Bug#556587: nf_conntrack sets wrong value for ctorigsrc parameter
From the Debian bug tracking system:
-------- Forwarded Message --------
From: Michel Messerschmidt <lists@michel-messerschmidt.de>
Reply-to: Michel Messerschmidt <lists@michel-messerschmidt.de>, 556587@bugs.debian.org
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Bug#556587: linux-image-2.6.31-1-686-bigmem: nf_conntrack sets wrong value for ctorigsrc parameter
Date: Mon, 16 Nov 2009 23:09:10 +0100
Package: linux-2.6
Version: 2.6.31-2
Severity: normal
My iptables script using the conntrack module does not work with this kernel
version anymore. The value of the ctorigsrc parameter is not set correctly:
rei:~$ cat /etc/mm_iptables/mm_iptables_dmz | grep -E 'ctorig|LOCALIP='
LOCALIP="192.168.40.3"
$IPT -A in_dmz -p udp --dport 1024:65535 -m conntrack --ctproto udp --ctorigsrc $LOCALIP --ctorigdstport 53 --ctreplsrcport 53 -j ACCEPT
$IPT -A in_dmz -p udp --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED --ctproto udp --ctorigsrc $LOCALIP -j ACCEPT
rei:~$ iptables -nvL | grep ctorig
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 ctproto 17 ctorigsrc 192.60.154.245 ctorigdstport 53 ctreplsrcport 53
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 ctstate RELATED,ESTABLISHED ctproto 17 ctorigsrc 128.49.154.245
I see the same behavior with the 686 flavour (without bigmem).
With older kernels up to 2.6.30-8, the ctorigsrc value was set as expected:
rei:~$ iptables -nvL | grep ctorig
21 2452 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 ctproto 17 ctorigsrc 192.168.40.3 ctorigdstport 53 ctreplsrcport 53
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 ctstate RELATED,ESTABLISHED ctproto 17 ctorigsrc 192.168.40.3
-- Package-specific info:
** Version:
Linux version 2.6.31-1-686-bigmem (Debian 2.6.31-2) (ben@decadent.org.uk) (gcc version 4.3.4 (Debian 4.3.4-6) ) #1 SMP Sun Nov 15 21:22:56 UTC 2009
** Network interface configuration:
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
post-up /etc/mm_iptables/mm_iptables_init start
# The primary network interface
# really use hotplug ???
#allow-hotplug eth0
auto eth0
iface eth0 inet static
address 192.168.42.3
netmask 255.255.255.0
broadcast 192.168.42.255
# gateway must not be set here to allow dialup connections
#gateway 192.168.42.3
# hardware address (MAC)
# hwaddress ether
# set MTU for ethernet only network
mtu 1500
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 192.168.42.3
dns-search matrix
# handle firewall rules for this interface
post-up /etc/mm_iptables/mm_iptables_localnet start
pre-down /etc/mm_iptables/mm_iptables_localnet stop || true
auto eth1
iface eth1 inet static
address 192.168.40.3
netmask 255.255.255.0
broadcast 192.168.40.255
# gateway must not be set here to allow dialup connections
gateway 192.168.40.1
# hardware address (MAC)
# hwaddress ether
# set MTU for dialup / dsl / internet
mtu 1492
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 192.168.42.3
dns-search home
# handle firewall rules for this interface
post-up /etc/mm_iptables/mm_iptables_dmz start
pre-down /etc/mm_iptables/mm_iptables_dmz stop || true
** Network status:
*** IP interfaces and addresses:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state UNKNOWN qlen 1000
link/ether 00:08:54:50:08:d8 brd ff:ff:ff:ff:ff:ff
inet 192.168.40.3/24 brd 192.168.40.255 scope global eth1
inet6 fe80::208:54ff:fe50:8d8/64 scope link
valid_lft forever preferred_lft forever
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:30:1b:ba:73:70 brd ff:ff:ff:ff:ff:ff
inet 192.168.42.3/24 brd 192.168.42.255 scope global eth0
inet6 fe80::230:1bff:feba:7370/64 scope link
valid_lft forever preferred_lft forever
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/[65534]
inet 10.1.41.3 peer 10.1.41.10/32 scope global tun0
03:0a.0 FireWire (IEEE 1394) [0c00]: VIA Technologies, Inc. VT6306 Fire II IEEE 1394 OHCI Link Layer Controller [1106:3044] (rev 80) (prog-if 10 [OHCI])
Subsystem: VIA Technologies, Inc. VT6306 Fire II IEEE 1394 OHCI Link Layer Controller [1106:3044]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping+ SERR- FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 32 (8000ns max), Cache Line Size: 32 bytes
Interrupt: pin A routed to IRQ 18
Region 0: Memory at dfcff000 (32-bit, non-prefetchable) [size=2K]
Region 1: I/O ports at de00 [size=128]
Capabilities: <access denied>
Kernel driver in use: firewire_ohci
** USB devices:
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 005 Device 002: ID 04e6:5115 SCM Microsystems, Inc. SCR335 SmartCard Reader
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Kernel: Linux 2.6.31-1-686-bigmem (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages linux-image-2.6.31-1-686-bigmem depends on:
ii debconf [debconf-2.0] 1.5.28 Debian configuration management sy
ii initramfs-tools [linux-initra 0.93.4 tools for generating an initramfs
ii module-init-tools 3.11-1 tools for managing Linux kernel mo
Versions of packages linux-image-2.6.31-1-686-bigmem recommends:
ii firmware-linux-free 2.6.31-2 Binary firmware for various driver
ii libc6-i686 2.10.1-7 GNU C Library: Shared libraries [i
Versions of packages linux-image-2.6.31-1-686-bigmem suggests:
ii grub 0.97-59 GRand Unified Bootloader (dummy pa
pn linux-doc-2.6.31 <none> (no description available)
Versions of packages linux-image-2.6.31-1-686-bigmem is related to:
pn firmware-bnx2 <none> (no description available)
pn firmware-bnx2x <none> (no description available)
pn firmware-ipw2x00 <none> (no description available)
pn firmware-ivtv <none> (no description available)
pn firmware-iwlwifi <none> (no description available)
ii firmware-linux 0.18 Binary firmware for various driver
pn firmware-linux-nonfree <none> (no description available)
pn firmware-qlogic <none> (no description available)
pn firmware-ralink <none> (no description available)
Kernel: Linux 2.6.30-2-686 (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages linux-image-2.6.31-1-686-bigmem depends on:
ii debconf [debconf-2.0] 1.5.28 Debian configuration management sy
ii initramfs-tools [linux-initra 0.93.4 tools for generating an initramfs
ii module-init-tools 3.11-1 tools for managing Linux kernel mo
Versions of packages linux-image-2.6.31-1-686-bigmem recommends:
ii firmware-linux-free 2.6.31-2 Binary firmware for various driver
ii libc6-i686 2.10.1-7 GNU C Library: Shared libraries [i
Versions of packages linux-image-2.6.31-1-686-bigmem suggests:
ii grub 0.97-59 GRand Unified Bootloader (dummy pa
pn linux-doc-2.6.31 <none> (no description available)
Versions of packages linux-image-2.6.31-1-686-bigmem is related to:
pn firmware-bnx2 <none> (no description available)
pn firmware-bnx2x <none> (no description available)
pn firmware-ipw2x00 <none> (no description available)
pn firmware-ivtv <none> (no description available)
pn firmware-iwlwifi <none> (no description available)
ii firmware-linux 0.18 Binary firmware for various driver
pn firmware-linux-nonfree <none> (no description available)
pn firmware-qlogic <none> (no description available)
pn firmware-ralink <none> (no description available)
11-18-2009, 06:39 AM
Ben Hutchings
Bug#556587: nf_conntrack sets wrong value for ctorigsrc parameter
From the Debian bug tracking system:
-------- Forwarded Message --------
From: Michel Messerschmidt <lists@michel-messerschmidt.de>
Reply-to: Michel Messerschmidt <lists@michel-messerschmidt.de>, 556587@bugs.debian.org
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Bug#556587: linux-image-2.6.31-1-686-bigmem: nf_conntrack sets wrong value for ctorigsrc parameter
Date: Mon, 16 Nov 2009 23:09:10 +0100
Package: linux-2.6
Version: 2.6.31-2
Severity: normal
My iptables script using the conntrack module does not work with this kernel
version anymore. The value of the ctorigsrc parameter is not set correctly:
rei:~$ cat /etc/mm_iptables/mm_iptables_dmz | grep -E 'ctorig|LOCALIP='
LOCALIP="192.168.40.3"
$IPT -A in_dmz -p udp --dport 1024:65535 -m conntrack --ctproto udp --ctorigsrc $LOCALIP --ctorigdstport 53 --ctreplsrcport 53 -j ACCEPT
$IPT -A in_dmz -p udp --dport 1024:65535 -m conntrack --ctstate RELATED,ESTABLISHED --ctproto udp --ctorigsrc $LOCALIP -j ACCEPT
rei:~$ iptables -nvL | grep ctorig
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 ctproto 17 ctorigsrc 192.60.154.245 ctorigdstport 53 ctreplsrcport 53
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 ctstate RELATED,ESTABLISHED ctproto 17 ctorigsrc 128.49.154.245
I see the same behavior with the 686 flavour (without bigmem).
With older kernels up to 2.6.30-8, the ctorigsrc value was set as expected:
rei:~$ iptables -nvL | grep ctorig
21 2452 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 ctproto 17 ctorigsrc 192.168.40.3 ctorigdstport 53 ctreplsrcport 53
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 ctstate RELATED,ESTABLISHED ctproto 17 ctorigsrc 192.168.40.3
-- Package-specific info:
** Version:
Linux version 2.6.31-1-686-bigmem (Debian 2.6.31-2) (ben@decadent.org.uk) (gcc version 4.3.4 (Debian 4.3.4-6) ) #1 SMP Sun Nov 15 21:22:56 UTC 2009
** Network interface configuration:
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
post-up /etc/mm_iptables/mm_iptables_init start
# The primary network interface
# really use hotplug ???
#allow-hotplug eth0
auto eth0
iface eth0 inet static
address 192.168.42.3
netmask 255.255.255.0
broadcast 192.168.42.255
# gateway must not be set here to allow dialup connections
#gateway 192.168.42.3
# hardware address (MAC)
# hwaddress ether
# set MTU for ethernet only network
mtu 1500
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 192.168.42.3
dns-search matrix
# handle firewall rules for this interface
post-up /etc/mm_iptables/mm_iptables_localnet start
pre-down /etc/mm_iptables/mm_iptables_localnet stop || true
auto eth1
iface eth1 inet static
address 192.168.40.3
netmask 255.255.255.0
broadcast 192.168.40.255
# gateway must not be set here to allow dialup connections
gateway 192.168.40.1
# hardware address (MAC)
# hwaddress ether
# set MTU for dialup / dsl / internet
mtu 1492
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 192.168.42.3
dns-search home
# handle firewall rules for this interface
post-up /etc/mm_iptables/mm_iptables_dmz start
pre-down /etc/mm_iptables/mm_iptables_dmz stop || true
** Network status:
*** IP interfaces and addresses:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state UNKNOWN qlen 1000
link/ether 00:08:54:50:08:d8 brd ff:ff:ff:ff:ff:ff
inet 192.168.40.3/24 brd 192.168.40.255 scope global eth1
inet6 fe80::208:54ff:fe50:8d8/64 scope link
valid_lft forever preferred_lft forever
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:30:1b:ba:73:70 brd ff:ff:ff:ff:ff:ff
inet 192.168.42.3/24 brd 192.168.42.255 scope global eth0
inet6 fe80::230:1bff:feba:7370/64 scope link
valid_lft forever preferred_lft forever
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/[65534]
inet 10.1.41.3 peer 10.1.41.10/32 scope global tun0
03:0a.0 FireWire (IEEE 1394) [0c00]: VIA Technologies, Inc. VT6306 Fire II IEEE 1394 OHCI Link Layer Controller [1106:3044] (rev 80) (prog-if 10 [OHCI])
Subsystem: VIA Technologies, Inc. VT6306 Fire II IEEE 1394 OHCI Link Layer Controller [1106:3044]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping+ SERR- FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 32 (8000ns max), Cache Line Size: 32 bytes
Interrupt: pin A routed to IRQ 18
Region 0: Memory at dfcff000 (32-bit, non-prefetchable) [size=2K]
Region 1: I/O ports at de00 [size=128]
Capabilities: <access denied>
Kernel driver in use: firewire_ohci
** USB devices:
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 005 Device 002: ID 04e6:5115 SCM Microsystems, Inc. SCR335 SmartCard Reader
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Kernel: Linux 2.6.31-1-686-bigmem (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages linux-image-2.6.31-1-686-bigmem depends on:
ii debconf [debconf-2.0] 1.5.28 Debian configuration management sy
ii initramfs-tools [linux-initra 0.93.4 tools for generating an initramfs
ii module-init-tools 3.11-1 tools for managing Linux kernel mo
Versions of packages linux-image-2.6.31-1-686-bigmem recommends:
ii firmware-linux-free 2.6.31-2 Binary firmware for various driver
ii libc6-i686 2.10.1-7 GNU C Library: Shared libraries [i
Versions of packages linux-image-2.6.31-1-686-bigmem suggests:
ii grub 0.97-59 GRand Unified Bootloader (dummy pa
pn linux-doc-2.6.31 <none> (no description available)
Versions of packages linux-image-2.6.31-1-686-bigmem is related to:
pn firmware-bnx2 <none> (no description available)
pn firmware-bnx2x <none> (no description available)
pn firmware-ipw2x00 <none> (no description available)
pn firmware-ivtv <none> (no description available)
pn firmware-iwlwifi <none> (no description available)
ii firmware-linux 0.18 Binary firmware for various driver
pn firmware-linux-nonfree <none> (no description available)
pn firmware-qlogic <none> (no description available)
pn firmware-ralink <none> (no description available)
Kernel: Linux 2.6.30-2-686 (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages linux-image-2.6.31-1-686-bigmem depends on:
ii debconf [debconf-2.0] 1.5.28 Debian configuration management sy
ii initramfs-tools [linux-initra 0.93.4 tools for generating an initramfs
ii module-init-tools 3.11-1 tools for managing Linux kernel mo
Versions of packages linux-image-2.6.31-1-686-bigmem recommends:
ii firmware-linux-free 2.6.31-2 Binary firmware for various driver
ii libc6-i686 2.10.1-7 GNU C Library: Shared libraries [i
Versions of packages linux-image-2.6.31-1-686-bigmem suggests:
ii grub 0.97-59 GRand Unified Bootloader (dummy pa
pn linux-doc-2.6.31 <none> (no description available)
Versions of packages linux-image-2.6.31-1-686-bigmem is related to:
pn firmware-bnx2 <none> (no description available)
pn firmware-bnx2x <none> (no description available)
pn firmware-ipw2x00 <none> (no description available)
pn firmware-ivtv <none> (no description available)
pn firmware-iwlwifi <none> (no description available)
ii firmware-linux 0.18 Binary firmware for various driver
pn firmware-linux-nonfree <none> (no description available)
pn firmware-qlogic <none> (no description available)
pn firmware-ralink <none> (no description available)