libvirt users - Mar 2013 - netfilter+libvirt=(smth got broken?)

Hello,

I'm having problem setting up filtering traffic for a virtual machine 
managed by libvirt. Strange thing is, such a setup has been working fine 
for me on an older version of distro (namely, opensuse 11.3  w/updates, 
kernel 2.6.34, libvirt 0.8.8) but refused to work on shiny new opensuse 
12.4 (kernel 3.7.10, libvirt 1.0.2).

The definition of filter in question is pretty simple:

<filter name='some-filt' chain='ipv4'>
   <rule action='accept' direction='in'>
     <tcp dstportstart='110'/>
   </rule>
   <rule action='drop' direction='inout'>
     <all/>
   </rule>
</filter>

So basically it should allow incoming connections to the specified port 
number and nothing else. After activating this filter on a box in 
question, connections to 110 started to fail (timeout). Examining 
iptables rules manually and comparing them to the rules from my old box 
did not reveal anything suspicious to me. However, through just pure 
guesswork, I managed to ocasionally "fix" the problem by manually 
editing 3 relevant rules as follows:

--A FI-vnet0 -p tcp -m tcp --sport 110 -m conntrack --ctstate 
ESTABLISHED -m conntrack --ctdir ORIGINAL -j RETURN
+-A FI-vnet0 -p tcp -m tcp --sport 110 -m conntrack --ctstate 
ESTABLISHED -m conntrack --ctdir REPLY -j RETURN

--A FO-vnet0 -p tcp -m tcp --dport 110 -m conntrack --ctstate 
NEW,ESTABLISHED -m conntrack --ctdir REPLY -j ACCEPT
+-A FO-vnet0 -p tcp -m tcp --dport 110 -m conntrack --ctstate 
NEW,ESTABLISHED -m conntrack --ctdir ORIGINAL -j ACCEPT

--A HI-vnet0 -p tcp -m tcp --sport 110 -m conntrack --ctstate 
ESTABLISHED -m conntrack --ctdir ORIGINAL -j RETURN
+-A HI-vnet0 -p tcp -m tcp --sport 110 -m conntrack --ctstate 
ESTABLISHED -m conntrack --ctdir REPLY -j RETURN

So essentially, just manually swtiching "--ctdir" values to their 
opposites makes the filter allow connections to port 110. I've also 
verified that the filter still blocks unwanted connections originating 
from port 110 from VM exactly as it should:

(in VM): netcat -v -v -n -p 110 192.168.122.1 22
(UNKNOWN) [192.168.122.1] 22 (?) : Connection timed out
  set 0, rcvd 0

I've then compared /proc/net/nf_conntrack on both (old and new) boxes. 
They look roughly the same, nothing suspicious.

This all looks to me as if "--ctdir" argument somehow magically
changed
its meaning to the opposite, but this just cannot be! I'm out of ideas 
and looking for insights. Any hints appreciated quite a lot.

Thank you.
Nikolai

Hello,
20.03.2013 16:47, I wrote:
[...]
> for me on an older version of distro (namely, opensuse 11.3 w/updates,
> kernel 2.6.34, libvirt 0.8.8) but refused to work on shiny new opensuse
> 12.4 (kernel 3.7.10, libvirt 1.0.2).
^^^^^^ This was a typo: should read '12.3' of course, sorry.

Nikolai

Hello,
20.03.2013 16:47, I wrote:
[...]
> This all looks to me as if "--ctdir" argument somehow magically
changed
> its meaning to the opposite, but this just cannot be! I'm out of ideas
> and looking for insights. Any hints appreciated quite a lot.
Some more searching over maillists yielded this (quite astonishing):

net/netfilter/xt_conntrack.c	
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 2c0086a..481a86f 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -195,7 +195,7 @@ conntrack_mt(const struct sk_buff *skb, struct 
xt_action_param *par,
  		return info->match_flags & XT_CONNTRACK_STATE;
  	if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
  	    (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
-	    !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
+	    !(info->invert_flags & XT_CONNTRACK_DIRECTION))
  		return false;

  	if (info->match_flags & XT_CONNTRACK_ORIGSRC)

So apparently, netfilter's behaviour was indeed reversed at some point, 
therefore libvirt stopped working properly.

I'd guess libvirt needs to be adapted then? Is it a known issue or 
should I fill in bugreport at Novell/Red Hat?


Thank you.
Nikolai
>
> Thank you.
> Nikolai
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe
netfilter" in
> the body of a message to majordomo at vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>