1

This /usr/sbin/conntrack -L |grep $1 | grep ESTAB |grep 'dport=80' | awk "{system("/usr/sbin/conntrack -D --orig-src $1 --orig-dst" substr($6,5) "-p tcp --orig-port-src " substr($7,7)" --orig-port-dst 80");}"

gives this output
awk: cmd. line:2: {system(/usr/sbin/conntrack awk: cmd. line:2: ^ unexpected newline or end of string

I need to debug this.

1
  • fun fact, the whole grep ESTAB |grep 'dport=80' | awk ' construct could be replaced with awk '/ESTAB/&&/dport=80/ – steve Sep 24 '17 at 16:38
1

Your awk script:

awk "{system("/usr/sbin/conntrack -D --orig-src $1 --orig-dst" substr($6,5) "-p tcp --orig-port-src " substr($7,7)" --orig-port-dst 80")}"

The script has an issue with quoting:

The script is in double quotes, and it also uses double quotes. The internal double quotes will cause problems.

The solution is to write the script in single quotes (awk scripts should always be in single quotes anyway so that $0 etc. is not interpreted by the shell):

awk '{system("/usr/sbin/conntrack -D --orig-src " $1 " --orig-dst " substr($6,5) " -p tcp --orig-port-src " substr($7,7) " --orig-port-dst 80")}'

You may also easily move the last two grep calls you're doing into the awk script:

awk '/ESTAB/ && /dport=80/ {system("/usr/sbin/conntrack -D --orig-src " $1 " --orig-dst " substr($6,5) " -p tcp --orig-port-src " substr($7,7) " --orig-port-dst 80");}'

And with a bit more work, you can get the first one in there as well:

awk -v arg1="$1" 'match($0, arg1) && /ESTAB/ && /dport=80/ {system("/usr/sbin/conntrack -D --orig-src " $1 " --orig-dst " substr($6,5) " -p tcp --orig-port-src " substr($7,7) " --orig-port-dst 80")}'
6
  • Now, conntrack says [code]Invalid IP address `--orig-dst'[/code] – Dudus Sep 25 '17 at 12:40
  • @DudusBlack It looks like --orig-src $1 --orig-dst should be --orig-src " $1 " --orig-dst. Further than that, I don't know. conntrack is an unknown command for me. – Kusalananda Sep 25 '17 at 12:42
  • @DudusBlack You may also want to make sure that you get the other spaces right in the string. For example --orig-dist " rather than --orig-dist". – Kusalananda Sep 25 '17 at 12:43
  • Thanks. They should have a "thumbs up". You're great help. It probably would have cost me a day and some hair. – Dudus Sep 25 '17 at 13:12
  • @DudusBlack Upvoting and/or accepting the answer is more than enough :-) – Kusalananda Sep 25 '17 at 13:15
0

If you want to delete the conntrack TCP entries that have a source IP address of $1 (the first parameter to your script), an original destination port 80 and an ESTABLISHED state, that should just be:

conntrack -D -s "$1" -p tcp --dport 80 --state ESTABLISHED

beside the issues already mentioned, your approach would match on lines that have dport=8080 as well or lines that have dport=80 in the reply-to dst. And $1 in "--orig-src " $1 would be the first field in the line as expanded by awk, not the first argument of the script. Also, grep 10.1.1.4 would match on 10.1.1.40 and 10.101.4.5 even with grep -w (. as a regexp operator matches any character, and is not a word character).

If conntrack didn't have the ability to filter entries by itself, you'd rather do something like:

conntrack -L | SRC=$1 awk '
  $1 == "tcp" && \
  $4 == "ESTABLISHED" && \
  $5 == "src=" ENVIRON["SRC"] && \
  $8 == "dport=80" {
    dst = substr($6, 5)
    sport = substr($7, 7)
    system("conntrack -D -s \"$SRC\" -d "dst" --dport 80 --sport "sport)
  }'

Or to avoid running one sh command per entry to delete (in addition to one conntrack command):

conntrack -L | SRC=$1 awk '
  $1 == "tcp" && \
  $4 == "ESTABLISHED" && \
  $5 == "src=" ENVIRON["SRC"] && \
  $8 == "dport=80" {
    dst = substr($6, 5)
    sport = substr($7, 7)
    print "conntrack -D -s \"$SRC\" -d "dst" --dport 80 --sport "sport
  }' | sh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.