-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge tag 'nf-23-10-04' of https://git.kernel.org/pub/scm/linux/kerne…
…l/git/netfilter/nf Florian Westphal says: ==================== netfilter patches for net First patch resolves a regression with vlan header matching, this was broken since 6.5 release. From myself. Second patch fixes an ancient problem with sctp connection tracking in case INIT_ACK packets are delayed. This comes with a selftest, both patches from Xin Long. Patch 4 extends the existing nftables audit selftest, from Phil Sutter. Patch 5, also from Phil, avoids a situation where nftables would emit an audit record twice. This was broken since 5.13 days. Patch 6, from myself, avoids spurious insertion failure if we encounter an overlapping but expired range during element insertion with the 'nft_set_rbtree' backend. This problem exists since 6.2. * tag 'nf-23-10-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure netfilter: nf_tables: Deduplicate nft_register_obj audit logs selftests: netfilter: Extend nft_audit.sh selftests: netfilter: test for sctp collision processing in nf_conntrack netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp netfilter: nft_payload: rebuild vlan header on h_proto access ==================== Link: https://lore.kernel.org/r/20231004141405.28749-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
- Loading branch information
Showing
9 changed files
with
395 additions
and
62 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
89 changes: 89 additions & 0 deletions
89
tools/testing/selftests/netfilter/conntrack_sctp_collision.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| #!/bin/bash | ||
| # SPDX-License-Identifier: GPL-2.0 | ||
| # | ||
| # Testing For SCTP COLLISION SCENARIO as Below: | ||
| # | ||
| # 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359] | ||
| # 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187] | ||
| # 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359] | ||
| # 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO] | ||
| # 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK] | ||
| # 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970] | ||
| # | ||
| # TOPO: SERVER_NS (link0)<--->(link1) ROUTER_NS (link2)<--->(link3) CLIENT_NS | ||
|
|
||
| CLIENT_NS=$(mktemp -u client-XXXXXXXX) | ||
| CLIENT_IP="198.51.200.1" | ||
| CLIENT_PORT=1234 | ||
|
|
||
| SERVER_NS=$(mktemp -u server-XXXXXXXX) | ||
| SERVER_IP="198.51.100.1" | ||
| SERVER_PORT=1234 | ||
|
|
||
| ROUTER_NS=$(mktemp -u router-XXXXXXXX) | ||
| CLIENT_GW="198.51.200.2" | ||
| SERVER_GW="198.51.100.2" | ||
|
|
||
| # setup the topo | ||
| setup() { | ||
| ip net add $CLIENT_NS | ||
| ip net add $SERVER_NS | ||
| ip net add $ROUTER_NS | ||
| ip -n $SERVER_NS link add link0 type veth peer name link1 netns $ROUTER_NS | ||
| ip -n $CLIENT_NS link add link3 type veth peer name link2 netns $ROUTER_NS | ||
|
|
||
| ip -n $SERVER_NS link set link0 up | ||
| ip -n $SERVER_NS addr add $SERVER_IP/24 dev link0 | ||
| ip -n $SERVER_NS route add $CLIENT_IP dev link0 via $SERVER_GW | ||
|
|
||
| ip -n $ROUTER_NS link set link1 up | ||
| ip -n $ROUTER_NS link set link2 up | ||
| ip -n $ROUTER_NS addr add $SERVER_GW/24 dev link1 | ||
| ip -n $ROUTER_NS addr add $CLIENT_GW/24 dev link2 | ||
| ip net exec $ROUTER_NS sysctl -wq net.ipv4.ip_forward=1 | ||
|
|
||
| ip -n $CLIENT_NS link set link3 up | ||
| ip -n $CLIENT_NS addr add $CLIENT_IP/24 dev link3 | ||
| ip -n $CLIENT_NS route add $SERVER_IP dev link3 via $CLIENT_GW | ||
|
|
||
| # simulate the delay on OVS upcall by setting up a delay for INIT_ACK with | ||
| # tc on $SERVER_NS side | ||
| tc -n $SERVER_NS qdisc add dev link0 root handle 1: htb | ||
| tc -n $SERVER_NS class add dev link0 parent 1: classid 1:1 htb rate 100mbit | ||
| tc -n $SERVER_NS filter add dev link0 parent 1: protocol ip u32 match ip protocol 132 \ | ||
| 0xff match u8 2 0xff at 32 flowid 1:1 | ||
| tc -n $SERVER_NS qdisc add dev link0 parent 1:1 handle 10: netem delay 1200ms | ||
|
|
||
| # simulate the ctstate check on OVS nf_conntrack | ||
| ip net exec $ROUTER_NS iptables -A FORWARD -m state --state INVALID,UNTRACKED -j DROP | ||
| ip net exec $ROUTER_NS iptables -A INPUT -p sctp -j DROP | ||
|
|
||
| # use a smaller number for assoc's max_retrans to reproduce the issue | ||
| modprobe sctp | ||
| ip net exec $CLIENT_NS sysctl -wq net.sctp.association_max_retrans=3 | ||
| } | ||
|
|
||
| cleanup() { | ||
| ip net exec $CLIENT_NS pkill sctp_collision 2>&1 >/dev/null | ||
| ip net exec $SERVER_NS pkill sctp_collision 2>&1 >/dev/null | ||
| ip net del "$CLIENT_NS" | ||
| ip net del "$SERVER_NS" | ||
| ip net del "$ROUTER_NS" | ||
| } | ||
|
|
||
| do_test() { | ||
| ip net exec $SERVER_NS ./sctp_collision server \ | ||
| $SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT & | ||
| ip net exec $CLIENT_NS ./sctp_collision client \ | ||
| $CLIENT_IP $CLIENT_PORT $SERVER_IP $SERVER_PORT | ||
| } | ||
|
|
||
| # NOTE: one way to work around the issue is set a smaller hb_interval | ||
| # ip net exec $CLIENT_NS sysctl -wq net.sctp.hb_interval=3500 | ||
|
|
||
| # run the test case | ||
| trap cleanup EXIT | ||
| setup && \ | ||
| echo "Test for SCTP Collision in nf_conntrack:" && \ | ||
| do_test && echo "PASS!" | ||
| exit $? |
Oops, something went wrong.