netdev - Re: [PATCH net] openvswitch: Fix cached ct with helper.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <67865008-7CDC-469D-8EAA-C097C19F7408@ovn.org>
Date:	Tue, 10 May 2016 16:55:33 -0700
From:	Jarno Rajahalme <jarno@....org>
To:	Joe Stringer <joe@....org>
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH net] openvswitch: Fix cached ct with helper.

This would result in inconsistent helper assignment if a first CT action assigns a helper and a further CT action tries to assign a different helper; Typically the second helper assignment would be ignored, but if the unconfirmed conntrack entry is lost due to an upcall the second helper assignment would be successful.  This is best resolved by allowing helper assignment by a committing CT action only by testing the 'info->commit' flag in addition to the conditions you have there already. It may also be helpful to fail helper assignment without the commit flag in parse_ct().

  Jarno

> On May 10, 2016, at 11:40 AM, Joe Stringer <joe@....org> wrote:
> 
> When using conntrack helpers from OVS, a common configuration is to
> perform a lookup without specifying a helper, then go through a
> firewalling policy, only to decide to attach a helper afterwards.
> 
> In this case, the initial lookup will cause a ct entry to be attached to
> the skb, then the later commit with helper should attach the helper and
> confirm the connection. However, the helper attachment has been missing.
> If the user has enabled automatic helper attachment, then this issue
> will be masked as it will be applied in init_conntrack(). It is also
> masked if the action is executed from ovs_packet_cmd_execute() as that
> will construct a fresh skb.
> 
> This patch fixes the issue by making an explicit call to try to assign
> the helper if there is a discrepancy between the action's helper and the
> current skb->nfct.
> 
> Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action")
> Signed-off-by: Joe Stringer <joe@....org>
> ---
> net/openvswitch/conntrack.c | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
> 
> diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
> index b5fea1101faa..89f61a1720eb 100644
> --- a/net/openvswitch/conntrack.c
> +++ b/net/openvswitch/conntrack.c
> @@ -776,6 +776,18 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
> 			return -EINVAL;
> 		}
> 
> +		/* Userspace may decide to perform a ct lookup without a helper
> +		 * specified followed by a (recirculate and) commit with one.
> +		 * Therefore, for unconfirmed connections we need to attach the
> +		 * helper here.
> +		 */
> +		if (!nf_ct_is_confirmed(ct) && info->helper && !nfct_help(ct)) {
> +			int err = __nf_ct_try_assign_helper(ct, info->ct,
> +							    GFP_ATOMIC);
> +			if (err)
> +				return err;
> +		}
> +
> 		/* Call the helper only if:
> 		 * - nf_conntrack_in() was executed above ("!cached") for a
> 		 *   confirmed connection, or
> -- 
> 2.1.4
>