166b7219d592b5d653775056c96f30ae9fc6d0a3
[openwrt/openwrt.git] / target / linux / generic / backport-4.14 / 370-netfilter-nf_flow_table-fix-offloaded-connection-tim.patch
1 From: Felix Fietkau <nbd@nbd.name>
2 Date: Wed, 13 Jun 2018 12:33:39 +0200
3 Subject: [PATCH] netfilter: nf_flow_table: fix offloaded connection timeout
4 corner case
5
6 The full teardown of offloaded flows is deferred to a gc work item,
7 however processing of packets by netfilter needs to happen immediately
8 after a teardown is requested, because the conntrack state needs to be
9 fixed up.
10
11 Since the IPS_OFFLOAD_BIT is still kept until the teardown is complete,
12 the netfilter conntrack gc can accidentally bump the timeout of a
13 connection where offload was just stopped, causing a conntrack entry
14 leak.
15
16 Fix this by moving the conntrack timeout bumping from conntrack core to
17 the nf_flow_offload and add a check to prevent bogus timeout bumps.
18
19 Signed-off-by: Felix Fietkau <nbd@nbd.name>
20 ---
21
22 --- a/net/netfilter/nf_conntrack_core.c
23 +++ b/net/netfilter/nf_conntrack_core.c
24 @@ -997,18 +997,6 @@ static bool gc_worker_can_early_drop(con
25 return false;
26 }
27
28 -#define DAY (86400 * HZ)
29 -
30 -/* Set an arbitrary timeout large enough not to ever expire, this save
31 - * us a check for the IPS_OFFLOAD_BIT from the packet path via
32 - * nf_ct_is_expired().
33 - */
34 -static void nf_ct_offload_timeout(struct nf_conn *ct)
35 -{
36 - if (nf_ct_expires(ct) < DAY / 2)
37 - ct->timeout = nfct_time_stamp + DAY;
38 -}
39 -
40 static void gc_worker(struct work_struct *work)
41 {
42 unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u);
43 @@ -1045,10 +1033,8 @@ static void gc_worker(struct work_struct
44 tmp = nf_ct_tuplehash_to_ctrack(h);
45
46 scanned++;
47 - if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) {
48 - nf_ct_offload_timeout(tmp);
49 + if (test_bit(IPS_OFFLOAD_BIT, &tmp->status))
50 continue;
51 - }
52
53 if (nf_ct_is_expired(tmp)) {
54 nf_ct_gc_expired(tmp);
55 --- a/net/netfilter/nf_flow_table_core.c
56 +++ b/net/netfilter/nf_flow_table_core.c
57 @@ -185,8 +185,27 @@ static const struct rhashtable_params nf
58 .automatic_shrinking = true,
59 };
60
61 +#define DAY (86400 * HZ)
62 +
63 +/* Set an arbitrary timeout large enough not to ever expire, this save
64 + * us a check for the IPS_OFFLOAD_BIT from the packet path via
65 + * nf_ct_is_expired().
66 + */
67 +static void nf_ct_offload_timeout(struct flow_offload *flow)
68 +{
69 + struct flow_offload_entry *entry;
70 + struct nf_conn *ct;
71 +
72 + entry = container_of(flow, struct flow_offload_entry, flow);
73 + ct = entry->ct;
74 +
75 + if (nf_ct_expires(ct) < DAY / 2)
76 + ct->timeout = nfct_time_stamp + DAY;
77 +}
78 +
79 int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
80 {
81 + nf_ct_offload_timeout(flow);
82 flow->timeout = (u32)jiffies;
83
84 rhashtable_insert_fast(&flow_table->rhashtable,
85 @@ -307,6 +326,8 @@ static int nf_flow_offload_gc_step(struc
86 rhashtable_walk_start(&hti);
87
88 while ((tuplehash = rhashtable_walk_next(&hti))) {
89 + bool teardown;
90 +
91 if (IS_ERR(tuplehash)) {
92 err = PTR_ERR(tuplehash);
93 if (err != -EAGAIN)
94 @@ -319,9 +340,13 @@ static int nf_flow_offload_gc_step(struc
95
96 flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
97
98 - if (nf_flow_has_expired(flow) ||
99 - (flow->flags & (FLOW_OFFLOAD_DYING |
100 - FLOW_OFFLOAD_TEARDOWN)))
101 + teardown = flow->flags & (FLOW_OFFLOAD_DYING |
102 + FLOW_OFFLOAD_TEARDOWN);
103 +
104 + if (!teardown)
105 + nf_ct_offload_timeout(flow);
106 +
107 + if (nf_flow_has_expired(flow) || teardown)
108 flow_offload_del(flow_table, flow);
109 }
110 out: