netfilter: synproxy: fix conntrackd interaction
Subsystems (2)
PATCH 1/1 netfilter: synproxy: fix conntrackd interaction
This patch fixes the creation of connection tracking entry from netlink when synproxy is used. It was missing the addition of the synproxy extension.
This was causing kernel crashes when a conntrack entry created by conntrackd was used after the switch of traffic from active node to the passive node.
--- net/netfilter/nf_conntrack_netlink.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_conntrack_netlink.c +4 -0
@@ -45,6 +45,8 @@#include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/nf_conntrack_timestamp.h> #include <net/netfilter/nf_conntrack_labels.h> +#include <net/netfilter/nf_conntrack_seqadj.h> +#include <net/netfilter/nf_conntrack_synproxy.h> #ifdef CONFIG_NF_NAT_NEEDED #include <net/netfilter/nf_nat_core.h> #include <net/netfilter/nf_nat_l4proto.h>
@@ -1828,6 +1830,8 @@ ctnetlink_create_conntrack(struct net *net,nf_ct_tstamp_ext_add (ct,GFP_ATOMIC );nf_ct_ecache_ext_add (ct,0 ,0 ,GFP_ATOMIC );nf_ct_labels_ext_add (ct); +nfct_seqadj_ext_add (ct); +nfct_synproxy_ext_add (ct);/* we must add conntrack extensions before confirmation. */ ct->status |=IPS_CONFIRMED ;
Signature · 1 line
2.11.0
Quoted 7 lines · On Thu, 11 May 2017 15:22:55 +0200 Eric Leblond <[email protected]> wrote:
This patch fixes the creation of connection tracking entry from netlink when synproxy is used. It was missing the addition of the synproxy extension.
This was causing kernel crashes when a conntrack entry created by conntrackd was used after the switch of traffic from active node to the passive node.
You are missing a Signed-off-by line ;-)
Quoted 26 lines
--- net/netfilter/nf_conntrack_netlink.c | 4 ++++ 1 file changed, 4 insertions(+)net/netfilter/nf_conntrack_netlink.c +4
-0@@ -45,6 +45,8 @@#include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/nf_conntrack_timestamp.h> #include <net/netfilter/nf_conntrack_labels.h> +#include <net/netfilter/nf_conntrack_seqadj.h> +#include <net/netfilter/nf_conntrack_synproxy.h> #ifdef CONFIG_NF_NAT_NEEDED #include <net/netfilter/nf_nat_core.h> #include <net/netfilter/nf_nat_l4proto.h> @@ -1828,6 +1830,8 @@ ctnetlink_create_conntrack(struct net *net,nf_ct_tstamp_ext_add (ct,GFP_ATOMIC );nf_ct_ecache_ext_add (ct,0 ,0 ,GFP_ATOMIC );nf_ct_labels_ext_add (ct); +nfct_seqadj_ext_add (ct); +nfct_synproxy_ext_add (ct);/* we must add conntrack extensions before confirmation. */ ct->status |=IPS_CONFIRMED ;
Signature · 4 lines
Best regards, Jesper Dangaard Brouer MSc.CS, Principal Kernel Engineer at Red Hat LinkedIn: http://www.linkedin.com/in/brouer
PATCH 1/1 netfilter: synproxy: fix conntrackd interaction
This patch fixes the creation of connection tracking entry from netlink when synproxy is used. It was missing the addition of the synproxy extension.
This was causing kernel crashes when a conntrack entry created by conntrackd was used after the switch of traffic from active node to the passive node.
--- net/netfilter/nf_conntrack_netlink.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_conntrack_netlink.c +4 -0
@@ -45,6 +45,8 @@#include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/nf_conntrack_timestamp.h> #include <net/netfilter/nf_conntrack_labels.h> +#include <net/netfilter/nf_conntrack_seqadj.h> +#include <net/netfilter/nf_conntrack_synproxy.h> #ifdef CONFIG_NF_NAT_NEEDED #include <net/netfilter/nf_nat_core.h> #include <net/netfilter/nf_nat_l4proto.h>
@@ -1828,6 +1830,8 @@ ctnetlink_create_conntrack(struct net *net,nf_ct_tstamp_ext_add (ct,GFP_ATOMIC );nf_ct_ecache_ext_add (ct,0 ,0 ,GFP_ATOMIC );nf_ct_labels_ext_add (ct); +nfct_seqadj_ext_add (ct); +nfct_synproxy_ext_add (ct);/* we must add conntrack extensions before confirmation. */ ct->status |=IPS_CONFIRMED ;
Signature · 1 line
2.11.0
Quoted 7 lines · Eric Leblond
This patch fixes the creation of connection tracking entry from netlink when synproxy is used. It was missing the addition of the synproxy extension.
This was causing kernel crashes when a conntrack entry created by conntrackd was used after the switch of traffic from active node to the passive node.
Applied, thanks Eric.
A message that is not in the archive (sent off-list or not yet received): [email protected]
Pablo Neira Ayuso
maintainerQuoted 14 lines · Eric Leblond
Hello,
Le 15 mai 2017 6:52 PM, Pablo Neira Ayuso <[email protected]> a écrit :On Thu, May 11, 2017 at 06:56:38PM +0200, Eric Leblond wrote:
> This patch fixes the creation of connection tracking entry from > netlink when synproxy is used. It was missing the addition of > the synproxy extension.
>
> This was causing kernel crashes when a conntrack entry created by > conntrackd was used after the switch of traffic from active node > to the passive node.
Applied, thanks Eric.
Quoted 3 lines
Thanks Pablo !
Will you push it to stable as it is causing a crash on older kernel like 3.16?
Does this compile cleanly as is?
If so, I can just request -stable maintainer to take it as soon as this hits upstream.
Hi,
Quoted 20 lines · Pablo Neira Ayuso
Quoted 19 lines · Eric Leblond
Hello,
Le 15 mai 2017 6:52 PM, Pablo Neira Ayuso <[email protected]> a
écrit :On Thu, May 11, 2017 at 06:56:38PM +0200, Eric Leblond wrote:
> This patch fixes the creation of connection tracking entry from
> netlink when synproxy is used. It was missing the addition of
> the synproxy extension.
>
> This was causing kernel crashes when a conntrack entry created by
> conntrackd was used after the switch of traffic from active node
> to the passive node.
Applied, thanks Eric.
Quoted 6 lines
Quoted 4 lines
Thanks Pablo !
Will you push it to stable as it is causing a crash on older kernel
like 3.16?Does this compile cleanly as is?
Yes, I have tested the patch on 3.16.1 and it applies cleanly. I've build module for 4.1 and patch applies too. I did not test it but code is unchanged.
Quoted 2 lines
If so, I can just request -stable maintainer to take it as soon as this hits upstream.
Thanks!
BR,
Signature · 1 line
Eric Leblond <[email protected]>