[PATCH] netfilter: synproxy: fix conntrackd interaction

[PATCH] netfilter: synproxy: fix conntrackd interaction

[Eric Leblond]

This patch fixes the creation of connection tracking entry from
netlink when synproxy is used. It was missing the addition of
the synproxy extension.

This was causing kernel crashes when a conntrack entry created by
conntrackd was used after the switch of traffic from active node
to the passive node.
---
 net/netfilter/nf_conntrack_netlink.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index dcf561b5c97a..1a127677ffe1 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,6 +45,8 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -1828,6 +1830,8 @@ ctnetlink_create_conntrack(struct net *net,
 	nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
 	nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
 	nf_ct_labels_ext_add(ct);
+	nfct_seqadj_ext_add(ct);
+	nfct_synproxy_ext_add(ct);
 
 	/* we must add conntrack extensions before confirmation. */
 	ct->status |= IPS_CONFIRMED;
-- 
2.11.0

Re: [PATCH] netfilter: synproxy: fix conntrackd interaction

[Jesper Dangaard Brouer]

On Thu, 11 May 2017 15:22:55 +0200
Eric Leblond <eric@regit.org> wrote:

> This patch fixes the creation of connection tracking entry from
> netlink when synproxy is used. It was missing the addition of
> the synproxy extension.
> 
> This was causing kernel crashes when a conntrack entry created by
> conntrackd was used after the switch of traffic from active node
> to the passive node.

You are missing a Signed-off-by line ;-)

> ---
>  net/netfilter/nf_conntrack_netlink.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> index dcf561b5c97a..1a127677ffe1 100644
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -45,6 +45,8 @@
>  #include <net/netfilter/nf_conntrack_zones.h>
>  #include <net/netfilter/nf_conntrack_timestamp.h>
>  #include <net/netfilter/nf_conntrack_labels.h>
> +#include <net/netfilter/nf_conntrack_seqadj.h>
> +#include <net/netfilter/nf_conntrack_synproxy.h>
>  #ifdef CONFIG_NF_NAT_NEEDED
>  #include <net/netfilter/nf_nat_core.h>
>  #include <net/netfilter/nf_nat_l4proto.h>
> @@ -1828,6 +1830,8 @@ ctnetlink_create_conntrack(struct net *net,
>  	nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
>  	nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
>  	nf_ct_labels_ext_add(ct);
> +	nfct_seqadj_ext_add(ct);
> +	nfct_synproxy_ext_add(ct);
>  
>  	/* we must add conntrack extensions before confirmation. */
>  	ct->status |= IPS_CONFIRMED;



-- 
Best regards,
  Jesper Dangaard Brouer
  MSc.CS, Principal Kernel Engineer at Red Hat
  LinkedIn: http://www.linkedin.com/in/brouer

[PATCH] netfilter: synproxy: fix conntrackd interaction

[Eric Leblond]

This patch fixes the creation of connection tracking entry from
netlink when synproxy is used. It was missing the addition of
the synproxy extension.

This was causing kernel crashes when a conntrack entry created by
conntrackd was used after the switch of traffic from active node
to the passive node.

Signed-off-by: Eric Leblond <eric@regit.org>
---
 net/netfilter/nf_conntrack_netlink.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index dcf561b5c97a..1a127677ffe1 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,6 +45,8 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -1828,6 +1830,8 @@ ctnetlink_create_conntrack(struct net *net,
 	nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
 	nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
 	nf_ct_labels_ext_add(ct);
+	nfct_seqadj_ext_add(ct);
+	nfct_synproxy_ext_add(ct);
 
 	/* we must add conntrack extensions before confirmation. */
 	ct->status |= IPS_CONFIRMED;
-- 
2.11.0

Re: [PATCH] netfilter: synproxy: fix conntrackd interaction

[Pablo Neira Ayuso]

On Thu, May 11, 2017 at 06:56:38PM +0200, Eric Leblond wrote:
> This patch fixes the creation of connection tracking entry from
> netlink when synproxy is used. It was missing the addition of
> the synproxy extension.
> 
> This was causing kernel crashes when a conntrack entry created by
> conntrackd was used after the switch of traffic from active node
> to the passive node.

Applied, thanks Eric.

Re: [PATCH] netfilter: synproxy: fix conntrackd interaction

[Pablo Neira Ayuso]

On Mon, May 15, 2017 at 07:49:18PM +0200, Eric Leblond wrote:
>    Hello,
>    Le 15 mai 2017 6:52 PM, Pablo Neira Ayuso <pablo@netfilter.org> a
>    écrit :
> 
>      On Thu, May 11, 2017 at 06:56:38PM +0200, Eric Leblond wrote:
>      > This patch fixes the creation of connection tracking entry from
>      > netlink when synproxy is used. It was missing the addition of
>      > the synproxy extension.
>      >
>      > This was causing kernel crashes when a conntrack entry created by
>      > conntrackd was used after the switch of traffic from active node
>      > to the passive node.
>      Applied, thanks Eric.
> 
>    Thanks Pablo !
>    Will you push it to stable as it is causing a crash on older kernel
>    like 3.16?

Does this compile cleanly as is?

If so, I can just request -stable maintainer to take it as soon as
this hits upstream.

Re: [PATCH] netfilter: synproxy: fix conntrackd interaction

[Eric Leblond]

Hi,

On Mon, 2017-05-15 at 19:55 +0200, Pablo Neira Ayuso wrote:
> On Mon, May 15, 2017 at 07:49:18PM +0200, Eric Leblond wrote:
> >    Hello,
> >    Le 15 mai 2017 6:52 PM, Pablo Neira Ayuso <pablo@netfilter.org>
> > a
> >    écrit :
> > 
> >      On Thu, May 11, 2017 at 06:56:38PM +0200, Eric Leblond wrote:
> >      > This patch fixes the creation of connection tracking entry
> > from
> >      > netlink when synproxy is used. It was missing the addition
> > of
> >      > the synproxy extension.
> >      >
> >      > This was causing kernel crashes when a conntrack entry
> > created by
> >      > conntrackd was used after the switch of traffic from active
> > node
> >      > to the passive node.
> >      Applied, thanks Eric.
> > 
> >    Thanks Pablo !
> >    Will you push it to stable as it is causing a crash on older
> > kernel
> >    like 3.16?
> 
> Does this compile cleanly as is?

Yes, I have tested the patch on 3.16.1 and it applies cleanly. I've
build module for 4.1 and patch applies too. I did not test it but code
is unchanged.

> If so, I can just request -stable maintainer to take it as soon as
> this hits upstream.

Thanks!

BR,
-- 
Eric Leblond <eric@regit.org>