[PATCH] ebtables dst cache overflow/SNAT fix

Hi all,

I've come across a problem when using SNAT, bridging and ebtables which leads
to "dst cache overflow" errors and major routing problems.

All I have to do is configure a bridge group, install a SNAT rule on the bridge interface
and sit back and wait.

Symptoms are a completely empty route cache list (/proc/net/rt_cache
shows nothing) but the dst_entries field from /proc/net/rt_cache_stat shows
the table should be full.

Basically you have a bunch of dst pointers with nonzero __refcnt that
are not in the hash table and will never be freed.

The offending code is in br_nf_pre_routing_finish() in the else case for
dnat_took_place(). The skb->dst pointer is set to a __fake_rtable
pointer thereby orphaning a route cache entry. There should be a check to
see if skb->dst is already set because the fake rtable wouldn't be needed.

Patch against ebtables-brnf-6_vs_2.4.26:


diff -u --recursive linux.orig/net/bridge/br_netfilter.c linux/net/bridge/br_netfilter.c
--- linux.orig/net/bridge/br_netfilter.c	Mon Sep 20 18:03:09 2004
+++ linux/net/bridge/br_netfilter.c	Mon Sep 20 18:10:58 2004
@@ -228,8 +228,10 @@
 			skb->pkt_type = PACKET_HOST;
 		}
 	} else {
-		skb->dst = (struct dst_entry *)&__fake_rtable;
-		dst_hold(skb->dst);
+		if (!skb->dst) {
+			skb->dst = (struct dst_entry *)&__fake_rtable;
+			dst_hold(skb->dst);
+		}
 	}

 	skb->dev = nf_bridge->physindev;

I'm not sure if a similar check should be done in the dnat_took_place()
case. The call to ip_route_input will overwrite skb->dst. Perhaps
skb->dst should be released prior to the ip_route_input() call?

Thanks,
Scott Yoder
ImageStream Internet Solutions, Inc.
E-mail: syoder-/[email protected]


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php