1. 02 Jul, 2021 4 commits
    • Vasily Averin's avatar
      netfilter: conntrack: nf_ct_gre_keymap_flush() removal · a23f89a9
      Vasily Averin authored
      nf_ct_gre_keymap_flush() is useless.
      It is called from nf_conntrack_cleanup_net_list() only and tries to remove
      nf_ct_gre_keymap entries from pernet gre keymap list. Though:
      a) at this point the list should already be empty, all its entries were
      deleted during the conntracks cleanup, because
      nf_conntrack_cleanup_net_list() executes nf_ct_iterate_cleanup(kill_all)
      before nf_conntrack_proto_pernet_fini():
       nf_conntrack_cleanup_net_list
        +- nf_ct_iterate_cleanup
        |   nf_ct_put
        |    nf_conntrack_put
        |     nf_conntrack_destroy
        |      destroy_conntrack
        |       destroy_gre_conntrack
        |        nf_ct_gre_keymap_destroy
        `- nf_conntrack_proto_pernet_fini
            nf_ct_gre_keymap_flush
      
      b) Let's say we find that the keymap list is not empty. This means netns
      still has a conntrack associated with gre, in which case we should not free
      its memory, because this will lead to a double free and related crashes.
      However I doubt it could have gone unnoticed for years, obviously
      this does not happen in real life. So I think we can remove
      both nf_ct_gre_keymap_flush() and nf_conntrack_proto_pernet_fini().
      Signed-off-by: default avatarVasily Averin <vvs@virtuozzo.com>
      Acked-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      a23f89a9
    • Colin Ian King's avatar
      netfilter: nf_tables: Fix dereference of null pointer flow · 4ca041f9
      Colin Ian King authored
      In the case where chain->flags & NFT_CHAIN_HW_OFFLOAD is false then
      nft_flow_rule_create is not called and flow is NULL. The subsequent
      error handling execution via label err_destroy_flow_rule will lead
      to a null pointer dereference on flow when calling nft_flow_rule_destroy.
      Since the error path to err_destroy_flow_rule has to cater for null
      and non-null flows, only call nft_flow_rule_destroy if flow is non-null
      to fix this issue.
      
      Addresses-Coverity: ("Explicity null dereference")
      Fixes: 3c5e4462 ("netfilter: nf_tables: memleak in hw offload abort path")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4ca041f9
    • Florian Westphal's avatar
      netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state · e15d4cdf
      Florian Westphal authored
      Consider:
        client -----> conntrack ---> Host
      
      client sends a SYN, but $Host is unreachable/silent.
      Client eventually gives up and the conntrack entry will time out.
      
      However, if the client is restarted with same addr/port pair, it
      may prevent the conntrack entry from timing out.
      
      This is noticeable when the existing conntrack entry has no NAT
      transformation or an outdated one and port reuse happens either
      on client or due to a NAT middlebox.
      
      This change prevents refresh of the timeout for SYN retransmits,
      so entry is going away after nf_conntrack_tcp_timeout_syn_sent
      seconds (default: 60).
      
      Entry will be re-created on next connection attempt, but then
      nat rules will be evaluated again.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      e15d4cdf
    • Florian Westphal's avatar
      selftest: netfilter: add test case for unreplied tcp connections · 37d220b5
      Florian Westphal authored
      TCP connections in UNREPLIED state (only SYN seen) can be kept alive
      indefinitely, as each SYN re-sets the timeout.
      
      This means that even if a peer has closed its socket the entry
      never times out.
      
      This also prevents re-evaluation of configured NAT rules.
      Add a test case that sets SYN timeout to 10 seconds, then check
      that the nat redirection added later eventually takes effect.
      
      This is based off a repro script from Antonio Ojea.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      37d220b5
  2. 01 Jul, 2021 36 commits