2019-06-04 10:11:33 +02:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-only
|
2013-08-27 08:50:14 +02:00
|
|
|
/*
|
|
|
|
* Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/skbuff.h>
|
|
|
|
#include <asm/unaligned.h>
|
|
|
|
#include <net/tcp.h>
|
|
|
|
#include <net/netns/generic.h>
|
2015-06-17 17:28:26 +02:00
|
|
|
#include <linux/proc_fs.h>
|
2013-08-27 08:50:14 +02:00
|
|
|
|
|
|
|
#include <linux/netfilter_ipv4/ip_tables.h>
|
|
|
|
#include <linux/netfilter/x_tables.h>
|
|
|
|
#include <linux/netfilter/xt_tcpudp.h>
|
|
|
|
#include <linux/netfilter/xt_SYNPROXY.h>
|
2015-08-08 21:40:01 +02:00
|
|
|
|
2013-08-27 08:50:14 +02:00
|
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
|
|
#include <net/netfilter/nf_conntrack_extend.h>
|
|
|
|
#include <net/netfilter/nf_conntrack_seqadj.h>
|
|
|
|
#include <net/netfilter/nf_conntrack_synproxy.h>
|
2015-08-08 21:40:01 +02:00
|
|
|
#include <net/netfilter/nf_conntrack_zones.h>
|
2013-08-27 08:50:14 +02:00
|
|
|
|
netns: make struct pernet_operations::id unsigned int
Make struct pernet_operations::id unsigned.
There are 2 reasons to do so:
1)
This field is really an index into an zero based array and
thus is unsigned entity. Using negative value is out-of-bound
access by definition.
2)
On x86_64 unsigned 32-bit data which are mixed with pointers
via array indexing or offsets added or subtracted to pointers
are preffered to signed 32-bit data.
"int" being used as an array index needs to be sign-extended
to 64-bit before being used.
void f(long *p, int i)
{
g(p[i]);
}
roughly translates to
movsx rsi, esi
mov rdi, [rsi+...]
call g
MOVSX is 3 byte instruction which isn't necessary if the variable is
unsigned because x86_64 is zero extending by default.
Now, there is net_generic() function which, you guessed it right, uses
"int" as an array index:
static inline void *net_generic(const struct net *net, int id)
{
...
ptr = ng->ptr[id - 1];
...
}
And this function is used a lot, so those sign extensions add up.
Patch snipes ~1730 bytes on allyesconfig kernel (without all junk
messing with code generation):
add/remove: 0/0 grow/shrink: 70/598 up/down: 396/-2126 (-1730)
Unfortunately some functions actually grow bigger.
This is a semmingly random artefact of code generation with register
allocator being used differently. gcc decides that some variable
needs to live in new r8+ registers and every access now requires REX
prefix. Or it is shifted into r12, so [r12+0] addressing mode has to be
used which is longer than [r8]
However, overall balance is in negative direction:
add/remove: 0/0 grow/shrink: 70/598 up/down: 396/-2126 (-1730)
function old new delta
nfsd4_lock 3886 3959 +73
tipc_link_build_proto_msg 1096 1140 +44
mac80211_hwsim_new_radio 2776 2808 +32
tipc_mon_rcv 1032 1058 +26
svcauth_gss_legacy_init 1413 1429 +16
tipc_bcbase_select_primary 379 392 +13
nfsd4_exchange_id 1247 1260 +13
nfsd4_setclientid_confirm 782 793 +11
...
put_client_renew_locked 494 480 -14
ip_set_sockfn_get 730 716 -14
geneve_sock_add 829 813 -16
nfsd4_sequence_done 721 703 -18
nlmclnt_lookup_host 708 686 -22
nfsd4_lockt 1085 1063 -22
nfs_get_client 1077 1050 -27
tcf_bpf_init 1106 1076 -30
nfsd4_encode_fattr 5997 5930 -67
Total: Before=154856051, After=154854321, chg -0.00%
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-17 02:58:21 +01:00
|
|
|
unsigned int synproxy_net_id;
|
2013-08-27 08:50:14 +02:00
|
|
|
EXPORT_SYMBOL_GPL(synproxy_net_id);
|
|
|
|
|
2013-09-30 09:51:46 +02:00
|
|
|
bool
|
2013-08-27 08:50:14 +02:00
|
|
|
synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
|
|
|
|
const struct tcphdr *th, struct synproxy_options *opts)
|
|
|
|
{
|
|
|
|
int length = (th->doff * 4) - sizeof(*th);
|
|
|
|
u8 buf[40], *ptr;
|
|
|
|
|
|
|
|
ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
|
2013-09-30 09:51:46 +02:00
|
|
|
if (ptr == NULL)
|
|
|
|
return false;
|
2013-08-27 08:50:14 +02:00
|
|
|
|
|
|
|
opts->options = 0;
|
|
|
|
while (length > 0) {
|
|
|
|
int opcode = *ptr++;
|
|
|
|
int opsize;
|
|
|
|
|
|
|
|
switch (opcode) {
|
|
|
|
case TCPOPT_EOL:
|
2013-09-30 09:51:46 +02:00
|
|
|
return true;
|
2013-08-27 08:50:14 +02:00
|
|
|
case TCPOPT_NOP:
|
|
|
|
length--;
|
|
|
|
continue;
|
|
|
|
default:
|
|
|
|
opsize = *ptr++;
|
|
|
|
if (opsize < 2)
|
2013-09-30 09:51:46 +02:00
|
|
|
return true;
|
2013-08-27 08:50:14 +02:00
|
|
|
if (opsize > length)
|
2013-09-30 09:51:46 +02:00
|
|
|
return true;
|
2013-08-27 08:50:14 +02:00
|
|
|
|
|
|
|
switch (opcode) {
|
|
|
|
case TCPOPT_MSS:
|
|
|
|
if (opsize == TCPOLEN_MSS) {
|
|
|
|
opts->mss = get_unaligned_be16(ptr);
|
|
|
|
opts->options |= XT_SYNPROXY_OPT_MSS;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case TCPOPT_WINDOW:
|
|
|
|
if (opsize == TCPOLEN_WINDOW) {
|
|
|
|
opts->wscale = *ptr;
|
2017-04-19 03:23:42 +02:00
|
|
|
if (opts->wscale > TCP_MAX_WSCALE)
|
|
|
|
opts->wscale = TCP_MAX_WSCALE;
|
2013-08-27 08:50:14 +02:00
|
|
|
opts->options |= XT_SYNPROXY_OPT_WSCALE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case TCPOPT_TIMESTAMP:
|
|
|
|
if (opsize == TCPOLEN_TIMESTAMP) {
|
|
|
|
opts->tsval = get_unaligned_be32(ptr);
|
|
|
|
opts->tsecr = get_unaligned_be32(ptr + 4);
|
|
|
|
opts->options |= XT_SYNPROXY_OPT_TIMESTAMP;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case TCPOPT_SACK_PERM:
|
|
|
|
if (opsize == TCPOLEN_SACK_PERM)
|
|
|
|
opts->options |= XT_SYNPROXY_OPT_SACK_PERM;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
ptr += opsize - 2;
|
|
|
|
length -= opsize;
|
|
|
|
}
|
|
|
|
}
|
2013-09-30 09:51:46 +02:00
|
|
|
return true;
|
2013-08-27 08:50:14 +02:00
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(synproxy_parse_options);
|
|
|
|
|
|
|
|
unsigned int synproxy_options_size(const struct synproxy_options *opts)
|
|
|
|
{
|
|
|
|
unsigned int size = 0;
|
|
|
|
|
|
|
|
if (opts->options & XT_SYNPROXY_OPT_MSS)
|
|
|
|
size += TCPOLEN_MSS_ALIGNED;
|
|
|
|
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
|
|
|
|
size += TCPOLEN_TSTAMP_ALIGNED;
|
|
|
|
else if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
|
|
|
|
size += TCPOLEN_SACKPERM_ALIGNED;
|
|
|
|
if (opts->options & XT_SYNPROXY_OPT_WSCALE)
|
|
|
|
size += TCPOLEN_WSCALE_ALIGNED;
|
|
|
|
|
|
|
|
return size;
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(synproxy_options_size);
|
|
|
|
|
|
|
|
void
|
|
|
|
synproxy_build_options(struct tcphdr *th, const struct synproxy_options *opts)
|
|
|
|
{
|
|
|
|
__be32 *ptr = (__be32 *)(th + 1);
|
|
|
|
u8 options = opts->options;
|
|
|
|
|
|
|
|
if (options & XT_SYNPROXY_OPT_MSS)
|
|
|
|
*ptr++ = htonl((TCPOPT_MSS << 24) |
|
|
|
|
(TCPOLEN_MSS << 16) |
|
|
|
|
opts->mss);
|
|
|
|
|
|
|
|
if (options & XT_SYNPROXY_OPT_TIMESTAMP) {
|
|
|
|
if (options & XT_SYNPROXY_OPT_SACK_PERM)
|
|
|
|
*ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
|
|
|
|
(TCPOLEN_SACK_PERM << 16) |
|
|
|
|
(TCPOPT_TIMESTAMP << 8) |
|
|
|
|
TCPOLEN_TIMESTAMP);
|
|
|
|
else
|
|
|
|
*ptr++ = htonl((TCPOPT_NOP << 24) |
|
|
|
|
(TCPOPT_NOP << 16) |
|
|
|
|
(TCPOPT_TIMESTAMP << 8) |
|
|
|
|
TCPOLEN_TIMESTAMP);
|
|
|
|
|
|
|
|
*ptr++ = htonl(opts->tsval);
|
|
|
|
*ptr++ = htonl(opts->tsecr);
|
|
|
|
} else if (options & XT_SYNPROXY_OPT_SACK_PERM)
|
|
|
|
*ptr++ = htonl((TCPOPT_NOP << 24) |
|
|
|
|
(TCPOPT_NOP << 16) |
|
|
|
|
(TCPOPT_SACK_PERM << 8) |
|
|
|
|
TCPOLEN_SACK_PERM);
|
|
|
|
|
|
|
|
if (options & XT_SYNPROXY_OPT_WSCALE)
|
|
|
|
*ptr++ = htonl((TCPOPT_NOP << 24) |
|
|
|
|
(TCPOPT_WINDOW << 16) |
|
|
|
|
(TCPOLEN_WINDOW << 8) |
|
|
|
|
opts->wscale);
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(synproxy_build_options);
|
|
|
|
|
|
|
|
void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
|
|
|
|
struct synproxy_options *opts)
|
|
|
|
{
|
|
|
|
opts->tsecr = opts->tsval;
|
2017-05-16 23:00:14 +02:00
|
|
|
opts->tsval = tcp_time_stamp_raw() & ~0x3f;
|
2013-08-27 08:50:14 +02:00
|
|
|
|
2013-11-14 15:35:31 +01:00
|
|
|
if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
|
|
|
|
opts->tsval |= opts->wscale;
|
|
|
|
opts->wscale = info->wscale;
|
|
|
|
} else
|
2013-08-27 08:50:14 +02:00
|
|
|
opts->tsval |= 0xf;
|
|
|
|
|
|
|
|
if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
|
|
|
|
opts->tsval |= 1 << 4;
|
|
|
|
|
|
|
|
if (opts->options & XT_SYNPROXY_OPT_ECN)
|
|
|
|
opts->tsval |= 1 << 5;
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(synproxy_init_timestamp_cookie);
|
|
|
|
|
|
|
|
void synproxy_check_timestamp_cookie(struct synproxy_options *opts)
|
|
|
|
{
|
|
|
|
opts->wscale = opts->tsecr & 0xf;
|
|
|
|
if (opts->wscale != 0xf)
|
|
|
|
opts->options |= XT_SYNPROXY_OPT_WSCALE;
|
|
|
|
|
|
|
|
opts->options |= opts->tsecr & (1 << 4) ? XT_SYNPROXY_OPT_SACK_PERM : 0;
|
|
|
|
|
|
|
|
opts->options |= opts->tsecr & (1 << 5) ? XT_SYNPROXY_OPT_ECN : 0;
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(synproxy_check_timestamp_cookie);
|
|
|
|
|
|
|
|
unsigned int synproxy_tstamp_adjust(struct sk_buff *skb,
|
|
|
|
unsigned int protoff,
|
|
|
|
struct tcphdr *th,
|
|
|
|
struct nf_conn *ct,
|
|
|
|
enum ip_conntrack_info ctinfo,
|
|
|
|
const struct nf_conn_synproxy *synproxy)
|
|
|
|
{
|
|
|
|
unsigned int optoff, optend;
|
2015-08-28 00:16:21 +02:00
|
|
|
__be32 *ptr, old;
|
2013-08-27 08:50:14 +02:00
|
|
|
|
|
|
|
if (synproxy->tsoff == 0)
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
optoff = protoff + sizeof(struct tcphdr);
|
|
|
|
optend = protoff + th->doff * 4;
|
|
|
|
|
|
|
|
if (!skb_make_writable(skb, optend))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
while (optoff < optend) {
|
|
|
|
unsigned char *op = skb->data + optoff;
|
|
|
|
|
|
|
|
switch (op[0]) {
|
|
|
|
case TCPOPT_EOL:
|
|
|
|
return 1;
|
|
|
|
case TCPOPT_NOP:
|
|
|
|
optoff++;
|
|
|
|
continue;
|
|
|
|
default:
|
|
|
|
if (optoff + 1 == optend ||
|
|
|
|
optoff + op[1] > optend ||
|
|
|
|
op[1] < 2)
|
|
|
|
return 0;
|
|
|
|
if (op[0] == TCPOPT_TIMESTAMP &&
|
|
|
|
op[1] == TCPOLEN_TIMESTAMP) {
|
|
|
|
if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
|
2015-08-28 00:16:21 +02:00
|
|
|
ptr = (__be32 *)&op[2];
|
2013-08-27 08:50:14 +02:00
|
|
|
old = *ptr;
|
|
|
|
*ptr = htonl(ntohl(*ptr) -
|
|
|
|
synproxy->tsoff);
|
|
|
|
} else {
|
2015-08-28 00:16:21 +02:00
|
|
|
ptr = (__be32 *)&op[6];
|
2013-08-27 08:50:14 +02:00
|
|
|
old = *ptr;
|
|
|
|
*ptr = htonl(ntohl(*ptr) +
|
|
|
|
synproxy->tsoff);
|
|
|
|
}
|
|
|
|
inet_proto_csum_replace4(&th->check, skb,
|
2015-08-17 22:42:25 +02:00
|
|
|
old, *ptr, false);
|
2013-08-27 08:50:14 +02:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
optoff += op[1];
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(synproxy_tstamp_adjust);
|
|
|
|
|
|
|
|
static struct nf_ct_ext_type nf_ct_synproxy_extend __read_mostly = {
|
|
|
|
.len = sizeof(struct nf_conn_synproxy),
|
|
|
|
.align = __alignof__(struct nf_conn_synproxy),
|
|
|
|
.id = NF_CT_EXT_SYNPROXY,
|
|
|
|
};
|
|
|
|
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
|
|
static void *synproxy_cpu_seq_start(struct seq_file *seq, loff_t *pos)
|
|
|
|
{
|
|
|
|
struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
|
|
|
|
int cpu;
|
|
|
|
|
|
|
|
if (*pos == 0)
|
|
|
|
return SEQ_START_TOKEN;
|
|
|
|
|
|
|
|
for (cpu = *pos - 1; cpu < nr_cpu_ids; cpu++) {
|
|
|
|
if (!cpu_possible(cpu))
|
|
|
|
continue;
|
|
|
|
*pos = cpu + 1;
|
|
|
|
return per_cpu_ptr(snet->stats, cpu);
|
|
|
|
}
|
|
|
|
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
|
|
|
|
{
|
|
|
|
struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
|
|
|
|
int cpu;
|
|
|
|
|
|
|
|
for (cpu = *pos; cpu < nr_cpu_ids; cpu++) {
|
|
|
|
if (!cpu_possible(cpu))
|
|
|
|
continue;
|
|
|
|
*pos = cpu + 1;
|
|
|
|
return per_cpu_ptr(snet->stats, cpu);
|
|
|
|
}
|
|
|
|
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void synproxy_cpu_seq_stop(struct seq_file *seq, void *v)
|
|
|
|
{
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int synproxy_cpu_seq_show(struct seq_file *seq, void *v)
|
|
|
|
{
|
|
|
|
struct synproxy_stats *stats = v;
|
|
|
|
|
|
|
|
if (v == SEQ_START_TOKEN) {
|
2017-03-28 23:55:17 +02:00
|
|
|
seq_puts(seq, "entries\t\tsyn_received\t"
|
|
|
|
"cookie_invalid\tcookie_valid\t"
|
|
|
|
"cookie_retrans\tconn_reopened\n");
|
2013-08-27 08:50:14 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
seq_printf(seq, "%08x\t%08x\t%08x\t%08x\t%08x\t%08x\n", 0,
|
|
|
|
stats->syn_received,
|
|
|
|
stats->cookie_invalid,
|
|
|
|
stats->cookie_valid,
|
|
|
|
stats->cookie_retrans,
|
|
|
|
stats->conn_reopened);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const struct seq_operations synproxy_cpu_seq_ops = {
|
|
|
|
.start = synproxy_cpu_seq_start,
|
|
|
|
.next = synproxy_cpu_seq_next,
|
|
|
|
.stop = synproxy_cpu_seq_stop,
|
|
|
|
.show = synproxy_cpu_seq_show,
|
|
|
|
};
|
|
|
|
|
|
|
|
static int __net_init synproxy_proc_init(struct net *net)
|
|
|
|
{
|
2018-04-10 19:42:55 +02:00
|
|
|
if (!proc_create_net("synproxy", 0444, net->proc_net_stat,
|
|
|
|
&synproxy_cpu_seq_ops, sizeof(struct seq_net_private)))
|
2013-08-27 08:50:14 +02:00
|
|
|
return -ENOMEM;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __net_exit synproxy_proc_exit(struct net *net)
|
|
|
|
{
|
|
|
|
remove_proc_entry("synproxy", net->proc_net_stat);
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
static int __net_init synproxy_proc_init(struct net *net)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __net_exit synproxy_proc_exit(struct net *net)
|
|
|
|
{
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
#endif /* CONFIG_PROC_FS */
|
|
|
|
|
|
|
|
static int __net_init synproxy_net_init(struct net *net)
|
|
|
|
{
|
|
|
|
struct synproxy_net *snet = synproxy_pernet(net);
|
|
|
|
struct nf_conn *ct;
|
|
|
|
int err = -ENOMEM;
|
|
|
|
|
2015-08-08 21:40:01 +02:00
|
|
|
ct = nf_ct_tmpl_alloc(net, &nf_ct_zone_dflt, GFP_KERNEL);
|
2015-07-28 00:42:28 +02:00
|
|
|
if (!ct)
|
2013-08-27 08:50:14 +02:00
|
|
|
goto err1;
|
|
|
|
|
|
|
|
if (!nfct_seqadj_ext_add(ct))
|
|
|
|
goto err2;
|
|
|
|
if (!nfct_synproxy_ext_add(ct))
|
|
|
|
goto err2;
|
|
|
|
|
netfilter: fix netns dependencies with conntrack templates
Quoting Daniel Borkmann:
"When adding connection tracking template rules to a netns, f.e. to
configure netfilter zones, the kernel will endlessly busy-loop as soon
as we try to delete the given netns in case there's at least one
template present, which is problematic i.e. if there is such bravery that
the priviledged user inside the netns is assumed untrusted.
Minimal example:
ip netns add foo
ip netns exec foo iptables -t raw -A PREROUTING -d 1.2.3.4 -j CT --zone 1
ip netns del foo
What happens is that when nf_ct_iterate_cleanup() is being called from
nf_conntrack_cleanup_net_list() for a provided netns, we always end up
with a net->ct.count > 0 and thus jump back to i_see_dead_people. We
don't get a soft-lockup as we still have a schedule() point, but the
serving CPU spins on 100% from that point onwards.
Since templates are normally allocated with nf_conntrack_alloc(), we
also bump net->ct.count. The issue why they are not yet nf_ct_put() is
because the per netns .exit() handler from x_tables (which would eventually
invoke xt_CT's xt_ct_tg_destroy() that drops reference on info->ct) is
called in the dependency chain at a *later* point in time than the per
netns .exit() handler for the connection tracker.
This is clearly a chicken'n'egg problem: after the connection tracker
.exit() handler, we've teared down all the connection tracking
infrastructure already, so rightfully, xt_ct_tg_destroy() cannot be
invoked at a later point in time during the netns cleanup, as that would
lead to a use-after-free. At the same time, we cannot make x_tables depend
on the connection tracker module, so that the xt_ct_tg_destroy() would
be invoked earlier in the cleanup chain."
Daniel confirms this has to do with the order in which modules are loaded or
having compiled nf_conntrack as modules while x_tables built-in. So we have no
guarantees regarding the order in which netns callbacks are executed.
Fix this by allocating the templates through kmalloc() from the respective
SYNPROXY and CT targets, so they don't depend on the conntrack kmem cache.
Then, release then via nf_ct_tmpl_free() from destroy_conntrack(). This branch
is marked as unlikely since conntrack templates are rarely allocated and only
from the configuration plane path.
Note that templates are not kept in any list to avoid further dependencies with
nf_conntrack anymore, thus, the tmpl larval list is removed.
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-13 15:11:48 +02:00
|
|
|
__set_bit(IPS_CONFIRMED_BIT, &ct->status);
|
|
|
|
nf_conntrack_get(&ct->ct_general);
|
2013-08-27 08:50:14 +02:00
|
|
|
snet->tmpl = ct;
|
|
|
|
|
|
|
|
snet->stats = alloc_percpu(struct synproxy_stats);
|
|
|
|
if (snet->stats == NULL)
|
|
|
|
goto err2;
|
|
|
|
|
|
|
|
err = synproxy_proc_init(net);
|
|
|
|
if (err < 0)
|
|
|
|
goto err3;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
err3:
|
|
|
|
free_percpu(snet->stats);
|
|
|
|
err2:
|
netfilter: conntrack: use nf_ct_tmpl_free in CT/synproxy error paths
Commit 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack
templates") migrated templates to the new allocator api, but forgot to
update error paths for them in CT and synproxy to use nf_ct_tmpl_free()
instead of nf_conntrack_free().
Due to that, memory is being freed into the wrong kmemcache, but also
we drop the per net reference count of ct objects causing an imbalance.
In Brad's case, this leads to a wrap-around of net->ct.count and thus
lets __nf_conntrack_alloc() refuse to create a new ct object:
[ 10.340913] xt_addrtype: ipv6 does not support BROADCAST matching
[ 10.810168] nf_conntrack: table full, dropping packet
[ 11.917416] r8169 0000:07:00.0 eth0: link up
[ 11.917438] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 12.815902] nf_conntrack: table full, dropping packet
[ 15.688561] nf_conntrack: table full, dropping packet
[ 15.689365] nf_conntrack: table full, dropping packet
[ 15.690169] nf_conntrack: table full, dropping packet
[ 15.690967] nf_conntrack: table full, dropping packet
[...]
With slab debugging, it also reports the wrong kmemcache (kmalloc-512 vs.
nf_conntrack_ffffffff81ce75c0) and reports poison overwrites, etc. Thus,
to fix the problem, export and use nf_ct_tmpl_free() instead.
Fixes: 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack templates")
Reported-by: Brad Jackson <bjackson0971@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-08-31 19:11:02 +02:00
|
|
|
nf_ct_tmpl_free(ct);
|
2013-08-27 08:50:14 +02:00
|
|
|
err1:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __net_exit synproxy_net_exit(struct net *net)
|
|
|
|
{
|
|
|
|
struct synproxy_net *snet = synproxy_pernet(net);
|
|
|
|
|
netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt
With this patch, the conntrack refcount is initially set to zero and
it is bumped once it is added to any of the list, so we fulfill
Eric's golden rule which is that all released objects always have a
refcount that equals zero.
Andrey Vagin reports that nf_conntrack_free can't be called for a
conntrack with non-zero ref-counter, because it can race with
nf_conntrack_find_get().
A conntrack slab is created with SLAB_DESTROY_BY_RCU. Non-zero
ref-counter says that this conntrack is used. So when we release
a conntrack with non-zero counter, we break this assumption.
CPU1 CPU2
____nf_conntrack_find()
nf_ct_put()
destroy_conntrack()
...
init_conntrack
__nf_conntrack_alloc (set use = 1)
atomic_inc_not_zero(&ct->use) (use = 2)
if (!l4proto->new(ct, skb, dataoff, timeouts))
nf_conntrack_free(ct); (use = 2 !!!)
...
__nf_conntrack_alloc (set use = 1)
if (!nf_ct_key_equal(h, tuple, zone))
nf_ct_put(ct); (use = 0)
destroy_conntrack()
/* continue to work with CT */
After applying the path "[PATCH] netfilter: nf_conntrack: fix RCU
race in nf_conntrack_find_get" another bug was triggered in
destroy_conntrack():
<4>[67096.759334] ------------[ cut here ]------------
<2>[67096.759353] kernel BUG at net/netfilter/nf_conntrack_core.c:211!
...
<4>[67096.759837] Pid: 498649, comm: atdd veid: 666 Tainted: G C --------------- 2.6.32-042stab084.18 #1 042stab084_18 /DQ45CB
<4>[67096.759932] RIP: 0010:[<ffffffffa03d99ac>] [<ffffffffa03d99ac>] destroy_conntrack+0x15c/0x190 [nf_conntrack]
<4>[67096.760255] Call Trace:
<4>[67096.760255] [<ffffffff814844a7>] nf_conntrack_destroy+0x17/0x30
<4>[67096.760255] [<ffffffffa03d9bb5>] nf_conntrack_find_get+0x85/0x130 [nf_conntrack]
<4>[67096.760255] [<ffffffffa03d9fb2>] nf_conntrack_in+0x352/0xb60 [nf_conntrack]
<4>[67096.760255] [<ffffffffa048c771>] ipv4_conntrack_local+0x51/0x60 [nf_conntrack_ipv4]
<4>[67096.760255] [<ffffffff81484419>] nf_iterate+0x69/0xb0
<4>[67096.760255] [<ffffffff814b5b00>] ? dst_output+0x0/0x20
<4>[67096.760255] [<ffffffff814845d4>] nf_hook_slow+0x74/0x110
<4>[67096.760255] [<ffffffff814b5b00>] ? dst_output+0x0/0x20
<4>[67096.760255] [<ffffffff814b66d5>] raw_sendmsg+0x775/0x910
<4>[67096.760255] [<ffffffff8104c5a8>] ? flush_tlb_others_ipi+0x128/0x130
<4>[67096.760255] [<ffffffff8100bc4e>] ? apic_timer_interrupt+0xe/0x20
<4>[67096.760255] [<ffffffff8100bc4e>] ? apic_timer_interrupt+0xe/0x20
<4>[67096.760255] [<ffffffff814c136a>] inet_sendmsg+0x4a/0xb0
<4>[67096.760255] [<ffffffff81444e93>] ? sock_sendmsg+0x13/0x140
<4>[67096.760255] [<ffffffff81444f97>] sock_sendmsg+0x117/0x140
<4>[67096.760255] [<ffffffff8102e299>] ? native_smp_send_reschedule+0x49/0x60
<4>[67096.760255] [<ffffffff81519beb>] ? _spin_unlock_bh+0x1b/0x20
<4>[67096.760255] [<ffffffff8109d930>] ? autoremove_wake_function+0x0/0x40
<4>[67096.760255] [<ffffffff814960f0>] ? do_ip_setsockopt+0x90/0xd80
<4>[67096.760255] [<ffffffff8100bc4e>] ? apic_timer_interrupt+0xe/0x20
<4>[67096.760255] [<ffffffff8100bc4e>] ? apic_timer_interrupt+0xe/0x20
<4>[67096.760255] [<ffffffff814457c9>] sys_sendto+0x139/0x190
<4>[67096.760255] [<ffffffff810efa77>] ? audit_syscall_entry+0x1d7/0x200
<4>[67096.760255] [<ffffffff810ef7c5>] ? __audit_syscall_exit+0x265/0x290
<4>[67096.760255] [<ffffffff81474daf>] compat_sys_socketcall+0x13f/0x210
<4>[67096.760255] [<ffffffff8104dea3>] ia32_sysret+0x0/0x5
I have reused the original title for the RFC patch that Andrey posted and
most of the original patch description.
Cc: Eric Dumazet <edumazet@google.com>
Cc: Andrew Vagin <avagin@parallels.com>
Cc: Florian Westphal <fw@strlen.de>
Reported-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Andrew Vagin <avagin@parallels.com>
2014-02-03 20:01:53 +01:00
|
|
|
nf_ct_put(snet->tmpl);
|
2013-08-27 08:50:14 +02:00
|
|
|
synproxy_proc_exit(net);
|
|
|
|
free_percpu(snet->stats);
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct pernet_operations synproxy_net_ops = {
|
|
|
|
.init = synproxy_net_init,
|
|
|
|
.exit = synproxy_net_exit,
|
|
|
|
.id = &synproxy_net_id,
|
|
|
|
.size = sizeof(struct synproxy_net),
|
|
|
|
};
|
|
|
|
|
|
|
|
static int __init synproxy_core_init(void)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
|
|
|
|
err = nf_ct_extend_register(&nf_ct_synproxy_extend);
|
|
|
|
if (err < 0)
|
|
|
|
goto err1;
|
|
|
|
|
|
|
|
err = register_pernet_subsys(&synproxy_net_ops);
|
|
|
|
if (err < 0)
|
|
|
|
goto err2;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
err2:
|
|
|
|
nf_ct_extend_unregister(&nf_ct_synproxy_extend);
|
|
|
|
err1:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit synproxy_core_exit(void)
|
|
|
|
{
|
|
|
|
unregister_pernet_subsys(&synproxy_net_ops);
|
|
|
|
nf_ct_extend_unregister(&nf_ct_synproxy_extend);
|
|
|
|
}
|
|
|
|
|
|
|
|
module_init(synproxy_core_init);
|
|
|
|
module_exit(synproxy_core_exit);
|
|
|
|
|
|
|
|
MODULE_LICENSE("GPL");
|
|
|
|
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
|