tree 3bfe17c0f91a43e69c8d849563572905735abcf9
parent ba76738c032ec0af3acbecd85c429c6a5c9e5e5e
author Pablo Neira Ayuso <pablo@netfilter.org> 1462055320 +0200
committer Pablo Neira Ayuso <pablo@netfilter.org> 1462459190 +0200

netfilter: conntrack: introduce clash resolution on insertion race

This patch introduces nf_ct_resolve_clash() to resolve race condition on
conntrack insertions.

This is particularly a problem for connection-less protocols such as
UDP, with no initial handshake. Two or more packets may race to insert
the entry resulting in packet drops.

Another problematic scenario are packets enqueued to userspace via
NFQUEUE after the raw table, that make it easier to trigger this
race.

To resolve this, the idea is to reset the conntrack entry to the one
that won race. Packet and bytes counters are also merged.

The 'insert_failed' stats still accounts for this situation, after
this patch, the drop counter is bumped whenever we drop packets, so we
can watch for unresolved clashes.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>