From: Florian Westphal <fw@strlen•de>
To: Jason Xing <kerneljasonxing@gmail•com>
Cc: edumazet@google•com, pablo@netfilter•org, kadlec@netfilter•org,
fw@strlen•de, kuba@kernel•org, pabeni@redhat•com,
davem@davemloft•net, netfilter-devel@vger•kernel.org,
coreteam@netfilter•org, netdev@vger•kernel.org,
Jason Xing <kernelxing@tencent•com>
Subject: Re: [PATCH net-next] netfilter: conntrack: avoid sending RST to reply out-of-window skb
Date: Thu, 7 Mar 2024 10:33:10 +0100 [thread overview]
Message-ID: <20240307093310.GI4420@breakpoint.cc> (raw)
In-Reply-To: <20240307090732.56708-1-kerneljasonxing@gmail.com>
Jason Xing <kerneljasonxing@gmail•com> wrote:
> client_ip:client_port <--> server_ip:b_port
>
> Then, some strange skbs from client or gateway, say, out-of-window
> skbs are sent to the server_ip:a_port (not b_port) due to DNAT
> clearing skb->_nfct value in nf_conntrack_in() function. Why?
> Because the tcp_in_window() considers the incoming skb as an
> invalid skb by returning NFCT_TCP_INVALID.
So far everything is as intended.
> I think, even we have set DNAT policy, it would be better if the
> whole process/behaviour adheres to the original TCP behaviour.
>
> Signed-off-by: Jason Xing <kernelxing@tencent•com>
> ---
> net/netfilter/nf_conntrack_proto_tcp.c | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
> index ae493599a3ef..3f3e620f3969 100644
> --- a/net/netfilter/nf_conntrack_proto_tcp.c
> +++ b/net/netfilter/nf_conntrack_proto_tcp.c
> @@ -1253,13 +1253,11 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
> res = tcp_in_window(ct, dir, index,
> skb, dataoff, th, state);
> switch (res) {
> - case NFCT_TCP_IGNORE:
> - spin_unlock_bh(&ct->lock);
> - return NF_ACCEPT;
> case NFCT_TCP_INVALID:
> nf_tcp_handle_invalid(ct, dir, index, skb, state);
> + case NFCT_TCP_IGNORE:
> spin_unlock_bh(&ct->lock);
> - return -NF_ACCEPT;
> + return NF_ACCEPT;
This looks wrong. -NF_ACCEPT means 'pass packet, but its not part
of the connection' (packet will match --ctstate INVALID check).
This change disables most of the tcp_in_window() test, this will
pretend everything is fine even though tcp_in_window says otherwise.
You could:
- drop invalid tcp packets in input hook
- set nf_conntrack_tcp_be_liberal=1
both will avoid this 'rst' issue.
next prev parent reply other threads:[~2024-03-07 9:33 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-07 9:07 [PATCH net-next] netfilter: conntrack: avoid sending RST to reply out-of-window skb Jason Xing
2024-03-07 9:33 ` Florian Westphal [this message]
2024-03-07 11:02 ` Jason Xing
2024-03-07 12:00 ` Florian Westphal
2024-03-07 13:33 ` Jason Xing
2024-03-07 14:10 ` Florian Westphal
2024-03-07 15:11 ` Jason Xing
2024-03-07 15:34 ` Jozsef Kadlecsik
2024-03-07 15:59 ` Jason Xing
2024-03-07 19:00 ` Jozsef Kadlecsik
2024-03-08 0:42 ` Jason Xing
2024-03-08 8:59 ` Jason Xing
2024-03-08 22:46 ` Florian Westphal
2024-03-09 0:37 ` Jason Xing
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240307093310.GI4420@breakpoint.cc \
--to=fw@strlen$(echo .)de \
--cc=coreteam@netfilter$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=kadlec@netfilter$(echo .)org \
--cc=kerneljasonxing@gmail$(echo .)com \
--cc=kernelxing@tencent$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pablo@netfilter$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox