[PATCH nf 0/5] conntrack expectation fixes

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

This series addresses races in the conntrack expectation
subsystem.

Patch #1 and #2 honor the exp->helper as a replacement to accessing
exp->master->helper which is unsafe when accessed away from the
nf_conntrack_expect spinlock, because the ct->ext is released
immediately, hence rcu_read_lock section cannot help in such case. On
the contrary, accessing exp->helper under rcu_read_lock section is safe.

Patch #3 extends the spinlock section in delete and get expectation
commands in ctnetlink, because holding a reference on the expectation
is not sufficient, the master conntrack can go away rendering
exp->master unsafe.

Patch #4 and #5 move the netns and zone to the expectation object.
This is to fix /proc/net/nf_conntrack_expect which is dumping the
global expectation table in every netns. By moving these fields
to the expectation, it is safe to access them under rcu_read_lock
section.

This passing tests with shell and scapy generated traffic to create
expectations for the ftp and tftp helpers, I am still reviewing the
remaining helpers in the tree. I will come back with a confirmation
that all is ok on that front too.

Pablo Neira Ayuso (5):
  netfilter: nf_conntrack_expect: honor expectation helper field
  netfilter: nf_conntrack_expect: use expect->helper
  netfilter: ctnetlink: ensure safe access to master conntrack
  netfilter: nf_conntrack_expect: store netns and zone in expectation
  netfilter: nf_conntrack_expect: skip expectations in other netns via proc

 include/net/netfilter/nf_conntrack_core.h   |  8 +++
 include/net/netfilter/nf_conntrack_expect.h | 20 ++++++-
 net/netfilter/nf_conntrack_broadcast.c      |  2 +-
 net/netfilter/nf_conntrack_ecache.c         |  2 +
 net/netfilter/nf_conntrack_expect.c         | 30 +++++++++--
 net/netfilter/nf_conntrack_h323_main.c      | 12 ++---
 net/netfilter/nf_conntrack_helper.c         |  8 ++-
 net/netfilter/nf_conntrack_netlink.c        | 58 ++++++++++++---------
 net/netfilter/nf_conntrack_sip.c            |  4 +-
 9 files changed, 101 insertions(+), 43 deletions(-)

-- 
2.47.3