lkml.org 
[lkml]   [2005]   [Jul]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject2.6.12 netfilter: local packets marked as invalid
Hi,

Some Gentoo users have reported very long application startup times in 2.6.12.
This seems to be because the applications are attempting to connect to local
ports such as sunrpc/portmap (where these services are not running), but some
packets are being dropped, so the application load just pauses until the
connection times out.

There was a similar problem reported recently ("2.6.12: connection tracking
broken?"), regarding bridge devices. No bridge devices are involved here.

This is easy to reproduce, and the problem exists on both Linux 2.6.12 and
2.6.13-rc2. This was not a problem on Linux 2.6.11.

Taking a simple configuration:

# iptables -P INPUT ACCEPT
# iptables -P OUTPUT ACCEPT
# iptables -P FORWARD ACCEPT

I don't have a webserver running. If I try and telnet to port 80, I
immediately get connection refused, as expected:

# telnet 127.0.0.1 80
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused

I now add another rule, to drop invalid packets, and retry the telnet connection.

# iptables -A INPUT -m state --state INVALID -j DROP
# telnet 127.0.0.1 80
<very long pause>
telnet: connect to address 127.0.0.1: Connection timed out

During the pause, netstat reports the connection state as SYN_SENT:

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 1 localhost:39066 localhost:http SYN_SENT

I now flush the filter table, and make the kernel log invalid packets:

# iptables -t filter -F
#iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "inv "

When retrying the telnet test, this appears in the logs:

Jul 8 14:53:04 dsd inv IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1
LEN=40 TOS=0x10 PREC=0x00 TTL=64 ID=15 DF PROTO=TCP SPT=80 DPT=58950 WINDOW=0
RES=0x00 ACK RST URGP=0

Does this mean that the kernel thinks its own ACK RST packet is invalid?

There is a Gentoo bug on this here:
http://bugs.gentoo.org/96948
...but I think I got the imporant info into this message.

Let me know if I can provide any more info. For those interested in a
temporary workaround, you can explicitly allow all local traffic, i.e.

# iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -m state --state INVALID -j DROP

Thanks.
Daniel
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-07-08 16:05    [W:0.055 / U:23.876 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site