[PATCH nf] netfilter: connmark: ignore skbs with magic untracked conntrack objects

[PATCH nf] netfilter: connmark: ignore skbs with magic untracked conntrack objects

[Florian Westphal]

The (percpu) untracked conntrack entries can end up with nonzero connmarks.

The 'untracked' conntrack objects are merely a way to distinguish INVALID
(i.e. protocol connection tracker says payload doesn't meet some
requirements or packet was never seen by the connection tracking code)
from packets that are intentionally not tracked (some icmpv6 types such as
neigh solicitation, or by using 'iptables -j CT --notrack' option).

Untracked conntrack objects are implementation detail, we might as well use
invalid magic address instead to tell INVALID and UNTRACKED apart.

Check skb->nfct for untracked dummy and behave as if skb->nfct is NULL.

Reported-by: XU Tianwen <evan.xu.tianwen@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
Here is the formal submit of earlier RFC patch, I also fixed
connmark match; conceptually UNTRACKED is not a conntrack object
so such skb should always fail the match.

diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 69f78e96fdb4..b83e158e116a 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -44,7 +44,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	u_int32_t newmark;
 
 	ct = nf_ct_get(skb, &ctinfo);
-	if (ct == NULL)
+	if (ct == NULL || nf_ct_is_untracked(ct))
 		return XT_CONTINUE;
 
 	switch (info->mode) {
@@ -97,7 +97,7 @@ connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	const struct nf_conn *ct;
 
 	ct = nf_ct_get(skb, &ctinfo);
-	if (ct == NULL)
+	if (ct == NULL || nf_ct_is_untracked(ct))
 		return false;
 
 	return ((ct->mark & info->mask) == info->mark) ^ info->invert;
-- 
2.7.3

Re: [PATCH nf] netfilter: connmark: ignore skbs with magic untracked conntrack objects

[Pablo Neira Ayuso]

On Sat, Oct 29, 2016 at 03:01:50AM +0200, Florian Westphal wrote:
> The (percpu) untracked conntrack entries can end up with nonzero connmarks.
> 
> The 'untracked' conntrack objects are merely a way to distinguish INVALID
> (i.e. protocol connection tracker says payload doesn't meet some
> requirements or packet was never seen by the connection tracking code)
> from packets that are intentionally not tracked (some icmpv6 types such as
> neigh solicitation, or by using 'iptables -j CT --notrack' option).
> 
> Untracked conntrack objects are implementation detail, we might as well use
> invalid magic address instead to tell INVALID and UNTRACKED apart.

We may consider recovering this old idea: https://lwn.net/Articles/141489/

> Check skb->nfct for untracked dummy and behave as if skb->nfct is NULL.
> 
> Reported-by: XU Tianwen <evan.xu.tianwen@gmail.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> Here is the formal submit of earlier RFC patch, I also fixed
> connmark match; conceptually UNTRACKED is not a conntrack object
> so such skb should always fail the match.

Applied, thanks.