netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation

Ulrich reports a regression with nfqueue:

If an application did not set the 'F_GSO' capability flag and a gso
packet with an unconfirmed nf_conn entry is received all packets are
now dropped instead of queued, because the check happens after
skb_gso_segment(). In that case, we did have exclusive ownership
of the skb and its associated conntrack entry. The elevated use
count is due to skb_clone happening via skb_gso_segment().

Move the check so that its peformed vs. the aggregated packet.

Then, annotate the individual segments except the first one so we
can do a 2nd check at reinject time.

For the normal case, where userspace does in-order reinjects, this avoids
packet drops: first reinjected segment continues traversal and confirms
entry, remaining segments observe the confirmed entry.

While at it, simplify nf_ct_drop_unconfirmed(): We only care about
unconfirmed entries with a refcnt > 1, there is no need to special-case
dying entries.

This only happens with UDP. With TCP, the only unconfirmed packet will
be the TCP SYN, those aren't aggregated by GRO.

Next patch adds a udpgro test case to cover this scenario.

Reported-by: Ulrich Weber <ulrich.weber@gmail.com>
Fixes: 7d8dc1c7be8d ("netfilter: nf_queue: drop packets with cloned unconfirmed conntracks")
Signed-off-by: Florian Westphal <fw@strlen.de>

Florian Westphal 4 months ago 207b3eba 35f83a75

+75 -49

2 changed files

expand all

include

net

netfilter

nf_queue.h

net

netfilter

nfnetlink_queue.c

include/net/netfilter/nf_queue.h

··· 21 21 struct net_device *physout; 22 22 #endif 23 23 struct nf_hook_state state; 24 + bool nf_ct_is_unconfirmed; 24 25 u16 size; /* sizeof(entry) + saved route keys */ 25 26 u16 queue_num; 26 27

+74 -49

net/netfilter/nfnetlink_queue.c

··· 435 435 nf_queue_entry_free(entry); 436 436 } 437 437 438 + /* return true if the entry has an unconfirmed conntrack attached that isn't owned by us 439 + * exclusively. 440 + */ 441 + static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry, bool *is_unconfirmed) 442 + { 443 + #if IS_ENABLED(CONFIG_NF_CONNTRACK) 444 + struct nf_conn *ct = (void *)skb_nfct(entry->skb); 445 + 446 + if (!ct || nf_ct_is_confirmed(ct)) 447 + return false; 448 + 449 + if (is_unconfirmed) 450 + *is_unconfirmed = true; 451 + 452 + /* in some cases skb_clone() can occur after initial conntrack 453 + * pickup, but conntrack assumes exclusive skb->_nfct ownership for 454 + * unconfirmed entries. 455 + * 456 + * This happens for br_netfilter and with ip multicast routing. 457 + * This can't be solved with serialization here because one clone 458 + * could have been queued for local delivery or could be transmitted 459 + * in parallel on another CPU. 460 + */ 461 + return refcount_read(&ct->ct_general.use) > 1; 462 + #endif 463 + return false; 464 + } 465 + 438 466 static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict) 439 467 { 440 468 const struct nf_ct_hook *ct_hook; ··· 490 462 break; 491 463 } 492 464 } 465 + 466 + if (verdict != NF_DROP && entry->nf_ct_is_unconfirmed) { 467 + /* If first queued segment was already reinjected then 468 + * there is a good chance the ct entry is now confirmed. 469 + * 470 + * Handle the rare cases: 471 + * - out-of-order verdict 472 + * - threaded userspace reinjecting in parallel 473 + * - first segment was dropped 474 + * 475 + * In all of those cases we can't handle this packet 476 + * because we can't be sure that another CPU won't modify 477 + * nf_conn->ext in parallel which isn't allowed. 478 + */ 479 + if (nf_ct_drop_unconfirmed(entry, NULL)) 480 + verdict = NF_DROP; 481 + } 482 + 493 483 nf_reinject(entry, verdict); 494 484 } 495 485 ··· 937 891 return NULL; 938 892 } 939 893 940 - static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry) 941 - { 942 - #if IS_ENABLED(CONFIG_NF_CONNTRACK) 943 - static const unsigned long flags = IPS_CONFIRMED | IPS_DYING; 944 - struct nf_conn *ct = (void *)skb_nfct(entry->skb); 945 - unsigned long status; 946 - unsigned int use; 947 - 948 - if (!ct) 949 - return false; 950 - 951 - status = READ_ONCE(ct->status); 952 - if ((status & flags) == IPS_DYING) 953 - return true; 954 - 955 - if (status & IPS_CONFIRMED) 956 - return false; 957 - 958 - /* in some cases skb_clone() can occur after initial conntrack 959 - * pickup, but conntrack assumes exclusive skb->_nfct ownership for 960 - * unconfirmed entries. 961 - * 962 - * This happens for br_netfilter and with ip multicast routing. 963 - * We can't be solved with serialization here because one clone could 964 - * have been queued for local delivery. 965 - */ 966 - use = refcount_read(&ct->ct_general.use); 967 - if (likely(use == 1)) 968 - return false; 969 - 970 - /* Can't decrement further? Exclusive ownership. */ 971 - if (!refcount_dec_not_one(&ct->ct_general.use)) 972 - return false; 973 - 974 - skb_set_nfct(entry->skb, 0); 975 - /* No nf_ct_put(): we already decremented .use and it cannot 976 - * drop down to 0. 977 - */ 978 - return true; 979 - #endif 980 - return false; 981 - } 982 - 983 894 static int 984 895 __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue, 985 896 struct nf_queue_entry *entry) ··· 952 949 goto err_out; 953 950 } 954 951 spin_lock_bh(&queue->lock); 955 - 956 - if (nf_ct_drop_unconfirmed(entry)) 957 - goto err_out_free_nskb; 958 952 959 953 if (queue->queue_total >= queue->queue_maxlen) 960 954 goto err_out_queue_drop; ··· 995 995 else 996 996 net_warn_ratelimited("nf_queue: hash insert failed: %d\n", err); 997 997 } 998 - err_out_free_nskb: 999 998 kfree_skb(nskb); 1000 999 err_out_unlock: 1001 1000 spin_unlock_bh(&queue->lock); ··· 1073 1074 static int 1074 1075 nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum) 1075 1076 { 1076 - unsigned int queued; 1077 - struct nfqnl_instance *queue; 1078 1077 struct sk_buff *skb, *segs, *nskb; 1078 + bool ct_is_unconfirmed = false; 1079 + struct nfqnl_instance *queue; 1080 + unsigned int queued; 1079 1081 int err = -ENOBUFS; 1080 1082 struct net *net = entry->state.net; 1081 1083 struct nfnl_queue_net *q = nfnl_queue_pernet(net); ··· 1100 1100 break; 1101 1101 } 1102 1102 1103 + /* Check if someone already holds another reference to 1104 + * unconfirmed ct. If so, we cannot queue the skb: 1105 + * concurrent modifications of nf_conn->ext are not 1106 + * allowed and we can't know if another CPU isn't 1107 + * processing the same nf_conn entry in parallel. 1108 + */ 1109 + if (nf_ct_drop_unconfirmed(entry, &ct_is_unconfirmed)) 1110 + return -EINVAL; 1111 + 1103 1112 if (!skb_is_gso(skb) || ((queue->flags & NFQA_CFG_F_GSO) && !skb_is_gso_sctp(skb))) 1104 1113 return __nfqnl_enqueue_packet(net, queue, entry); 1105 1114 ··· 1122 1113 goto out_err; 1123 1114 queued = 0; 1124 1115 err = 0; 1116 + 1125 1117 skb_list_walk_safe(segs, segs, nskb) { 1118 + if (ct_is_unconfirmed && queued > 0) { 1119 + /* skb_gso_segment() increments the ct refcount. 1120 + * This is a problem for unconfirmed (not in hash) 1121 + * entries, those can race when reinjections happen 1122 + * in parallel. 1123 + * 1124 + * Annotate this for all queued entries except the 1125 + * first one. 1126 + * 1127 + * As long as the first one is reinjected first it 1128 + * will do the confirmation for us. 1129 + */ 1130 + entry->nf_ct_is_unconfirmed = ct_is_unconfirmed; 1131 + } 1132 + 1126 1133 if (err == 0) 1127 1134 err = __nfqnl_enqueue_packet_gso(net, queue, 1128 1135 segs, entry);

Configure Feed

Configure Feed