netfilter: let reset rules clean out conntrack entries

[ Upstream commit 2954fe60e33da0f4de4d81a4c95c7dddb517d00c ]

iptables/nftables support responding to tcp packets with tcp resets.

The generated tcp reset packet passes through both output and postrouting
netfilter hooks, but conntrack will never see them because the generated
skb has its ->nfct pointer copied over from the packet that triggered the
reset rule.

If the reset rule is used for established connections, this
may result in the conntrack entry to be around for a very long
time (default timeout is 5 days).

One way to avoid this would be to not copy the nf_conn pointer
so that the rest packet passes through conntrack too.

Problem is that output rules might not have the same conntrack
zone setup as the prerouting ones, so its possible that the
reset skb won't find the correct entry.  Generating a template
entry for the skb seems error prone as well.

Add an explicit "closing" function that switches a confirmed
conntrack entry to closed state and wire this up for tcp.

If the entry isn't confirmed, no action is needed because
the conntrack entry will never be committed to the table.

Reported-by: Russel King <linux@armlinux.org.uk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 62e7151ae3eb ("netfilter: bridge: confirm multicast packets before passing them up the stack")
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 5a665034c30bebf2734c76f5daf95e81c1a3295b..c92bb1580f4195766def737119f671f8061d870b 100644 (file)
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -436,11 +436,13 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
 #include <linux/netfilter/nf_conntrack_zones_common.h>
 
 void nf_ct_attach(struct sk_buff *, const struct sk_buff *);
+void nf_ct_set_closing(struct nf_conntrack *nfct);
 struct nf_conntrack_tuple;
 bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple *dst_tuple,
                         const struct sk_buff *skb);
 #else
 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
+static inline void nf_ct_set_closing(struct nf_conntrack *nfct) {}
 struct nf_conntrack_tuple;
 static inline bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple *dst_tuple,
                                       const struct sk_buff *skb)
@@ -458,6 +460,7 @@ struct nf_ct_hook {
        bool (*get_tuple_skb)(struct nf_conntrack_tuple *,
                              const struct sk_buff *);
        void (*attach)(struct sk_buff *nskb, const struct sk_buff *skb);
+       void (*set_closing)(struct nf_conntrack *nfct);
 };
 extern const struct nf_ct_hook __rcu *nf_ct_hook;
 

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 34c266502a50e1400e644791c4efd37f4e55efd1..39541ab912a16c80e2afbde42abeaac2e8031d5d 100644 (file)
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -123,6 +123,12 @@ struct nf_conn {
        union nf_conntrack_proto proto;
 };
 
+static inline struct nf_conn *
+nf_ct_to_nf_conn(const struct nf_conntrack *nfct)
+{
+       return container_of(nfct, struct nf_conn, ct_general);
+}
+
 static inline struct nf_conn *
 nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)
 {
@@ -173,6 +179,8 @@ nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
 
 void nf_ct_destroy(struct nf_conntrack *nfct);
 
+void nf_conntrack_tcp_set_closing(struct nf_conn *ct);
+
 /* decrement reference count on a conntrack */
 static inline void nf_ct_put(struct nf_conn *ct)
 {

diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index f2edb40c0db00be38cee664f667b095559c2083c..350aaca126181ac4df48bdc34ade427a264ed559 100644 (file)
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -278,6 +278,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
                goto free_nskb;
 
        nf_ct_attach(nskb, oldskb);
+       nf_ct_set_closing(skb_nfct(oldskb));
 
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
        /* If we use ip_local_out for bridged traffic, the MAC source on

diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index dffeaaaadcdedb82ad96cd09cbfa5d88146fab2f..c0057edd84cfc46e0b22ae0d1005e35877830818 100644 (file)
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -345,6 +345,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
        nf_reject_ip6_tcphdr_put(nskb, oldskb, otcph, otcplen);
 
        nf_ct_attach(nskb, oldskb);
+       nf_ct_set_closing(skb_nfct(oldskb));
 
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
        /* If we use ip6_local_out for bridged traffic, the MAC source on

diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index aa3f7d3228fda7f4379e8138ac89d2715e42529f..fe81824799d9547007bb2652c71a86dcbcc5fccc 100644 (file)
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -674,6 +674,22 @@ void nf_conntrack_destroy(struct nf_conntrack *nfct)
 }
 EXPORT_SYMBOL(nf_conntrack_destroy);
 
+void nf_ct_set_closing(struct nf_conntrack *nfct)
+{
+       const struct nf_ct_hook *ct_hook;
+
+       if (!nfct)
+               return;
+
+       rcu_read_lock();
+       ct_hook = rcu_dereference(nf_ct_hook);
+       if (ct_hook)
+               ct_hook->set_closing(nfct);
+
+       rcu_read_unlock();
+}
+EXPORT_SYMBOL_GPL(nf_ct_set_closing);
+
 bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple *dst_tuple,
                         const struct sk_buff *skb)
 {

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 2a4222eefc894d627d0d9113de15fd4afd2b12ec..e0f4f76439d3d2549f5018cc7b756df0d12c3387 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -2833,11 +2833,23 @@ err_cachep:
        return ret;
 }
 
+static void nf_conntrack_set_closing(struct nf_conntrack *nfct)
+{
+       struct nf_conn *ct = nf_ct_to_nf_conn(nfct);
+
+       switch (nf_ct_protonum(ct)) {
+       case IPPROTO_TCP:
+               nf_conntrack_tcp_set_closing(ct);
+               break;
+       }
+}
+
 static const struct nf_ct_hook nf_conntrack_hook = {
        .update         = nf_conntrack_update,
        .destroy        = nf_ct_destroy,
        .get_tuple_skb  = nf_conntrack_get_tuple_skb,
        .attach         = nf_conntrack_attach,
+       .set_closing    = nf_conntrack_set_closing,
 };
 
 void nf_conntrack_init_end(void)

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 1ecfdc4f23be8c4538524d0341f6f934226b2447..f33e6aea7f4da17b14a5ee6f0901d92984e57f5d 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -870,6 +870,41 @@ static bool tcp_can_early_drop(const struct nf_conn *ct)
        return false;
 }
 
+void nf_conntrack_tcp_set_closing(struct nf_conn *ct)
+{
+       enum tcp_conntrack old_state;
+       const unsigned int *timeouts;
+       u32 timeout;
+
+       if (!nf_ct_is_confirmed(ct))
+               return;
+
+       spin_lock_bh(&ct->lock);
+       old_state = ct->proto.tcp.state;
+       ct->proto.tcp.state = TCP_CONNTRACK_CLOSE;
+
+       if (old_state == TCP_CONNTRACK_CLOSE ||
+           test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
+               spin_unlock_bh(&ct->lock);
+               return;
+       }
+
+       timeouts = nf_ct_timeout_lookup(ct);
+       if (!timeouts) {
+               const struct nf_tcp_net *tn;
+
+               tn = nf_tcp_pernet(nf_ct_net(ct));
+               timeouts = tn->timeouts;
+       }
+
+       timeout = timeouts[TCP_CONNTRACK_CLOSE];
+       WRITE_ONCE(ct->timeout, timeout + nfct_time_stamp);
+
+       spin_unlock_bh(&ct->lock);
+
+       nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
+}
+
 static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
 {
        state->td_end           = 0;