Skip to content

Commit 8e56b06

Browse files
lxinFlorian Westphal
lxin
authored and
Florian Westphal
committed
netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp
In Scenario A and B below, as the delayed INIT_ACK always changes the peer vtag, SCTP ct with the incorrect vtag may cause packet loss. Scenario A: INIT_ACK is delayed until the peer receives its own INIT_ACK 192.168.1.2 > 192.168.1.1: [INIT] [init tag: 1328086772] 192.168.1.1 > 192.168.1.2: [INIT] [init tag: 1414468151] 192.168.1.2 > 192.168.1.1: [INIT ACK] [init tag: 1328086772] 192.168.1.1 > 192.168.1.2: [INIT ACK] [init tag: 1650211246] * 192.168.1.2 > 192.168.1.1: [COOKIE ECHO] 192.168.1.1 > 192.168.1.2: [COOKIE ECHO] 192.168.1.2 > 192.168.1.1: [COOKIE ACK] Scenario B: INIT_ACK is delayed until the peer completes its own handshake 192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408] 192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885] 192.168.1.2 > 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408] 192.168.1.1 > 192.168.1.2: sctp (1) [COOKIE ECHO] 192.168.1.2 > 192.168.1.1: sctp (1) [COOKIE ACK] 192.168.1.1 > 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] * This patch fixes it as below: In SCTP_CID_INIT processing: - clear ct->proto.sctp.init[!dir] if ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir]. (Scenario E) - set ct->proto.sctp.init[dir]. In SCTP_CID_INIT_ACK processing: - drop it if !ct->proto.sctp.init[!dir] && ct->proto.sctp.vtag[!dir] && ct->proto.sctp.vtag[!dir] != ih->init_tag. (Scenario B, Scenario C) - drop it if ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir] && ct->proto.sctp.vtag[!dir] != ih->init_tag. (Scenario A) In SCTP_CID_COOKIE_ACK processing: - clear ct->proto.sctp.init[dir] and ct->proto.sctp.init[!dir]. (Scenario D) Also, it's important to allow the ct state to move forward with cookie_echo and cookie_ack from the opposite dir for the collision scenarios. There are also other Scenarios where it should allow the packet through, addressed by the processing above: Scenario C: new CT is created by INIT_ACK. Scenario D: start INIT on the existing ESTABLISHED ct. Scenario E: start INIT after the old collision on the existing ESTABLISHED ct. 192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408] 192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885] (both side are stopped, then start new connection again in hours) 192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 242308742] Fixes: 9fb9cbb ("[NETFILTER]: Add nf_conntrack subsystem.") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
1 parent af84f9e commit 8e56b06

2 files changed

Lines changed: 34 additions & 10 deletions

File tree

‎include/linux/netfilter/nf_conntrack_sctp.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ struct ip_ct_sctp {
99
enum sctp_conntrack state;
1010

1111
__be32 vtag[IP_CT_DIR_MAX];
12+
u8 init[IP_CT_DIR_MAX];
1213
u8 last_dir;
1314
u8 flags;
1415
};

‎net/netfilter/nf_conntrack_proto_sctp.c‎

Lines changed: 33 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
112112
/* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA, sSA},
113113
/* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL},/* Can't have Stale cookie*/
114114
/* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA, sCL},/* 5.2.4 - Big TODO */
115-
/* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL},/* Can't come in orig dir */
115+
/* cookie_ack */ {sCL, sCL, sCW, sES, sES, sSS, sSR, sSA, sCL},/* Can't come in orig dir */
116116
/* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL, sCL},
117117
/* heartbeat */ {sHS, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS},
118118
/* heartbeat_ack*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS},
@@ -126,7 +126,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
126126
/* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV},
127127
/* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV},
128128
/* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA, sIV},
129-
/* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV},/* Can't come in reply dir */
129+
/* cookie_echo */ {sIV, sCL, sCE, sCE, sES, sSS, sSR, sSA, sIV},/* Can't come in reply dir */
130130
/* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA, sIV},
131131
/* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL, sIV},
132132
/* heartbeat */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS},
@@ -412,6 +412,9 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
412412
/* (D) vtag must be same as init_vtag as found in INIT_ACK */
413413
if (sh->vtag != ct->proto.sctp.vtag[dir])
414414
goto out_unlock;
415+
} else if (sch->type == SCTP_CID_COOKIE_ACK) {
416+
ct->proto.sctp.init[dir] = 0;
417+
ct->proto.sctp.init[!dir] = 0;
415418
} else if (sch->type == SCTP_CID_HEARTBEAT) {
416419
if (ct->proto.sctp.vtag[dir] == 0) {
417420
pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir);
@@ -461,16 +464,18 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
461464
}
462465

463466
/* If it is an INIT or an INIT ACK note down the vtag */
464-
if (sch->type == SCTP_CID_INIT ||
465-
sch->type == SCTP_CID_INIT_ACK) {
466-
struct sctp_inithdr _inithdr, *ih;
467+
if (sch->type == SCTP_CID_INIT) {
468+
struct sctp_inithdr _ih, *ih;
467469

468-
ih = skb_header_pointer(skb, offset + sizeof(_sch),
469-
sizeof(_inithdr), &_inithdr);
470-
if (ih == NULL)
470+
ih = skb_header_pointer(skb, offset + sizeof(_sch), sizeof(*ih), &_ih);
471+
if (!ih)
471472
goto out_unlock;
472-
pr_debug("Setting vtag %x for dir %d\n",
473-
ih->init_tag, !dir);
473+
474+
if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
475+
ct->proto.sctp.init[!dir] = 0;
476+
ct->proto.sctp.init[dir] = 1;
477+
478+
pr_debug("Setting vtag %x for dir %d\n", ih->init_tag, !dir);
474479
ct->proto.sctp.vtag[!dir] = ih->init_tag;
475480

476481
/* don't renew timeout on init retransmit so
@@ -481,6 +486,24 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
481486
old_state == SCTP_CONNTRACK_CLOSED &&
482487
nf_ct_is_confirmed(ct))
483488
ignore = true;
489+
} else if (sch->type == SCTP_CID_INIT_ACK) {
490+
struct sctp_inithdr _ih, *ih;
491+
__be32 vtag;
492+
493+
ih = skb_header_pointer(skb, offset + sizeof(_sch), sizeof(*ih), &_ih);
494+
if (!ih)
495+
goto out_unlock;
496+
497+
vtag = ct->proto.sctp.vtag[!dir];
498+
if (!ct->proto.sctp.init[!dir] && vtag && vtag != ih->init_tag)
499+
goto out_unlock;
500+
/* collision */
501+
if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir] &&
502+
vtag != ih->init_tag)
503+
goto out_unlock;
504+
505+
pr_debug("Setting vtag %x for dir %d\n", ih->init_tag, !dir);
506+
ct->proto.sctp.vtag[!dir] = ih->init_tag;
484507
}
485508

486509
ct->proto.sctp.state = new_state;

0 commit comments

Comments
 (0)