Merge tag 'nf-26-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Add a workaround to avoid a possible crash if nf_nat and nft_chain_nat are compiled built-in and nf_nat fails to register, allowing nft_chain_nat to access the incorrect pernetns area. This is crash specific of all built-in compilation. From Matias Krause. 2) Revisit conncount GC optimization for confirmed conntracks, skip GC round if IPS_ASSURED is set on. This is addressing an issue for corner case use case scenario involving locally generated traffic. No crash, just a functionality fix. From Fernando F. Mancera. 3) Validate iph->ihl in flowtable IPIP tunnel support, from Lorenzo Bianconi. This a sanity check to bounces back malformed IPIP packets to classic forwarding path. 4) Kdoc fixes for x_tables.h, from Randy Dunlap. 5) Use info->options so nft_synproxy_tcp_options() stays on the same local snapshot, otherwise eval path can observe inconsistent mix of mss and timestamps. From Runyu Xiao. 6) Add conntrack_sctp_collision.sh to cover for SCTP INIT collisions. From Yi Chen. 7) Do not allow NFPROTO_UNSPEC targets if family is NFPROTO_BRIDGE in nft_compat. This allows to use non-sense targets such as xt_nat leading to crash. From Florian Westphal. 8) Add a selftest queueing from bridge family. From Florian Westphal. 9) Do not allow to reset a conntrack helper via ctnetlink. This feature antedates the creation of the conntrack-tools, and it is not used I don't have a usecase for it, I prefer to remove than fixing it. 10) Add deprecation warning for IPv4 only conntrack helpers for PPTP and IRC. From Florian Westphal. 11) Store the master tuple in the expectation object and use it, otherwise SLAB_TYPESAFE_RCU rules allow to display incorrect master tuple information through ctnetlink. 12) Run expectation eviction when inserting an expectation with no helper, this is a fix for the nft_ct custom expectation support. 13) Fix nft_ct custom expectation timeouts, userspace provides a timeout in milliseconds but kernel assumes this comes in seconds. From Florian Westphal. 14) Cap maximum number of expectations per class to 255 expectations per master conntrack at helper registration. This is a fix to restrict the maximum number of expectations per master conntrack which can be a issue for the new lazy GC expectation approach. * tag 'nf-26-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration netfilter: nft_ct: expectation timeouts are passed in milliseconds netfilter: nf_conntrack_expect: run expectation eviction with no helper netfilter: nf_conntrack_expect: store master_tuple in expectation netfilter: conntrack: add deprecation warnings for irc and pptp trackers netfilter: ctnetlink: do not allow to reset helper on existing conntrack selftests: nft_queue.sh: add a bridge queue test netfilter: nft_compat: ebtables emulation must reject non-bridge targets selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test netfilter: nft_synproxy: stop bypassing the priv->info snapshot netfilter: x_tables.h: fix all kernel-doc warnings netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() netfilter: nf_conncount: prevent connlimit drops for early confirmed ct netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() ====================

Jakub Kicinski committed 4 months ago

Commit 02f144f2 parents 620839b 397c83018 files · +246 −86Browse files

Unified · Split

18 files

include/linux/netfilter/x_tables.h +21 −8
include/net/netfilter/nf_conntrack_expect.h +1 −0
include/net/netfilter/nf_conntrack_helper.h +4 −0
net/netfilter/Kconfig +6 −5
net/netfilter/nf_conncount.c +5 −6
net/netfilter/nf_conntrack_broadcast.c +1 −0
net/netfilter/nf_conntrack_expect.c +10 −2
net/netfilter/nf_conntrack_helper.c +7 −2
net/netfilter/nf_conntrack_irc.c +2 −0
net/netfilter/nf_conntrack_netlink.c +4 −19
net/netfilter/nf_conntrack_pptp.c +2 −0
net/netfilter/nf_flow_table_ip.c +5 −3
net/netfilter/nf_nat_core.c +10 −0
net/netfilter/nft_compat.c +21 −3
net/netfilter/nft_ct.c +18 −3
net/netfilter/nft_synproxy.c +4 −5
tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh +67 −22
tools/testing/selftests/net/netfilter/nft_queue.sh +58 −8

include/linux/netfilter/x_tables.h+21−8

  * @match:	the match extension
  * @target:	the target extension
  * @matchinfo:	per-match data
- * @targetinfo:	per-target data
+ * @targinfo:	per-target data
  * @state:	pointer to hook state this packet came from
  * @fragoff:	packet is a fragment, this is the data offset
  * @thoff:	position of transport header relative to skb->data
  * @match:	struct xt_match through which this function was invoked
  * @matchinfo:	per-match data
  * @hook_mask:	via which hooks the new rule is reachable
- * Other fields as above.
+ * @family:	actual NFPROTO_* through which the function is invoked
+ *		(helpful when match->family == NFPROTO_UNSPEC)
+ * @nft_compat:	running from the nft compat layer if true
  */
 struct xt_mtchk_param {
 	struct net *net;
 };
 /**
- * struct xt_mdtor_param - match destructor parameters
+ * struct xt_mtdtor_param - match destructor parameters
- * Fields as above.
+ *
+ * @net:	network namespace through which the check was invoked
+ * @match:	struct xt_match through which this function was invoked
+ * @matchinfo:	per-match data
+ * @family:	actual NFPROTO_* through which the function is invoked
+ *		(helpful when match->family == NFPROTO_UNSPEC)
  */
 struct xt_mtdtor_param {
 	struct net *net;
  * struct xt_tgchk_param - parameters for target extensions'
  * checkentry functions
  *
+ * @net:	network namespace through which the check was invoked
+ * @table:	table the rule is tried to be inserted into
  * @entryinfo:	the family-specific rule data
  * 		(struct ipt_entry, ip6t_entry, arpt_entry, ebt_entry)
- *
+ * @target:	the target extension
- * Other fields see above.
+ * @targinfo:	per-target data
+ * @hook_mask:	via which hooks the new rule is reachable
+ * @family:	actual NFPROTO_* through which the function is invoked
+ *		(helpful when match->family == NFPROTO_UNSPEC)
+ * @nft_compat:	running from the nft compat layer if true
  */
 struct xt_tgchk_param {
 	struct net *net;
 void xt_free_table_info(struct xt_table_info *info);
 /**
- * xt_recseq - recursive seqcount for netfilter use
+ * var xt_recseq - recursive seqcount for netfilter use
  *
- * Packet processing changes the seqcount only if no recursion happened
+ * Packet processing changes the seqcount only if no recursion happened.
  * get_counters() can use read_seqcount_begin()/read_seqcount_retry(),
  * because we use the normal seqcount convention :
  * Low order bit set to 1 if a writer is active.

include/net/netfilter/nf_conntrack_expect.h+1−0

@@ -26,6 +26,7 @@ struct nf_conntrack_expect { · 25 unmodified lines
26	possible_net_t net;	26	possible_net_t net;
27		27
28	/* We expect this tuple, with the following mask */	28	/* We expect this tuple, with the following mask */
		29	struct nf_conntrack_tuple master_tuple;
29	struct nf_conntrack_tuple tuple;	30	struct nf_conntrack_tuple tuple;
30	struct nf_conntrack_tuple_mask mask;	31	struct nf_conntrack_tuple_mask mask;
31		32

include/net/netfilter/nf_conntrack_helper.h+4−0

@@ -114,6 +114,10 @@ int nf_conntrack_helpers_register(struct nf_conntrack_helper *, unsigned int, · 113 unmodified lines
114	void nf_conntrack_helpers_unregister(struct nf_conntrack_helper **,	114	void nf_conntrack_helpers_unregister(struct nf_conntrack_helper **,
115	unsigned int);	115	unsigned int);
116		116
		117	#define nf_conntrack_helper_deprecated(name) \
		118	pr_warn("The %s conntrack helper is scheduled for removal.\n" \
		119	"Please contact the netfilter-devel mailing list if you still need this.\n", name)
		120
117	struct nf_conn_help nf_ct_helper_ext_add(struct nf_conn ct, gfp_t gfp);	121	struct nf_conn_help nf_ct_helper_ext_add(struct nf_conn ct, gfp_t gfp);
118		122
119	int __nf_ct_try_assign_helper(struct nf_conn ct, struct nf_conn tmpl,	123	int __nf_ct_try_assign_helper(struct nf_conn ct, struct nf_conn tmpl,

net/netfilter/Kconfig+6−5

 	  To compile it as a module, choose M here.  If unsure, say N.
 config NF_CONNTRACK_IRC
-	tristate "IRC protocol support"
+	tristate "IRC DCC protocol support (obsolete)"
-	default m if NETFILTER_ADVANCED=n
 	help
 	  There is a commonly-used extension to IRC called
 	  Direct Client-to-Client Protocol (DCC).  This enables users to send
 	  using NAT, this extension will enable you to send files and initiate
 	  chats.  Note that you do NOT need this extension to get files or
 	  have others initiate chats, or everything else in IRC.
+	  DCC tracking behind NAT requires plaintext (unencrypted) IRC, so
+	  this helper is of limited use these days.
 	  To compile it as a module, choose M here.  If unsure, say N.
 	  To compile it as a module, choose M here.  If unsure, say N.
 config NF_CONNTRACK_PPTP
-	tristate "PPtP protocol support"
+	tristate "PPtP protocol support (deprecated)"
 	depends on NETFILTER_ADVANCED
 	select NF_CT_PROTO_GRE
 	help
 	  This module adds support for PPTP (Point to Point Tunnelling
 	  Protocol, RFC2637) connection tracking and NAT.
-	  If you are running PPTP sessions over a stateful firewall or NAT
+	  If you are still running PPTP sessions over a stateful firewall or NAT
 	  box, you may want to enable this feature.
-	  Please note that not all PPTP modes of operation are supported yet.
+	  Please note that not all PPTP modes of operation are supported.
 	  Specifically these limitations exist:
 	    - Blindly assumes that control connections are always established
 	      in PNS->PAC direction. This is a violation of RFC2637.

net/netfilter/nf_conncount.c+5−6

 		return -ENOENT;
 	if (ct && nf_ct_is_confirmed(ct)) {
-		/* local connections are confirmed in postrouting so confirmation
+		/* Connection is confirmed but might still be in the setup phase.
-		 * might have happened before hitting connlimit
+		 * Only skip the tracking if it is fully assured. This guarantees
+		 * that setup packets or retransmissions are properly counted and
+		 * deduplicated.
 		 */
-		if (skb->skb_iif != LOOPBACK_IFINDEX) {
+		if (test_bit(IPS_ASSURED_BIT, &ct->status)) {
 			err = -EEXIST;
 			goto out_put;
 		}
-		/* this is likely a local connection, skip optimization to avoid
-		 * adding duplicates from a 'packet train'
-		 */
 		goto check_connections;
 	}

net/netfilter/nf_conntrack_broadcast.c+1−0

@@ -62,6 +62,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, · 61 unmodified lines
62	if (exp == NULL)	62	if (exp == NULL)
63	goto out;	63	goto out;
64		64
		65	exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
65	exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;	66	exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
66		67
67	helper = rcu_dereference(help->helper);	68	helper = rcu_dereference(help->helper);

net/netfilter/nf_conntrack_expect.c+10−2

 	exp->tuple.src.l3num = family;
 	exp->tuple.dst.protonum = proto;
+	exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 	if (saddr) {
 		memcpy(&exp->tuple.src.u3, saddr, len);
 		if (sizeof(exp->tuple.src.u3) > len)
 					   lockdep_is_held(&nf_conntrack_expect_lock));
 	if (helper) {
 		p = &helper->expect_policy[expect->class];
-		if (p->max_expected &&
+		if (master_help->expecting[expect->class] >= p->max_expected)
-		    master_help->expecting[expect->class] >= p->max_expected)
 			evict_oldest_expect(master_help, expect, p);
+	} else {
+		const struct nf_conntrack_expect_policy default_exp_policy = {
+			.max_expected = NF_CT_EXPECT_MAX_CNT,
+		};
+		if (master_help->expecting[expect->class] >= default_exp_policy.max_expected)
+			evict_oldest_expect(master_help, expect, &default_exp_policy);
 	}
 	cnet = nf_ct_pernet(net);

net/netfilter/nf_conntrack_helper.c+7−2

 	if (!nf_ct_helper_hash)
 		return -ENOENT;
-	if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
+	for (i = 0; i <= me->expect_class_max; i++) {
-		return -EINVAL;
+		if (!me->expect_policy[i].max_expected)
+			me->expect_policy[i].max_expected = NF_CT_EXPECT_MAX_CNT;
+		if (me->expect_policy[i].max_expected > NF_CT_EXPECT_MAX_CNT)
+			return -EINVAL;
+	}
 	mutex_lock(&nf_ct_helper_mutex);
 	for (i = 0; i < nf_ct_helper_hsize; i++) {

net/netfilter/nf_conntrack_irc.c+2−0

@@ -262,6 +262,8 @@ static int __init nf_conntrack_irc_init(void) · 261 unmodified lines
262	{	262	{
263	int i, ret;	263	int i, ret;
264		264
		265	nf_conntrack_helper_deprecated(HELPER_NAME);
		266
265	if (max_dcc_channels < 1) {	267	if (max_dcc_channels < 1) {
266	pr_err("max_dcc_channels must not be zero\n");	268	pr_err("max_dcc_channels must not be zero\n");
267	return -EINVAL;	269	return -EINVAL;

net/netfilter/nf_conntrack_netlink.c+4−19

 		return err;
 	}
-	if (!strcmp(helpname, "") && help) {
-		helper = rcu_dereference(help->helper);
-		if (helper) {
-			/* we had a helper before ... */
-			nf_ct_remove_expectations(ct);
-			RCU_INIT_POINTER(help->helper, NULL);
-			if (refcount_dec_and_test(&helper->ct_refcnt))
-				kfree_rcu(helper, rcu);
-		}
-		rcu_read_unlock();
-		return 0;
-	}
 	helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
 					    nf_ct_protonum(ct));
 	if (helper == NULL) {
 			  const struct nf_conntrack_expect *exp)
 {
 	__s32 timeout = (__s32)(READ_ONCE(exp->timeout) - nfct_time_stamp) / HZ;
-	struct nf_conn *master = exp->master;
 	struct nf_conntrack_helper *helper;
 #if IS_ENABLED(CONFIG_NF_NAT)
 	struct nlattr *nest_parms;
 		goto nla_put_failure;
 	if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
 		goto nla_put_failure;
-	if (ctnetlink_exp_dump_tuple(skb,
+	if (ctnetlink_exp_dump_tuple(skb, &exp->master_tuple, CTA_EXPECT_MASTER) < 0)
-				 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
-				 CTA_EXPECT_MASTER) < 0)
 		goto nla_put_failure;
 #if IS_ENABLED(CONFIG_NF_NAT)
 		if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))
 			goto nla_put_failure;
-		nat_tuple.src.l3num = nf_ct_l3num(master);
+		nat_tuple.src.l3num = exp->master_tuple.src.l3num;
 		nat_tuple.src.u3 = exp->saved_addr;
-		nat_tuple.dst.protonum = nf_ct_protonum(master);
+		nat_tuple.dst.protonum = exp->master_tuple.dst.protonum;
 		nat_tuple.src.u = exp->saved_proto;
 		if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,
 #endif
 	rcu_assign_pointer(exp->helper, helper);
 	rcu_assign_pointer(exp->assign_helper, assign_helper);
+	exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 	exp->tuple = *tuple;
 	exp->mask.src.u3 = mask->src.u3;
 	exp->mask.src.u.all = mask->src.u.all;

net/netfilter/nf_conntrack_pptp.c+2−0

@@ -545,6 +545,8 @@ static int __init nf_conntrack_pptp_init(void) · 544 unmodified lines
545		545
546	pptp.destroy = gre_pptp_destroy_siblings;	546	pptp.destroy = gre_pptp_destroy_siblings;
547		547
		548	nf_conntrack_helper_deprecated(pptp.name);
		549
548	return nf_conntrack_helper_register(&pptp, &pptp_ptr);	550	return nf_conntrack_helper_register(&pptp, &pptp_ptr);
549	}	551	}
550		552

net/netfilter/nf_flow_table_ip.c+5−3

 		return false;
 	iph = (struct iphdr *)(skb_network_header(skb) + ctx->offset);
-	size = iph->ihl << 2;
+	if (iph->ihl < 5)
+		return false;
+	size = iph->ihl << 2;
 	if (ip_is_fragment(iph) || unlikely(ip_has_options(size)))
 		return false;
 		return false;
 	if (iph->protocol == IPPROTO_IPIP) {
-		ctx->tun.proto = IPPROTO_IPIP;
+		ctx->tun.proto = iph->protocol;
 		ctx->tun.hdr_size = size;
-		ctx->offset += size;
+		ctx->offset += ctx->tun.hdr_size;
 	}
 	return true;

net/netfilter/nf_nat_core.c+10−0

@@ -1181,6 +1181,16 @@ int nf_nat_register_fn(struct net net, u8 pf, const struct nf_hook_ops ops, · 1180 unmodified lines
1181	struct nf_hook_ops *nat_ops;	1181	struct nf_hook_ops *nat_ops;
1182	int i, ret;	1182	int i, ret;
1183		1183
		1184	#ifndef MODULE
		1185	/* If nf_nat_core is built-in and nf_nat_init() fails, dependent
		1186	* modules like nft_chain_nat.ko may still call this function.
		1187	* However, nat_net would be invalid, likely pointing to some other
		1188	* per-net structure.
		1189	*/
		1190	if (WARN_ON_ONCE(!nf_nat_hook))
		1191	return -EOPNOTSUPP;
		1192	#endif
		1193
1184	if (WARN_ON_ONCE(pf >= ARRAY_SIZE(nat_net->nat_proto_net)))	1194	if (WARN_ON_ONCE(pf >= ARRAY_SIZE(nat_net->nat_proto_net)))
1185	return -EINVAL;	1195	return -EINVAL;
1186		1196

net/netfilter/nft_compat.c+21−3

 	return 0;
 }
+static int nft_target_bridge_validate(const struct nft_ctx *ctx,
+				      const struct nft_expr *expr)
+{
+	struct xt_target *target = expr->ops->data;
+	/* Do not allow UNSPEC to stand-in for NFPROTO_BRIDGE
+	 * targets: they are incompatible.  ebtables targets return
+	 * EBT_ACCEPT, DROP and so on which are not compatible with
+	 * NF_ACCEPT, NF_DROP and so on.
+	 */
+	if (target->family != NFPROTO_BRIDGE)
+		return -ENOENT;
+	return nft_target_validate(ctx, expr);
+}
 static void __nft_match_eval(const struct nft_expr *expr,
 			     struct nft_regs *regs,
 			     const struct nft_pktinfo *pkt,
 	ops->init = nft_target_init;
 	ops->destroy = nft_target_destroy;
 	ops->dump = nft_target_dump;
-	ops->validate = nft_target_validate;
 	ops->data = target;
-	if (family == NFPROTO_BRIDGE)
+	if (family == NFPROTO_BRIDGE) {
 		ops->eval = nft_target_eval_bridge;
-	else
+		ops->validate = nft_target_bridge_validate;
+	} else {
 		ops->eval = nft_target_eval_xt;
+		ops->validate = nft_target_validate;
+	}
 	return ops;
 err:

net/netfilter/nft_ct.c+18−3

 	u32		timeout;
 };
+static int nft_ct_expect_timeout_get(const struct nlattr *attr, u32 *val)
+{
+	unsigned long jiffies_val = msecs_to_jiffies(nla_get_u32(attr));
+	if (jiffies_val > UINT_MAX)
+		return -ERANGE;
+	*val = jiffies_val;
+	return 0;
+}
 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
 				  const struct nlattr * const tb[],
 				  struct nft_object *obj)
 {
 	struct nft_ct_expect_obj *priv = nft_obj_data(obj);
+	int err;
 	if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
 	    !tb[NFTA_CT_EXPECT_DPORT] ||
 		return -EOPNOTSUPP;
 	}
+	err = nft_ct_expect_timeout_get(tb[NFTA_CT_EXPECT_TIMEOUT], &priv->timeout);
+	if (err)
+		return err;
 	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
-	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
 	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
 	return nf_ct_netns_get(ctx->net, ctx->family);
 	if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
 	    nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
 	    nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
-	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
+	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, jiffies_to_msecs(priv->timeout)) ||
 	    nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
 		return -1;
 		          &ct->tuplehash[!dir].tuple.src.u3,
 		          &ct->tuplehash[!dir].tuple.dst.u3,
 		          priv->l4proto, NULL, &priv->dport);
-	exp->timeout += priv->timeout * HZ;
+	exp->timeout += priv->timeout;
 	if (nf_ct_expect_related(exp, 0) != 0)
 		regs->verdict.code = NF_DROP;

net/netfilter/nft_synproxy.c+4−5

 static void nft_synproxy_tcp_options(struct synproxy_options *opts,
 				     const struct tcphdr *tcp,
 				     struct synproxy_net *snet,
-				     struct nf_synproxy_info *info,
+				     struct nf_synproxy_info *info)
-				     const struct nft_synproxy *priv)
 {
 	this_cpu_inc(snet->stats->syn_received);
 	if (tcp->ece && tcp->cwr)
 		opts->options |= NF_SYNPROXY_OPT_ECN;
-	opts->options &= priv->info.options;
+	opts->options &= info->options;
 	opts->mss_encode = opts->mss_option;
 	opts->mss_option = info->mss;
 	if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
 	if (tcp->syn) {
 		/* Initial SYN from client */
-		nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
+		nft_synproxy_tcp_options(opts, tcp, snet, &info);
 		synproxy_send_client_synack(net, skb, tcp, opts);
 		consume_skb(skb);
 		regs->verdict.code = NF_STOLEN;
 	if (tcp->syn) {
 		/* Initial SYN from client */
-		nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
+		nft_synproxy_tcp_options(opts, tcp, snet, &info);
 		synproxy_send_client_synack_ipv6(net, skb, tcp, opts);
 		consume_skb(skb);
 		regs->verdict.code = NF_STOLEN;

tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh+67−22

@@ -2,18 +2,32 @@ · 1 unmodified line
2	# SPDX-License-Identifier: GPL-2.0	2	# SPDX-License-Identifier: GPL-2.0
3	#	3	#
4	# Testing For SCTP COLLISION SCENARIO as Below:	4	# Testing For SCTP COLLISION SCENARIO as Below:
5	#	5	# 1. Stale INIT_ACK capture:
6	# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]	6	# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]
7	# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]	7	# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]
8	# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]	8	# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]
9	# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]	9	# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]
10	# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]	10	# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]
11	# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]	11	# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]
		12	# (Delayed)
		13	#
		14	# 2. Stale INIT capture:
		15	# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]
		16	# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]
		17	# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]
		18	# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]
		19	# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]
		20	# (Delayed)
		21	# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]
12	#	22	#
13	# TOPO: SERVER_NS (link0)<--->(link1) ROUTER_NS (link2)<--->(link3) CLIENT_NS	23	# TOPO: SERVER_NS (link0)<--->(link1) ROUTER_NS (link2)<--->(link3) CLIENT_NS
14		24
15	source lib.sh	25	source lib.sh
16		26
		27	checktool "nft --version" "run test without nft"
		28	checktool "tc -h" "run test without tc"
		29	checktool "modprobe -q sctp" "load sctp module"
		30
17	CLIENT_IP="198.51.200.1"	31	CLIENT_IP="198.51.200.1"
18	CLIENT_PORT=1234	32	CLIENT_PORT=1234
19		33
@@ -24,7 +38,8 @@ CLIENT_GW="198.51.200.2" · 4 unmodified lines
24	SERVER_GW="198.51.100.2"	38	SERVER_GW="198.51.100.2"
25		39
26	# setup the topo	40	# setup the topo
27	setup() {	41	topo_setup() {
		42	# setup_ns cleans up existing net namespaces first.
28	setup_ns CLIENT_NS SERVER_NS ROUTER_NS	43	setup_ns CLIENT_NS SERVER_NS ROUTER_NS
29	ip -n "$SERVER_NS" link add link0 type veth peer name link1 netns "$ROUTER_NS"	44	ip -n "$SERVER_NS" link add link0 type veth peer name link1 netns "$ROUTER_NS"
30	ip -n "$CLIENT_NS" link add link3 type veth peer name link2 netns "$ROUTER_NS"	45	ip -n "$CLIENT_NS" link add link3 type veth peer name link2 netns "$ROUTER_NS"
@@ -38,35 +53,53 @@ setup() { · 7 unmodified lines
38	ip -n "$ROUTER_NS" addr add $SERVER_GW/24 dev link1	53	ip -n "$ROUTER_NS" addr add $SERVER_GW/24 dev link1
39	ip -n "$ROUTER_NS" addr add $CLIENT_GW/24 dev link2	54	ip -n "$ROUTER_NS" addr add $CLIENT_GW/24 dev link2
40	ip net exec "$ROUTER_NS" sysctl -wq net.ipv4.ip_forward=1	55	ip net exec "$ROUTER_NS" sysctl -wq net.ipv4.ip_forward=1
		56	sysctl -wq net.netfilter.nf_log_all_netns=1
41		57
42	ip -n "$CLIENT_NS" link set link3 up	58	ip -n "$CLIENT_NS" link set link3 up
43	ip -n "$CLIENT_NS" addr add $CLIENT_IP/24 dev link3	59	ip -n "$CLIENT_NS" addr add $CLIENT_IP/24 dev link3
44	ip -n "$CLIENT_NS" route add $SERVER_IP dev link3 via $CLIENT_GW	60	ip -n "$CLIENT_NS" route add $SERVER_IP dev link3 via $CLIENT_GW
		61	}
		62
		63	conf_delay()
		64	{
		65	# simulate the delay on OVS upcall by setting up a delay for INIT_ACK/INIT with
		66	local ns=$1
		67	local link=$2
		68	local chunk_type=$3
45		69
46	# simulate the delay on OVS upcall by setting up a delay for INIT_ACK with	70	# use a smaller number for assoc's max_retrans to reproduce the issue
47	# tc on $SERVER_NS side	71	ip net exec "$CLIENT_NS" sysctl -wq net.sctp.association_max_retrans=3
48	tc -n "$SERVER_NS" qdisc add dev link0 root handle 1: htb r2q 64	72
49	tc -n "$SERVER_NS" class add dev link0 parent 1: classid 1:1 htb rate 100mbit	73	tc -n "$ns" qdisc add dev "$link" root handle 1: htb r2q 64
50	tc -n "$SERVER_NS" filter add dev link0 parent 1: protocol ip u32 match ip protocol 132 \	74	tc -n "$ns" class add dev "$link" parent 1: classid 1:1 htb rate 100mbit
51	0xff match u8 2 0xff at 32 flowid 1:1	75	tc -n "$ns" filter add dev "$link" parent 1: protocol ip \
52	if ! tc -n "$SERVER_NS" qdisc add dev link0 parent 1:1 handle 10: netem delay 1200ms; then	76	u32 match ip protocol 132 0xff match u8 "$chunk_type" 0xff at 32 flowid 1:1
		77	if ! tc -n "$ns" qdisc add dev "$link" parent 1:1 handle 10: netem delay 1200ms; then
53	echo "SKIP: Cannot add netem qdisc"	78	echo "SKIP: Cannot add netem qdisc"
54	exit $ksft_skip	79	return $ksft_skip
55	fi	80	fi
56		81
57	# simulate the ctstate check on OVS nf_conntrack	82	# simulate the ctstate check on OVS nf_conntrack
58	ip net exec "$ROUTER_NS" iptables -A FORWARD -m state --state INVALID,UNTRACKED -j DROP	83	ip net exec "$ROUTER_NS" nft -f - <<-EOF
59	ip net exec "$ROUTER_NS" iptables -A INPUT -p sctp -j DROP	84	table ip t {
60		85	chain forward {
61	# use a smaller number for assoc's max_retrans to reproduce the issue	86	type filter hook forward priority filter; policy accept;
62	modprobe -q sctp	87	meta l4proto icmp counter accept
63	ip net exec "$CLIENT_NS" sysctl -wq net.sctp.association_max_retrans=3	88	ct state new counter accept
		89	ct state established,related counter accept
		90	ct state invalid log flags all counter drop comment \
		91	"Expect to drop stale INIT/INIT_ACK chunks"
		92	counter
		93	}
		94	}
		95	EOF
		96	return 0
64	}	97	}
65		98
66	cleanup() {	99	cleanup() {
67	ip net exec "$CLIENT_NS" pkill sctp_collision >/dev/null 2>&1	100	# cleanup_all_ns terminates running processes in the namespaces.
68	ip net exec "$SERVER_NS" pkill sctp_collision >/dev/null 2>&1
69	cleanup_all_ns	101	cleanup_all_ns
		102	sysctl -wq net.netfilter.nf_log_all_netns=0
70	}	103	}
71		104
72	do_test() {	105	do_test() {
@@ -81,7 +114,19 @@ do_test() { · 8 unmodified lines
81		114
82	# run the test case	115	# run the test case
83	trap cleanup EXIT	116	trap cleanup EXIT
84	setup && \	117
85	echo "Test for SCTP Collision in nf_conntrack:" && \	118	echo "Test for SCTP INIT_ACK Collision in nf_conntrack:"
86	do_test && echo "PASS!"	119	topo_setup \|\| exit $?
87	exit $?	120	conf_delay $SERVER_NS link0 2 \|\| exit $?
		121
		122	if ! do_test; then
		123	exit $ksft_fail
		124	fi
		125
		126	echo "Test for SCTP INIT Collision in nf_conntrack:"
		127	topo_setup \|\| exit $?
		128	conf_delay $CLIENT_NS link3 1 \|\| exit $?
		129
		130	if ! do_test; then
		131	exit $ksft_fail
		132	fi

tools/testing/selftests/net/netfilter/nft_queue.sh+58−8

 ip -net "$ns3" route add default via dead:3::1
 load_ruleset() {
-	local name=$1
+	local family=$1
-	local prio=$2
+	local name=$2
+	local prio=$3
 ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF
-table inet $name {
+table $family $name {
 	chain nfq {
 		ip protocol icmp queue bypass
 		icmpv6 type { "echo-request", "echo-reply" } queue num 1 bypass
 test_queue()
 {
 	local expected="$1"
+	local family="$2"
 	local last=""
 	# spawn nf_queue listeners
 		if [ x"$last" != x"$expected packets total" ]; then
 			echo "FAIL: Expected $expected packets total, but got $last" 1>&2
 			ip netns exec "$nsrouter" nft list ruleset
+			echo -n "$TMPFILE0: ";cat "$TMPFILE0"
+			echo -n "$TMPFILE1: ";cat "$TMPFILE1"
 			exit 1
 		fi
 	done
-	echo "PASS: Expected and received $last"
+	echo "PASS: Expected and received $last ($family)"
 }
 listener_ready()
 	kill "$nfqpid"
 	echo "PASS: icmp+nfqueue via vrf"
+	ip -net "$ns1" link del tvrf
+	ip netns exec "$ns1" nft flush ruleset
 }
 sctp_listener_ready()
 	check_tainted "queue program exiting while packets queued"
 }
+test_queue_bridge()
+{
+	ip -net "$nsrouter" addr flush dev veth0
+	ip -net "$nsrouter" addr flush dev veth1
+	ip -net "$nsrouter" link add br0 type bridge
+	ip -net "$nsrouter" link set veth0 master br0
+	ip -net "$nsrouter" link set veth1 master br0
+	ip -net "$nsrouter" link set br0 up
+	ip -net "$nsrouter" addr add 10.0.2.1/16 dev br0
+	ip -net "$nsrouter" addr add dead:2::1/64 dev br0 nodad
+	ip -net "$ns1" addr flush dev eth0
+	ip -net "$ns2" addr flush dev eth0
+	ip -net "$ns1" addr add 10.0.1.1/16 dev eth0
+	ip -net "$ns1" addr add dead:2::2/64 dev eth0 nodad
+	ip -net "$ns2" addr add 10.0.2.99/16 dev eth0
+	ip -net "$ns2" addr add dead:2::99/64 dev eth0 nodad
+	ip netns exec "$nsrouter" nft flush ruleset
+	ip netns exec "$nsrouter" sysctl net.ipv6.conf.all.forwarding=0 > /dev/null
+	ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth0.forwarding=0 > /dev/null
+	ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth1.forwarding=0 > /dev/null
+	if ! test_ping;then
+		echo "FAIL: netns bridge connectivity" 1>&2
+		exit $ret
+	fi
+	load_ruleset "bridge" "filter" 10
+	test_queue 10 "bridge"
+	load_ruleset "bridge" "filter2" 20
+	test_queue 20 "bridge"
+}
 ip netns exec "$nsrouter" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
 ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
 ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
 ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth2.forwarding=1 > /dev/null
-load_ruleset "filter" 0
+load_ruleset "inet" "filter" 0
 if test_ping; then
 	# queue bypass works (rules were skipped, no listener)
 # 1x icmp prerouting,forward,postrouting -> 3 queue events (6 incl. reply).
 # 1x icmp prerouting,input,output postrouting -> 4 queue events incl. reply.
 # so we expect that userspace program receives 10 packets.
-test_queue 10
+test_queue 10 "inet"
 # same.  We queue to a second program as well.
-load_ruleset "filter2" 20
+load_ruleset "inet" "filter2" 20
-test_queue 20
+test_queue 20 "inet"
 ip netns exec "$ns1" nft flush ruleset
 test_tcp_forward
 test_icmp_vrf
 test_queue_removal
+# turns router into a bridge
+test_queue_bridge
 exit $ret