Hi Antonio,
On Tue, Mar 18, 2025 at 04:35:29PM +0000, Antonio Ojea wrote:
> This test ensures that conntrack correctly applies reject rules to
> established connections after DNAT, even when those connections are
> persistent.
>
> The test sets up three network namespaces: ns1, ns2, and nsrouter.
> nsrouter acts as a router with DNAT, exposing a service running in ns2
> via a virtual IP.
>
> The test validates that is possible to filter and reject new and
> established connections to the DNATed IP in the prerouting and forward
> filters.
I am testing with different stable kernels to uncover timing issues.
With nf and nf-next kernels with instrumentions, **this works just fine**.
But I triggered a weird issue with Debian's 6.1.0-31-amd64:
# ./nft_conntrack_reject_established.sh
...
ERROR: backend filter-ip6: fail to connect to [dead:2::99]:8080
ERROR: backend filter-ip6: fail to connect over the established connection to [dead:4::a]:8080
ERROR: backend filter-ip6: fail to connect to [dead:4::a]:8080
ERROR: backend filter-ip6: fail to connect over the established connection to [dead:4::a]:8080
ERROR: backend filter-ip6: fail to connect to [dead:2::99]:8080
interestingly if I reversed the order, ie. I run ipv6 before ipv4
test, then ipv4 fails:
for testname in "${!testcases[@]}"; do
- test_conntrack_reject_established "ip" "$testname" "${testcases[$testname]}"
test_conntrack_reject_established "ip6" "$testname" "${testcases[$testname]}"
+ test_conntrack_reject_established "ip" "$testname" "${testcases[$testname]}"
done
also, running standalone ipv4 test, ie.:
for testname in "${!testcases[@]}"; do
test_conntrack_reject_established "ip" "$testname" "${testcases[$testname]}"
done
or ipv6 test, ie.:
for testname in "${!testcases[@]}"; do
test_conntrack_reject_established "ip6" "$testname" "${testcases[$testname]}"
done
works perfectly fine.
Hm, where is the issue? I have to double check, maybe -stable 6.1 is
missing a backport fix.
Thanks.
