netdev - Re: [PATCH v3] netfilter: xt_connlimit: fix race in connection counting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190110192716.GA54095@dev-dsk-alakeshh-2c-f8a3e6e0.us-west-2.amazon.com>
Date:   Thu, 10 Jan 2019 19:27:16 +0000
From:   Alakesh Haloi <alakeshh@...zon.com>
To:     Greg KH <greg@...ah.com>
CC:     <stable@...r.kernel.org>, Pablo Neira Ayuso <pablo@...filter.org>,
        "Jozsef Kadlecsik" <kadlec@...ckhole.kfki.hu>,
        Florian Westphal <fw@...len.de>,
        "David S. Miller" <davem@...emloft.net>,
        Dmitry Andrianov <dmitry.andrianov@...rtme.com>,
        Justin Pettit <jpettit@...are.com>,
        "Yi-Hung Wei" <yihung.wei@...il.com>, <netdev@...r.kernel.org>
Subject: Re: [PATCH v3] netfilter: xt_connlimit: fix race in connection
 counting

On Thu, Jan 10, 2019 at 08:19:09PM +0100, Greg KH wrote:
> On Thu, Jan 03, 2019 at 12:28:46AM +0000, Alakesh Haloi wrote:
> > commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm
> >         race")
> > 
> > An iptable rule like the following on a multicore systems will result in
> > accepting more connections than set in the rule.
> > 
> > iptables  -A INPUT -p tcp -m tcp --syn --dport 7777 -m connlimit \
> >       --connlimit-above 2000 --connlimit-mask 0 -j DROP
> > 
> > In check_hlist function, connections that are found in saved connections
> > but not in netfilter conntrack are deleted, assuming that those
> > connections do not exist anymore. But for multi core systems, there exists
> > a small time window, when a connection has been added to the xt_connlimit
> > maintained rb-tree but has not yet made to netfilter conntrack table. This
> > causes concurrent connections to return incorrect counts and go over limit
> > set in iptable rule.
> > 
> > The fix has been partially backported from the above mentioned upstream
> > commit. Introduce timestamp and the owning cpu.
> > 
> > Signed-off-by: Alakesh Haloi <alakeshh@...zon.com>
> > Cc: Pablo Neira Ayuso <pablo@...filter.org>
> > Cc: Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
> > Cc: Florian Westphal <fw@...len.de>
> > Cc: "David S. Miller" <davem@...emloft.net>
> > Cc: stable@...r.kernel.org # v4.15 and before
> 
> But 4.14.92 already b36e4523d4d5 ("netfilter: nf_conncount: fix garbage
> collection confirm race") and 4cd273bb91b3 ("netfilter: nf_conncount:
> don't skip eviction when age is negative") in it.  Are you sure you
> still need this patch?
> 
> thanks,
> 
> greg k-h
Hi Greg
We do not need this patch anymore, since the relevant patches are already
in 4.9.92.

Thanks
-Alakesh