Re: [libvirt-users] netfilter+libvirt=(smth got broken?)

On Thu, Mar 21, 2013 at 10:55:42AM +0100, Pablo Neira Ayuso wrote: > Hi Eric, > > On Wed, Mar 20, 2013 at 09:18:21PM -0600, Eric Blake wrote: > [...] >>> By looking at the changes you made: >>> >>>> --A FI-vnet0 -p tcp -m tcp --sport 110 -m conntrack --ctstate >>>> ESTABLISHED -m conntrack --ctdir ORIGINAL -j RETURN >>>> +-A FI-vnet0 -p tcp -m tcp --sport 110 -m conntrack --ctstate >>>> ESTABLISHED -m conntrack --ctdir REPLY -j RETURN >>> The first rule looks wrong to me indeed, traffic coming in the >>> original direction will initiate the connection to destination port >>> TCP/110. Therefore, your change is correct. >> Correct for the new kernel interpretation, but we also want to support >> use of libvirt with older kernels, preferably with a runtime check so >> that a binary compiled on an older kernel will still work after a kernel >> upgrade. > My suggestion is to relax that rule-set that you're using, ie. remove > the --ctdir. The connection tracking table and the TCP tracker already > take care for those invalid situations that you were trying to catch > with that --ctdir. You only have to add an iptables rule somewhere to > catch invalid packets. In case you need more information, have a look at: linux/net/netfilter/nf_conntrack_proto_tcp.c Basically, the TCP tracker already validates that traffic is coming from the correct direction. We have an internal state-machine for that that will put coming in the wrong direction packets into the INVALID state. If you have a rule-set whose default policy is drop or you log and drop invalid packets, it will allow you to obtain the effect you seem to be looking for. So basically, it's safe to remove the --ctdir without having a less secure rule-set.