Florian Westphal
b36e4523d4
netfilter: nf_conncount: fix garbage collection confirm race ...
Yi-Hung Wei and Justin Pettit found a race in the garbage collection scheme
used by nf_conncount.
When doing list walk, we lookup the tuple in the conntrack table.
If the lookup fails we remove this tuple from our list because
the conntrack entry is gone.
This is the common cause, but turns out its not the only one.
The list entry could have been created just before by another cpu, i.e. the
conntrack entry might not yet have been inserted into the global hash.
The avoid this, we introduce a timestamp and the owning cpu.
If the entry appears to be stale, evict only if:
1. The current cpu is the one that added the entry, or,
2. The timestamp is older than two jiffies
The second constraint allows GC to be taken over by other
cpu too (e.g. because a cpu was offlined or napi got moved to another
cpu).
We can't pretend the 'doubtful' entry wasn't in our list.
Instead, when we don't find an entry indicate via IS_ERR
that entry was removed ('did not exist' or withheld
('might-be-unconfirmed').
This most likely also fixes a xt_connlimit imbalance earlier reported by
Dmitry Andrianov.
Cc: Dmitry Andrianov <dmitry.andrianov@alertme.com>
Reported-by: Justin Pettit <jpettit@vmware.com>
Reported-by: Yi-Hung Wei <yihung.wei@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Yi-Hung Wei <yihung.wei@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-06-26 18:28:57 +02:00
netfilter: ipset: forbid family for hash:mac sets
2018-06-06 14:01:00 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-06-16 07:39:34 +09:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-05-23 16:37:11 -04:00
netfilter: nf_tables: add connlimit support
2018-06-03 01:18:29 +02:00
netfilter: nf_tables: add connlimit support
2018-06-03 01:18:29 +02:00
netfilter: nf_conncount: fix garbage collection confirm race
2018-06-26 18:28:57 +02:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: use nf_conntrack_helpers_register when possible
2017-06-19 19:13:21 +02:00
netfilter: nf_conntrack_broadcast: remove useless parameter
2018-03-05 23:15:43 +01:00
netfilter: nfnetlink_queue: resolve clash for unconfirmed conntracks
2018-05-23 09:26:08 +02:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
proc: introduce proc_create_net{,_data}
2018-05-16 07:24:30 +02:00
netfilter: conntrack: include kmemleak.h for kmemleak_not_leak()
2018-04-17 10:59:43 +02:00
netfilter: add __exit mark to helper modules
2018-04-24 10:29:14 +02:00
netfilter: nf_conntrack_h323: Remove unwanted comments.
2018-01-08 18:01:05 +01:00
netfilter: move route indirection to struct nf_ipv6_ops
2018-01-08 18:01:26 +01:00
netfilter: nf_ct_helper: Fix possible panic after nf_conntrack_helper_unregister
2018-06-18 14:15:12 +02:00
netfilter: add __exit mark to helper modules
2018-04-24 10:29:14 +02:00
netfilter: conntrack: place print_tuple in procfs part
2017-08-24 18:52:32 +02:00
netfilter: conntrack: mark extension structs as const
2017-04-26 09:30:22 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-03-30 11:41:18 -04:00
netfilter: ctnetlink: avoid null pointer dereference
2018-06-12 19:31:07 +02:00
netfilter: Remove duplicated rcu_read_lock.
2017-07-24 13:24:46 +02:00
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
netfilter: conntrack: l4 protocol trackers can be const
2018-01-08 18:00:54 +01:00
netfilter: conntrack: timeouts can be const
2018-01-08 18:01:02 +01:00
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
netfilter: conntrack: timeouts can be const
2018-01-08 18:01:02 +01:00
netfilter: Fix handling simultaneous open in TCP conntrack
2018-04-27 00:39:29 +02:00
netfilter: conntrack: timeouts can be const
2018-01-08 18:01:02 +01:00
netfilter: add __exit mark to helper modules
2018-04-24 10:29:14 +02:00
netfilter: conntrack: mark extension structs as const
2017-04-26 09:30:22 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-05-06 21:51:37 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-03-30 11:41:18 -04:00
proc: introduce proc_create_net{,_data}
2018-05-16 07:24:30 +02:00
netfilter: add __exit mark to helper modules
2018-04-24 10:29:14 +02:00
netfilter: conntrack: mark extension structs as const
2017-04-26 09:30:22 +02:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: dup: resolve warnings about missing prototypes
2017-05-29 11:32:36 +02:00
netfilter: nf_flow_table: fix offloading connections with SNAT+DNAT
2018-04-24 10:29:07 +02:00
netfilter: nf_flow_table: move init code to nf_flow_table_core.c
2018-04-24 10:28:45 +02:00
netfilter: nf_flow_table: attach dst to skbs
2018-06-01 09:47:36 +02:00
netfilter: core: export raw versions of add/delete hook functions
2018-05-23 09:14:05 +02:00
netfilter: nf_log: don't hold nf_log_mutex during user access
2018-06-26 16:48:40 +02:00
netfilter: nf_log: do not assume ethernet header in netdev family
2016-12-04 20:45:33 +01:00
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
netfilter: nat: nf_nat_mangle_{udp,tcp}_packet returns boolean
2017-04-06 22:01:38 +02:00
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: nat: merge nf_nat_redirect into nf_nat
2018-05-29 00:25:40 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: extract Passive OS fingerprint infrastructure from xt_osf
2018-05-07 00:02:11 +02:00
netfilter: remove duplicated include
2018-01-10 15:32:15 +01:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
proc: introduce proc_create_net{,_data}
2018-05-16 07:24:30 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-06-16 07:39:34 +09:00
netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
2018-06-12 19:30:11 +02:00
netfilter: nf_tables: Allow chain name of up to 255 chars
2017-07-31 20:41:57 +02:00
netfilter: nf_tables: fix module unload race
2018-06-12 19:28:18 +02:00
netfilter: provide correct argument to nla_strlcpy()
2018-05-24 00:52:35 +02:00
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2018-06-06 18:39:49 -07:00
netfilter: nf_queue: augment nfqa_cfg_policy
2018-06-18 14:13:24 +02:00
netfilter: nf_tables: revisit chain/object refcounting from elements
2017-05-15 12:51:41 +02:00
netfilter: nf_tables: simplify the basic expressions' init routine
2016-11-09 23:42:23 +01:00
netfilter: nf_tables: close race between netns exit and rmmod
2018-06-12 19:28:18 +02:00
netfilter: mark expected switch fall-throughs
2018-01-08 18:01:01 +01:00
netfilter: nft_compat: use call_rcu for nfnl_compat_get
2018-05-29 14:50:26 +02:00
netfilter: nf_conncount: Fix garbage collection with zones
2018-06-12 20:07:07 +02:00
netfilter: nf_tables: add destroy_clone expression
2018-06-03 00:02:11 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-06-03 09:31:58 -04:00
netfilter: nf_tables: add packet duplication to the netdev family
2016-01-03 21:04:23 +01:00
netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL
2018-06-12 19:12:48 +02:00
netfilter: nf_tables: merge exthdr expression into nft core
2018-04-27 00:00:56 +02:00
netfilter: nft_fib: Support existence check
2017-03-13 13:45:36 +01:00
netfilter: nf_tables: use hook state from xt_action_param structure
2016-11-03 11:52:34 +01:00
netfilter: nf_tables: add fib expression to the netdev family
2017-07-31 19:01:40 +02:00
netfilter: nf_tables: simplify lookup functions
2018-04-24 10:29:09 +02:00
netfilter: nft_fwd_netdev: allow to forward packets via neighbour layer
2018-06-01 10:35:47 +02:00
netfilter: fix ptr_ret.cocci warnings
2018-06-01 09:38:40 +02:00
netfilter: nf_tables: fix chain dependency validation
2018-06-01 09:46:22 +02:00
netfilter: nft_limit: fix packet ratelimiting
2018-05-23 09:50:28 +02:00
netfilter: nf_tables: add NFT_LOGLEVEL_* enumeration and use it
2018-06-07 16:14:00 -04:00
netfilter: nf_tables: fix chain dependency validation
2018-06-01 09:46:22 +02:00
netfilter: nf_tables: add single table list for all families
2018-01-10 15:32:08 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-06-03 09:31:58 -04:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: fix ptr_ret.cocci warnings
2018-06-01 09:38:40 +02:00
netfilter: nf_tables: simplify lookup functions
2018-04-24 10:29:09 +02:00
netfilter: fix a few (harmless) sparse warnings
2017-08-28 17:42:56 +02:00
netfilter: Remove exceptional & on function name
2017-04-07 18:24:47 +02:00
netfilter: nf_tables: add select_ops for stateful objects
2017-09-04 13:25:09 +02:00
netfilter: nf_tables: revisit chain/object refcounting from elements
2017-05-15 12:51:41 +02:00
netfilter: nf_tables: add single table list for all families
2018-01-10 15:32:08 +01:00
netfilter: nf_tables: validate the expr explicitly after init successfully
2017-03-06 18:22:12 +01:00
netfilter: nf_tables: validate the expr explicitly after init successfully
2017-03-06 18:22:12 +01:00
netfilter: nf_tables: merge rt expression into nft core
2018-04-27 00:00:55 +02:00
netfilter: nf_tables: Simplify set backend selection
2018-04-24 10:29:11 +02:00
netfilter: nf_tables: garbage collection for stateful expressions
2018-06-03 00:02:10 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
2018-06-11 14:24:32 -07:00
netfilter: nft_socket: fix module autoload
2018-06-12 19:12:45 +02:00
netfilter: move reroute indirection to struct nf_ipv6_ops
2018-01-08 18:10:53 +01:00
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
netfilter: x_tables: use pr ratelimiting in matches/targets
2018-02-14 21:05:37 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: xt_cluster: get rid of xt_cluster_ipv6_is_multicast
2018-03-05 23:15:43 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: Refactor nf_conncount
2018-03-20 13:27:17 +01:00
netfilter: xt_connmark: fix list corruption on rmmod
2018-06-12 19:35:52 +02:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: xt_CT: Reject the non-null terminated string from user space
2018-06-01 10:14:51 +02:00
netfilter: x_tables: move hook state into xt_action_param structure
2016-11-03 10:56:21 +01:00
netfilter: x_tables: remove pr_info where possible
2018-02-14 21:05:33 +01:00
netfilter: x_tables: remove pr_info where possible
2018-02-14 21:05:33 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter/xt_hashlimit: switch to proc_create_{seq,single}_data
2018-05-16 07:24:30 +02:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: remove pr_info where possible
2018-02-14 21:05:33 +01:00
netfilter: x_tables: use pr ratelimiting in matches/targets
2018-02-14 21:05:37 +01:00
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: fix missing timer initialization in xt_LED
2018-02-14 21:05:39 +01:00
netfilter: xt_limit: Spelling s/maxmum/maximum/
2018-03-05 23:15:50 +01:00
netfilter: x_tables: move hook state into xt_action_param structure
2016-11-03 10:56:21 +01:00
netfilter: xt_MARK: Add ARP support
2015-05-14 13:00:27 +02:00
netfilter: xt_multiport: Fix wrong unmatch result with multiple ports
2016-12-06 21:48:20 +01:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: nfnetlink_acct: remove useless parameter
2018-03-05 23:15:43 +01:00
netfilter: xt_NFLOG: use nf_log_packet instead of nfulnl_log_packet.
2018-04-19 13:02:44 +02:00
netfilter: xt_NFQUEUE: use pr ratelimiting
2018-02-14 21:05:35 +01:00
netfilter: extract Passive OS fingerprint infrastructure from xt_osf
2018-05-07 00:02:11 +02:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: pkttype: unnecessary to check ipv6 multicast address
2017-01-18 20:32:43 +01:00
netfilter: x_tables: use pr ratelimiting in matches/targets
2018-02-14 21:05:37 +01:00
xtables: extend matches and targets with .usersize
2017-01-09 17:24:55 +01:00
netfilter: make xt_rateest hash table per net
2018-03-05 23:15:44 +01:00
netfilter: make xt_rateest hash table per net
2018-03-05 23:15:44 +01:00
treewide: Use struct_size() for kmalloc()-family
2018-06-06 11:15:43 -07:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
sctp: remove the typedef sctp_chunkhdr_t
2017-07-01 09:08:41 -07:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: ipset: Limit max timeout value
2018-06-06 14:00:54 +02:00
netfilter: Decrease code duplication regarding transparent socket option
2018-06-03 00:02:01 +02:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: fix pointer leaks to userspace
2018-01-31 14:59:24 +01:00
netfilter: ebtables: Add string filter
2018-03-30 11:04:12 +02:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool
2015-08-17 21:33:06 -07:00
netfilter: Convert FWINV<[foo]> macros and uses to NF_INVF
2016-07-03 10:55:07 +02:00
netfilter: Rework xt_TEE netdevice notifier
2018-03-30 10:59:23 -04:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: Libify xt_TPROXY
2018-06-03 00:02:05 +02:00
netfilter: xt_TRACE: add explicitly nf_logger_find_get call
2016-06-23 13:26:49 +02:00
b36e4523d4