On Thu, Jan 03, 2019 at 12:28:46AM +0000, Alakesh Haloi wrote:
commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race")
An iptable rule like the following on a multicore systems will result in accepting more connections than set in the rule.
iptables -A INPUT -p tcp -m tcp --syn --dport 7777 -m connlimit \ --connlimit-above 2000 --connlimit-mask 0 -j DROP
In check_hlist function, connections that are found in saved connections but not in netfilter conntrack are deleted, assuming that those connections do not exist anymore. But for multi core systems, there exists a small time window, when a connection has been added to the xt_connlimit maintained rb-tree but has not yet made to netfilter conntrack table. This causes concurrent connections to return incorrect counts and go over limit set in iptable rule.
The fix has been partially backported from the above mentioned upstream commit. Introduce timestamp and the owning cpu.
Signed-off-by: Alakesh Haloi alakeshh@amazon.com Cc: Pablo Neira Ayuso pablo@netfilter.org Cc: Jozsef Kadlecsik kadlec@blackhole.kfki.hu Cc: Florian Westphal fw@strlen.de Cc: "David S. Miller" davem@davemloft.net Cc: stable@vger.kernel.org # v4.15 and before
But 4.14.92 already b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race") and 4cd273bb91b3 ("netfilter: nf_conncount: don't skip eviction when age is negative") in it. Are you sure you still need this patch?
thanks,
greg k-h