netfilter: nf_nat: better error handling of nf_ct_expect_related() in helpers

This patch improves the situation in which the expectation table is
full for conntrack NAT helpers. Basically, we give up if we don't
find a place in the table instead of looping over nf_ct_expect_related()
with a different port (we should only do this if it returns -EBUSY, for
-EMFILE or -ESHUTDOWN I think that it's better to skip this).

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>

5 files changed, 93 insertions, 14 deletions

diff --git a/net/ipv4/netfilter/nf_nat_amanda.c b/net/ipv4/netfilter/nf_nat_amanda.c
index c31b87668250..0f23b3f06df0 100644
--- a/net/ipv4/netfilter/nf_nat_amanda.c
+++ b/net/ipv4/netfilter/nf_nat_amanda.c
@@ -44,9 +44,16 @@ static unsigned int help(struct sk_buff *skb,
 
         /* Try to get same port: if not, try to change it. */
         for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        port = 0;
                         break;
+                }
         }
 
         if (port == 0)
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/ipv4/netfilter/nf_nat_ftp.c
index 86e0e84ff0a0..dc73abb3fe27 100644
--- a/net/ipv4/netfilter/nf_nat_ftp.c
+++ b/net/ipv4/netfilter/nf_nat_ftp.c
@@ -79,9 +79,16 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
 
         /* Try to get same port: if not, try to change it. */
         for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        port = 0;
                         break;
+                }
         }
 
         if (port == 0)
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index 5045196d853c..790f3160e012 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -222,13 +222,24 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
         /* Try to get a pair of ports. */
         for (nated_port = ntohs(rtp_exp->tuple.dst.u.udp.port);
              nated_port != 0; nated_port += 2) {
+                int ret;
+
                 rtp_exp->tuple.dst.u.udp.port = htons(nated_port);
-                if (nf_ct_expect_related(rtp_exp) == 0) {
+                ret = nf_ct_expect_related(rtp_exp);
+                if (ret == 0) {
                         rtcp_exp->tuple.dst.u.udp.port =
                             htons(nated_port + 1);
-                        if (nf_ct_expect_related(rtcp_exp) == 0)
+                        ret = nf_ct_expect_related(rtcp_exp);
+                        if (ret == 0)
+                                break;
+                        else if (ret != -EBUSY) {
+                                nf_ct_unexpect_related(rtp_exp);
+                                nated_port = 0;
                                 break;
-                        nf_ct_unexpect_related(rtp_exp);
+                        }
+                } else if (ret != -EBUSY) {
+                        nated_port = 0;
+                        break;
                 }
         }
 
@@ -284,9 +295,16 @@ static int nat_t120(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Try to get same port: if not, try to change it. */
         for (; nated_port != 0; nated_port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(nated_port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        nated_port = 0;
                         break;
+                }
         }
 
         if (nated_port == 0) {  /* No port available */
@@ -334,9 +352,16 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Try to get same port: if not, try to change it. */
         for (; nated_port != 0; nated_port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(nated_port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
                         break;
+                else if (ret != -EBUSY) {
+                        nated_port = 0;
+                        break;
+                }
         }
 
         if (nated_port == 0) {  /* No port available */
@@ -418,9 +443,16 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Try to get same port: if not, try to change it. */
         for (; nated_port != 0; nated_port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(nated_port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        nated_port = 0;
                         break;
+                }
         }
 
         if (nated_port == 0) {  /* No port available */
@@ -500,9 +532,16 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Try to get same port: if not, try to change it. */
         for (nated_port = ntohs(port); nated_port != 0; nated_port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(nated_port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
                         break;
+                else if (ret != -EBUSY) {
+                        nated_port = 0;
+                        break;
+                }
         }
 
         if (nated_port == 0) {  /* No port available */
diff --git a/net/ipv4/netfilter/nf_nat_irc.c b/net/ipv4/netfilter/nf_nat_irc.c
index ea83a886b03e..535e1a802356 100644
--- a/net/ipv4/netfilter/nf_nat_irc.c
+++ b/net/ipv4/netfilter/nf_nat_irc.c
@@ -45,9 +45,16 @@ static unsigned int help(struct sk_buff *skb,
 
         /* Try to get same port: if not, try to change it. */
         for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        port = 0;
                         break;
+                }
         }
 
         if (port == 0)
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index 11b538deaaec..e40cf7816fdb 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -307,9 +307,16 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
         exp->expectfn = ip_nat_sip_expected;
 
         for (; port != 0; port++) {
+                int ret;
+
                 exp->tuple.dst.u.udp.port = htons(port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        port = 0;
                         break;
+                }
         }
 
         if (port == 0)
@@ -480,13 +487,25 @@ static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
         /* Try to get same pair of ports: if not, try to change them. */
         for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
              port != 0; port += 2) {
+                int ret;
+
                 rtp_exp->tuple.dst.u.udp.port = htons(port);
-                if (nf_ct_expect_related(rtp_exp) != 0)
+                ret = nf_ct_expect_related(rtp_exp);
+                if (ret == -EBUSY)
                         continue;
+                else if (ret < 0) {
+                        port = 0;
+                        break;
+                }
                 rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
-                if (nf_ct_expect_related(rtcp_exp) == 0)
+                ret = nf_ct_expect_related(rtcp_exp);
+                if (ret == 0)
                         break;
-                nf_ct_unexpect_related(rtp_exp);
+                else if (ret != -EBUSY) {
+                        nf_ct_unexpect_related(rtp_exp);
+                        port = 0;
+                        break;
+                }
         }
 
         if (port == 0)