Netfilter zone directions

PATCH Superseded Daniel Borkmann 2 participants 11 messages Jul 22, 2015 – Aug 6, 2015

Subsystems (4)

Networking netfilter Traffic control (tc) IPVS

lore

Share & tools

lore

Daniel Borkmann

author

2015-07-22 10:54 UTC #0 lore raw

v3 cover Netfilter zone directions

This is v3 of the originally named flextuples [1] patch set, but this time after discussions from NFWS completely reworked towards integration into the existing zones infrastructure. Please see individual patches for details.

Thanks!

[1] http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/57412/

v2 -> v3:
- Have a global default zone object, use it directly
- Do not touch uapi-exposed ct->status bits, but integrate the marking flag into the zones structure
- Rebased onto latest nf-next, rerun all stress tests
v1 -> v2:
- Reworked entire set, integration into zones
- Rebased onto latest nf-next

Daniel Borkmann (3):
netfilter: nf_conntrack: push zone object into functions
netfilter: nf_conntrack: add direction support for zones
netfilter: nf_conntrack: add efficient mark to zone mapping

 include/net/netfilter/nf_conntrack.h               |   6 +-
 include/net/netfilter/nf_conntrack_core.h          |   3 +-
 include/net/netfilter/nf_conntrack_expect.h        |  11 +-
 include/net/netfilter/nf_conntrack_zones.h         |  82 ++++++++++--
 include/uapi/linux/netfilter/nfnetlink_conntrack.h |   9 ++
 include/uapi/linux/netfilter/xt_CT.h               |   8 +-
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c     |   2 +-
 net/ipv4/netfilter/nf_conntrack_proto_icmp.c       |   4 +-
 net/ipv4/netfilter/nf_defrag_ipv4.c                |  18 +--
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c     |   2 +-
 net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c     |   5 +-
 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c          |  19 +--
 net/netfilter/ipvs/ip_vs_nfct.c                    |   2 +-
 net/netfilter/nf_conntrack_core.c                  |  95 ++++++++------
 net/netfilter/nf_conntrack_expect.c                |  19 +--
 net/netfilter/nf_conntrack_netlink.c               | 139 ++++++++++++++-------
 net/netfilter/nf_conntrack_pptp.c                  |   3 +-
 net/netfilter/nf_conntrack_standalone.c            |  24 +++-
 net/netfilter/nf_nat_core.c                        |  24 ++--
 net/netfilter/nf_synproxy_core.c                   |   4 +-
 net/netfilter/xt_CT.c                              |  26 +++-
 net/netfilter/xt_connlimit.c                       |   9 +-
 net/sched/act_connmark.c                           |   6 +-
 23 files changed, 366 insertions(+), 154 deletions(-)

Signature · 1 line

1.9.3

Daniel Borkmann

author

2015-07-22 10:54 UTC #1 lore raw

PATCH v3 1/3 netfilter: nf_conntrack: push zone object into functions

This patch replaces the zone id which is pushed down into functions with the actual zone object. It's a bigger one-time change, but needed for later on extending zones with a direction parameter, and thus decoupling this additional information from all call-sites.

No functional changes in this patch.

The default zones becomes a global const object, namely nf_ct_zone_dflt and will be returned directly in various cases, one being, when there's f.e. no zoning support.

Signed-off-by Daniel Borkmann <[email protected]>

---
 include/net/netfilter/nf_conntrack.h           |  6 +-
 include/net/netfilter/nf_conntrack_core.h      |  3 +-
 include/net/netfilter/nf_conntrack_expect.h    | 11 +++-
 include/net/netfilter/nf_conntrack_zones.h     | 33 +++++++---
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |  2 +-
 net/ipv4/netfilter/nf_conntrack_proto_icmp.c   |  3 +-
 net/ipv4/netfilter/nf_defrag_ipv4.c            | 12 ++--
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |  2 +-
 net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c |  3 +-
 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c      | 13 ++--
 net/netfilter/ipvs/ip_vs_nfct.c                |  2 +-
 net/netfilter/nf_conntrack_core.c              | 69 +++++++++++++--------
 net/netfilter/nf_conntrack_expect.c            | 19 +++---
 net/netfilter/nf_conntrack_netlink.c           | 84 ++++++++++++++------------
 net/netfilter/nf_conntrack_pptp.c              |  3 +-
 net/netfilter/nf_conntrack_standalone.c        | 17 ++++--
 net/netfilter/nf_nat_core.c                    | 19 +++---
 net/netfilter/nf_synproxy_core.c               |  4 +-
 net/netfilter/xt_CT.c                          |  5 +-
 net/netfilter/xt_connlimit.c                   |  9 +--
 net/sched/act_connmark.c                       |  5 +-
 21 files changed, 194 insertions(+), 130 deletions(-)

include/net/netfilter/nf_conntrack.h +5 -1

index 095433b..1a6d28c 100644
@@ -250,8 +250,12 @@ void nf_ct_untracked_status_or(unsigned long bits);
 void nf_ct_iterate_cleanup(struct net *net,
 			   int (*iter)(struct nf_conn *i, void *data),
 			   void *data, u32 portid, int report);
+
+struct nf_conntrack_zone;
+
 void nf_conntrack_free(struct nf_conn *ct);
-struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone,
+struct nf_conn *nf_conntrack_alloc(struct net *net,
+				   const struct nf_conntrack_zone *zone,
 				   const struct nf_conntrack_tuple *orig,
 				   const struct nf_conntrack_tuple *repl,
 				   gfp_t gfp);

include/net/netfilter/nf_conntrack_core.h +2 -1

index f2f0fa3..c03f9c4 100644
@@ -52,7 +52,8 @@ bool nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
 
 /* Find a connection corresponding to a tuple. */
 struct nf_conntrack_tuple_hash *
-nf_conntrack_find_get(struct net *net, u16 zone,
+nf_conntrack_find_get(struct net *net,
+		      const struct nf_conntrack_zone *zone,
 		      const struct nf_conntrack_tuple *tuple);
 
 int __nf_conntrack_confirm(struct sk_buff *skb);

include/net/netfilter/nf_conntrack_expect.h +8 -3

index 3f3aecb..dce56f0 100644
@@ -4,7 +4,9 @@
 
 #ifndef _NF_CONNTRACK_EXPECT_H
 #define _NF_CONNTRACK_EXPECT_H
+
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 
 extern unsigned int nf_ct_expect_hsize;
 extern unsigned int nf_ct_expect_max;

@@ -76,15 +78,18 @@ int nf_conntrack_expect_init(void);
 void nf_conntrack_expect_fini(void);
 
 struct nf_conntrack_expect *
-__nf_ct_expect_find(struct net *net, u16 zone,
+__nf_ct_expect_find(struct net *net,
+		    const struct nf_conntrack_zone *zone,
 		    const struct nf_conntrack_tuple *tuple);
 
 struct nf_conntrack_expect *
-nf_ct_expect_find_get(struct net *net, u16 zone,
+nf_ct_expect_find_get(struct net *net,
+		      const struct nf_conntrack_zone *zone,
 		      const struct nf_conntrack_tuple *tuple);
 
 struct nf_conntrack_expect *
-nf_ct_find_expectation(struct net *net, u16 zone,
+nf_ct_find_expectation(struct net *net,
+		       const struct nf_conntrack_zone *zone,
 		       const struct nf_conntrack_tuple *tuple);
 
 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,

include/net/netfilter/nf_conntrack_zones.h +23 ~~-10~~

index 034efe8..0788bb0 100644
@@ -1,25 +1,38 @@
 #ifndef _NF_CONNTRACK_ZONES_H
 #define _NF_CONNTRACK_ZONES_H
 
-#define NF_CT_DEFAULT_ZONE	0
-
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
-#include <net/netfilter/nf_conntrack_extend.h>
+#define NF_CT_DEFAULT_ZONE_ID	0
 
 struct nf_conntrack_zone {
 	u16	id;
 };
 
-static inline u16 nf_ct_zone(const struct nf_conn *ct)
+extern const struct nf_conntrack_zone nf_ct_zone_dflt;
+
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+#include <net/netfilter/nf_conntrack_extend.h>
+
+static inline const struct nf_conntrack_zone *
+nf_ct_zone(const struct nf_conn *ct)
 {
+	const struct nf_conntrack_zone *nf_ct_zone = NULL;
+
 #ifdef CONFIG_NF_CONNTRACK_ZONES
-	struct nf_conntrack_zone *nf_ct_zone;
 	nf_ct_zone = nf_ct_ext_find(ct, NF_CT_EXT_ZONE);
-	if (nf_ct_zone)
-		return nf_ct_zone->id;
 #endif
-	return NF_CT_DEFAULT_ZONE;
+	return nf_ct_zone ? nf_ct_zone : &nf_ct_zone_dflt;
 }
 
-#endif /* CONFIG_NF_CONNTRACK || CONFIG_NF_CONNTRACK_MODULE */
+static inline const struct nf_conntrack_zone *
+nf_ct_zone_tmpl(const struct nf_conn *tmpl)
+{
+	return tmpl ? nf_ct_zone(tmpl) : &nf_ct_zone_dflt;
+}
+
+static inline bool nf_ct_zone_equal(const struct nf_conn *a,
+				    const struct nf_conntrack_zone *b)
+{
+	return nf_ct_zone(a)->id == b->id;
+}
+#endif /* IS_ENABLED(CONFIG_NF_CONNTRACK) */
 #endif /* _NF_CONNTRACK_ZONES_H */

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +1 -1

index 30ad955..8a2caaf 100644
@@ -280,7 +280,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
 		return -EINVAL;
 	}
 
-	h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
+	h = nf_conntrack_find_get(sock_net(sk), &nf_ct_zone_dflt, &tuple);
 	if (h) {
 		struct sockaddr_in sin;
 		struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);

net/ipv4/netfilter/nf_conntrack_proto_icmp.c +2 -1

index 80d5554..8a2f41c 100644
@@ -134,9 +134,10 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
 	struct nf_conntrack_tuple innertuple, origtuple;
 	const struct nf_conntrack_l4proto *innerproto;
 	const struct nf_conntrack_tuple_hash *h;
-	u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
+	const struct nf_conntrack_zone *zone;
 
 	NF_CT_ASSERT(skb->nfct == NULL);
+	zone = nf_ct_zone_tmpl(tmpl);
 
 	/* Are they talking about one of our connections? */
 	if (!nf_ct_get_tuplepr(skb,

net/ipv4/netfilter/nf_defrag_ipv4.c +5 -7

index c88b7d4..ad0501a 100644
@@ -43,22 +43,20 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
 static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
 					      struct sk_buff *skb)
 {
-	u16 zone = NF_CT_DEFAULT_ZONE;
-
+	u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 	if (skb->nfct)
-		zone = nf_ct_zone((struct nf_conn *)skb->nfct);
+		zone_id = nf_ct_zone((struct nf_conn *)skb->nfct)->id;
 #endif
-
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 	if (skb->nf_bridge &&
 	    skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
-		return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
+		return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id;
 #endif
 	if (hooknum == NF_INET_PRE_ROUTING)
-		return IP_DEFRAG_CONNTRACK_IN + zone;
+		return IP_DEFRAG_CONNTRACK_IN + zone_id;
 	else
-		return IP_DEFRAG_CONNTRACK_OUT + zone;
+		return IP_DEFRAG_CONNTRACK_OUT + zone_id;
 }
 
 static unsigned int ipv4_conntrack_defrag(const struct nf_hook_ops *ops,

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +1 -1

index 4ba0c34..7302900 100644
@@ -251,7 +251,7 @@ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
 	if (*len < 0 || (unsigned int) *len < sizeof(sin6))
 		return -EINVAL;
 
-	h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
+	h = nf_conntrack_find_get(sock_net(sk), &nf_ct_zone_dflt, &tuple);
 	if (!h) {
 		pr_debug("IP6T_SO_ORIGINAL_DST: Can't find %pI6c/%u-%pI6c/%u.\n",
 			 &tuple.src.u3.ip6, ntohs(tuple.src.u.tcp.port),

net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +1 -2

index 90388d6..2029141 100644
@@ -150,7 +150,6 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
 	struct nf_conntrack_tuple intuple, origtuple;
 	const struct nf_conntrack_tuple_hash *h;
 	const struct nf_conntrack_l4proto *inproto;
-	u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
 
 	NF_CT_ASSERT(skb->nfct == NULL);

@@ -177,7 +176,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
 
 	*ctinfo = IP_CT_RELATED;
 
-	h = nf_conntrack_find_get(net, zone, &intuple);
+	h = nf_conntrack_find_get(net, nf_ct_zone_tmpl(tmpl), &intuple);
 	if (!h) {
 		pr_debug("icmpv6_error: no match\n");
 		return -NF_ACCEPT;

net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +5 -8

index a45db0b..1749500 100644
@@ -33,23 +33,20 @@
 static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
 						struct sk_buff *skb)
 {
-	u16 zone = NF_CT_DEFAULT_ZONE;
-
+	u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 	if (skb->nfct)
-		zone = nf_ct_zone((struct nf_conn *)skb->nfct);
+		zone_id = nf_ct_zone((struct nf_conn *)skb->nfct)->id;
 #endif
-
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 	if (skb->nf_bridge &&
 	    skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
-		return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
+		return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id;
 #endif
 	if (hooknum == NF_INET_PRE_ROUTING)
-		return IP6_DEFRAG_CONNTRACK_IN + zone;
+		return IP6_DEFRAG_CONNTRACK_IN + zone_id;
 	else
-		return IP6_DEFRAG_CONNTRACK_OUT + zone;
-
+		return IP6_DEFRAG_CONNTRACK_OUT + zone_id;
 }
 
 static unsigned int ipv6_defrag(const struct nf_hook_ops *ops,

net/netfilter/ipvs/ip_vs_nfct.c +1 -1

index 5882bbf..1361845 100644
@@ -274,7 +274,7 @@ void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)
 		" for conn " FMT_CONN "\n",
 		__func__, ARG_TUPLE(&tuple), ARG_CONN(cp));
 
-	h = nf_conntrack_find_get(ip_vs_conn_net(cp), NF_CT_DEFAULT_ZONE,
+	h = nf_conntrack_find_get(ip_vs_conn_net(cp), &nf_ct_zone_dflt,
 				  &tuple);
 	if (h) {
 		ct = nf_ct_tuplehash_to_ctrack(h);

net/netfilter/nf_conntrack_core.c +43 ~~-26~~

239 lines not on this page · raw message

net/netfilter/nf_conntrack_expect.c +11 -8

index 7a17070..4abee59 100644
@@ -88,7 +88,8 @@ static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple *tuple
 }
 
 struct nf_conntrack_expect *
-__nf_ct_expect_find(struct net *net, u16 zone,
+__nf_ct_expect_find(struct net *net,
+		    const struct nf_conntrack_zone *zone,
 		    const struct nf_conntrack_tuple *tuple)
 {
 	struct nf_conntrack_expect *i;

@@ -100,7 +101,7 @@ __nf_ct_expect_find(struct net *net, u16 zone,
 	h = nf_ct_expect_dst_hash(tuple);
 	hlist_for_each_entry_rcu(i, &net->ct.expect_hash[h], hnode) {
 		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
-		    nf_ct_zone(i->master) == zone)
+		    nf_ct_zone_equal(i->master, zone))
 			return i;
 	}
 	return NULL;

@@ -109,7 +110,8 @@ EXPORT_SYMBOL_GPL(__nf_ct_expect_find);
 
 /* Just find a expectation corresponding to a tuple. */
 struct nf_conntrack_expect *
-nf_ct_expect_find_get(struct net *net, u16 zone,
+nf_ct_expect_find_get(struct net *net,
+		      const struct nf_conntrack_zone *zone,
 		      const struct nf_conntrack_tuple *tuple)
 {
 	struct nf_conntrack_expect *i;

@@ -127,7 +129,8 @@ EXPORT_SYMBOL_GPL(nf_ct_expect_find_get);
 /* If an expectation for this connection is found, it gets delete from
  * global list then returned. */
 struct nf_conntrack_expect *
-nf_ct_find_expectation(struct net *net, u16 zone,
+nf_ct_find_expectation(struct net *net,
+		       const struct nf_conntrack_zone *zone,
 		       const struct nf_conntrack_tuple *tuple)
 {
 	struct nf_conntrack_expect *i, *exp = NULL;

@@ -140,7 +143,7 @@ nf_ct_find_expectation(struct net *net, u16 zone,
 	hlist_for_each_entry(i, &net->ct.expect_hash[h], hnode) {
 		if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
 		    nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
-		    nf_ct_zone(i->master) == zone) {
+		    nf_ct_zone_equal(i->master, zone)) {
 			exp = i;
 			break;
 		}

@@ -226,9 +229,9 @@ static inline int expect_matches(const struct nf_conntrack_expect *a,
 				 const struct nf_conntrack_expect *b)
 {
 	return a->master == b->master && a->class == b->class &&
-		nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
-		nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
-		nf_ct_zone(a->master) == nf_ct_zone(b->master);
+	       nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
+	       nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
+	       nf_ct_zone_equal(a->master, nf_ct_zone(b->master));
 }
 
 /* Generally a bad idea to call this: could have matched already. */

net/netfilter/nf_conntrack_netlink.c +44 ~~-40~~

240 lines not on this page · raw message

net/netfilter/nf_conntrack_pptp.c +2 -1

index 825c3e3..5588c7a 100644
@@ -143,13 +143,14 @@ static int destroy_sibling_or_exp(struct net *net, struct nf_conn *ct,
 				  const struct nf_conntrack_tuple *t)
 {
 	const struct nf_conntrack_tuple_hash *h;
+	const struct nf_conntrack_zone *zone;
 	struct nf_conntrack_expect *exp;
 	struct nf_conn *sibling;
-	u16 zone = nf_ct_zone(ct);
 
 	pr_debug("trying to timeout ct or exp for tuple ");
 	nf_ct_dump_tuple(t);
 
+	zone = nf_ct_zone(ct);
 	h = nf_conntrack_find_get(net, zone, t);
 	if (h)  {
 		sibling = nf_ct_tuplehash_to_ctrack(h);

net/netfilter/nf_conntrack_standalone.c +12 -5

index fc823fa..28c8b2b 100644
@@ -140,6 +140,17 @@ static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 }
 #endif
 
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+static void ct_show_zone(struct seq_file *s, const struct nf_conn *ct)
+{
+	seq_printf(s, "zone=%u ", nf_ct_zone(ct)->id);
+}
+#else
+static inline void ct_show_zone(struct seq_file *s, const struct nf_conn *ct)
+{
+}
+#endif
+
 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
 static void ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
 {

@@ -228,11 +239,7 @@ static int ct_seq_show(struct seq_file *s, void *v)
 #endif
 
 	ct_show_secctx(s, ct);
-
-#ifdef CONFIG_NF_CONNTRACK_ZONES
-	seq_printf(s, "zone=%u ", nf_ct_zone(ct));
-#endif
-
+	ct_show_zone(s, ct);
 	ct_show_delta_time(s, ct);
 
 	seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use));

net/netfilter/nf_nat_core.c +12 -7

index 4e0b478..65ebaf9 100644
@@ -118,14 +118,15 @@ EXPORT_SYMBOL(nf_xfrm_me_harder);
 
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
-hash_by_src(const struct net *net, u16 zone,
+hash_by_src(const struct net *net,
+	    const struct nf_conntrack_zone *zone,
 	    const struct nf_conntrack_tuple *tuple)
 {
 	unsigned int hash;
 
 	/* Original src, to ensure we map it consistently if poss. */
 	hash = jhash2((u32 *)&tuple->src, sizeof(tuple->src) / sizeof(u32),
-		      tuple->dst.protonum ^ zone ^ nf_conntrack_hash_rnd);
+		      tuple->dst.protonum ^ zone->id ^ nf_conntrack_hash_rnd);
 
 	return reciprocal_scale(hash, net->ct.nat_htable_size);
 }

@@ -185,7 +186,8 @@ same_src(const struct nf_conn *ct,
 
 /* Only called for SRC manip */
 static int
-find_appropriate_src(struct net *net, u16 zone,
+find_appropriate_src(struct net *net,
+		     const struct nf_conntrack_zone *zone,
 		     const struct nf_nat_l3proto *l3proto,
 		     const struct nf_nat_l4proto *l4proto,
 		     const struct nf_conntrack_tuple *tuple,

@@ -198,7 +200,7 @@ find_appropriate_src(struct net *net, u16 zone,
 
 	hlist_for_each_entry_rcu(nat, &net->ct.nat_bysource[h], bysource) {
 		ct = nat->ct;
-		if (same_src(ct, tuple) && nf_ct_zone(ct) == zone) {
+		if (same_src(ct, tuple) && nf_ct_zone_equal(ct, zone)) {
 			/* Copy source part from reply tuple. */
 			nf_ct_invert_tuplepr(result,
 				       &ct->tuplehash[IP_CT_DIR_REPLY].tuple);

@@ -218,7 +220,8 @@ find_appropriate_src(struct net *net, u16 zone,
  * the ip with the lowest src-ip/dst-ip/proto usage.
  */
 static void
-find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
+find_best_ips_proto(const struct nf_conntrack_zone *zone,
+		    struct nf_conntrack_tuple *tuple,
 		    const struct nf_nat_range *range,
 		    const struct nf_conn *ct,
 		    enum nf_nat_manip_type maniptype)

@@ -258,7 +261,7 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
 	 */
 	j = jhash2((u32 *)&tuple->src.u3, sizeof(tuple->src.u3) / sizeof(u32),
 		   range->flags & NF_NAT_RANGE_PERSISTENT ?
-			0 : (__force u32)tuple->dst.u3.all[max] ^ zone);
+			0 : (__force u32)tuple->dst.u3.all[max] ^ zone->id);
 
 	full_range = false;
 	for (i = 0; i <= max; i++) {

@@ -297,10 +300,12 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
 		 struct nf_conn *ct,
 		 enum nf_nat_manip_type maniptype)
 {
+	const struct nf_conntrack_zone *zone;
 	const struct nf_nat_l3proto *l3proto;
 	const struct nf_nat_l4proto *l4proto;
 	struct net *net = nf_ct_net(ct);
-	u16 zone = nf_ct_zone(ct);
+
+	zone = nf_ct_zone(ct);
 
 	rcu_read_lock();
 	l3proto = __nf_nat_l3proto_find(orig_tuple->src.l3num);

net/netfilter/nf_synproxy_core.c +3 -1

index 789feea..484a5d1 100644
@@ -17,10 +17,12 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_tcpudp.h>
 #include <linux/netfilter/xt_SYNPROXY.h>
+
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_synproxy.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 
 int synproxy_net_id;
 EXPORT_SYMBOL_GPL(synproxy_net_id);

@@ -354,7 +356,7 @@ static int __net_init synproxy_net_init(struct net *net)
 	int err = -ENOMEM;
 
 	memset(&t, 0, sizeof(t));
-	ct = nf_conntrack_alloc(net, 0, &t, &t, GFP_KERNEL);
+	ct = nf_conntrack_alloc(net, &nf_ct_zone_dflt, &t, &t, GFP_KERNEL);
 	if (IS_ERR(ct)) {
 		err = PTR_ERR(ct);
 		goto err1;

net/netfilter/xt_CT.c +4 -1

index 75747ae..e2d7b55 100644
@@ -184,6 +184,7 @@ out:
 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 			  struct xt_ct_target_info_v1 *info)
 {
+	struct nf_conntrack_zone zone;
 	struct nf_conntrack_tuple t;
 	struct nf_conn *ct;
 	int ret = -EOPNOTSUPP;

@@ -203,7 +204,9 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 		goto err1;
 
 	memset(&t, 0, sizeof(t));
-	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
+	zone.id = info->zone;
+
+	ct = nf_conntrack_alloc(par->net, &zone, &t, &t, GFP_KERNEL);
 	ret = PTR_ERR(ct);
 	if (IS_ERR(ct))
 		goto err2;

net/netfilter/xt_connlimit.c +5 -4

index 29ba621..075d89d 100644
@@ -134,7 +134,7 @@ static bool add_hlist(struct hlist_head *head,
 static unsigned int check_hlist(struct net *net,
 				struct hlist_head *head,
 				const struct nf_conntrack_tuple *tuple,
-				u16 zone,
+				const struct nf_conntrack_zone *zone,
 				bool *addit)
 {
 	const struct nf_conntrack_tuple_hash *found;

@@ -201,7 +201,7 @@ static unsigned int
 count_tree(struct net *net, struct rb_root *root,
 	   const struct nf_conntrack_tuple *tuple,
 	   const union nf_inet_addr *addr, const union nf_inet_addr *mask,
-	   u8 family, u16 zone)
+	   u8 family, const struct nf_conntrack_zone *zone)
 {
 	struct xt_connlimit_rb *gc_nodes[CONNLIMIT_GC_MAX_NODES];
 	struct rb_node **rbnode, *parent;

@@ -290,7 +290,8 @@ static int count_them(struct net *net,
 		      const struct nf_conntrack_tuple *tuple,
 		      const union nf_inet_addr *addr,
 		      const union nf_inet_addr *mask,
-		      u_int8_t family, u16 zone)
+		      u_int8_t family,
+		      const struct nf_conntrack_zone *zone)
 {
 	struct rb_root *root;
 	int count;

@@ -321,10 +322,10 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	union nf_inet_addr addr;
 	struct nf_conntrack_tuple tuple;
 	const struct nf_conntrack_tuple *tuple_ptr = &tuple;
+	const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
 	enum ip_conntrack_info ctinfo;
 	const struct nf_conn *ct;
 	unsigned int connections;
-	u16 zone = NF_CT_DEFAULT_ZONE;
 
 	ct = nf_ct_get(skb, &ctinfo);
 	if (ct != NULL) {

net/sched/act_connmark.c +4 -1

index f2b5402..e67a1bd 100644
@@ -37,6 +37,7 @@ static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a,
 	struct nf_conntrack_tuple tuple;
 	enum ip_conntrack_info ctinfo;
 	struct tcf_connmark_info *ca = a->priv;
+	struct nf_conntrack_zone zone;
 	struct nf_conn *c;
 	int proto;

@@ -70,7 +71,9 @@ static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a,
 			       proto, &tuple))
 		goto out;
 
-	thash = nf_conntrack_find_get(dev_net(skb->dev), ca->zone, &tuple);
+	zone.id = ca->zone;
+
+	thash = nf_conntrack_find_get(dev_net(skb->dev), &zone, &tuple);
 	if (!thash)
 		goto out;

Signature · 1 line

1.9.3

Daniel Borkmann

author

2015-07-22 10:54 UTC #9 lore raw

PATCH v3 2/3 netfilter: nf_conntrack: add direction support for zones

In reply to Daniel Borkmann

This work adds a direction parameter to netfilter zones, so identity separation can be performed only in original/reply or both directions (default). This basically opens up the possibility of doing NAT with conflicting IP address/port tuples from multiple, isolated tenants on a host (e.g. from a netns) without requiring each tenant to NAT twice resp. to use its own dedicated IP address to SNAT to, meaning overlapping tuples can be made unique with the zone identifier in original direction, where the NAT engine will then allocate a unique tuple in the commonly shared default zone for the reply direction. In some restricted, local DNAT cases, also port redirection could be used for making the reply traffic unique w/o requiring SNAT.

The consensus we've reached and discussed at NFWS and since the initial implementation [1] was to directly integrate the direction meta data into the existing zones infrastructure, as opposed to the ct->mark approach we proposed initially.

As we pass the nf_conntrack_zone object directly around, we don't have to touch all call-sites, but only those, that contain equality checks of zones. Thus, based on the current direction (original or reply), we either return the actual id, or the default NF_CT_DEFAULT_ZONE_ID. CT expectations are direction-agnostic entities when expectations are being compared among themselves, so we can only used the identifier in this case.

Note that zone identifiers can not be included into the hash mix anymore as they don't contain a "stable" value that would be equal for both directions at all times, f.e. if only zone->id would unconditionally be xor'ed into the table slot hash, then replies won't find the corresponding conntracking entry anymore.

If no particular direction is specified when configuring zones, the behaviour is exactly as we expect currently (both directions).

Support has been added for the CT netlink interface as well as the x_tables raw CT target, which both already offer existing interfaces to user space for the configuration of zones.

Below a minimal, simplified collision example (script in [2]) with netperf sessions:

  +--- tenant-1 ---+   mark := 1
  |    netperf     |--+
  +----------------+  |                CT zone := mark [ORIGINAL]
   [ip,sport] := X   +--------------+  +--- gateway ---+
                     | mark routing |--|     SNAT      |-- ... +
                     +--------------+  +---------------+       |
  +--- tenant-2 ---+  |                                     ~~~|~~~
  |    netperf     |--+                +-----------+           |
  +----------------+   mark := 2       | netserver |------ ... +
   [ip,sport] := X                     +-----------+
                                        [ip,port] := Y

On the gateway netns, example:

  iptables -t raw -A PREROUTING -j CT --zone mark --zone-dir ORIGINAL
  iptables -t nat -A POSTROUTING -o <dev> -j SNAT --to-source <ip> --random-fully

  iptables -t mangle -A PREROUTING -m conntrack --ctdir ORIGINAL -j CONNMARK --save-mark
  iptables -t mangle -A POSTROUTING -m conntrack --ctdir REPLY -j CONNMARK --restore-mark

conntrack -L from gateway netns:

netperf -H 10.1.1.2 -t TCP_STREAM -l60 -p12865,5555 from each tenant netns

tcp 6 431995 ESTABLISHED src=40.1.1.1 dst=10.1.1.2 sport=5555 dport=12865
src=10.1.1.2 dst=10.1.1.1 sport=12865 dport=1024
[ASSURED] mark=1 secctx=system_u:object_r:unlabeled_t:s0
zone=1 use=1 zone-dir=original

tcp 6 431994 ESTABLISHED src=40.1.1.1 dst=10.1.1.2 sport=5555 dport=12865
src=10.1.1.2 dst=10.1.1.1 sport=12865 dport=5555
[ASSURED] mark=2 secctx=system_u:object_r:unlabeled_t:s0
zone=2 use=1 zone-dir=original

tcp 6 299 ESTABLISHED src=40.1.1.1 dst=10.1.1.2 sport=39438 dport=33768
src=10.1.1.2 dst=10.1.1.1 sport=33768 dport=39438
[ASSURED] mark=1 secctx=system_u:object_r:unlabeled_t:s0
zone=1 use=1 zone-dir=original

tcp 6 300 ESTABLISHED src=40.1.1.1 dst=10.1.1.2 sport=32889 dport=40206
src=10.1.1.2 dst=10.1.1.1 sport=40206 dport=32889
[ASSURED] mark=2 secctx=system_u:object_r:unlabeled_t:s0
zone=2 use=2 zone-dir=original

Taking this further, test script in [2] creates 200 tenants and runs original-tuple colliding netperf sessions each. A conntrack -L dump in the gateway netns also confirms 200 overlapping entries, all in ESTABLISHED state as expected.

I also did run various other tests with some permutations of the script, to mention some: SNAT in random/random-fully/persistent mode, no zones (no overlaps), static zones (original, reply, both directions), etc.

[1] http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/57412/
[2] https://paste.fedoraproject.org/242835/65657871/

Signed-off-by Daniel Borkmann <[email protected]>

---
 include/net/netfilter/nf_conntrack_zones.h         | 30 +++++++++-
 include/uapi/linux/netfilter/nfnetlink_conntrack.h |  9 +++
 include/uapi/linux/netfilter/xt_CT.h               |  6 +-
 net/ipv4/netfilter/nf_defrag_ipv4.c                |  8 ++-
 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c          |  8 ++-
 net/netfilter/nf_conntrack_core.c                  | 52 +++++++++---------
 net/netfilter/nf_conntrack_expect.c                |  6 +-
 net/netfilter/nf_conntrack_netlink.c               | 64 ++++++++++++++++++----
 net/netfilter/nf_conntrack_standalone.c            |  9 ++-
 net/netfilter/nf_nat_core.c                        | 13 ++---
 net/netfilter/xt_CT.c                              | 16 +++++-
 net/sched/act_connmark.c                           |  1 +
 12 files changed, 167 insertions(+), 55 deletions(-)

include/net/netfilter/nf_conntrack_zones.h +29 -1

index 0788bb0..bef0539 100644
@@ -1,10 +1,17 @@
 #ifndef _NF_CONNTRACK_ZONES_H
 #define _NF_CONNTRACK_ZONES_H
 
+#include <linux/netfilter/nf_conntrack_tuple_common.h>
+
 #define NF_CT_DEFAULT_ZONE_ID	0
 
+#define NF_CT_ORIG_DIR		(1 << IP_CT_DIR_ORIGINAL)
+#define NF_CT_REPL_DIR		(1 << IP_CT_DIR_REPLY)
+#define NF_CT_DEFAULT_DIR	(NF_CT_ORIG_DIR | NF_CT_REPL_DIR)
+
 struct nf_conntrack_zone {
 	u16	id;
+	u16	dir;
 };
 
 extern const struct nf_conntrack_zone nf_ct_zone_dflt;

@@ -29,8 +36,29 @@ nf_ct_zone_tmpl(const struct nf_conn *tmpl)
 	return tmpl ? nf_ct_zone(tmpl) : &nf_ct_zone_dflt;
 }
 
+static inline bool nf_ct_zone_matches_dir(const struct nf_conntrack_zone *zone,
+					  enum ip_conntrack_dir dir)
+{
+	return zone->dir & (1 << dir);
+}
+
+static inline u16 nf_ct_zone_id(const struct nf_conntrack_zone *zone,
+				enum ip_conntrack_dir dir)
+{
+	return nf_ct_zone_matches_dir(zone, dir) ?
+	       zone->id : NF_CT_DEFAULT_ZONE_ID;
+}
+
 static inline bool nf_ct_zone_equal(const struct nf_conn *a,
-				    const struct nf_conntrack_zone *b)
+				    const struct nf_conntrack_zone *b,
+				    enum ip_conntrack_dir dir)
+{
+	return nf_ct_zone_id(nf_ct_zone(a), dir) ==
+	       nf_ct_zone_id(b, dir);
+}
+
+static inline bool nf_ct_zone_equal_any(const struct nf_conn *a,
+					const struct nf_conntrack_zone *b)
 {
 	return nf_ct_zone(a)->id == b->id;
 }

include/uapi/linux/netfilter/nfnetlink_conntrack.h +9 -0

index acad6c5..95841a5 100644
@@ -53,6 +53,7 @@ enum ctattr_type {
 	CTA_MARK_MASK,
 	CTA_LABELS,
 	CTA_LABELS_MASK,
+	CTA_DIR,
 	__CTA_MAX
 };
 #define CTA_MAX (__CTA_MAX - 1)

@@ -260,4 +261,12 @@ enum ctattr_expect_stats {
 };
 #define CTA_STATS_EXP_MAX (__CTA_STATS_EXP_MAX - 1)
 
+enum ctattr_dir {
+	CTA_DIR_UNSPEC,
+	CTA_DIR_ORIG,
+	CTA_DIR_REPL,
+	__CTA_DIR_MAX
+};
+#define CTA_DIR_MAX (__CTA_DIR_MAX - 1)
+
 #endif /* _IPCONNTRACK_NETLINK_H */

include/uapi/linux/netfilter/xt_CT.h +5 -1

index 5a688c1..452005f 100644
@@ -6,7 +6,11 @@
 enum {
 	XT_CT_NOTRACK		= 1 << 0,
 	XT_CT_NOTRACK_ALIAS	= 1 << 1,
-	XT_CT_MASK		= XT_CT_NOTRACK | XT_CT_NOTRACK_ALIAS,
+	XT_CT_ZONE_DIR_ORIG	= 1 << 2,
+	XT_CT_ZONE_DIR_REPL	= 1 << 3,
+
+	XT_CT_MASK		= XT_CT_NOTRACK | XT_CT_NOTRACK_ALIAS |
+				  XT_CT_ZONE_DIR_ORIG | XT_CT_ZONE_DIR_REPL,
 };
 
 struct xt_ct_target_info {

net/ipv4/netfilter/nf_defrag_ipv4.c +6 -2

index ad0501a..5fdd6f6 100644
@@ -45,8 +45,12 @@ static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
 {
 	u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
-	if (skb->nfct)
-		zone_id = nf_ct_zone((struct nf_conn *)skb->nfct)->id;
+	if (skb->nfct) {
+		enum ip_conntrack_info ctinfo;
+		const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+
+		zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo));
+	}
 #endif
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 	if (skb->nf_bridge &&

net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +6 -2

index 1749500..f623f06 100644
@@ -35,8 +35,12 @@ static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
 {
 	u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
-	if (skb->nfct)
-		zone_id = nf_ct_zone((struct nf_conn *)skb->nfct)->id;
+	if (skb->nfct) {
+		enum ip_conntrack_info ctinfo;
+		const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+
+		zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo));
+	}
 #endif
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 	if (skb->nf_bridge &&

net/netfilter/nf_conntrack_core.c +26 ~~-26~~

180 lines not on this page · raw message

net/netfilter/nf_conntrack_expect.c +3 -3

index 4abee59..f20f30e 100644
@@ -101,7 +101,7 @@ __nf_ct_expect_find(struct net *net,
 	h = nf_ct_expect_dst_hash(tuple);
 	hlist_for_each_entry_rcu(i, &net->ct.expect_hash[h], hnode) {
 		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
-		    nf_ct_zone_equal(i->master, zone))
+		    nf_ct_zone_equal_any(i->master, zone))
 			return i;
 	}
 	return NULL;

@@ -143,7 +143,7 @@ nf_ct_find_expectation(struct net *net,
 	hlist_for_each_entry(i, &net->ct.expect_hash[h], hnode) {
 		if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
 		    nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
-		    nf_ct_zone_equal(i->master, zone)) {
+		    nf_ct_zone_equal_any(i->master, zone)) {
 			exp = i;
 			break;
 		}

@@ -231,7 +231,7 @@ static inline int expect_matches(const struct nf_conntrack_expect *a,
 	return a->master == b->master && a->class == b->class &&
 	       nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
 	       nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
-	       nf_ct_zone_equal(a->master, nf_ct_zone(b->master));
+	       nf_ct_zone_equal_any(a->master, nf_ct_zone(b->master));
 }
 
 /* Generally a bad idea to call this: could have matched already. */

net/netfilter/nf_conntrack_netlink.c +53 ~~-11~~

160 lines not on this page · raw message

net/netfilter/nf_conntrack_standalone.c +8 -1

index 28c8b2b..b214e91 100644
@@ -143,7 +143,14 @@ static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 static void ct_show_zone(struct seq_file *s, const struct nf_conn *ct)
 {
-	seq_printf(s, "zone=%u ", nf_ct_zone(ct)->id);
+	const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
+	static const char * const dir_name[] = {
+		[NF_CT_ORIG_DIR]	= "original",
+		[NF_CT_REPL_DIR]	= "reply",
+		[NF_CT_DEFAULT_DIR]	= "both",
+	};
+
+	seq_printf(s, "zone=%u zone-dir=%s ", zone->id, dir_name[zone->dir]);
 }
 #else
 static inline void ct_show_zone(struct seq_file *s, const struct nf_conn *ct)

net/netfilter/nf_nat_core.c +6 -7

index 65ebaf9..5113dfd 100644
@@ -118,15 +118,13 @@ EXPORT_SYMBOL(nf_xfrm_me_harder);
 
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
-hash_by_src(const struct net *net,
-	    const struct nf_conntrack_zone *zone,
-	    const struct nf_conntrack_tuple *tuple)
+hash_by_src(const struct net *net, const struct nf_conntrack_tuple *tuple)
 {
 	unsigned int hash;
 
 	/* Original src, to ensure we map it consistently if poss. */
 	hash = jhash2((u32 *)&tuple->src, sizeof(tuple->src) / sizeof(u32),
-		      tuple->dst.protonum ^ zone->id ^ nf_conntrack_hash_rnd);
+		      tuple->dst.protonum ^ nf_conntrack_hash_rnd);
 
 	return reciprocal_scale(hash, net->ct.nat_htable_size);
 }

@@ -194,13 +192,14 @@ find_appropriate_src(struct net *net,
 		     struct nf_conntrack_tuple *result,
 		     const struct nf_nat_range *range)
 {
-	unsigned int h = hash_by_src(net, zone, tuple);
+	unsigned int h = hash_by_src(net, tuple);
 	const struct nf_conn_nat *nat;
 	const struct nf_conn *ct;
 
 	hlist_for_each_entry_rcu(nat, &net->ct.nat_bysource[h], bysource) {
 		ct = nat->ct;
-		if (same_src(ct, tuple) && nf_ct_zone_equal(ct, zone)) {
+		if (same_src(ct, tuple) &&
+		    nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL)) {
 			/* Copy source part from reply tuple. */
 			nf_ct_invert_tuplepr(result,
 				       &ct->tuplehash[IP_CT_DIR_REPLY].tuple);

@@ -425,7 +424,7 @@ nf_nat_setup_info(struct nf_conn *ct,
 	if (maniptype == NF_NAT_MANIP_SRC) {
 		unsigned int srchash;
 
-		srchash = hash_by_src(net, nf_ct_zone(ct),
+		srchash = hash_by_src(net,
 				      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 		spin_lock_bh(&nf_nat_lock);
 		/* nf_conntrack_alter_reply might re-allocate extension aera */

net/netfilter/xt_CT.c +15 -1

index e2d7b55..8646075 100644
@@ -181,6 +181,18 @@ out:
 #endif
 }
 
+static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
+{
+	switch (info->flags & (XT_CT_ZONE_DIR_ORIG | XT_CT_ZONE_DIR_REPL)) {
+	case XT_CT_ZONE_DIR_ORIG:
+		return NF_CT_ORIG_DIR;
+	case XT_CT_ZONE_DIR_REPL:
+		return NF_CT_REPL_DIR;
+	default:
+		return NF_CT_DEFAULT_DIR;
+	}
+}
+
 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 			  struct xt_ct_target_info_v1 *info)
 {

@@ -195,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 	}
 
 #ifndef CONFIG_NF_CONNTRACK_ZONES
-	if (info->zone)
+	if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
+					 XT_CT_ZONE_DIR_REPL))
 		goto err1;
 #endif

@@ -205,6 +218,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 
 	memset(&t, 0, sizeof(t));
 	zone.id = info->zone;
+	zone.dir = xt_ct_flags_to_dir(info);
 
 	ct = nf_conntrack_alloc(par->net, &zone, &t, &t, GFP_KERNEL);
 	ret = PTR_ERR(ct);

net/sched/act_connmark.c +1 -0

index e67a1bd..25dc890 100644
@@ -72,6 +72,7 @@ static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a,
 		goto out;
 
 	zone.id = ca->zone;
+	zone.dir = NF_CT_DEFAULT_DIR;
 
 	thash = nf_conntrack_find_get(dev_net(skb->dev), &zone, &tuple);
 	if (!thash)

Signature · 1 line

1.9.3

Daniel Borkmann

author

2015-07-22 10:54 UTC #10 lore raw

PATCH v3 3/3 netfilter: nf_conntrack: add efficient mark to zone mapping

In reply to Daniel Borkmann

This work adds the possibility of deriving the zone id from the skb->mark field in a scalable manner. This allows for having only a single template serving hundreds/thousands of different zones, for example, instead of the need to have one match for each zone as an extra CT jump target.

Note that we'd need to have this information attached to the template as at the time when we're trying to lookup a possible ct object, we already need to know zone information for a possible match when going into __nf_conntrack_find_get(). This work provides a minimal implementation for a possible mapping.

In order to not add/expose an extra ct->status bit, the zone structure has been extended to carry a flag for deriving the mark.

Signed-off-by Daniel Borkmann <[email protected]>

---
 include/net/netfilter/nf_conntrack_zones.h     | 29 +++++++++++++++++++++++---
 include/uapi/linux/netfilter/xt_CT.h           |  4 +++-
 net/ipv4/netfilter/nf_conntrack_proto_icmp.c   |  3 ++-
 net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c |  4 +++-
 net/netfilter/nf_conntrack_core.c              | 10 +++++----
 net/netfilter/nf_conntrack_netlink.c           |  1 +
 net/netfilter/xt_CT.c                          |  9 ++++++--
 7 files changed, 48 insertions(+), 12 deletions(-)

include/net/netfilter/nf_conntrack_zones.h +26 -3

index bef0539..4ab835f6 100644
@@ -9,9 +9,12 @@
 #define NF_CT_REPL_DIR		(1 << IP_CT_DIR_REPLY)
 #define NF_CT_DEFAULT_DIR	(NF_CT_ORIG_DIR | NF_CT_REPL_DIR)
 
+#define NF_CT_FLAG_MARK		1
+
 struct nf_conntrack_zone {
 	u16	id;
-	u16	dir;
+	u8	flags;
+	u8	dir;
 };
 
 extern const struct nf_conntrack_zone nf_ct_zone_dflt;

@@ -31,9 +34,29 @@ nf_ct_zone(const struct nf_conn *ct)
 }
 
 static inline const struct nf_conntrack_zone *
-nf_ct_zone_tmpl(const struct nf_conn *tmpl)
+nf_ct_zone_init(struct nf_conntrack_zone *zone, u16 id, u8 dir, u8 flags)
 {
-	return tmpl ? nf_ct_zone(tmpl) : &nf_ct_zone_dflt;
+	zone->id = id;
+	zone->flags = flags;
+	zone->dir = dir;
+
+	return zone;
+}
+
+static inline const struct nf_conntrack_zone *
+nf_ct_zone_tmpl(const struct nf_conn *tmpl, const struct sk_buff *skb,
+		struct nf_conntrack_zone *tmp)
+{
+	const struct nf_conntrack_zone *zone;
+
+	if (!tmpl)
+		return &nf_ct_zone_dflt;
+
+	zone = nf_ct_zone(tmpl);
+	if (zone->flags & NF_CT_FLAG_MARK)
+		zone = nf_ct_zone_init(tmp, skb->mark, zone->dir, 0);
+
+	return zone;
 }
 
 static inline bool nf_ct_zone_matches_dir(const struct nf_conntrack_zone *zone,

include/uapi/linux/netfilter/xt_CT.h +3 -1

index 452005f..9e52041 100644
@@ -8,9 +8,11 @@ enum {
 	XT_CT_NOTRACK_ALIAS	= 1 << 1,
 	XT_CT_ZONE_DIR_ORIG	= 1 << 2,
 	XT_CT_ZONE_DIR_REPL	= 1 << 3,
+	XT_CT_ZONE_MARK		= 1 << 4,
 
 	XT_CT_MASK		= XT_CT_NOTRACK | XT_CT_NOTRACK_ALIAS |
-				  XT_CT_ZONE_DIR_ORIG | XT_CT_ZONE_DIR_REPL,
+				  XT_CT_ZONE_DIR_ORIG | XT_CT_ZONE_DIR_REPL |
+				  XT_CT_ZONE_MARK,
 };
 
 struct xt_ct_target_info {

net/ipv4/netfilter/nf_conntrack_proto_icmp.c +2 -1

index 8a2f41c..cdde3ec 100644
@@ -135,9 +135,10 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
 	const struct nf_conntrack_l4proto *innerproto;
 	const struct nf_conntrack_tuple_hash *h;
 	const struct nf_conntrack_zone *zone;
+	struct nf_conntrack_zone tmp;
 
 	NF_CT_ASSERT(skb->nfct == NULL);
-	zone = nf_ct_zone_tmpl(tmpl);
+	zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);
 
 	/* Are they talking about one of our connections? */
 	if (!nf_ct_get_tuplepr(skb,

net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +3 -1

index 2029141..0e6fae1 100644
@@ -150,6 +150,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
 	struct nf_conntrack_tuple intuple, origtuple;
 	const struct nf_conntrack_tuple_hash *h;
 	const struct nf_conntrack_l4proto *inproto;
+	struct nf_conntrack_zone tmp;
 
 	NF_CT_ASSERT(skb->nfct == NULL);

@@ -176,7 +177,8 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
 
 	*ctinfo = IP_CT_RELATED;
 
-	h = nf_conntrack_find_get(net, nf_ct_zone_tmpl(tmpl), &intuple);
+	h = nf_conntrack_find_get(net, nf_ct_zone_tmpl(tmpl, skb, &tmp),
+				  &intuple);
 	if (!h) {
 		pr_debug("icmpv6_error: no match\n");
 		return -NF_ACCEPT;

net/netfilter/nf_conntrack_core.c +6 -4

index 8f8e842..e0ef80a 100644
@@ -849,8 +849,8 @@ __nf_conntrack_alloc(struct net *net,
 		nf_ct_zone = nf_ct_ext_add(ct, NF_CT_EXT_ZONE, GFP_ATOMIC);
 		if (!nf_ct_zone)
 			goto out_free;
-		nf_ct_zone->id = zone->id;
-		nf_ct_zone->dir = zone->dir;
+
+		nf_ct_zone_init(nf_ct_zone, zone->id, zone->dir, zone->flags);
 	}
 #endif
 	/* Because we use RCU lookups, we set ct_general.use to zero before

@@ -912,6 +912,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
 	struct nf_conntrack_expect *exp = NULL;
 	const struct nf_conntrack_zone *zone;
 	struct nf_conn_timeout *timeout_ext;
+	struct nf_conntrack_zone tmp;
 	unsigned int *timeouts;
 
 	if (!nf_ct_invert_tuple(&repl_tuple, tuple, l3proto, l4proto)) {

@@ -919,7 +920,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
 		return NULL;
 	}
 
-	zone = nf_ct_zone_tmpl(tmpl);
+	zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);
 	ct = __nf_conntrack_alloc(net, zone, tuple, &repl_tuple, GFP_ATOMIC,
 				  hash);
 	if (IS_ERR(ct))

@@ -1017,6 +1018,7 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl,
 	const struct nf_conntrack_zone *zone;
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_tuple_hash *h;
+	struct nf_conntrack_zone tmp;
 	struct nf_conn *ct;
 	u32 hash;

@@ -1028,7 +1030,7 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl,
 	}
 
 	/* look for tuple match */
-	zone = nf_ct_zone_tmpl(tmpl);
+	zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);
 	hash = hash_conntrack_raw(&tuple);
 	h = __nf_conntrack_find_get(net, zone, &tuple, hash);
 	if (!h) {

net/netfilter/nf_conntrack_netlink.c +1 -0

index 0d389ec..b53d425 100644
@@ -1008,6 +1008,7 @@ ctnetlink_parse_zone(const struct nlattr *zattr,
 {
 	zone->id = NF_CT_DEFAULT_ZONE_ID;
 	zone->dir = NF_CT_DEFAULT_DIR;
+	zone->flags = 0;
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 	if (zattr)

net/netfilter/xt_CT.c +7 -2

index 8646075..df4e9ad 100644
@@ -20,6 +20,8 @@
 #include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 
+#define XT_CT_ZONE_FLAGS (XT_CT_ZONE_DIR_ORIG | XT_CT_ZONE_DIR_REPL | XT_CT_ZONE_MARK)
+
 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
 {
 	/* Previously seen (loopback)? Ignore. */

@@ -207,8 +209,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 	}
 
 #ifndef CONFIG_NF_CONNTRACK_ZONES
-	if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
-					 XT_CT_ZONE_DIR_REPL))
+	if (info->zone || info->flags & XT_CT_ZONE_FLAGS)
 		goto err1;
 #endif

@@ -217,8 +218,12 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 		goto err1;
 
 	memset(&t, 0, sizeof(t));
+
 	zone.id = info->zone;
 	zone.dir = xt_ct_flags_to_dir(info);
+	zone.flags = 0;
+	if (info->flags & XT_CT_ZONE_MARK)
+		zone.flags |= NF_CT_FLAG_MARK;
 
 	ct = nf_conntrack_alloc(par->net, &zone, &t, &t, GFP_KERNEL);
 	ret = PTR_ERR(ct);

Signature · 1 line

1.9.3

Pablo Neira Ayuso

maintainer

2015-07-30 16:01 UTC #2 lore raw

Re: [PATCH nf-next v3 1/3] netfilter: nf_conntrack: push zone object into functions

In reply to Daniel Borkmann

Quoted 10 lines · Daniel Borkmann

This patch replaces the zone id which is pushed down into functions with the actual zone object. It's a bigger one-time change, but needed for later on extending zones with a direction parameter, and thus decoupling this additional information from all call-sites.
No functional changes in this patch.
The default zones becomes a global const object, namely nf_ct_zone_dflt and will be returned directly in various cases, one being, when there's f.e. no zoning support.

Looks fine. This patchset depends on the recent fixes though, so let me send a pull request to David with pending nf-next updates, then you can rebase upon a fresh HEAD.

Regarding follow up patches, it would be good if you rename CTA_DIR to CTA_ZONE_DIR. If you plan to place more information into the zone extension, then it's probably a good idea to add a new nested CTA_ZONE_INFO attribute where we can start adding new more information on the zone configuration there that applies to the tuple.

I have seen also that you placed zone-dir= after use= in the sysctl output, but you can place this after the zone instead. We have a netlink interface so people should not be doing string parsing.

I'll make a closer look later to see if I have more comments. Thanks for your patience, Daniel.

Daniel Borkmann

author

2015-07-30 16:34 UTC #3 lore raw

Re: [PATCH nf-next v3 1/3] netfilter: nf_conntrack: push zone object into functions

Quoted 8 lines · Pablo Neira Ayuso

Quoted 7 lines · Daniel Borkmann
This patch replaces the zone id which is pushed down into functions with the actual zone object. It's a bigger one-time change, but needed for later on extending zones with a direction parameter, and thus decoupling this additional information from all call-sites.
No functional changes in this patch.

Quoted 7 lines

Quoted 3 lines
The default zones becomes a global const object, namely nf_ct_zone_dflt and will be returned directly in various cases, one being, when there's f.e. no zoning support.
Looks fine. This patchset depends on the recent fixes though, so let me send a pull request to David with pending nf-next updates, then you can rebase upon a fresh HEAD.

Okay, I guess there would be quite some ugly merge conflicts otherwise due to the recent -nf fixes that accumulated over time. I will send out a rebased version against -nf-next as soon as this dependency is resolved.

Quoted 5 lines

Regarding follow up patches, it would be good if you rename CTA_DIR to CTA_ZONE_DIR. If you plan to place more information into the zone extension, then it's probably a good idea to add a new nested CTA_ZONE_INFO attribute where we can start adding new more information on the zone configuration there that applies to the tuple.

CTA_ZONE_DIR seems better, sure. I don't have any other extensions at the moment, but it seems it makes sense to make this nested at this point in time, so we have CTA_ZONE and CTA_ZONE_INFO as a container for CTA_ZONE_DIR and whatever future might bring. I will look into it.

Quoted 3 lines

I have seen also that you placed zone-dir= after use= in the sysctl output, but you can place this after the zone instead. We have a netlink interface so people should not be doing string parsing.

Okay, good to know, thanks!

Quoted 2 lines

I'll make a closer look later to see if I have more comments. Thanks for your patience, Daniel.

No problem. Thanks, Pablo!

Pablo Neira Ayuso

maintainer

2015-08-03 15:53 UTC #4 lore raw

Re: [PATCH nf-next v3 1/3] netfilter: nf_conntrack: push zone object into functions

Quoted 4 lines · Daniel Borkmann

CTA_ZONE_DIR seems better, sure. I don't have any other extensions at the moment, but it seems it makes sense to make this nested at this point in time, so we have CTA_ZONE and CTA_ZONE_INFO as a container for CTA_ZONE_DIR and whatever future might bring. I will look into it.

thinking it well, this is part of the tuple, so I'd suggest you add CTA_TUPLE_ZONE to enum ctattr_tuple. We will probably need later to place each tuple in different zones.

Daniel Borkmann

author

2015-08-03 16:00 UTC #5 lore raw

Re: [PATCH nf-next v3 1/3] netfilter: nf_conntrack: push zone object into functions

Quoted 9 lines · Pablo Neira Ayuso

Quoted 4 lines · Daniel Borkmann
CTA_ZONE_DIR seems better, sure. I don't have any other extensions at the moment, but it seems it makes sense to make this nested at this point in time, so we have CTA_ZONE and CTA_ZONE_INFO as a container for CTA_ZONE_DIR and whatever future might bring. I will look into it.
thinking it well, this is part of the tuple, so I'd suggest you add CTA_TUPLE_ZONE to enum ctattr_tuple. We will probably need later to place each tuple in different zones.

That's fine with me, will do after your tree rebase.

Thanks again,
Daniel

Pablo Neira Ayuso

maintainer

2015-08-05 10:45 UTC #6 lore raw

Re: [PATCH nf-next v3 1/3] netfilter: nf_conntrack: push zone object into functions

Quoted 7 lines · Daniel Borkmann

Quoted 6 lines · Pablo Neira Ayuso
Quoted 4 lines · Daniel Borkmann
CTA_ZONE_DIR seems better, sure. I don't have any other extensions at the moment, but it seems it makes sense to make this nested at this point in time, so we have CTA_ZONE and CTA_ZONE_INFO as a container for CTA_ZONE_DIR and whatever future might bring. I will look into it.

Quoted 5 lines

Quoted 3 lines
thinking it well, this is part of the tuple, so I'd suggest you add CTA_TUPLE_ZONE to enum ctattr_tuple. We will probably need later to place each tuple in different zones.
That's fine with me, will do after your tree rebase.

Just pushed out a fresh copy with net-next into nf-next.

Daniel, a minor change that I came up with. With your patchset, the configurations that we accept look like:

zone original=Value reply=0
zone original=0 reply=Value

But thinking on Thomas' requirements to limit the number of conntracks per zone, I think another valid configuration (and more generic) can be:

zone original=ValueX reply=ValueY

So we don't assume that the original or reply zone is always zero.

The zone extension are that look like this:

struct nf_conntrack_zone {
        u16     id[IP_CT_DIR_MAX];
};

And we don't need to store the direction. To keep backward compatibility we can set the id in both directions to the same value.

Can you see any problem with this approach? I think it should require just a little adjustment to you patchset. Thanks.

Daniel Borkmann

author

2015-08-05 14:00 UTC #7 lore raw

Re: [PATCH nf-next v3 1/3] netfilter: nf_conntrack: push zone object into functions

Quoted 8 lines · Pablo Neira Ayuso

Quoted 7 lines · Daniel Borkmann
Quoted 6 lines · Pablo Neira Ayuso
Quoted 4 lines · Daniel Borkmann
CTA_ZONE_DIR seems better, sure. I don't have any other extensions at the moment, but it seems it makes sense to make this nested at this point in time, so we have CTA_ZONE and CTA_ZONE_INFO as a container for CTA_ZONE_DIR and whatever future might bring. I will look into it.

Quoted 7 lines

Quoted 5 lines
Quoted 3 lines
thinking it well, this is part of the tuple, so I'd suggest you add CTA_TUPLE_ZONE to enum ctattr_tuple. We will probably need later to place each tuple in different zones.
That's fine with me, will do after your tree rebase.
Just pushed out a fresh copy with net-next into nf-next.

Cool, thanks, will move on with my rework/base of the set then!

Quoted 5 lines

Daniel, a minor change that I came up with. With your patchset, the configurations that we accept look like:
zone original=Value reply=0
zone original=0 reply=Value

Yes, the full picture is ...

  zone   original=Value     reply=Default
  zone   original=Default   reply=Value
  zone   original=Value     reply=Value
  zone   original=Default   reply=Default

... where Default (== 0) is to be understood "zone unspecified".

Quoted 14 lines

But thinking on Thomas' requirements to limit the number of conntracks per zone, I think another valid configuration (and more generic) can be:
zone original=ValueX reply=ValueY
So we don't assume that the original or reply zone is always zero.
The zone extension are that look like this:
struct nf_conntrack_zone {
         u16     id[IP_CT_DIR_MAX];
};

Quoted 5 lines

And we don't need to store the direction. To keep backward compatibility we can set the id in both directions to the same value.
Can you see any problem with this approach? I think it should require just a little adjustment to you patchset. Thanks.

Don't yet see the bigger picture how this would relate to limiting the number of conntrack entries per zone, but I also haven't thought deeply on an implementation of that issue. A zone ValueX and ValueY where ValueX != ValueY in different directions would imply fully overlapping tuples in both directions, or only partially shared/common pools for tuple allocations in the opposite directions.

Anyway, this would mean that instead of a simple direction flag as we currently have, we'd need new revisions to add either two more zone ids to uapi structs or a flag and a 2nd zone id field, if we want to reuse the first zone field, and similarly also for the netlink interfaces.

On the mark to zone mapping, we would then need to fill the whole id[IP_CT_DIR_MAX] on the template, which seems a little more problematic to me.

This would probably mean we have to split the mark's bit space into two 16 bit parts (f.e. mark := (ValueX << 16) | ValueY)) to fill both directions depending from which side we arrive.

The entity setting the mark would need to shift its own id encoding into the correct direction in the mark and would leave the other one as default zone (== 0) if unaware of it? Then, the problem is that the /first/ one creating the conntrack entry does need to know ValueX /and/ ValueY, if later on we want to retrieve the entry again via zone ValueY.

This mark bit shifting seems rather inconvenient to use, imho. If ValueY can be dymanic, perhaps then the one triggering the initial packet might not even know which one to arrive in yet?

One could still add a direction parameter in the zone struct to know where to apply the mark, if we don't want to encode both ids, and to have the other one 0 to not expose this burden to the user. But that means ValueY is static to 0 in this case, which seems undesired here.

So it looks actually a bit of a more complex change (/configuration), doesn't seem to integrate as 'straight-forward' as the current approach, but also targets a bit of a different use case (?) than this current set does. Note that the current set doesn't ban us either from modifications later on. Please let me know if I'm wrong somewhere, but given the above issues, I would be happy to stick with the current approach instead, with your feedback integrated from your other mails, of course.

Thanks,
Daniel

Pablo Neira Ayuso

maintainer

2015-08-06 09:56 UTC #8 lore raw

Re: [PATCH nf-next v3 1/3] netfilter: nf_conntrack: push zone object into functions

On Wed, Aug 05, 2015 at 04:00:29PM +0200, Daniel Borkmann wrote:
[...]

Quoted 2 lines

[...] I would be happy to stick with the current approach instead, with your feedback integrated from your other mails, of course.

Please send a new round, as you said we have room to revisit this later on. Thanks.