming though, the attribute names were neither consistent with themselves nor with the naming scheme used elsewhere, so we now have:

+enum ctattr_natseq {

+       CTA_NAT_SEQ_CORRECTION_POS,
+       CTA_NAT_SEQ_OFFSET_BEFORE,
+       CTA_NAT_SEQ_OFFSET_AFTER,
+       __CTA_NAT_SEQ_MAX

+};
+#define CTA_NAT_SEQ_MAX (__CTA_NAT_SEQ_MAX - 1)