<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - nf_conntrack_update fails in fedora kernels 5.6.16 and 5.6.18"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1436#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - nf_conntrack_update fails in fedora kernels 5.6.16 and 5.6.18"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1436">bug 1436</a>
from <span class="vcard"><a class="email" href="mailto:rce-dev@protonmail.com" title="rce-dev@protonmail.com">rce-dev@protonmail.com</a>
</span></b>
<pre>Created <span class=""><a href="attachment.cgi?id=597" name="attach_597" title="kernel 5.6.19 reporter-print (1) output">attachment 597</a> <a href="attachment.cgi?id=597&action=edit" title="kernel 5.6.19 reporter-print (1) output">[details]</a></span>
kernel 5.6.19 reporter-print (1) output
kernel 5.6.19 reporter-print (1) output
This bug makes it impossible to run an IPS process under kernels 5.6.16-19.
Bug is still present in 5.6.19;
IPS is run with:
/sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid
-v -D -q 1 -q 2 -q 3
IPS is able to pass small packets (ie echo, echo-reply) but kernel oops occurs
under increased network activity such as opening a web page.
It appears that an oops occurs with attempt of IPS to use each of the NFQUEUEs
1-3. Once an oops occurs, IPS traffic is blocked - IPS useless.
Restarting IPS results in failure to open previously used queues:
<Error> - [ERRCODE: SC_ERR_NFQ_CREATE_QUEUE(72)] - nfq_create_queue failed
An IPS process can open previously unused queues (ie q4) but with the same
ultimate result.
The most recently attached file is the 3rd of 3 oops events corresponding with
an attempt to open a web page. These events resulted in blocking all subsequent
traffic from the IPS process.
Note that each oops references a very short-lived tainted process which I've
been unable to identify with `ps -e` run at `sleep 1e-03` interval.
first oops:
CPU: 1 PID: 14850 Comm: TX#01 Not tainted 5.6.19-200.fc31.x86_64 #1
[ 109.483740] CPU: 1 PID: 14850 Comm: TX#01 Not tainted 5.6.19-200.fc31.x86_64
#1
[ 110.064602] CPU: 3 PID: 14851 Comm: TX#02 Tainted: G D
5.6.19-200.fc31.x86_64 #1
2nd oops:
kernel_tainted_long: D - Kernel has oopsed before
3 PID: 14851 Comm: TX#02 Tainted: G D 5.6.19-200.fc31.x86_64 #1
[ 109.483740] CPU: 1 PID: 14850 Comm: TX#01 Not tainted 5.6.19-200.fc31.x86_64
#1
[ 110.064602] CPU: 3 PID: 14851 Comm: TX#02 Tainted: G D
5.6.19-200.fc31.x86_64 #1
3rd oops
kernel_tainted_long: D - Kernel has oopsed before
/var/tmp/ProblemReport-C-5.6.19-200.fc31.txt::CPU: 3 PID: 14849 Comm: TX#00
Tainted: G D 5.6.19-200.fc31.x86_64 #1
[ 109.483740] CPU: 1 PID: 14850 Comm: TX#01 Not tainted 5.6.19-200.fc31.x86_64
#1
[ 110.064602] CPU: 3 PID: 14851 Comm: TX#02 Tainted: G D
5.6.19-200.fc31.x86_64 #1
[ 124.498896] CPU: 3 PID: 14849 Comm: TX#00 Tainted: G D
5.6.19-200.fc31.x86_64 #1</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>