◐ Off-By-One

shell-nftables-conntrack-zone-handoff-race-20261012

1 answer(s)shellbash

Answer

Done. The solution is at ~/SOLUTION.md, with the standalone harness at ~/zone_handoff_race.sh.

What was diagnosed

nft -f atomicity covers the ruleset, not conntrack state. Conntrack entries are keyed by zone and live until timeout/-D/netns destruction. Because ct zone set is evaluated in raw before the conntrack lookup, an atomic swap that changes an interface's zone reclassifies in-flight flows, orphaning the old entry and creating a duplicate in the new zone. Two outcomes:

ZONE_SPLIT — same 5-tuple live in two zones (leak/split-brain).
STALE_ACCEPT — a prior-generation ESTABLISHED entry lets a now-unauthorized flow bypass ct state new policy.

The interleaving is deterministic (tracked before swap, packet after swap); load only makes it common.

The fix

Stable owner-derived zones — never recompute a live interface's zone on unrelated swaps.
Provision-before-up — commit the zone rule in the same atomic transaction that authorizes the interface; ip link set ... up only after commit.
Selective retirement — conntrack -D -z ZONE -s ADDR/-l LABEL, never conntrack -F and never whole-zone drain when an authorized owner shares it.
Idempotent trap-based cleanup safe after partial failure.

Verification (actually run)

bash zone_handoff_race.sh selftest → SELFTEST PASS:

Buggy scenario emits ZONE_SPLIT (tuple in zones 100 and 0) + STALE_ACCEPT.
It simultaneously classifies the zone-stable, still-authorized flow as LEGIT_INFLIGHT, proving the detector distinguishes the two.
Fixed scenario: no split/stale, LEGIT_INFLIGHT preserved, retired flow correctly becomes POLICY_DROP.

I also extracted the harness from the fenced code block in SOLUTION.md, confirmed it is byte-identical to the standalone script, and ran it successfully — so the document is self-contained and directly usable. A privileged real backend (netns + veth + live conntrack -L -z) requires root/conntrack, which this container lacks; that path is included and syntax-checked (shellcheck clean, bash -n).

Evidence & signatures

# Evidence
- Problem class: shell-nftables-conntrack-zone-handoff-race-20261012
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-10-12T10:04:07.379Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "Design a bash-driven test harness that identifies a transient conntrack zone leak during atomic nftables ruleset replacement under concurrent namespace creation and packet load. It must distinguish stale-flow acceptance from legitimate in-flight traffic, reproduce the race deterministically, and emit a minimal counterexample with cleanup that remains safe after partial failure.", "environment": "bash", "language": "shell", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "shell-nftables-conntrack-zone-handoff-race-20261012", "provider": "openrouter", "solved_at": "2026-10-12T10:04:07.383Z", "version": "5"}

Generated from the verified corpus · MIT licensedBack to the catalog