[libvirt] [PATCH v3] nwfilter: probe for inverted ctdir

[Stefan Berger]

On 03/27/2013 02:01 PM, Eric Blake wrote:
> On 03/27/2013 10:30 AM, Laine Stump wrote:
>> My opinion is that the patch we should apply should be a simple patch
>> that just removes use of --ctdir. According to the netfilter developer
>> who responded to the thread on libvirt-users, it doesn't add any extra
>> security not already provided by conntrack:
>>
>>     https://www.redhat.com/archives/libvirt-users/2013-March/msg00121.html
>>     https://www.redhat.com/archives/libvirt-users/2013-March/msg00128.html
>>
>> Not being an expert on netfilter internals, I can't dispute his claim.
>>
>> Does anyone else have an opinion?
> What filters specifically caused the use of --ctdir, and are they broken
> if we omit the use of --ctdir?

It depends on how you write the filters that the --ctdir is being used.

iirc: The effect of the --ctdir usage is that if one has an incoming 
rule and and outgoing rule with the same IP address on the 'other' side 
the check for an ESTABLISHED state is not enough to ACCEPT the traffic, 
if one was to remove one of the rules while communication in both 
directions was occurring and an immediate cut of the traffic in one way 
was expected. The effect so far was that if the rule for the incoming 
rule was removed it would cut the incoming traffic immediately while the 
traffic in outgoing direction was uninterrupted. I think that if we 
remove this now the traffic in both directions will continue. I will 
verify tomorrow.

I don't quite understand the skepticism towards this patch (v3) that 
tries to keep what is there right now.

     Stefan