tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp

In Scenario A and B below, as the delayed INIT_ACK always changes the peer
vtag, SCTP ct with the incorrect vtag may cause packet loss.

Scenario A: INIT_ACK is delayed until the peer receives its own INIT_ACK

192.168.1.2 > 192.168.1.1: [INIT] [init tag: 1328086772]
192.168.1.1 > 192.168.1.2: [INIT] [init tag: 1414468151]
192.168.1.2 > 192.168.1.1: [INIT ACK] [init tag: 1328086772]
192.168.1.1 > 192.168.1.2: [INIT ACK] [init tag: 1650211246] *
192.168.1.2 > 192.168.1.1: [COOKIE ECHO]
192.168.1.1 > 192.168.1.2: [COOKIE ECHO]
192.168.1.2 > 192.168.1.1: [COOKIE ACK]

Scenario B: INIT_ACK is delayed until the peer completes its own handshake

192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]
192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]
192.168.1.2 > 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]
192.168.1.1 > 192.168.1.2: sctp (1) [COOKIE ECHO]
192.168.1.2 > 192.168.1.1: sctp (1) [COOKIE ACK]
192.168.1.1 > 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *

This patch fixes it as below:

In SCTP_CID_INIT processing:
- clear ct->proto.sctp.init[!dir] if ct->proto.sctp.init[dir] &&
ct->proto.sctp.init[!dir]. (Scenario E)
- set ct->proto.sctp.init[dir].

In SCTP_CID_INIT_ACK processing:
- drop it if !ct->proto.sctp.init[!dir] && ct->proto.sctp.vtag[!dir] &&
ct->proto.sctp.vtag[!dir] != ih->init_tag. (Scenario B, Scenario C)
- drop it if ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir] &&
ct->proto.sctp.vtag[!dir] != ih->init_tag. (Scenario A)

In SCTP_CID_COOKIE_ACK processing:
- clear ct->proto.sctp.init[dir] and ct->proto.sctp.init[!dir].
(Scenario D)

Also, it's important to allow the ct state to move forward with cookie_echo
and cookie_ack from the opposite dir for the collision scenarios.

There are also other Scenarios where it should allow the packet through,
addressed by the processing above:

Scenario C: new CT is created by INIT_ACK.

Scenario D: start INIT on the existing ESTABLISHED ct.

Scenario E: start INIT after the old collision on the existing ESTABLISHED
ct.

192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]
192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]
(both side are stopped, then start new connection again in hours)
192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 242308742]

Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>

authored by

Xin Long and committed by
Florian Westphal 8e56b063 af84f9e4

+34 -10
+1
include/linux/netfilter/nf_conntrack_sctp.h
··· 9 9 enum sctp_conntrack state; 10 10 11 11 __be32 vtag[IP_CT_DIR_MAX]; 12 + u8 init[IP_CT_DIR_MAX]; 12 13 u8 last_dir; 13 14 u8 flags; 14 15 };
+33 -10
net/netfilter/nf_conntrack_proto_sctp.c
··· 112 112 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA, sSA}, 113 113 /* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL},/* Can't have Stale cookie*/ 114 114 /* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA, sCL},/* 5.2.4 - Big TODO */ 115 - /* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL},/* Can't come in orig dir */ 115 + /* cookie_ack */ {sCL, sCL, sCW, sES, sES, sSS, sSR, sSA, sCL},/* Can't come in orig dir */ 116 116 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL, sCL}, 117 117 /* heartbeat */ {sHS, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS}, 118 118 /* heartbeat_ack*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS}, ··· 126 126 /* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV}, 127 127 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV}, 128 128 /* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA, sIV}, 129 - /* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV},/* Can't come in reply dir */ 129 + /* cookie_echo */ {sIV, sCL, sCE, sCE, sES, sSS, sSR, sSA, sIV},/* Can't come in reply dir */ 130 130 /* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA, sIV}, 131 131 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL, sIV}, 132 132 /* heartbeat */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS}, ··· 412 412 /* (D) vtag must be same as init_vtag as found in INIT_ACK */ 413 413 if (sh->vtag != ct->proto.sctp.vtag[dir]) 414 414 goto out_unlock; 415 + } else if (sch->type == SCTP_CID_COOKIE_ACK) { 416 + ct->proto.sctp.init[dir] = 0; 417 + ct->proto.sctp.init[!dir] = 0; 415 418 } else if (sch->type == SCTP_CID_HEARTBEAT) { 416 419 if (ct->proto.sctp.vtag[dir] == 0) { 417 420 pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir); ··· 464 461 } 465 462 466 463 /* If it is an INIT or an INIT ACK note down the vtag */ 467 - if (sch->type == SCTP_CID_INIT || 468 - sch->type == SCTP_CID_INIT_ACK) { 469 - struct sctp_inithdr _inithdr, *ih; 464 + if (sch->type == SCTP_CID_INIT) { 465 + struct sctp_inithdr _ih, *ih; 470 466 471 - ih = skb_header_pointer(skb, offset + sizeof(_sch), 472 - sizeof(_inithdr), &_inithdr); 473 - if (ih == NULL) 467 + ih = skb_header_pointer(skb, offset + sizeof(_sch), sizeof(*ih), &_ih); 468 + if (!ih) 474 469 goto out_unlock; 475 - pr_debug("Setting vtag %x for dir %d\n", 476 - ih->init_tag, !dir); 470 + 471 + if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir]) 472 + ct->proto.sctp.init[!dir] = 0; 473 + ct->proto.sctp.init[dir] = 1; 474 + 475 + pr_debug("Setting vtag %x for dir %d\n", ih->init_tag, !dir); 477 476 ct->proto.sctp.vtag[!dir] = ih->init_tag; 478 477 479 478 /* don't renew timeout on init retransmit so ··· 486 481 old_state == SCTP_CONNTRACK_CLOSED && 487 482 nf_ct_is_confirmed(ct)) 488 483 ignore = true; 484 + } else if (sch->type == SCTP_CID_INIT_ACK) { 485 + struct sctp_inithdr _ih, *ih; 486 + __be32 vtag; 487 + 488 + ih = skb_header_pointer(skb, offset + sizeof(_sch), sizeof(*ih), &_ih); 489 + if (!ih) 490 + goto out_unlock; 491 + 492 + vtag = ct->proto.sctp.vtag[!dir]; 493 + if (!ct->proto.sctp.init[!dir] && vtag && vtag != ih->init_tag) 494 + goto out_unlock; 495 + /* collision */ 496 + if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir] && 497 + vtag != ih->init_tag) 498 + goto out_unlock; 499 + 500 + pr_debug("Setting vtag %x for dir %d\n", ih->init_tag, !dir); 501 + ct->proto.sctp.vtag[!dir] = ih->init_tag; 489 502 } 490 503 491 504 ct->proto.sctp.state = new_state;