Skip to content

Commit

Permalink
netfilter: nf_conntrack: allow early drop of offloaded UDP conns
Browse files Browse the repository at this point in the history
Both synchronous early drop algorithm and asynchronous gc worker completely
ignore connections with IPS_OFFLOAD_BIT status bit set. With new
functionality that enabled UDP NEW connection offload in action CT
malicious user can flood the conntrack table with offloaded UDP connections
by just sending a single packet per 5tuple because such connections can no
longer be deleted by early drop algorithm.

To mitigate the issue allow both early drop and gc to consider offloaded
UDP connections for deletion.

Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Vlad Buslov authored and David S. Miller committed Feb 3, 2023
1 parent 6a9bad0 commit df25455
Showing 1 changed file with 6 additions and 5 deletions.
11 changes: 6 additions & 5 deletions net/netfilter/nf_conntrack_core.c
Original file line number Diff line number Diff line change
Expand Up @@ -1371,9 +1371,6 @@ static unsigned int early_drop_list(struct net *net,
hlist_nulls_for_each_entry_rcu(h, n, head, hnnode) {
tmp = nf_ct_tuplehash_to_ctrack(h);

if (test_bit(IPS_OFFLOAD_BIT, &tmp->status))
continue;

if (nf_ct_is_expired(tmp)) {
nf_ct_gc_expired(tmp);
continue;
Expand Down Expand Up @@ -1443,11 +1440,14 @@ static bool gc_worker_skip_ct(const struct nf_conn *ct)
static bool gc_worker_can_early_drop(const struct nf_conn *ct)
{
const struct nf_conntrack_l4proto *l4proto;
u8 protonum = nf_ct_protonum(ct);

if (test_bit(IPS_OFFLOAD_BIT, &ct->status) && protonum != IPPROTO_UDP)
return false;
if (!test_bit(IPS_ASSURED_BIT, &ct->status))
return true;

l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct));
l4proto = nf_ct_l4proto_find(protonum);
if (l4proto->can_early_drop && l4proto->can_early_drop(ct))
return true;

Expand Down Expand Up @@ -1504,7 +1504,8 @@ static void gc_worker(struct work_struct *work)

if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) {
nf_ct_offload_timeout(tmp);
continue;
if (!nf_conntrack_max95)
continue;
}

if (expired_count > GC_SCAN_EXPIRED_MAX) {
Expand Down

0 comments on commit df25455

Please sign in to comment.