From patchwork Sun Dec 15 16:10:42 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Julian Anastasov X-Patchwork-Id: 301358 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6552B2C009B for ; Mon, 16 Dec 2013 03:11:52 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751513Ab3LOQLa (ORCPT ); Sun, 15 Dec 2013 11:11:30 -0500 Received: from ja.ssi.bg ([178.16.129.10]:57762 "EHLO ja.home.ssi.bg" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1751474Ab3LOQL3 (ORCPT ); Sun, 15 Dec 2013 11:11:29 -0500 Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by ja.home.ssi.bg (8.14.7/8.14.7) with ESMTP id rBFGAg7K020827; Sun, 15 Dec 2013 18:10:45 +0200 Date: Sun, 15 Dec 2013 18:10:42 +0200 (EET) From: Julian Anastasov X-X-Sender: ja@ja.home.ssi.bg To: Jesper Dangaard Brouer cc: Simon Horman , lvs-devel@vger.kernel.org, Pablo Neira Ayuso , "David S. Miller" , netdev@vger.kernel.org, Patrick McHardy Subject: Re: [PATCH] ipvs: avoid oops in nf_ct_seqadj_set when called from ip_vs_ftp helper In-Reply-To: <20131213214023.14478.74738.stgit@dragon> Message-ID: References: <20131213214023.14478.74738.stgit@dragon> User-Agent: Alpine 2.11 (LFD 23 2013-08-11) MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hello, On Fri, 13 Dec 2013, Jesper Dangaard Brouer wrote: > The IPVS FTP helper ip_vs_ftp can trigger an OOPS in nf_ct_seqadj_set, > after commit 41d73ec053d2 (netfilter: nf_conntrack: make sequence > number adjustments usuable without NAT). > > We can avoid the oops in nf_ct_seqadj_set() by in ip_vs_ftp_out() > instead of calling nf_nat_mangle_tcp_packet() we simply call > __nf_nat_mangle_tcp_packet() with a "false" last parameter, which > indicate not invoking the seqadj code. > > After this fix, I've tested that FTP over IPVS, with module ip_vs_ftp > loaded, works for both passive and active FTP. > > Fixes: 41d73ec053d2 (netfilter: nf_conntrack: make sequence number adjustments usuable without NAT) > Signed-off-by: Jesper Dangaard Brouer > > --- > I'm uncertain if this is the correct fix. Perhaps the ip_vs_ftp > helper need to allocate/init the seqadj extension instead? I hope I'll save you some time... What do you think about such change: [PATCH net] ipvs: use the new seqadj interface from ip_vs_ftp diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c index 77c1732..9c2074d 100644 --- a/net/netfilter/ipvs/ip_vs_ftp.c +++ b/net/netfilter/ipvs/ip_vs_ftp.c @@ -34,6 +34,7 @@ #include #include #include +#include #include #include #include @@ -260,7 +261,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp, buf_len = strlen(buf); ct = nf_ct_get(skb, &ctinfo); - if (ct && !nf_ct_is_untracked(ct) && nfct_nat(ct)) { + if (ct && !nf_ct_is_untracked(ct) && nfct_nat(ct) && + nfct_seqadj(ct)) { /* If mangling fails this function will return 0 * which will cause the packet to be dropped. * Mangling can only fail under memory pressure, diff --git a/net/netfilter/ipvs/ip_vs_nfct.c b/net/netfilter/ipvs/ip_vs_nfct.c index c8beafd..5a355a4 100644 --- a/net/netfilter/ipvs/ip_vs_nfct.c +++ b/net/netfilter/ipvs/ip_vs_nfct.c @@ -63,6 +63,7 @@ #include #include #include +#include #include #include @@ -97,6 +98,11 @@ ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin) if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) return; + /* Applications may adjust TCP seqs */ + if (cp->app && nf_ct_protonum(ct) == IPPROTO_TCP && + !nfct_seqadj(ct) && !nfct_seqadj_ext_add(ct)) + return; + /* * The connection is not yet in the hashtable, so we update it. * CIP->VIP will remain the same, so leave the tuple in