[Devel] [PATCH RH7] ms/netfilter: don't setup nat info for confirmed ct

[Vasily Averin]

please ignore, it is not enough,
this patch depends on upstream 9a08ecfe74d7 ("netfilter: don't attach a nat extension by default")
and it requires additional investigations.

On 2/2/21 1:24 PM, Vasily Averin wrote:
> From: Liping Zhang <zlpnobody at gmail.com>
> 
> We cannot setup nat info if the ct has been confirmed already, else,
> different cpu may race to handle the same ct. In extreme situation,
> we may hit the "BUG_ON(nf_nat_initialized(ct, maniptype))" in the
> nf_nat_setup_info.
> 
> Also running the following commands will easily hit NF_CT_ASSERT in
> nf_conntrack_alter_reply:
>   # nft flush ruleset
>   # ping -c 2 -W 1 1.1.1.111 &
>   # nft add table t
>   # nft add chain t c {type nat hook postrouting priority 0 \;}
>   # nft add rule t c snat to 4.5.6.7
>   WARNING: CPU: 1 PID: 10065 at net/netfilter/nf_conntrack_core.c:1472
>   nf_conntrack_alter_reply+0x9a/0x1a0 [nf_conntrack]
>   [...]
>   Call Trace:
>    nf_nat_setup_info+0xad/0x840 [nf_nat]
>    ? deactivate_slab+0x65d/0x6c0
>    nft_nat_eval+0xcd/0x100 [nft_nat]
>    nft_do_chain+0xff/0x5d0 [nf_tables]
>    ? mark_held_locks+0x6f/0xa0
>    ? __local_bh_enable_ip+0x70/0xa0
>    ? trace_hardirqs_on_caller+0x11f/0x190
>    ? ipt_do_table+0x310/0x610
>    ? trace_hardirqs_on+0xd/0x10
>    ? __local_bh_enable_ip+0x70/0xa0
>    ? ipt_do_table+0x32b/0x610
>    ? __lock_acquire+0x2ac/0x1580
>    ? ipt_do_table+0x32b/0x610
>    nft_nat_do_chain+0x65/0x80 [nft_chain_nat_ipv4]
>    nf_nat_ipv4_fn+0x1ae/0x240 [nf_nat_ipv4]
>    nf_nat_ipv4_out+0x4a/0xf0 [nf_nat_ipv4]
>    nft_nat_ipv4_out+0x15/0x20 [nft_chain_nat_ipv4]
>    nf_hook_slow+0x2c/0xf0
>    ip_output+0x154/0x270
> 
> So for the confirmed ct, just ignore it and return NF_ACCEPT.
> 
> Fixes: 9a08ecfe74d7 ("netfilter: don't attach a nat extension by default")
> Signed-off-by: Liping Zhang <zlpnobody at gmail.com>
> Acked-by: Florian Westphal <fw at strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
> (cherry picked from commit d110a3942aca78d14929bc648aeb83ee0b245a61)
> 
> https://jira.sw.ru/browse/PSBM-124668
> Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
> ---
>  net/netfilter/nf_nat_core.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
> index 790951c..8afad8b 100644
> --- a/net/netfilter/nf_nat_core.c
> +++ b/net/netfilter/nf_nat_core.c
> @@ -400,6 +400,10 @@ nf_nat_setup_info(struct nf_conn *ct,
>  	if (nat == NULL)
>  		return NF_ACCEPT;
>  
> +	/* Can't setup nat info for confirmed ct. */
> +	if (nf_ct_is_confirmed(ct))
> +		return NF_ACCEPT;
> +
>  	NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
>  		     maniptype == NF_NAT_MANIP_DST);
>  
>