Alternative SCTP l4 tracker?

Alternative SCTP l4 tracker?

[Sriram Yagnaraman]

Hi,

I am building a simple conntrack module for SCTP protocol. It is specified in a draft that still under review: https://www.ietf.org/archive/id/draft-porfiri-tsvwg-sctp-natsupp-03.txt
The idea with the draft is to only look at SCTP INIT chunks and use timers to handle the rest of the state handling. 

I would like to minimize the number of changes I make inside the existing conntrack, since this is just a research project as of now.
The question is if it is possible to have an external conntrack module that handles SCTP instead of the built-in SCTP l4 tracker?

I have tried the following ideas, but am not happy with any of them
1. Register a kprobe for nf_conntrack_sctp_packet() and do my tracking there, but getting the original function arguments is messy and the original nf_conntrack_sctp_packet is still called
2. Change NF_CT_PROTO_SCTP to tristate and load my module at start up instead of the original SCTP l4 tracker, and use a function pointer for nf_conntrack_sctp_packet()
3. Modify existing SCTP l4 tracker directly 

I would be happy to try any other suggestion someone here might have.

BR,
/Sriram

Re: Alternative SCTP l4 tracker?

[Pablo Neira Ayuso]

On Thu, Jun 02, 2022 at 09:47:04AM +0000, Sriram Yagnaraman wrote:
> Hi,
> 
> I am building a simple conntrack module for SCTP protocol. It is specified in a draft that still under review: https://www.ietf.org/archive/id/draft-porfiri-tsvwg-sctp-natsupp-03.txt
> The idea with the draft is to only look at SCTP INIT chunks and use timers to handle the rest of the state handling. 
> 
> I would like to minimize the number of changes I make inside the existing conntrack, since this is just a research project as of now.
> The question is if it is possible to have an external conntrack module that handles SCTP instead of the built-in SCTP l4 tracker?
> 
> I have tried the following ideas, but am not happy with any of them
> 1. Register a kprobe for nf_conntrack_sctp_packet() and do my tracking there, but getting the original function arguments is messy and the original nf_conntrack_sctp_packet is still called
> 2. Change NF_CT_PROTO_SCTP to tristate and load my module at start up instead of the original SCTP l4 tracker, and use a function pointer for nf_conntrack_sctp_packet()
> 3. Modify existing SCTP l4 tracker directly 
> 
> I would be happy to try any other suggestion someone here might have.

Number #3, you will have to send incremental patches for review.

I would suggest you start by adding a test to tools/testing/selftests/netfilter/

Florian has been adding most of the tests there, he can probably
provide a few hints/ideas on what would be good to cover.