From:   Madhu Koriginja <madhu.koriginja@nxp.com>
To:     gerrit@erg.abdn.ac.uk, davem@davemloft.net, kuznet@ms2.inr.ac.ru,
        yoshfuji@linux-ipv6.org, edumazet@google.com, dccp@vger.kernel.org,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc:     vani.namala@nxp.com, Madhu Koriginja <madhu.koriginja@nxp.com>
Subject: [PATCH] [NETFILTER]: Keep conntrack reference until IPsecv6 policy checks are done
Date:   Wed,  1 Mar 2023 20:25:34 +0530
Message-Id: <20230301145534.421569-1-madhu.koriginja@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?YjehmtuhPy7Qg1nWyeILiWtxixjA7Rt0fOuG+RjH+IrJK4FrrzCzGWuPvlOg?=
 =?us-ascii?Q?tLKPNqGzWSr/2SNrA/+ZcZDltXq6QoguDrJXnufpUerVbMLDSloLC5eKdQXP?=
 =?us-ascii?Q?KB+n7DCGDF52L7UMfd0nTdoZfnygXOiauhYBUZ0cYZhFuDo7KHd5aOtfLelm?=
 =?us-ascii?Q?s0FtV8b4WeGEmbiuBiSW8Im4tfD12pg+LAEWAnmbu8y3T4SbulDHzvtudnKI?=
 =?us-ascii?Q?ojdFGuJOeHkAlUK6CFOUeXGGI0A75SXASFCHi2N29Q4W+zCWt08/A2RP2NER?=
 =?us-ascii?Q?/BdpxMcRLfzu4SFitAyFWYE+6Rt4F6/CHb9aNN5t1GGHsymNIdzWw1pDgyly?=
 =?us-ascii?Q?lp4TlDsjHEv2plQjAdm21OKrXuNuYsDSEwqAWWuFSPI5/b2ZDIGVV4RLWg8t?=
 =?us-ascii?Q?d0MyChGyyYrtkFyt25O7Xk1gkw4POWI06cODkVO1p99IHe65LmwGcYd6DI4p?=
 =?us-ascii?Q?ZxJwqiYsjsRoEJRIPpYw8uE+b/XTD647kDdml0hDeeBQ0xmVZ6KieqbEaDgh?=
 =?us-ascii?Q?FjFJhXlLJ4fI3nnJwaCNpjq/W6nGci10/ukEVb0gaEuwcBh5XzYUz5jXWrAk?=
 =?us-ascii?Q?c5WEoLt3LLp2YX0mvpNN0N8IMu3ESkAn5Wfeir0NY8/HwUJI+Q4d028gzoac?=
 =?us-ascii?Q?lvywXWWPnXiPpDFqMhKUCNDZDNpRA5YFHzF3OV8KevIwKyRA2LH/SKtRe8K5?=
 =?us-ascii?Q?ijLZXJa532SbXM82Cxk6sd9ejSa25PT6wUmv92Q2nfyYF+IVx4YMDf9NFpHb?=
 =?us-ascii?Q?NpFmiNYr0XGX8tBYnoNAsq7oKtjCIYJQeDBeAPWaNCjIPDorA7JBcjERawkb?=
 =?us-ascii?Q?lqpPsHC2AaBxRT2CdaEdVBklFU6cz7FesnQ24bVYbEkFFJLA0UaFk+MsqbiN?=
 =?us-ascii?Q?YcKS8HrEo/H2rqVAlYBYov8XHb9LKZUtreBoev6mUX1nHU0vEABgXLRr/jlv?=
 =?us-ascii?Q?7brpziqE+SMl3oMxw2aVIocgdNrVxzzKKWLS2fzX0gtE5S5LYTGKF2tw4spa?=
 =?us-ascii?Q?rxne00Vxp0tmY7Uc2s1KjejOSHEsvzF/qmb9pxSd3S/a5XTX3+9SEMXOjpiz?=
 =?us-ascii?Q?c9Hse1H33FNqUo7tMwUgF/FXAePXS5DV5pQZUm/kftFo3uUMb7kFQFpi3Hj2?=
 =?us-ascii?Q?/uyyvBeSCAMNWwwKKEpDVVOhtp4Ik37tNKSYAa+a7HU26G1aziKXNVCBfo0q?=
 =?us-ascii?Q?SYiFGn2/45YAtM1ifg74Jy1edv4iA4LowJIIbkUt8wmDWLeNoH311WEjKQ30?=
 =?us-ascii?Q?IYzvuSP8d8Py3aGxsvEFldD4Sez+YpgyY61u1eHm6AkMyUBG78EQLe5qjH7z?=
 =?us-ascii?Q?NO0Aactfsg9A6CM9RYZNkocUZNmjJK3v5fSrf+vTZMRh1y0QdDsImPkmqn4n?=
 =?us-ascii?Q?zEHPgtbnXG044JS9ym80Ti0sRixYrHrkBzTfUQ9BC0XxgrR6L8Yre7Psjs2Y?=
 =?us-ascii?Q?Cn6q7FKxIzDP1R0UngpWHVYXXWIfaXb1EJONwZTvNM5rprZMPN9U952GgEEN?=
 =?us-ascii?Q?POJeqElQM0Jx582qX0uDZtFibAIfMotQiZU4BywUuXw9PUUf3Ps1Vc1yAp+4?=
 =?us-ascii?Q?n1x8/gjsKQWDoiQbsnYDeQZkZL5L+Bn7hWuxQLnAjU89glPCIhost4e4Wu3Z?=
 =?us-ascii?Q?AQ=3D=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 50154116-c5bf-4f43-6fae-08db1a650e32
X-MS-Exchange-CrossTenant-AuthSource: DB9PR04MB9648.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Mar 2023 14:55:53.6668
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: KJGBfrEXDentoV+srrm2NSamjqCi7bhRjVSkMTiPiRDgSzy01Od+SHLD9RJoV9SbuXK3LAKTaTW3sAnQqx/zIQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB8499
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Keep the conntrack reference until policy checks have been performed for
IPsec V6 NAT support. The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Signed-off-by: Madhu Koriginja <madhu.koriginja@nxp.com>
---
 net/dccp/ipv6.c      |  1 +
 net/ipv6/ip6_input.c | 14 +++++++-------
 net/ipv6/raw.c       |  2 +-
 net/ipv6/tcp_ipv6.c  |  2 ++
 net/ipv6/udp.c       |  2 ++
 5 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 58a401e9cf09..eb503096db6c 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -771,6 +771,7 @@ static int dccp_v6_rcv(struct sk_buff *skb)
 
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_and_relse;
+	nf_reset(skb);
 
 	return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4,
 				refcounted) ? -1 : 0;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index acf0749ee5bb..7dc295b7af8f 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -374,10 +374,6 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk
 			/* Only do this once for first final protocol */
 			have_final = true;
 
-			/* Free reference early: we don't need it any more,
-			   and it may hold ip_conntrack module loaded
-			   indefinitely. */
-			nf_reset(skb);
 
 			skb_postpull_rcsum(skb, skb_network_header(skb),
 					   skb_network_header_len(skb));
@@ -388,9 +384,13 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk
 			    !ipv6_is_mld(skb, nexthdr, skb_network_header_len(skb)))
 				goto discard;
 		}
-		if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&
-		    !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
-			goto discard;
+
+		if (!ipprot->flags & INET6_PROTO_NOPOLICY) {
+			if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+				goto discard;
+
+			nf_reset(skb);
+		}
 
 		ret = ipprot->handler(skb);
 		if (ret > 0) {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4856d9320b28..cf68c9418897 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -220,7 +220,6 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 
 			/* Not releasing hash table! */
 			if (clone) {
-				nf_reset(clone);
 				rawv6_rcv(sk, clone);
 			}
 		}
@@ -428,6 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
+	nf_reset(skb);
 
 	if (!rp->checksum)
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 9a117a79af65..0bc959cfbea4 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1534,6 +1534,8 @@ static int tcp_v6_rcv(struct sk_buff *skb)
 	if (tcp_v6_inbound_md5_hash(sk, skb))
 		goto discard_and_relse;
 
+	nf_reset(skb);
+
 	if (tcp_filter(sk, skb))
 		goto discard_and_relse;
 	th = (const struct tcphdr *)skb->data;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 72b2e7809af6..aacb48e977cb 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -567,6 +567,7 @@ static int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto drop;
+	nf_reset(skb);
 
 	if (static_branch_unlikely(&udpv6_encap_needed_key) && up->encap_type) {
 		int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
@@ -860,6 +861,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
 		goto discard;
+	nf_reset(skb);
 
 	if (udp_lib_checksum_complete(skb))
 		goto csum_error;
-- 
2.25.1