Patchwork linux 3.12 regression - snat problem with ftp helper

login
register
mail settings
Submitter Phil Oester
Date Nov. 15, 2013, 8:09 p.m.
Message ID <20131115200928.GA11322@home>
Download mbox | patch
Permalink /patch/291659/
State Superseded
Headers show

Comments

Phil Oester - Nov. 15, 2013, 8:09 p.m.
On Fri, Nov 15, 2013 at 02:48:08PM +0100, Dawid Stawiarski - nazwa.pl wrote:
> hello,
> 
> after upgrade to mainline kernel v. 3.12 our machines are not able
> to connect to ftp service (from inside of the lxc containters).
> Mainline kernel 3.11.8 works fine.
> 
> in packet 8 host sends rewriten PORT command (with changed private
> to public IP) - however the packet has incorrect sequence number
> (should have 41).
> the ftp server responds with SACK but the host resets the connection.

Does the attached patch solve the problem for you?

Phil
Pablo Neira - Nov. 17, 2013, 12:23 a.m.
On Fri, Nov 15, 2013 at 12:09:29PM -0800, Phil Oester wrote:
> On Fri, Nov 15, 2013 at 02:48:08PM +0100, Dawid Stawiarski - nazwa.pl wrote:
> > hello,
> > 
> > after upgrade to mainline kernel v. 3.12 our machines are not able
> > to connect to ftp service (from inside of the lxc containters).
> > Mainline kernel 3.11.8 works fine.
> > 
> > in packet 8 host sends rewriten PORT command (with changed private
> > to public IP) - however the packet has incorrect sequence number
> > (should have 41).
> > the ftp server responds with SACK but the host resets the connection.
> 
> Does the attached patch solve the problem for you?

This fix works here in my testbed. Will revisit this tomorrow again.

Thanks Phil.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Dawid Stawiarski - nazwa.pl - Nov. 18, 2013, 7:41 a.m.
W dniu 15.11.2013 21:09, Phil Oester pisze:
>> in packet 8 host sends rewriten PORT command (with changed private
>> to public IP) - however the packet has incorrect sequence number
>> (should have 41).
>> the ftp server responds with SACK but the host resets the connection.
>
> Does the attached patch solve the problem for you?

yes, I can confirm that the kernel with your patch applied works as 
expected. Thank you for quick reply and the fix.

Dawid

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 5f9bfd0..17c1bcb 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -41,8 +41,8 @@  int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 	spin_lock_bh(&ct->lock);
 	this_way = &seqadj->seq[dir];
 	if (this_way->offset_before == this_way->offset_after ||
-	    before(this_way->correction_pos, seq)) {
-		this_way->correction_pos = seq;
+	    before(this_way->correction_pos, ntohl(seq))) {
+		this_way->correction_pos = ntohl(seq);
 		this_way->offset_before	 = this_way->offset_after;
 		this_way->offset_after	+= off;
 	}