Ubuntu
linux-bluefield package

Fix ct_state nat matching and nat action not being executed

Bug #1957807 reported by Bodong Wang
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-bluefield (Ubuntu)
Invalid
Undecided
Unassigned
Focal
Fix Released
Undecided
Unassigned

Bug Description

* Explain the bug

Netfilter conntrack maintains NAT flags per connection indicating
whether NAT was configured for the connection. Openvswitch maintains
NAT flags on the per packet flow key ct_state field, indicating
whether NAT was actually executed on the packet.

When a packet misses from tc to ovs the conntrack NAT flags are set.
However, NAT was not necessarily executed on the packet because the
connection's state might still be in NEW state. As such, openvswitch
wrongly assumes that NAT was executed and sets an incorrect flow key
NAT flags.

This can lead to incorrect matching on ct_state nat flags, and nat not being executed
by ovs.

* How to test

Create OVS bridge (br-ovs below) with 2 devices $dev1, $dev2 (can be any devices), with hw offload enabled.
Configure NAT connection tracking OpenFlow rules which would only be partially offloaded to tc/hw
because of dp_hash/hash (groups in openflow) not being offloaded, so we would have misses from tc to ovs:

    ovs-ofctl del-flows br-ovs
    ovs-ofctl add-flow br-ovs arp,actions=normal
    ovs-ofctl -O OpenFlow12 add-group ovs-br \
         'group_id=2,type=select,bucket=ct(table=4,zone=5,nat(src=1.1.1.128),commit)'

    #rules
    ovs-ofctl del-flows ovs-br

    ovs-ofctl add-flow ovs-br "table=0, arp, action=normal"
    ovs-ofctl add-flow ovs-br "table=0, ip, nw_src=1.1.1.1 actions=ct(zone=5,table=1,nat)"

    ovs-ofctl add-flow ovs-br "table=1, in_port=1, actions=group:2"

    ovs-ofctl add-flow ovs-br "table=4, ip, nw_src=1.1.1.128 actions=2" #good flow
    ovs-ofctl add-flow ovs-br "table=4, ip, nw_src=1.1.1.1 actions=drop" #bad flow

Run single sided UDP traffic from $dev1 to $dev2, and observe source nat not being done,
and hit of drop rule in table=4.

With the fix, the src nat will be done, and table=4 rule which matches new ip (128) will be hit.

* What it could break.

NA

Luke Nowakowski-Krijger (lukenow)
Changed in linux-bluefield (Ubuntu):
status: New → Fix Committed
Kleber Sacilotto de Souza (kleber-souza)
Changed in linux-bluefield (Ubuntu Focal):
status: New → Fix Committed
Changed in linux-bluefield (Ubuntu):
status: Fix Committed → Invalid
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (17.9 KiB)

This bug was fixed in the package linux-bluefield - 5.4.0-1028.31

---------------
linux-bluefield (5.4.0-1028.31) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1028.31 -proposed tracker (LP: #1959252)

  * Support CIFS for CUDA (LP: #1958299)
    - [Config] bluefield: CONFIG_CIFS=m
    - [Config] bluefield: Additional config options for CIFS

  * Fix ct_state nat matching and nat action not being executed (LP: #1957807)
    - net: zero-initialize tc skb extension on allocation
    - net/sched: Extend qdisc control block with tc control block
    - net/sched: flow_dissector: Fix matching on zone id for invalid conns
    - net: openvswitch: Fix matching zone id for invalid conns arriving from tc
    - net: openvswitch: Fix ct_state nat flags for conns arriving from tc

  * Fix sprintf usage that may lead to buffer overflow (LP: #1959119)
    - SAUCE: Fix references to sprintf that may cause buffer overflow

  [ Ubuntu: 5.4.0-100.113 ]

  * focal/linux: 5.4.0-100.113 -proposed tracker (LP: #1959900)
  * CVE-2022-22942
    - SAUCE: drm/vmwgfx: Fix stale file descriptors on failed usercopy
  * CVE-2022-0330
    - drm/i915: Flush TLBs before releasing backing store
  * Focal update: v5.4.166 upstream stable release (LP: #1957008)
    - netfilter: selftest: conntrack_vrf.sh: fix file permission
    - Linux 5.4.166
    - net/packet: rx_owner_map depends on pg_vec
    - USB: gadget: bRequestType is a bitfield, not a enum
    - HID: holtek: fix mouse probing
    - udp: using datalen to cap ipv6 udp max gso segments
    - selftests: Calculate udpgso segment count without header adjustment
  * Focal update: v5.4.165 upstream stable release (LP: #1957007)
    - serial: tegra: Change lower tolerance baud rate limit for tegra20 and
      tegra30
    - ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type
    - HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
    - HID: google: add eel USB id
    - HID: add hid_is_usb() function to make it simpler for USB detection
    - HID: add USB_HID dependancy to hid-prodikeys
    - HID: add USB_HID dependancy to hid-chicony
    - HID: add USB_HID dependancy on some USB HID drivers
    - HID: bigbenff: prevent null pointer dereference
    - HID: wacom: fix problems when device is not a valid USB device
    - HID: check for valid USB device for many HID drivers
    - can: kvaser_usb: get CAN clock frequency from device
    - can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct
      stats->{rx,tx}_errors counter
    - can: sja1000: fix use after free in ems_pcmcia_add_card()
    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
    - selftests: netfilter: add a vrf+conntrack testcase
    - vrf: don't run conntrack on vrf with !dflt qdisc
    - bpf: Fix the off-by-two error in range markings
    - ice: ignore dropped packets during init
    - bonding: make tx_rebalance_counter an atomic
    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
    - seg6: fix the iif in the IPv6 socket control block
    - udp: using datalen to cap max gso segments
    - iavf: restore MSI state on reset
    - iavf: Fix reporting when setting descriptor count
    - IB/hfi1: ...

Changed in linux-bluefield (Ubuntu Focal):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.