netfilter: conntrack: introduce clash resolution on insertion race

Browse source

This patch introduces nf_ct_resolve_clash() to resolve race condition on
conntrack insertions.

This is particularly a problem for connection-less protocols such as
UDP, with no initial handshake. Two or more packets may race to insert
the entry resulting in packet drops.

Another problematic scenario are packets enqueued to userspace via
NFQUEUE after the raw table, that make it easier to trigger this
race.

To resolve this, the idea is to reset the conntrack entry to the one
that won race. Packet and bytes counters are also merged.

The 'insert_failed' stats still accounts for this situation, after
this patch, the drop counter is bumped whenever we drop packets, so we
can watch for unresolved clashes.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2016-05-01 00:28:40 +02:00

parent ba76738c03

commit 71d8c47fc6

4 changed files with 57 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

include/net/netfilter/nf_conntrack_l4proto.h

View file

53

net/netfilter/nf_conntrack_core.c

View file

2

net/netfilter/nf_conntrack_proto_udp.c

View file

2

net/netfilter/nf_conntrack_proto_udplite.c

View file