From patchwork Thu Dec 12 15:19:34 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Changli Gao X-Patchwork-Id: 300684 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6B4772C0085 for ; Fri, 13 Dec 2013 02:21:49 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751395Ab3LLPVq (ORCPT ); Thu, 12 Dec 2013 10:21:46 -0500 Received: from mail-pd0-f173.google.com ([209.85.192.173]:43971 "EHLO mail-pd0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751358Ab3LLPVq (ORCPT ); Thu, 12 Dec 2013 10:21:46 -0500 Received: by mail-pd0-f173.google.com with SMTP id p10so668044pdj.32 for ; Thu, 12 Dec 2013 07:21:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=5hpeRakLRpc4iABFoAdwJVD3xHPGLjdt0OBklHgJJaU=; b=NPRcX5o5Esi4Jwevj4PKzL29uy02o2lXew2/DHXmX7Eq2e/cHTAAvPvoAtzJkEhSVC aSlkTNzw6MO1B2wgxLCTXZmA+8rwAb7dXPPan6s4D/hnhxub2fqJ4BPb/1dWfRw6k86s 2jPR0j0DijJbpmgoxnDZX3Fh0skoBd5e6rwiomM8mGmU/SOWkC2TrNNtVvIwAPel8Ywt OW/NG5tfUPI58nk/CYhVPsSyV4x43Od2ZIK/gP77H6mCsxVhbOBUIxX78+FqB8A9ggCg vYU4k8aob4jgWW1BvKEN5K1W+W14TfRHFf+6O2V14nsqNq+IBhhJILBxm1GDSA9yQVmg i8zA== X-Received: by 10.68.228.97 with SMTP id sh1mr13225272pbc.50.1386861704565; Thu, 12 Dec 2013 07:21:44 -0800 (PST) Received: from localhost.localdomain ([221.239.34.230]) by mx.google.com with ESMTPSA id ik1sm40936211pbc.9.2013.12.12.07.21.40 for (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 12 Dec 2013 07:21:43 -0800 (PST) From: Changli Gao To: Pablo Neira Ayuso Cc: Changli Gao , netfilter-devel@vger.kernel.org Subject: [PATCH] netfilter: Kill unreplied conntracks by ICMP errors Date: Thu, 12 Dec 2013 10:19:34 -0500 Message-Id: <1386861575-121885-1-git-send-email-xiaosuo@gmail.com> X-Mailer: git-send-email 1.7.9.5 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Think about the following scenario: +--------+ +-------+ +----------+ | Server +------+ NAT 1 +------| Client 1 | +---+----+ +-------+ +----------+ | | +-------+ +----------+ +-----------+ NAT 2 +------| Client 2 | +-------+ +----------+ The following UDP punching steps are used to to establish a direct session between Client 1 and Client 2 with the help from Server. 1. Client 1 sends a UDP packet to Server, and Server learned the public IP and port of Client 1. 2. Client 2 sends a UDP packet to Server, and Server learned the public IP and port of Client 2. 3. Server tells Client 1 the public IP and port of Client 2. 4. Server tells Client 2 the public IP and port of Client 1. 5. Client 1 sends UDP packets to the public IP and port of Client 2. 6. Client 2 sends UDP packets to the public IP and port of Client 1. If both NAT 1 and NAT 2 are Cone NAT, Client 1 and Client 2 can communicate with each other directly. Linux tries its best to be a Port Restricted NAT. But there is a race condition between 5 and 6. Suppose the packet from Client 1 to the public IP and port of Client 2 reaches NAT 2 before the packet from Client 2 to the public IP and port of Client 1, and it belongs to a new session to NAT 2 itself since there isn't any corresponding conntrack in NAT 2, and it is likely that port isn't opened at NAT 2, so at last, a Port Unreachable ICMP packet will be delivered to Client 1. Then, the packet from Client 2 to the public IP and port of Client 1 reaches NAT 2, and NAT 2 fails to use the same public IP and port of the packet sent to Server as the source IP and port, because the corresponding tuple is in use, at last, NAT 2 has to allocate a new pair of IP and port. One and simplest solution is killing unreplied conntracks by ICMP errors. Signed-off-by: Changli Gao --- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c index a338dad..6210820 100644 --- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c +++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c @@ -135,6 +135,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, const struct nf_conntrack_l4proto *innerproto; const struct nf_conntrack_tuple_hash *h; u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE; + struct nf_conn *ct; NF_CT_ASSERT(skb->nfct == NULL); @@ -169,8 +170,12 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) *ctinfo += IP_CT_IS_REPLY; + ct = nf_ct_tuplehash_to_ctrack(h); + if (!test_bit(IPS_SEEN_REPLY, &ct->status)) + nf_ct_kill_acct(ct, *ctinfo, skb); + /* Update skb to refer to this connection */ - skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general; + skb->nfct = &ct->ct_general; skb->nfctinfo = *ctinfo; return NF_ACCEPT; }