<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Flowtable: Flows exiting OFFLOAD State being assigned value of nf_conntrack_tcp_timeout_unacknowledged"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1743#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Flowtable: Flows exiting OFFLOAD State being assigned value of nf_conntrack_tcp_timeout_unacknowledged"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1743">bug 1743</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>Hi,
flowtable PPPoE was broken in software mode.
The flow entry was created in the flowtable, but it did not match. That is,
listing with conntrack -L shows an entry with the OFFLOAD flag but it was never
match, but you still see packets hitting the forward chain which is not
correct. Once flowtable fast path is set up, packets are seen at ingress and
egress hooks.
Basically, PPPoE encapsulated packets were pushed back to classic path because
the tuple was not correctly set up, only one direction of the flow followed the
fast path.
I managed to reproduce this in a small testbed with a PPPoE server/client,
hence the fix I posted.
I have a more permanent testbed to test PPPoE, it would be good to integrate
this into a script that can run in nftables tests/shell with containers to make
sure this does not break again in the future, I have to look into this.
Please, note that this patch is also convenient to have for those that require
PPPoE:
From: Pablo Neira Ayuso <<a href="mailto:pablo@netfilter.org">pablo@netfilter.org</a>>
[ Upstream commit 87b3593bed1868b2d9fe096c01bcdf0ea86cbebf ]
Ensure there is sufficient room to access the protocol field of the
PPPoe header. Validate it once before the flowtable lookup, then use a
helper function to access protocol field.
Reported-by: <a href="mailto:syzbot+b6f07e1c07ef40199081@syzkaller.appspotmail.com">syzbot+b6f07e1c07ef40199081@syzkaller.appspotmail.com</a>
Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
Signed-off-by: Pablo Neira Ayuso <<a href="mailto:pablo@netfilter.org">pablo@netfilter.org</a>>
Signed-off-by: Sasha Levin <<a href="mailto:sashal@kernel.org">sashal@kernel.org</a>>
These two patches has been enqueued to -stable kernels.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>