Re: [PATCH net] sched: act_ct: add netns into the key of tcf_ct_flow_table

[Simon Horman <horms@kernel.org>]

On Sat, Jun 15, 2024 at 05:47:30PM -0400, Xin Long wrote:
> zones_ht is a global hashtable for flow_table with zone as key. However,
> it does not consider netns when getting a flow_table from zones_ht in
> tcf_ct_init(), and it means an act_ct action in netns A may get a
> flow_table that belongs to netns B if it has the same zone value.
> 
> In Shuang's test with the TOPO:
> 
>   tcf2_c <---> tcf2_sw1 <---> tcf2_sw2 <---> tcf2_s
> 
> tcf2_sw1 and tcf2_sw2 saw the same flow and used the same flow table,
> which caused their ct entries entering unexpected states and the
> TCP connection not able to end normally.
> 
> This patch fixes the issue simply by adding netns into the key of
> tcf_ct_flow_table so that an act_ct action gets a flow_table that
> belongs to its own netns in tcf_ct_init().
> 
> Note that for easy coding we don't use tcf_ct_flow_table.nf_ft.net,
> as the ct_ft is initialized after inserting it to the hashtable in
> tcf_ct_flow_table_get() and also it requires to implement several
> functions in rhashtable_params including hashfn, obj_hashfn and
> obj_cmpfn.
> 
> Fixes: 64ff70b80fd4 ("net/sched: act_ct: Offload established connections to flow table")
> Reported-by: Shuang Li <shuali@redhat.com>
> Signed-off-by: Xin Long <lucien.xin@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>