From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg KH Subject: Re: [PATCH v3] netfilter: xt_connlimit: fix race in connection counting Date: Thu, 10 Jan 2019 20:19:09 +0100 Message-ID: <20190110191909.GG18221@kroah.com> References: <20190103002839.GA111435@dev-dsk-alakeshh-2c-f8a3e6e0.us-west-2.amazon.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: stable@vger.kernel.org, Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal , "David S. Miller" , Dmitry Andrianov , Justin Pettit , Yi-Hung Wei , netdev@vger.kernel.org To: Alakesh Haloi Return-path: Content-Disposition: inline In-Reply-To: <20190103002839.GA111435@dev-dsk-alakeshh-2c-f8a3e6e0.us-west-2.amazon.com> Sender: stable-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Thu, Jan 03, 2019 at 12:28:46AM +0000, Alakesh Haloi wrote: > commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm > race") > > An iptable rule like the following on a multicore systems will result in > accepting more connections than set in the rule. > > iptables -A INPUT -p tcp -m tcp --syn --dport 7777 -m connlimit \ > --connlimit-above 2000 --connlimit-mask 0 -j DROP > > In check_hlist function, connections that are found in saved connections > but not in netfilter conntrack are deleted, assuming that those > connections do not exist anymore. But for multi core systems, there exists > a small time window, when a connection has been added to the xt_connlimit > maintained rb-tree but has not yet made to netfilter conntrack table. This > causes concurrent connections to return incorrect counts and go over limit > set in iptable rule. > > The fix has been partially backported from the above mentioned upstream > commit. Introduce timestamp and the owning cpu. > > Signed-off-by: Alakesh Haloi > Cc: Pablo Neira Ayuso > Cc: Jozsef Kadlecsik > Cc: Florian Westphal > Cc: "David S. Miller" > Cc: stable@vger.kernel.org # v4.15 and before But 4.14.92 already b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race") and 4cd273bb91b3 ("netfilter: nf_conncount: don't skip eviction when age is negative") in it. Are you sure you still need this patch? thanks, greg k-h From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_MUTT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5165C43387 for ; Thu, 10 Jan 2019 19:27:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B4EB6208E3 for ; Thu, 10 Jan 2019 19:27:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b="eewpeJYP"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="G9j5kbT/" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729536AbfAJT1P (ORCPT ); Thu, 10 Jan 2019 14:27:15 -0500 Received: from new2-smtp.messagingengine.com ([66.111.4.224]:42975 "EHLO new2-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728572AbfAJT1P (ORCPT ); Thu, 10 Jan 2019 14:27:15 -0500 X-Greylist: delayed 481 seconds by postgrey-1.27 at vger.kernel.org; Thu, 10 Jan 2019 14:27:14 EST Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailnew.nyi.internal (Postfix) with ESMTP id D3EC413F18; Thu, 10 Jan 2019 14:19:12 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute6.internal (MEProxy); Thu, 10 Jan 2019 14:19:12 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kroah.com; h= date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=fm2; bh=VgTrF3ZXc9nlA/SBoKpUZ5Ag+v+ dqUPCaRoagBaNHEg=; b=eewpeJYPaPNTkgjmYeikqiHvY5Yo0ouJkpKqGsZtk0x a4PI5ovRNA1Yu0sa03/ItwxrrGD4mBIgdeQHPX9QbFfS+jTe79mK8EE28TpV8B3M tGtrlH0q+91M3OzJkQdzEvy9cB+B4rZlbgMSlVl0zMoHlElC0DtrreVF07NTdYOb 7bnEiqcdEu+jKoDZh1TMxobl39oaqhzCEyY/5fv3ADfjKxiLBTH/w1otrSu9Rxlq wsQRTLOw2nGufGa6mbrOdWVM72wCwl08/zYDzJiM/+mjHL6mL1EMzNAnyLbUxy6x wcEeoQO9i8m4AvIZiXkxkDqFEF+zm8PyLp4iS1xj2Vw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=VgTrF3 ZXc9nlA/SBoKpUZ5Ag+v+dqUPCaRoagBaNHEg=; b=G9j5kbT/sSFCWyZee36uFi GUV70oC8D8I56ZKQ/nIoby5CxinmDSuikXFYAcfn43itf8EXQtdFaHi2s2sx06pI LrIakRY7R5g2CoOMRrN1RcaVCxywA2dKZTNWkT8198YOs+4ExqQi2aRf03vTwJe4 YlzlumqiqbuHul05GASJgVNQC+d5UEeGN0JKSCrkbMdAdPJdc9OA+dfVht0d1mfW yV4a+RWEDGtFkjHEjaRBFuNEhl1ASlIOj3xrCNJk1BzQ9tebuxOfG/YStD4xldCQ qvIOkJIsca3QNOilIZzqZLskgGott7KL9bfCLqI/xORlIR+bdxVqrTPv1KxZkUzw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedtledrfeefgdduvdehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfquhhtnecuuegrihhlohhuthemucef tddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenogfuphgrmhfkphculdeftd dtmdenucfjughrpeffhffvuffkfhggtggujggfsehttdertddtredvnecuhfhrohhmpefi rhgvghcumffjuceoghhrvghgsehkrhhorghhrdgtohhmqeenucfkphepkeefrdekiedrke elrddutdejnecurfgrrhgrmhepmhgrihhlfhhrohhmpehgrhgvgheskhhrohgrhhdrtgho mhenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: from localhost (5356596b.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) by mail.messagingengine.com (Postfix) with ESMTPA id E56D6E4043; Thu, 10 Jan 2019 14:19:10 -0500 (EST) Date: Thu, 10 Jan 2019 20:19:09 +0100 From: Greg KH To: Alakesh Haloi Cc: stable@vger.kernel.org, Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal , "David S. Miller" , Dmitry Andrianov , Justin Pettit , Yi-Hung Wei , netdev@vger.kernel.org Subject: Re: [PATCH v3] netfilter: xt_connlimit: fix race in connection counting Message-ID: <20190110191909.GG18221@kroah.com> References: <20190103002839.GA111435@dev-dsk-alakeshh-2c-f8a3e6e0.us-west-2.amazon.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190103002839.GA111435@dev-dsk-alakeshh-2c-f8a3e6e0.us-west-2.amazon.com> User-Agent: Mutt/1.11.2 (2019-01-07) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Message-ID: <20190110191909.koWDqWiLFF2CLHjpFmzeZD7hDo3M9g0TT2Z3lzup3ys@z> On Thu, Jan 03, 2019 at 12:28:46AM +0000, Alakesh Haloi wrote: > commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm > race") > > An iptable rule like the following on a multicore systems will result in > accepting more connections than set in the rule. > > iptables -A INPUT -p tcp -m tcp --syn --dport 7777 -m connlimit \ > --connlimit-above 2000 --connlimit-mask 0 -j DROP > > In check_hlist function, connections that are found in saved connections > but not in netfilter conntrack are deleted, assuming that those > connections do not exist anymore. But for multi core systems, there exists > a small time window, when a connection has been added to the xt_connlimit > maintained rb-tree but has not yet made to netfilter conntrack table. This > causes concurrent connections to return incorrect counts and go over limit > set in iptable rule. > > The fix has been partially backported from the above mentioned upstream > commit. Introduce timestamp and the owning cpu. > > Signed-off-by: Alakesh Haloi > Cc: Pablo Neira Ayuso > Cc: Jozsef Kadlecsik > Cc: Florian Westphal > Cc: "David S. Miller" > Cc: stable@vger.kernel.org # v4.15 and before But 4.14.92 already b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race") and 4cd273bb91b3 ("netfilter: nf_conncount: don't skip eviction when age is negative") in it. Are you sure you still need this patch? thanks, greg k-h