From patchwork Tue Sep 1 12:20:51 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Patrick McHardy X-Patchwork-Id: 32741 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id DD178B7CB5 for ; Tue, 1 Sep 2009 22:21:08 +1000 (EST) Received: by ozlabs.org (Postfix) id CBFE5DDDA2; Tue, 1 Sep 2009 22:21:08 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 5DC6CDDD1B for ; Tue, 1 Sep 2009 22:21:08 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754306AbZIAMU6 (ORCPT ); Tue, 1 Sep 2009 08:20:58 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754083AbZIAMU6 (ORCPT ); Tue, 1 Sep 2009 08:20:58 -0400 Received: from stinky.trash.net ([213.144.137.162]:53114 "EHLO stinky.trash.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753837AbZIAMU5 (ORCPT ); Tue, 1 Sep 2009 08:20:57 -0400 Received: from [IPv6:2001:6f8:974:0:215:f2ff:fe24:91f8] (unknown [IPv6:2001:6f8:974:0:215:f2ff:fe24:91f8]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by stinky.trash.net (Postfix) with ESMTPSA id EA124B2C48; Tue, 1 Sep 2009 14:20:56 +0200 (MEST) Message-ID: <4A9D11A3.5070809@trash.net> Date: Tue, 01 Sep 2009 14:20:51 +0200 From: Patrick McHardy User-Agent: Mozilla-Thunderbird 2.0.0.22 (X11/20090701) MIME-Version: 1.0 To: Andreas Jaggi CC: Mark Brown , Jing Min Zhao , netdev@vger.kernel.org Subject: Re: H.245v10+ support in nf_conntrack_h323? References: <20090901092910.GC11354@urbino.open.ch> <20090901100230.GA18651@sirena.org.uk> <4A9D04A2.60307@trash.net> <20090901121033.GA18731@urbino.open.ch> In-Reply-To: <20090901121033.GA18731@urbino.open.ch> X-Enigmail-Version: 0.95.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Andreas Jaggi wrote: > On Tue, Sep 01, 2009 at 01:25:22PM +0200, Patrick McHardy wrote: >> Mark Brown wrote: >>> I'd be surprised if the H.245 version were the source of your problems >>> here - the new protocol versions are backwards compatible and I don't >>> remember any changes in any of the stuff that's relevant for firewall >>> transit. >> Good point. The helper should also log packets dropped due to parsing >> errors. If you don't get any messages, I'd suggest to use the iptables >> TRACE target to figure out where the packets are dropped exactly. > > I'm quite confident that the H.245 parsing/handling is involved in the > packet dropping: > 1. there are plenty of 'nf_ct_h245: packet dropped' messages > (but no nf_ct_q931 or nf_ct_ras messages) Yes, that's the H.323 helper. > 2. without nf_conntrack_h323 the videoconferencing works seamlessly > 3. with nf_conntrack_h323 and a ...-j NOTRACK rule the videoconferencing > works too > > In our setup there is a LOG rule preceding any DROP or ACCEPT rule, and > there were no logentries for DROP rules showing up (only the nf_ct_h245: > packet dropped messages). > Would a TRACE rule provide more insight than this? (eg. by showing in > which part of the nf_conntrack_h323 code a packet is dropped?) No, it only shows the path of the packet through the ruleset. > For me it looks like nf_conntrack_h323 is not only doing connection > tracking, but also doing protocol enforcement (by dropping packets which > do not correspond exactly to H.245v7). > Perhaps there should be a config option to disable the protocol > enforcement? Its unfortunately necessary to drop packets in some cases after parsing errors when the helper might have already (partially) mangled the packet. You could try this patch in combination with ulogd and the pcap output plugin to capture the packets which are dropped by the helper for analysis. commit 74f7a6552c8d76ffc5e11eb8d9d6c07238b9ae77 Author: Patrick McHardy Date: Tue Aug 25 15:33:08 2009 +0200 netfilter: nf_conntrack: log packets dropped by helpers Log packets dropped by helpers using the netfilter logging API. This is useful in combination with nfnetlink_log to analyze those packets in userspace for debugging. Signed-off-by: Patrick McHardy diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c index 9ac2fdc..aa95bb8 100644 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c @@ -26,6 +26,7 @@ #include #include #include +#include int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb, struct nf_conn *ct, @@ -113,8 +114,11 @@ static unsigned int ipv4_confirm(unsigned int hooknum, ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb), ct, ctinfo); - if (ret != NF_ACCEPT) + if (ret != NF_ACCEPT) { + nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL, + "nf_ct_%s: dropping packet", helper->name); return ret; + } if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) { typeof(nf_nat_seq_adjust_hook) seq_adjust; diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c index a7f4cd6..5f2ec20 100644 --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c @@ -27,6 +27,7 @@ #include #include #include +#include static bool ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff, struct nf_conntrack_tuple *tuple) @@ -176,8 +177,11 @@ static unsigned int ipv6_confirm(unsigned int hooknum, } ret = helper->help(skb, protoff, ct, ctinfo); - if (ret != NF_ACCEPT) + if (ret != NF_ACCEPT) { + nf_log_packet(NFPROTO_IPV6, hooknum, skb, in, out, NULL, + "nf_ct_%s: dropping packet", helper->name); return ret; + } out: /* We've seen it coming out the other side: confirm it */ return nf_conntrack_confirm(skb);