Skip to content

Commit cf791b2

Browse files
lxinFlorian Westphal
lxin
authored and
Florian Westphal
committed
selftests: netfilter: test for sctp collision processing in nf_conntrack
This patch adds a test case to reproduce the SCTP DATA chunk retransmission timeout issue caused by the improper SCTP collision processing in netfilter nf_conntrack_proto_sctp. In this test, client sends a INIT chunk, but the INIT_ACK replied from server is delayed until the server sends a INIT chunk to start a new connection from its side. After the connection is complete from server side, the delayed INIT_ACK arrives in nf_conntrack_proto_sctp. The delayed INIT_ACK should be dropped in nf_conntrack_proto_sctp instead of updating the vtag with the out-of-date init_tag, otherwise, the vtag in DATA chunks later sent by client don't match the vtag in the conntrack entry and the DATA chunks get dropped. Signed-off-by: Xin Long <[email protected]> Signed-off-by: Florian Westphal <[email protected]>
1 parent 8e56b06 commit cf791b2

File tree

3 files changed

+191
-2
lines changed

3 files changed

+191
-2
lines changed

‎tools/testing/selftests/netfilter/Makefile

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,14 @@ TEST_PROGS := nft_trans_stress.sh nft_fib.sh nft_nat.sh bridge_brouter.sh \
66
nft_concat_range.sh nft_conntrack_helper.sh \
77
nft_queue.sh nft_meta.sh nf_nat_edemux.sh \
88
ipip-conntrack-mtu.sh conntrack_tcp_unreplied.sh \
9-
conntrack_vrf.sh nft_synproxy.sh rpath.sh nft_audit.sh
9+
conntrack_vrf.sh nft_synproxy.sh rpath.sh nft_audit.sh \
10+
conntrack_sctp_collision.sh
1011

1112
HOSTPKG_CONFIG := pkg-config
1213

1314
CFLAGS += $(shell $(HOSTPKG_CONFIG) --cflags libmnl 2>/dev/null)
1415
LDLIBS += $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl)
1516

16-
TEST_GEN_FILES = nf-queue connect_close audit_logread
17+
TEST_GEN_FILES = nf-queue connect_close audit_logread sctp_collision
1718

1819
include ../lib.mk

‎tools/testing/selftests/netfilter/conntrack_sctp_collision.sh

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#!/bin/bash
2+
# SPDX-License-Identifier: GPL-2.0
3+
#
4+
# Testing For SCTP COLLISION SCENARIO as Below:
5+
#
6+
# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]
7+
# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]
8+
# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]
9+
# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]
10+
# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]
11+
# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]
12+
#
13+
# TOPO: SERVER_NS (link0)<--->(link1) ROUTER_NS (link2)<--->(link3) CLIENT_NS
14+
15+
CLIENT_NS=$(mktemp -u client-XXXXXXXX)
16+
CLIENT_IP="198.51.200.1"
17+
CLIENT_PORT=1234
18+
19+
SERVER_NS=$(mktemp -u server-XXXXXXXX)
20+
SERVER_IP="198.51.100.1"
21+
SERVER_PORT=1234
22+
23+
ROUTER_NS=$(mktemp -u router-XXXXXXXX)
24+
CLIENT_GW="198.51.200.2"
25+
SERVER_GW="198.51.100.2"
26+
27+
# setup the topo
28+
setup() {
29+
ip net add $CLIENT_NS
30+
ip net add $SERVER_NS
31+
ip net add $ROUTER_NS
32+
ip -n $SERVER_NS link add link0 type veth peer name link1 netns $ROUTER_NS
33+
ip -n $CLIENT_NS link add link3 type veth peer name link2 netns $ROUTER_NS
34+
35+
ip -n $SERVER_NS link set link0 up
36+
ip -n $SERVER_NS addr add $SERVER_IP/24 dev link0
37+
ip -n $SERVER_NS route add $CLIENT_IP dev link0 via $SERVER_GW
38+
39+
ip -n $ROUTER_NS link set link1 up
40+
ip -n $ROUTER_NS link set link2 up
41+
ip -n $ROUTER_NS addr add $SERVER_GW/24 dev link1
42+
ip -n $ROUTER_NS addr add $CLIENT_GW/24 dev link2
43+
ip net exec $ROUTER_NS sysctl -wq net.ipv4.ip_forward=1
44+
45+
ip -n $CLIENT_NS link set link3 up
46+
ip -n $CLIENT_NS addr add $CLIENT_IP/24 dev link3
47+
ip -n $CLIENT_NS route add $SERVER_IP dev link3 via $CLIENT_GW
48+
49+
# simulate the delay on OVS upcall by setting up a delay for INIT_ACK with
50+
# tc on $SERVER_NS side
51+
tc -n $SERVER_NS qdisc add dev link0 root handle 1: htb
52+
tc -n $SERVER_NS class add dev link0 parent 1: classid 1:1 htb rate 100mbit
53+
tc -n $SERVER_NS filter add dev link0 parent 1: protocol ip u32 match ip protocol 132 \
54+
0xff match u8 2 0xff at 32 flowid 1:1
55+
tc -n $SERVER_NS qdisc add dev link0 parent 1:1 handle 10: netem delay 1200ms
56+
57+
# simulate the ctstate check on OVS nf_conntrack
58+
ip net exec $ROUTER_NS iptables -A FORWARD -m state --state INVALID,UNTRACKED -j DROP
59+
ip net exec $ROUTER_NS iptables -A INPUT -p sctp -j DROP
60+
61+
# use a smaller number for assoc's max_retrans to reproduce the issue
62+
modprobe sctp
63+
ip net exec $CLIENT_NS sysctl -wq net.sctp.association_max_retrans=3
64+
}
65+
66+
cleanup() {
67+
ip net exec $CLIENT_NS pkill sctp_collision 2>&1 >/dev/null
68+
ip net exec $SERVER_NS pkill sctp_collision 2>&1 >/dev/null
69+
ip net del "$CLIENT_NS"
70+
ip net del "$SERVER_NS"
71+
ip net del "$ROUTER_NS"
72+
}
73+
74+
do_test() {
75+
ip net exec $SERVER_NS ./sctp_collision server \
76+
$SERVER_IP $SERVER_PORT $CLIENT_IP $CLIENT_PORT &
77+
ip net exec $CLIENT_NS ./sctp_collision client \
78+
$CLIENT_IP $CLIENT_PORT $SERVER_IP $SERVER_PORT
79+
}
80+
81+
# NOTE: one way to work around the issue is set a smaller hb_interval
82+
# ip net exec $CLIENT_NS sysctl -wq net.sctp.hb_interval=3500
83+
84+
# run the test case
85+
trap cleanup EXIT
86+
setup && \
87+
echo "Test for SCTP Collision in nf_conntrack:" && \
88+
do_test && echo "PASS!"
89+
exit $?

‎tools/testing/selftests/netfilter/sctp_collision.c

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
3+
#include <stdio.h>
4+
#include <stdlib.h>
5+
#include <string.h>
6+
#include <unistd.h>
7+
#include <arpa/inet.h>
8+
9+
int main(int argc, char *argv[])
10+
{
11+
struct sockaddr_in saddr = {}, daddr = {};
12+
int sd, ret, len = sizeof(daddr);
13+
struct timeval tv = {25, 0};
14+
char buf[] = "hello";
15+
16+
if (argc != 6 || (strcmp(argv[1], "server") && strcmp(argv[1], "client"))) {
17+
printf("%s <server|client> <LOCAL_IP> <LOCAL_PORT> <REMOTE_IP> <REMOTE_PORT>\n",
18+
argv[0]);
19+
return -1;
20+
}
21+
22+
sd = socket(AF_INET, SOCK_SEQPACKET, IPPROTO_SCTP);
23+
if (sd < 0) {
24+
printf("Failed to create sd\n");
25+
return -1;
26+
}
27+
28+
saddr.sin_family = AF_INET;
29+
saddr.sin_addr.s_addr = inet_addr(argv[2]);
30+
saddr.sin_port = htons(atoi(argv[3]));
31+
32+
ret = bind(sd, (struct sockaddr *)&saddr, sizeof(saddr));
33+
if (ret < 0) {
34+
printf("Failed to bind to address\n");
35+
goto out;
36+
}
37+
38+
ret = listen(sd, 5);
39+
if (ret < 0) {
40+
printf("Failed to listen on port\n");
41+
goto out;
42+
}
43+
44+
daddr.sin_family = AF_INET;
45+
daddr.sin_addr.s_addr = inet_addr(argv[4]);
46+
daddr.sin_port = htons(atoi(argv[5]));
47+
48+
/* make test shorter than 25s */
49+
ret = setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
50+
if (ret < 0) {
51+
printf("Failed to setsockopt SO_RCVTIMEO\n");
52+
goto out;
53+
}
54+
55+
if (!strcmp(argv[1], "server")) {
56+
sleep(1); /* wait a bit for client's INIT */
57+
ret = connect(sd, (struct sockaddr *)&daddr, len);
58+
if (ret < 0) {
59+
printf("Failed to connect to peer\n");
60+
goto out;
61+
}
62+
ret = recvfrom(sd, buf, sizeof(buf), 0, (struct sockaddr *)&daddr, &len);
63+
if (ret < 0) {
64+
printf("Failed to recv msg %d\n", ret);
65+
goto out;
66+
}
67+
ret = sendto(sd, buf, strlen(buf) + 1, 0, (struct sockaddr *)&daddr, len);
68+
if (ret < 0) {
69+
printf("Failed to send msg %d\n", ret);
70+
goto out;
71+
}
72+
printf("Server: sent! %d\n", ret);
73+
}
74+
75+
if (!strcmp(argv[1], "client")) {
76+
usleep(300000); /* wait a bit for server's listening */
77+
ret = connect(sd, (struct sockaddr *)&daddr, len);
78+
if (ret < 0) {
79+
printf("Failed to connect to peer\n");
80+
goto out;
81+
}
82+
sleep(1); /* wait a bit for server's delayed INIT_ACK to reproduce the issue */
83+
ret = sendto(sd, buf, strlen(buf) + 1, 0, (struct sockaddr *)&daddr, len);
84+
if (ret < 0) {
85+
printf("Failed to send msg %d\n", ret);
86+
goto out;
87+
}
88+
ret = recvfrom(sd, buf, sizeof(buf), 0, (struct sockaddr *)&daddr, &len);
89+
if (ret < 0) {
90+
printf("Failed to recv msg %d\n", ret);
91+
goto out;
92+
}
93+
printf("Client: rcvd! %d\n", ret);
94+
}
95+
ret = 0;
96+
out:
97+
close(sd);
98+
return ret;
99+
}

0 commit comments

Comments
 (0)