Skip to contentSkip to conversation

nf_conntrack entry lost after using ipq_set_verdict() with NF_ACCEPT

DISCUSSION Yun Lin 1 participant 1 message Mar 29, 2009

lore
Share & tools
lore

Yun Lin

author
#0 lore raw

I am going to conntrack and NAT for a udp traffic with destination port 4.
in the conntrack helper() i did so:

if (ct->status & IPS_NAT_MASK){
    printk("going to ALG part after NAT\n");
    ret = NF_QUEUE;
    }

The first query (with dport 4) packet after MASQUERADE goes into the application layer gateway with NF_QUEUE into userspace, where the payload can be further changed.
Then i use ipq_set_verdict() with verdict NF_ACCEPT to forward it. But when the response in the other direction comes, it cannot be recognized as the reply of the query.
I think the entry of nf_conntrack of the first query packet has been lost, because when i just use MASQUERADE without userspace processing, the response will be marked correct as IP_CT_IS_REPLY.

I have printed out the conntrack tuple when the helper()is called, for the Query,
ctinfo = IP_CT_NEW;
the original tuple is:
10.21.22.21:4 -> 10.23.24.24:4 l3num:2 protonum:17
the reply tuple:
10.23.24.24:4 -> 10.22.23.22:4 l3num:2 protonum:17 10.21.22.21 is the ip address of querying node, 10.22.23.22 is the NAT and 10.23.24.24 is the responding node.

As for the Response:
ctinfo = IP_CT_NEW(which should be IP_CT_IS_REPLY) original tuple:
10.23.24.24:4 -> 10.22.23.22:4 l3num:2 protonum:17 reply tuple:
10.22.23.22:4 -> 10.23.24.24:4 l3num:2 protonum:17

Is there someone could help me figure this out??

best regards!!