netdev - Re: [PATCH net] sched: act_ct: add netns into the key of tcf_ct_flow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240618090425.GG8447@kernel.org>
Date: Tue, 18 Jun 2024 10:04:25 +0100
From: Simon Horman <horms@...nel.org>
To: Xin Long <lucien.xin@...il.com>
Cc: network dev <netdev@...r.kernel.org>, davem@...emloft.net,
	kuba@...nel.org, Eric Dumazet <edumazet@...gle.com>,
	Paolo Abeni <pabeni@...hat.com>,
	Jamal Hadi Salim <jhs@...atatu.com>,
	Cong Wang <xiyou.wangcong@...il.com>, Jiri Pirko <jiri@...nulli.us>,
	Paul Blakey <paulb@...lanox.com>,
	Yossi Kuperman <yossiku@...lanox.com>,
	Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
Subject: Re: [PATCH net] sched: act_ct: add netns into the key of
 tcf_ct_flow_table

On Sat, Jun 15, 2024 at 05:47:30PM -0400, Xin Long wrote:
> zones_ht is a global hashtable for flow_table with zone as key. However,
> it does not consider netns when getting a flow_table from zones_ht in
> tcf_ct_init(), and it means an act_ct action in netns A may get a
> flow_table that belongs to netns B if it has the same zone value.
> 
> In Shuang's test with the TOPO:
> 
>   tcf2_c <---> tcf2_sw1 <---> tcf2_sw2 <---> tcf2_s
> 
> tcf2_sw1 and tcf2_sw2 saw the same flow and used the same flow table,
> which caused their ct entries entering unexpected states and the
> TCP connection not able to end normally.
> 
> This patch fixes the issue simply by adding netns into the key of
> tcf_ct_flow_table so that an act_ct action gets a flow_table that
> belongs to its own netns in tcf_ct_init().
> 
> Note that for easy coding we don't use tcf_ct_flow_table.nf_ft.net,
> as the ct_ft is initialized after inserting it to the hashtable in
> tcf_ct_flow_table_get() and also it requires to implement several
> functions in rhashtable_params including hashfn, obj_hashfn and
> obj_cmpfn.
> 
> Fixes: 64ff70b80fd4 ("net/sched: act_ct: Offload established connections to flow table")
> Reported-by: Shuang Li <shuali@...hat.com>
> Signed-off-by: Xin Long <lucien.xin@...il.com>

Reviewed-by: Simon Horman <horms@...nel.org>