Question about nf_conntrack_proto for IPsec

Question about nf_conntrack_proto for IPsec

[Naruto Nguyen]

Hi everyone,

In linux/latest/source/net/netfilter/ folder, I only see we have
nf_conntrack_proto_tcp.c, nf_conntrack_proto_udp.c and some other
conntrack implementations for other protocols but I do not see
nf_conntrack_proto for IPsec, so does it mean connection tracking
cannot track ESP or AH protocol as a connection. I mean when I use
"conntrack -L" command, I will not see ESP or AH  connection is saved
in conntrack list. Could you please help me to understand if conntrack
supports that and any reasons if it does not support?

Thanks a lot,
Brs,
Naruto

Re: Question about nf_conntrack_proto for IPsec

[Florian Westphal]

Naruto Nguyen <narutonguyen2018@gmail.com> wrote:
> In linux/latest/source/net/netfilter/ folder, I only see we have
> nf_conntrack_proto_tcp.c, nf_conntrack_proto_udp.c and some other
> conntrack implementations for other protocols but I do not see
> nf_conntrack_proto for IPsec, so does it mean connection tracking
> cannot track ESP or AH protocol as a connection. I mean when I use
> "conntrack -L" command, I will not see ESP or AH  connection is saved
> in conntrack list. Could you please help me to understand if conntrack
> supports that and any reasons if it does not support?

ESP/AH etc. use the generic tracker, i.e. only one ESP connection
is tracked between each endpoint.

Re: Question about nf_conntrack_proto for IPsec

[Naruto Nguyen]

Hi Florian,

Thanks a lot for your reply.

Could you please elaborate more on how generic tracker tracks ESP connection?

Brs,
Bao

On Wed, 26 Jun 2019 at 18:13, Florian Westphal <fw@strlen.de> wrote:
>
> Naruto Nguyen <narutonguyen2018@gmail.com> wrote:
> > In linux/latest/source/net/netfilter/ folder, I only see we have
> > nf_conntrack_proto_tcp.c, nf_conntrack_proto_udp.c and some other
> > conntrack implementations for other protocols but I do not see
> > nf_conntrack_proto for IPsec, so does it mean connection tracking
> > cannot track ESP or AH protocol as a connection. I mean when I use
> > "conntrack -L" command, I will not see ESP or AH  connection is saved
> > in conntrack list. Could you please help me to understand if conntrack
> > supports that and any reasons if it does not support?
>
> ESP/AH etc. use the generic tracker, i.e. only one ESP connection
> is tracked between each endpoint.

Re: Question about nf_conntrack_proto for IPsec

[Florian Westphal]

Naruto Nguyen <narutonguyen2018@gmail.com> wrote:
> Could you please elaborate more on how generic tracker tracks ESP connection?

All protocols that do not have a more specific l4 tracker are tracked
based on l3 protocol + l4 proto number.

IOW, any ESP packet sent between the same endpoint addresses is seen
as matching a single esp flow.

We could easily add the ESP SPI as additional distinction marker if needed.