* [PATCH net 0/1] Netfilter fixes for net
@ 2023-01-17 22:06 Pablo Neira Ayuso
2023-01-17 22:06 ` [PATCH net 1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-17 22:06 UTC (permalink / raw)
To: netfilter-devel
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix syn-retransmits until initiator gives up when connection is re-used
due to rst marked as invalid, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 1f3bd64ad921f051254591fbed04fd30b306cde6:
net: stmmac: fix invalid call to mdiobus_get_phy() (2023-01-17 13:33:19 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to c410cb974f2ba562920ecb8492ee66945dcf88af:
netfilter: conntrack: handle tcp challenge acks during connection reuse (2023-01-17 23:00:06 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: handle tcp challenge acks during connection reuse
net/netfilter/nf_conntrack_proto_tcp.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH net 1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse
2023-01-17 22:06 [PATCH net 0/1] Netfilter fixes for net Pablo Neira Ayuso
@ 2023-01-17 22:06 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-17 22:06 UTC (permalink / raw)
To: netfilter-devel
From: Florian Westphal <fw@strlen.de>
When a connection is re-used, following can happen:
[ connection starts to close, fin sent in either direction ]
> syn # initator quickly reuses connection
< ack # peer sends a challenge ack
> rst # rst, sequence number == ack_seq of previous challenge ack
> syn # this syn is expected to pass
Problem is that the rst will fail window validation, so it gets
tagged as invalid.
If ruleset drops such packets, we get repeated syn-retransmits until
initator gives up or peer starts responding with syn/ack.
Before the commit indicated in the "Fixes" tag below this used to work:
The challenge-ack made conntrack re-init state based on the challenge
ack itself, so the following rst would pass window validation.
Add challenge-ack support: If we get ack for syn, record the ack_seq,
and then check if the rst sequence number matches the last ack number
seen in reverse direction.
Fixes: c7aab4f17021 ("netfilter: nf_conntrack_tcp: re-init for syn packets only")
Reported-by: Michal Tesar <mtesar@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_proto_tcp.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 656631083177..3ac1af6f59fc 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1068,6 +1068,13 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
ct->proto.tcp.last_flags |=
IP_CT_EXP_CHALLENGE_ACK;
}
+
+ /* possible challenge ack reply to syn */
+ if (old_state == TCP_CONNTRACK_SYN_SENT &&
+ index == TCP_ACK_SET &&
+ dir == IP_CT_DIR_REPLY)
+ ct->proto.tcp.last_ack = ntohl(th->ack_seq);
+
spin_unlock_bh(&ct->lock);
nf_ct_l4proto_log_invalid(skb, ct, state,
"packet (index %d) in dir %d ignored, state %s",
@@ -1193,6 +1200,14 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
* segments we ignored. */
goto in_window;
}
+
+ /* Reset in response to a challenge-ack we let through earlier */
+ if (old_state == TCP_CONNTRACK_SYN_SENT &&
+ ct->proto.tcp.last_index == TCP_ACK_SET &&
+ ct->proto.tcp.last_dir == IP_CT_DIR_REPLY &&
+ ntohl(th->seq) == ct->proto.tcp.last_ack)
+ goto in_window;
+
break;
default:
/* Keep compilers happy. */
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net 0/1] Netfilter fixes for net
@ 2023-01-18 9:54 Pablo Neira Ayuso
2023-01-18 9:54 ` [PATCH net 1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-18 9:54 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix syn-retransmits until initiator gives up when connection is re-used
due to rst marked as invalid, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 1f3bd64ad921f051254591fbed04fd30b306cde6:
net: stmmac: fix invalid call to mdiobus_get_phy() (2023-01-17 13:33:19 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to c410cb974f2ba562920ecb8492ee66945dcf88af:
netfilter: conntrack: handle tcp challenge acks during connection reuse (2023-01-17 23:00:06 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: handle tcp challenge acks during connection reuse
net/netfilter/nf_conntrack_proto_tcp.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH net 1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse
2023-01-18 9:54 [PATCH net 0/1] Netfilter fixes for net Pablo Neira Ayuso
@ 2023-01-18 9:54 ` Pablo Neira Ayuso
2023-01-18 13:50 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-18 9:54 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
From: Florian Westphal <fw@strlen.de>
When a connection is re-used, following can happen:
[ connection starts to close, fin sent in either direction ]
> syn # initator quickly reuses connection
< ack # peer sends a challenge ack
> rst # rst, sequence number == ack_seq of previous challenge ack
> syn # this syn is expected to pass
Problem is that the rst will fail window validation, so it gets
tagged as invalid.
If ruleset drops such packets, we get repeated syn-retransmits until
initator gives up or peer starts responding with syn/ack.
Before the commit indicated in the "Fixes" tag below this used to work:
The challenge-ack made conntrack re-init state based on the challenge
ack itself, so the following rst would pass window validation.
Add challenge-ack support: If we get ack for syn, record the ack_seq,
and then check if the rst sequence number matches the last ack number
seen in reverse direction.
Fixes: c7aab4f17021 ("netfilter: nf_conntrack_tcp: re-init for syn packets only")
Reported-by: Michal Tesar <mtesar@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_proto_tcp.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 656631083177..3ac1af6f59fc 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1068,6 +1068,13 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
ct->proto.tcp.last_flags |=
IP_CT_EXP_CHALLENGE_ACK;
}
+
+ /* possible challenge ack reply to syn */
+ if (old_state == TCP_CONNTRACK_SYN_SENT &&
+ index == TCP_ACK_SET &&
+ dir == IP_CT_DIR_REPLY)
+ ct->proto.tcp.last_ack = ntohl(th->ack_seq);
+
spin_unlock_bh(&ct->lock);
nf_ct_l4proto_log_invalid(skb, ct, state,
"packet (index %d) in dir %d ignored, state %s",
@@ -1193,6 +1200,14 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
* segments we ignored. */
goto in_window;
}
+
+ /* Reset in response to a challenge-ack we let through earlier */
+ if (old_state == TCP_CONNTRACK_SYN_SENT &&
+ ct->proto.tcp.last_index == TCP_ACK_SET &&
+ ct->proto.tcp.last_dir == IP_CT_DIR_REPLY &&
+ ntohl(th->seq) == ct->proto.tcp.last_ack)
+ goto in_window;
+
break;
default:
/* Keep compilers happy. */
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net 1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse
2023-01-18 9:54 ` [PATCH net 1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse Pablo Neira Ayuso
@ 2023-01-18 13:50 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-01-18 13:50 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet
Hello:
This patch was applied to netdev/net.git (master)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Wed, 18 Jan 2023 10:54:24 +0100 you wrote:
> From: Florian Westphal <fw@strlen.de>
>
> When a connection is re-used, following can happen:
> [ connection starts to close, fin sent in either direction ]
> > syn # initator quickly reuses connection
> < ack # peer sends a challenge ack
> > rst # rst, sequence number == ack_seq of previous challenge ack
> > syn # this syn is expected to pass
>
> [...]
Here is the summary with links:
- [net,1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse
https://git.kernel.org/netdev/net/c/c410cb974f2b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-01-18 14:10 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-17 22:06 [PATCH net 0/1] Netfilter fixes for net Pablo Neira Ayuso
2023-01-17 22:06 ` [PATCH net 1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2023-01-18 9:54 [PATCH net 0/1] Netfilter fixes for net Pablo Neira Ayuso
2023-01-18 9:54 ` [PATCH net 1/1] netfilter: conntrack: handle tcp challenge acks during connection reuse Pablo Neira Ayuso
2023-01-18 13:50 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).