From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id ED9041FF165 for ; Thu, 11 Sep 2025 12:06:30 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 573D6FF8F; Thu, 11 Sep 2025 12:06:33 +0200 (CEST) From: Gabriel Goller To: pve-devel@lists.proxmox.com Date: Thu, 11 Sep 2025 12:05:41 +0200 Message-ID: <20250911100555.63174-1-g.goller@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1757585157196 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.005 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH kernel 0/5] backport nftables atomicity fix X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Stefan Hanreich discovered this nftables bug which breaks the atomicity when updating certain sets. This means that when updating a set, packets sometimes slip through even though the existing and the incoming rules deny the packet. A full reproducer is available here: [0]. More information in following commit messages. The upstream series has not been applied yet, but is available here: https://lore.kernel.org/netfilter-devel/20250910080227.11174-1-fw@strlen.de/ Nftables changed quite a bit since 6.14 so the backport was a bit tricky -- a few Tested-by's would be nice :). If anyone needs help to reproduce this or wants a pre-build kernel with the fix feel free to reach out! Thanks to Stefan Hanreich for identifying the bug and providing a minimal reproducer, and to Florian Westphal for the quick fix. [0]: Initial network setup: ip netns add east ip netns add west ip link add east type veth peer name west ip link set east netns east ip link set west netns west ip netns exec east ip a a 192.0.2.20/24 dev east ip netns exec west ip link add br0 type bridge ip netns exec west ip a a 192.0.2.10/24 dev br0 ip netns exec west ip link set west master br0 ip netns exec east ip link set up east ip netns exec west ip link set up west ip netns exec west ip link set up br0 Initial nft ruleset in network namespace 'west': table bridge west { set east-ip-nomatch { type ipv4_addr flags interval; elements = { 0.0.0.0-192.0.2.19, 192.0.2.21-255.255.255.255 } } chain block-spoofed { type filter hook prerouting priority filter; policy accept; ip saddr @east-ip-nomatch drop } } This should block all traffic on the bridge br0, which does not have 192.0.2.20 as source IP address, but when continuously flushing / re-creating the east-ip-nomatch set via the following commands: $ while true; do ip netns exec west nft -j -f update_set.json; done; # update_set.json { "nftables": [ { "add": { "set": { "family": "bridge", "table": "west", "name": "east-ip-nomatch", "type": "ipv4_addr", "flags": [ "interval" ] } } }, { "flush": { "set": { "family": "bridge", "table": "west", "name": "east-ip-nomatch" } } }, { "add": { "element": { "family": "bridge", "table": "west", "name": "east-ip-nomatch", "elem": [ { "range": ["0.0.0.0", "192.0.2.19"] }, { "range": ["192.0.2.21", "255.255.255.255"] } ] } } } ] } And then continously sending ICMP packets from east to west via e.g. scapy: $ ip netns exec east python3 -c 'from scapy.all import send, Ether, IP, ICMP; send(IP(src="192.0.2.30", dst="192.0.2.10")/ICMP(id=2222, seq=42), count=1000000, inter=0.001)' Some of them pass through, as is visible via tcpdump (sometimes its required to terminate the process for the packets to be visible, since the buffers do not get flushed immediately): $ ip netns exec west tcpdump -envi br0 icmp tcpdump: listening on br0, link-type EN10MB (Ethernet), snapshot length 262144 bytes 17:11:10.008758 06:a4:e8:d4:db:20 > 8a:88:57:79:f6:97, ethertype IPv4 (0x0800), length 42: (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto ICMP (1), l ength 28) 192.0.2.30 > 192.0.2.10: ICMP echo request, id 2222, seq 42, length 8 pve-kernel: Gabriel Goller (5): kernel: backport: netfilter: nft_set_pipapo: don't check genbit from packetpath lookups kernel: backport: netfilter: nft_set_rbtree: continue traversal if element is inactive kernel: backport: netfilter: nf_tables: place base_seq in struct net kernel: backport: netfilter: nf_tables: make nft_set_do_lookup available unconditionally kernel: backport: netfilter: nf_tables: restart set lookup on base_seq change ...t_pipapo-don-t-check-genbit-from-pac.patch | 160 +++++++++ ...t_rbtree-continue-traversal-if-eleme.patch | 88 +++++ ..._tables-place-base_seq-in-struct-net.patch | 310 ++++++++++++++++++ ...les-make-nft_set_do_lookup-available.patch | 86 +++++ ...les-restart-set-lookup-on-base_seq-c.patch | 148 +++++++++ 5 files changed, 792 insertions(+) create mode 100644 patches/kernel/0014-netfilter-nft_set_pipapo-don-t-check-genbit-from-pac.patch create mode 100644 patches/kernel/0015-netfilter-nft_set_rbtree-continue-traversal-if-eleme.patch create mode 100644 patches/kernel/0016-netfilter-nf_tables-place-base_seq-in-struct-net.patch create mode 100644 patches/kernel/0017-netfilter-nf_tables-make-nft_set_do_lookup-available.patch create mode 100644 patches/kernel/0018-netfilter-nf_tables-restart-set-lookup-on-base_seq-c.patch Summary over all repositories: 5 files changed, 792 insertions(+), 0 deletions(-) -- Generated by git-murpp 0.8.0 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel