Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1560263

[RFC/PATCH 0/3] Fix ctnetlink regressions

Show all headers | View raw

These patches address a problem I am seeing on Linux 4.4.  They do not
apply as-is to the master branch.  But I wanted to run them past the list
first to gather feedback on whether this is a reasonable approach.

I am using the user conntrack helpers from conntrackd on systems running
Linux 3.14, 3.18, and 4.4.  It was observed that conntrackd worked fine
on the 3.14/3.18 systems, but had no apparent effect on the 4.4 systems.
I tracked this down to a new check that was added in 4.4:

+       if (nfq_ct->parse(nfqa[NFQA_CT], ct) < 0)
+               return NULL;
+
+       if (nfqa[NFQA_EXP])
+               nfq_ct->attach_expect(nfqa[NFQA_EXP], ct,
+                                     NETLINK_CB(entry->skb).portid,
+                                     nlmsg_report(nlh));

Prior to 4.4, even if a netlink message failed the parse() checks, the
kernel would still run attach_expect() on it.  This masked a number of
failures.  With 4.4+, a sanity check failure on any attribute checked by
parse() will prevent the expectation from being created, which usually
breaks the conntrack helper.

In my testing I found that the sanity checks for CTA_TIMEOUT, CTA_STATUS,
and CTA_HELP were overly strict.  CTA_TIMEOUT may have been inadvertently
fixed in master (commit f330a7fdbe161), but I don't think the other two
are.  My proposal is to relax the checks so that existing user programs
do not break.

Another option is to simply ignore the parse() result, so that the
interface remains bug-compatible with old user code.


Kevin Cernekee (3):
  netfilter: ctnetlink: Fix regression in CTA_TIMEOUT processing
  netfilter: ctnetlink: Fix regression in CTA_STATUS processing
  netfilter: ctnetlink: Fix regression in CTA_HELP processing

 include/uapi/linux/netfilter/nf_conntrack_common.h |  4 +++
 net/netfilter/nf_conntrack_netlink.c               | 35 +++++++++++++---------
 2 files changed, 25 insertions(+), 14 deletions(-)

-- 
2.7.4

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[RFC/PATCH 0/3] Fix ctnetlink regressions Kevin Cernekee <cernekee@chromium.org> - 2017-01-17 06:20 +0100
  [RFC/PATCH 2/3] netfilter: ctnetlink: Fix regression in CTA_STATUS processing Kevin Cernekee <cernekee@chromium.org> - 2017-01-17 06:20 +0100
    Re: [RFC/PATCH 2/3] netfilter: ctnetlink: Fix regression in  CTA_STATUS processing Doug Anderson <dianders@chromium.org> - 2017-01-18 20:10 +0100
  [RFC/PATCH 1/3] netfilter: ctnetlink: Fix regression in CTA_TIMEOUT processing Kevin Cernekee <cernekee@chromium.org> - 2017-01-17 06:20 +0100
    Re: [RFC/PATCH 1/3] netfilter: ctnetlink: Fix regression in  CTA_TIMEOUT processing Doug Anderson <dianders@chromium.org> - 2017-01-18 20:00 +0100
  Re: [RFC/PATCH 0/3] Fix ctnetlink regressions Pablo Neira Ayuso <pablo@netfilter.org> - 2017-01-25 01:40 +0100

csiph-web