firewall: flush stale UDP conntrack entries on port_forward setup/teardown by shivkr6 · Pull Request #1362 · containers/netavark

shivkr6 · 2025-11-18T15:46:24Z

Add a new netlink_netfilter module to interact with the kernel's conntrack table using the netlink_packet_netfilter crate. This module allows dumping and deleting conntrack entries. All firewall drivers now call the new flush_udp_conntrack() function during port forwarding setup and teardown.

When a container with a UDP port mapping is started, stale conntrack entries can prevent traffic from reaching the new container instance. This change proactively deletes these stale entries for the mapped UDP ports, ensuring that new connections are not dropped by the kernel.

Fixes: #1045

NOTE: This PR cannot be merged right now because:
~~1) I'm waiting for my PRs to be merged in the netlink-packet-netfilter crate.~~ [DONE]
~~2) I have to write integration tests to test this functionality.~~ [DONE]
~~3) netlink-packet-netfilter new release~~

CC: @Luap99 @mheon

shivkr6 · 2025-11-19T08:52:47Z

The unit tests seem to be failing because conntrack-tools is not installed in CI/CD

shivkr6 · 2025-11-20T12:23:24Z

Finished writing the integration tests for flushing conntrack entries.

Question: Is it possible to install conntrack-tools in the CI/CD test environment? conntrack-tools is needed for some of the unit tests.
CC: @Luap99 @mheon

packit-as-a-service · 2025-11-20T12:25:48Z

Ephemeral COPR build failed. @containers/packit-build please check.

packit-as-a-service · 2025-11-20T12:25:48Z

Ephemeral COPR build failed. @containers/packit-build please check.

packit-as-a-service · 2025-11-20T12:25:49Z

Ephemeral COPR build failed. @containers/packit-build please check.

shivkr6 · 2025-11-20T12:29:40Z

I moved the conntrack entries flushing code to the end of all setup_port_forward and teardown_port_forward functions, instead of keeping it at the start, to avoid a potential race condition where a new conntrack entry is created after the flush but before the port forwarding rules are completely set up.

Luap99 · 2025-11-20T13:09:02Z

Question: Is it possible to install conntrack-tools in the CI/CD test environment? conntrack-tools is needed for some of the unit tests.

Yes we can do that. I make that happen.

Needed for containers/netavark#1362 Signed-off-by: Paul Holzinger <pholzing@redhat.com>

Luap99 · 2025-11-20T15:06:16Z

#1363 this should include conntrack now

(once that merges you can rebase)

Luap99 · 2025-11-20T17:40:49Z

#1363 was merged so CI should have access to conntrack I hope.

shivkr6 · 2025-11-20T18:08:59Z

~~I'll do the remaining changes tomorrow~~ Done.

mheon · 2025-11-21T13:19:57Z

I have an error message nit, but on the whole LGTM

Luap99 · 2025-11-21T15:44:54Z

 rand = "0.9.2"
 sha2 = "0.10.9"
 netlink-packet-route = "0.25.1"
+netlink-packet-netfilter = { git = "https://github.com/shivkr6/netlink-packet-netfilter.git", branch = "conntrack-new" }


just so it is not overlooked, we cannot merge this while the upstream lib isn't merged so I mark as changes requested

Luap99 · 2025-11-21T15:50:36Z

Forgot to say overall great work!

shivkr6 · 2025-11-23T17:55:34Z

I have no idea why the firewalld: receive udp traffic with pre-existing stale conntrack entry (range) test is failing even after successfully the flushing the conntrack entries. IDK why socat inside the container still cannot receive the udp traffic :(

Please help @Luap99 @mheon

shivkr6 · 2025-11-23T17:59:00Z

Forgot to say overall great work!

Thanks! The appreciation from you and Matt really keeps my motivation and confidence high

shivkr6 · 2025-11-24T07:07:21Z

It's extremely weird that the firewalld: receive udp traffic with pre-existing stale conntrack entry (range) integration test passes when I change the container_port from 8081 to 8080.
This passes successfully:

@test "firewalld: receive udp traffic with pre-existing stale conntrack entry (range)" {
    setup_firewalld
    export NETAVARK_FW="firewalld"
    # Explicitly add a rule to trigger connection tracking.
    run_in_host_netns firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -p udp -m state --state NEW -j ACCEPT
    run_ct_udp_flush_test "${TESTSDIR}/testfiles/bridge-udp-stale-conntrack-range.json" "127.0.0.1" "10081" "8080"
}

shivkr6 · 2025-11-24T17:57:58Z

I skipped the firewalld: receive udp traffic with pre-existing stale conntrack entry (range) test because port forwarding range seems to be broken with firewalld. All the traffic gets redirected to the first container port no matter which host range port you pick. It's not an issue related to conntrack.

mheon · 2025-11-24T19:07:31Z

Tests green, just waiting on that upstream library now. Nice work @shivkr6

shivkr6 · 2025-11-25T06:23:47Z

Thanks @mheon. The bigger PR, rust-netlink/netlink-packet-netfilter#12, got merged. The remaining smaller PRs yet to be merged are rust-netlink/netlink-packet-netfilter#14 and rust-netlink/netlink-packet-netfilter#15

CC @Luap99

polarathene · 2026-01-16T05:15:07Z

The remaining smaller PRs yet to be merged are rust-netlink/netlink-packet-netfilter#14 and rust-netlink/netlink-packet-netfilter#15

Those two appear to be merged now. Any other blockers?

EDIT: Crate needs to publish a new release, since there doesn't seem to be any activity there pushing that along I've opened an issue requesting that.

shivkr6 · 2026-01-16T06:08:27Z

@polarathene , the maintainer of the rust-netlink crates, said:
“I don't want to release the current codebase as a new version because I dislike the current Subsystem layout.”

He wants the subsystem layout of netlink-packet-netfilter to be similar to netlink-packet-route.
We had this discussion in the rust-netlink Matrix channel.

I’m open to doing the subsystem layout rewrite around February or March 2026; I have some exams right now.

polarathene · 2026-01-16T06:27:18Z

@polarathene , the maintainer of the rust-netlink crates, said:
“I don't want to release the current codebase as a new version because I dislike the current Subsystem layout.”

I don't see how that's a release blocker 🤔

0.3.0 / 0.2.1 could be released in the interim (it's been 2 years since that crate really saw any activity until your contributions)
New version bump for the subsystem layout refactor.

No worries though, thanks for chiming in with an update! 😁

Luap99 · 2026-01-20T14:14:56Z

@polarathene That is not up for us to decide but the maintainer of that crate though.

duck-rh · 2026-08-16T17:09:37Z

@shivkr6 just merged upstream \o/ 🎆

shivkr6 · 2026-08-16T17:11:43Z

@shivkr6 just merged upstream \o/ 🎆

Hi, I'll rebase the PR tomorrow and it should be ready to merge

frispete · 2026-08-21T15:13:17Z

Ohh, looks, like it still has serious troubles to compile...

I haven't looked at any rust code in my life before, but it seems, that the netavark rust interface does not fit the netlink-netfilter git code.

…rdown Add a new netlink_netfilter module to interact with the kernel's conntrack table using the netlink_packet_netfilter crate. This module allows dumping and deleting conntrack entries. All firewall drivers now call the new flush_udp_conntrack() function during port forwarding setup and teardown. When a container with a UDP port mapping is started, stale conntrack entries can prevent traffic from reaching the new container instance. This change proactively deletes these stale entries for the mapped UDP ports, ensuring that new connections are not dropped by the kernel. Added an integration test for the same and unit tests for dump_conntrack and del_conntrack. Fixes: containers#1045 Signed-off-by: Shivang K Raghuvanshi <shivangraghuvanshi2005@gmail.com>

shivkr6 · 2026-08-22T17:31:11Z

Should be ready to be merged @Luap99 @mheon

mheon · 2026-08-22T19:44:27Z

Looks like some of the testing-farm machines are missing the conntrack binary

mheon · 2026-08-22T19:45:02Z

I remain LGTM, though we should sort out the testing farm issues before we merge. TYVM @shivkr6

shivkr6 force-pushed the netlink-packet-netfilter branch from f61d2f3 to 0731a48 Compare November 20, 2025 12:20

shivkr6 force-pushed the netlink-packet-netfilter branch from 0731a48 to 82cb21c Compare November 20, 2025 12:25

shivkr6 force-pushed the netlink-packet-netfilter branch from 82cb21c to 86d1881 Compare November 20, 2025 12:49

Luap99 added a commit to Luap99/automation_images that referenced this pull request Nov 20, 2025

netavark: add conntrack-tools

cdf6a38

Needed for containers/netavark#1362 Signed-off-by: Paul Holzinger <pholzing@redhat.com>

shivkr6 force-pushed the netlink-packet-netfilter branch 4 times, most recently from 425517c to 107bf6b Compare November 20, 2025 13:42

Luap99 reviewed Nov 20, 2025

View reviewed changes

shivkr6 force-pushed the netlink-packet-netfilter branch from 107bf6b to e6104d8 Compare November 20, 2025 18:06

shivkr6 force-pushed the netlink-packet-netfilter branch 3 times, most recently from b07535a to bf8e6dc Compare November 21, 2025 06:31

shivkr6 requested a review from Luap99 November 21, 2025 07:44

mheon reviewed Nov 21, 2025

View reviewed changes

Comment thread src/network/netlink_netfilter.rs Outdated

Luap99 requested changes Nov 21, 2025

View reviewed changes

shivkr6 force-pushed the netlink-packet-netfilter branch from bf8e6dc to bcb10cb Compare November 23, 2025 17:52

shivkr6 force-pushed the netlink-packet-netfilter branch 2 times, most recently from 343b730 to 49b6f1d Compare November 24, 2025 17:45

polarathene mentioned this pull request Jan 16, 2026

New Release? rust-netlink/netlink-packet-netfilter#16

Closed

Luap99 mentioned this pull request Jul 30, 2026

teardown() sequence removes interface routes before flushing DNAT rules, causing packet leaks to default gateway #1482

Closed

shivkr6 force-pushed the netlink-packet-netfilter branch from 49b6f1d to c5e896f Compare August 21, 2026 06:55

shivkr6 force-pushed the netlink-packet-netfilter branch from c5e896f to 199f1e6 Compare August 22, 2026 17:27

shivkr6 marked this pull request as ready for review August 22, 2026 17:28

Uh oh!

Conversation

shivkr6 commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shivkr6 commented Nov 19, 2025

Uh oh!

shivkr6 commented Nov 20, 2025

Uh oh!

packit-as-a-service Bot commented Nov 20, 2025

Uh oh!

packit-as-a-service Bot commented Nov 20, 2025

Uh oh!

packit-as-a-service Bot commented Nov 20, 2025

Uh oh!

shivkr6 commented Nov 20, 2025

Uh oh!

Luap99 commented Nov 20, 2025

Uh oh!

Luap99 commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Luap99 commented Nov 20, 2025

Uh oh!

shivkr6 commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

mheon commented Nov 21, 2025

Uh oh!

Uh oh!

Luap99 Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Luap99 commented Nov 21, 2025

Uh oh!

shivkr6 commented Nov 23, 2025

Uh oh!

shivkr6 commented Nov 23, 2025

Uh oh!

shivkr6 commented Nov 24, 2025

Uh oh!

shivkr6 commented Nov 24, 2025

Uh oh!

mheon commented Nov 24, 2025

Uh oh!

shivkr6 commented Nov 25, 2025

Uh oh!

polarathene commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shivkr6 commented Jan 16, 2026

Uh oh!

polarathene commented Jan 16, 2026

Uh oh!

Luap99 commented Jan 20, 2026

Uh oh!

duck-rh commented Aug 16, 2026

Uh oh!

shivkr6 commented Aug 16, 2026

Uh oh!

frispete commented Aug 21, 2026

Uh oh!

shivkr6 commented Aug 22, 2026

Uh oh!

mheon commented Aug 22, 2026

Uh oh!

mheon commented Aug 22, 2026

Uh oh!

Reviewers

Assignees

shivkr6 commented Nov 18, 2025 •

edited

Loading

Luap99 commented Nov 20, 2025 •

edited

Loading

shivkr6 commented Nov 20, 2025 •

edited

Loading

polarathene commented Jan 16, 2026 •

edited

Loading