Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging

[Florian Westphal <fw@strlen.de>]

Jamal Hadi Salim <jhs@mojatatu.com> wrote:
> Example: If the ebpf one could be reproduced with unshare -urn would
> it have been fine to make the fix sit in netfilter?

I don't know how to 'fix netfilter'.  We would have to remove skb->nfct
and re-parse at every turn.  Is that a viable option...? Don't think so.

> > And that doesn't solve BPF (can sit anywhere) or OVS (no idea here if
> > its affected or not).
> 
> OVS is very likely affected.
> I saw your other email and you are the expert, but I am itchy to try
> the nf_confirm() approach.
> At minimal it should fix the PoC imo.

As I said, I don't see any existing function that could be used
to add the required re-validation.  nf_confirm() is the last step
in the pipeline, its way too late.  nf_conntrack_in() doesn't work
either because you can install matches earlier than that, e.g. via
-t raw -m conntrack in classic iptables, or via 'hook prerouting
type filter priority -2147483647' or something like that in
nftables.

The only other option is playing whack-a-mole, accepting the original
proposed patch for nft_ct, but I can already tell this will not be
enough and revalidation will have to be added everywhere.