conntrackd: inject-add2: Invalid argument

[Sascha Frey]

Hi list,

I did set up conntrackd in sync mode on two firewall hosts.

I get a lot of errors in the log:

conntrack-tools[6607]: inject-add2: Invalid argument
conntrack-tools[6607]: tcp 6 ESTABLISHED src=yyy.yyy.yyy.55 dst=10.255.255.1 sport=51505 dport=22 [UNREPLIED]
conntrack-tools[6607]: inject-upd1: Invalid argument
conntrack-tools[6607]: tcp 6 FIN_WAIT src=yyy.yyy.yyy.55 dst=10.255.255.1 sport=51505 dport=22 [UNREPLIED]
conntrack-tools[6607]: inject-add2: Invalid argument
conntrack-tools[6607]: tcp 6 ESTABLISHED src=yyy.yyy.yyy.55 dst=10.255.255.1 sport=51505 dport=22 [UNREPLIED]

Any idea what's wrong here?

Both machines run Debian Wheezy with backports kernel
(3.14.7-1~bpo70+1) and conntrackd (1.2.1-1).


My conntrackd.conf:

Sync {
Mode FTFW {
DisableExternalCache On
CommitTimeout 1800
PurgeTimeout 5
}

# Dedicated link
UDP Default {
IPv4_address 192.168.109.2
IPv4_Destination_Address 192.168.109.3
Port 3780
Interface bond1
SndSocketBuffer 134217728
RcvSocketBuffer 134217728
Checksum on
}

# Fallback
UDP {
IPv4_address xxx.xxx.xxx.162
IPv4_Destination_Address xxx.xxx.xxx.163
Port 3780
Interface bond0
SndSocketBuffer 134217728
RcvSocketBuffer 134217728
Checksum on
}
}

General {
Nice -20
HashSize 262144
HashLimit 1048576
LogFile off
Syslog local6
LockFile /var/lock/conntrackd.lock
UNIX {
Path /var/run/conntrackd.sock
Backlog 20
}
SocketBufferSize 16777216
SocketBufferSizeMaxGrown 67108864

Filter From Kernelspace {
Protocol Accept {
TCP
UDP
ICMP
}

Address Ignore {
IPv4_address 127.0.0.k
IPv6_address ::1 # loopback

IPv4_address xxx.xxx.xxx.160/28
IPv4_address 192.168.109.0/24
}
}
}

Cheers,
Sascha
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

[Sascha Frey]

Sascha Frey wrote:

[...]

Post by Sascha Frey
Both machines run Debian Wheezy with backports kernel
(3.14.7-1~bpo70+1) and conntrackd (1.2.1-1).

I built conntrack-tools 1.4.2 from source including all the necessary
libraries (libmnl-1.0.3, libnetfilter_conntrack-1.0.4,
libnetfilter_cthelper-1.0.0, libnetfilter_cttimeout-1.0.0,
libnetfilter_queue-1.0.2, libnfnetlink-1.0.1).

Unfortunately, I get the same errors with 1.4.2 when external cache is
disabled.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html