[RFC/PATCH 0/3] Fix ctnetlink regressions

Path	csiph.com!news.redatomik.org!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod
From	Kevin Cernekee <cernekee@chromium.org>
Newsgroups	linux.kernel
Subject	[RFC/PATCH 0/3] Fix ctnetlink regressions
Date	Tue, 17 Jan 2017 06:20:02 +0100
Message-ID	<t0ulz-2IQ-3@gated-at.bofh.it> (permalink)
X-Original-To	pablo@netfilter.org
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=XryIksRzXEVPRG55fruuvqCPHagKffhq0ddOqHVK6es=; b=ID3FFl5TqX9LDdgP7Vvywkme55caglN2p1VeQ+oGqoY27FVWgiumiwmydzackM7gQ7 N3b3djxRIPvvnk7V9tbJLkg/TEf5pF4H88j7b+l26m+16ck1mbxdDGqRVm72wG3pCsbt ZIPLi0Z3oR3608ufXRvl9J8fuMygmkOF1m4kUL0RIBYvPqj1CxDx2CVeZ047QQXUfg0r czc26XqQVbg3VnI2hL6pg1hHTr4pMO2WhFlNmEIUjqEBHq+cCbV1f4qlG2bPP2hpWlIu eQ9vnxjldPheI7pLApS5dguNNfU/2eDatBmagaLLIFEBK1C9sK5cwcX/oaeG/mCbYvZ+ XnjA==
X-Gm-Message-State	AIkVDXJy6syujIZU+g5QR8kLCuLQZjc4Fn94nHW25K/uGI6p7sbw+LDXEV0aiIO2nGzRUQ==
X-Received	by 10.84.238.131 with SMTP id v3mr55804753plk.143.1484630099445; Mon, 16 Jan 2017 21:14:59 -0800 (PST)
X-Mailer	git-send-email 2.7.4
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	44
Organization	linux.* mail to news gateway
X-Original-Cc	netfilter-devel@vger.kernel.org, linux-kernel@vger.kernel.org
X-Original-Date	Mon, 16 Jan 2017 21:14:05 -0800
X-Original-Message-ID	<1484630048-25416-1-git-send-email-cernekee@chromium.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1560263

Show key headers only | View raw

These patches address a problem I am seeing on Linux 4.4.  They do not
apply as-is to the master branch.  But I wanted to run them past the list
first to gather feedback on whether this is a reasonable approach.

I am using the user conntrack helpers from conntrackd on systems running
Linux 3.14, 3.18, and 4.4.  It was observed that conntrackd worked fine
on the 3.14/3.18 systems, but had no apparent effect on the 4.4 systems.
I tracked this down to a new check that was added in 4.4:

+       if (nfq_ct->parse(nfqa[NFQA_CT], ct) < 0)
+               return NULL;
+
+       if (nfqa[NFQA_EXP])
+               nfq_ct->attach_expect(nfqa[NFQA_EXP], ct,
+                                     NETLINK_CB(entry->skb).portid,
+                                     nlmsg_report(nlh));

Prior to 4.4, even if a netlink message failed the parse() checks, the
kernel would still run attach_expect() on it.  This masked a number of
failures.  With 4.4+, a sanity check failure on any attribute checked by
parse() will prevent the expectation from being created, which usually
breaks the conntrack helper.

In my testing I found that the sanity checks for CTA_TIMEOUT, CTA_STATUS,
and CTA_HELP were overly strict.  CTA_TIMEOUT may have been inadvertently
fixed in master (commit f330a7fdbe161), but I don't think the other two
are.  My proposal is to relax the checks so that existing user programs
do not break.

Another option is to simply ignore the parse() result, so that the
interface remains bug-compatible with old user code.


Kevin Cernekee (3):
  netfilter: ctnetlink: Fix regression in CTA_TIMEOUT processing
  netfilter: ctnetlink: Fix regression in CTA_STATUS processing
  netfilter: ctnetlink: Fix regression in CTA_HELP processing

 include/uapi/linux/netfilter/nf_conntrack_common.h |  4 +++
 net/netfilter/nf_conntrack_netlink.c               | 35 +++++++++++++---------
 2 files changed, 25 insertions(+), 14 deletions(-)

-- 
2.7.4

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[RFC/PATCH 0/3] Fix ctnetlink regressions Kevin Cernekee <cernekee@chromium.org> - 2017-01-17 06:20 +0100
  [RFC/PATCH 2/3] netfilter: ctnetlink: Fix regression in CTA_STATUS processing Kevin Cernekee <cernekee@chromium.org> - 2017-01-17 06:20 +0100
    Re: [RFC/PATCH 2/3] netfilter: ctnetlink: Fix regression in  CTA_STATUS processing Doug Anderson <dianders@chromium.org> - 2017-01-18 20:10 +0100
  [RFC/PATCH 1/3] netfilter: ctnetlink: Fix regression in CTA_TIMEOUT processing Kevin Cernekee <cernekee@chromium.org> - 2017-01-17 06:20 +0100
    Re: [RFC/PATCH 1/3] netfilter: ctnetlink: Fix regression in  CTA_TIMEOUT processing Doug Anderson <dianders@chromium.org> - 2017-01-18 20:00 +0100
  Re: [RFC/PATCH 0/3] Fix ctnetlink regressions Pablo Neira Ayuso <pablo@netfilter.org> - 2017-01-25 01:40 +0100

csiph-web