History

Merge tag 'nf-26-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Add a workaround to avoid a possible crash if nf_nat and nft_chain_nat are compiled built-in and nf_nat fails to register, allowing nft_chain_nat to access the incorrect pernetns area. This is crash specific of all built-in compilation. From Matias Krause. 2) Revisit conncount GC optimization for confirmed conntracks, skip GC round if IPS_ASSURED is set on. This is addressing an issue for corner case use case scenario involving locally generated traffic. No crash, just a functionality fix. From Fernando F. Mancera. 3) Validate iph->ihl in flowtable IPIP tunnel support, from Lorenzo Bianconi. This a sanity check to bounces back malformed IPIP packets to classic forwarding path. 4) Kdoc fixes for x_tables.h, from Randy Dunlap. 5) Use info->options so nft_synproxy_tcp_options() stays on the same local snapshot, otherwise eval path can observe inconsistent mix of mss and timestamps. From Runyu Xiao. 6) Add conntrack_sctp_collision.sh to cover for SCTP INIT collisions. From Yi Chen. 7) Do not allow NFPROTO_UNSPEC targets if family is NFPROTO_BRIDGE in nft_compat. This allows to use non-sense targets such as xt_nat leading to crash. From Florian Westphal. 8) Add a selftest queueing from bridge family. From Florian Westphal. 9) Do not allow to reset a conntrack helper via ctnetlink. This feature antedates the creation of the conntrack-tools, and it is not used I don't have a usecase for it, I prefer to remove than fixing it. 10) Add deprecation warning for IPv4 only conntrack helpers for PPTP and IRC. From Florian Westphal. 11) Store the master tuple in the expectation object and use it, otherwise SLAB_TYPESAFE_RCU rules allow to display incorrect master tuple information through ctnetlink. 12) Run expectation eviction when inserting an expectation with no helper, this is a fix for the nft_ct custom expectation support. 13) Fix nft_ct custom expectation timeouts, userspace provides a timeout in milliseconds but kernel assumes this comes in seconds. From Florian Westphal. 14) Cap maximum number of expectations per class to 255 expectations per master conntrack at helper registration. This is a fix to restrict the maximum number of expectations per master conntrack which can be a issue for the new lazy GC expectation approach. * tag 'nf-26-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration netfilter: nft_ct: expectation timeouts are passed in milliseconds netfilter: nf_conntrack_expect: run expectation eviction with no helper netfilter: nf_conntrack_expect: store master_tuple in expectation netfilter: conntrack: add deprecation warnings for irc and pptp trackers netfilter: ctnetlink: do not allow to reset helper on existing conntrack selftests: nft_queue.sh: add a bridge queue test netfilter: nft_compat: ebtables emulation must reject non-bridge targets selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test netfilter: nft_synproxy: stop bypassing the priv->info snapshot netfilter: x_tables.h: fix all kernel-doc warnings netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() netfilter: nf_conncount: prevent connlimit drops for early confirmed ct netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() ====================

Jakub Kicinski committed 4 months ago

Commit 02f144f2 parents 620839b 397c83018 files · +246 −86Browse files

Showing the changes to include (3 of 18 files). Show all

Unified · Split

3 files
  1. include/linux/netfilter/x_tables.h +21 −8
  2. include/net/netfilter/nf_conntrack_expect.h +1 −0
  3. include/net/netfilter/nf_conntrack_helper.h +4 −0
include/linux/netfilter/x_tables.h+21−8
@@ -18,7 +18,7 @@ · 17 unmodified lines
18 * @match: the match extension18 * @match: the match extension
19 * @target: the target extension19 * @target: the target extension
20 * @matchinfo: per-match data20 * @matchinfo: per-match data
21 * @targetinfo: per-target data21 * @targinfo: per-target data
22 * @state: pointer to hook state this packet came from22 * @state: pointer to hook state this packet came from
23 * @fragoff: packet is a fragment, this is the data offset23 * @fragoff: packet is a fragment, this is the data offset
24 * @thoff: position of transport header relative to skb->data24 * @thoff: position of transport header relative to skb->data
@@ -77,7 +77,9 @@ static inline u_int8_t xt_family(const struct xt_action_param *par) · 52 unmodified lines
77 * @match: struct xt_match through which this function was invoked77 * @match: struct xt_match through which this function was invoked
78 * @matchinfo: per-match data78 * @matchinfo: per-match data
79 * @hook_mask: via which hooks the new rule is reachable79 * @hook_mask: via which hooks the new rule is reachable
80 * Other fields as above.80 * @family: actual NFPROTO_* through which the function is invoked
81 * (helpful when match->family == NFPROTO_UNSPEC)
82 * @nft_compat: running from the nft compat layer if true
81 */83 */
82struct xt_mtchk_param {84struct xt_mtchk_param {
83 struct net *net;85 struct net *net;
@@ -91,8 +93,13 @@ struct xt_mtchk_param { · 7 unmodified lines
91};93};
92 94
93/**95/**
94 * struct xt_mdtor_param - match destructor parameters96 * struct xt_mtdtor_param - match destructor parameters
95 * Fields as above.97 *
98 * @net: network namespace through which the check was invoked
99 * @match: struct xt_match through which this function was invoked
100 * @matchinfo: per-match data
101 * @family: actual NFPROTO_* through which the function is invoked
102 * (helpful when match->family == NFPROTO_UNSPEC)
96 */103 */
97struct xt_mtdtor_param {104struct xt_mtdtor_param {
98 struct net *net;105 struct net *net;
@@ -105,10 +112,16 @@ struct xt_mtdtor_param { · 6 unmodified lines
105 * struct xt_tgchk_param - parameters for target extensions'112 * struct xt_tgchk_param - parameters for target extensions'
106 * checkentry functions113 * checkentry functions
107 *114 *
115 * @net: network namespace through which the check was invoked
116 * @table: table the rule is tried to be inserted into
108 * @entryinfo: the family-specific rule data117 * @entryinfo: the family-specific rule data
109 * (struct ipt_entry, ip6t_entry, arpt_entry, ebt_entry)118 * (struct ipt_entry, ip6t_entry, arpt_entry, ebt_entry)
110 *119 * @target: the target extension
111 * Other fields see above.120 * @targinfo: per-target data
121 * @hook_mask: via which hooks the new rule is reachable
122 * @family: actual NFPROTO_* through which the function is invoked
123 * (helpful when match->family == NFPROTO_UNSPEC)
124 * @nft_compat: running from the nft compat layer if true
112 */125 */
113struct xt_tgchk_param {126struct xt_tgchk_param {
114 struct net *net;127 struct net *net;
@@ -336,9 +349,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size); · 221 unmodified lines
336void xt_free_table_info(struct xt_table_info *info);349void xt_free_table_info(struct xt_table_info *info);
337 350
338/**351/**
339 * xt_recseq - recursive seqcount for netfilter use352 * var xt_recseq - recursive seqcount for netfilter use
340 *353 *
341 * Packet processing changes the seqcount only if no recursion happened354 * Packet processing changes the seqcount only if no recursion happened.
342 * get_counters() can use read_seqcount_begin()/read_seqcount_retry(),355 * get_counters() can use read_seqcount_begin()/read_seqcount_retry(),
343 * because we use the normal seqcount convention :356 * because we use the normal seqcount convention :
344 * Low order bit set to 1 if a writer is active.357 * Low order bit set to 1 if a writer is active.
include/net/netfilter/nf_conntrack_expect.h+1−0
@@ -26,6 +26,7 @@ struct nf_conntrack_expect { · 25 unmodified lines
26 possible_net_t net;26 possible_net_t net;
27 27
28 /* We expect this tuple, with the following mask */28 /* We expect this tuple, with the following mask */
29 struct nf_conntrack_tuple master_tuple;
29 struct nf_conntrack_tuple tuple;30 struct nf_conntrack_tuple tuple;
30 struct nf_conntrack_tuple_mask mask;31 struct nf_conntrack_tuple_mask mask;
31 32
include/net/netfilter/nf_conntrack_helper.h+4−0
@@ -114,6 +114,10 @@ int nf_conntrack_helpers_register(struct nf_conntrack_helper *, unsigned int, · 113 unmodified lines
114void nf_conntrack_helpers_unregister(struct nf_conntrack_helper **,114void nf_conntrack_helpers_unregister(struct nf_conntrack_helper **,
115 unsigned int);115 unsigned int);
116 116
117#define nf_conntrack_helper_deprecated(name) \
118 pr_warn("The %s conntrack helper is scheduled for removal.\n" \
119 "Please contact the netfilter-devel mailing list if you still need this.\n", name)
120
117struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp);121struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp);
118 122
119int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,123int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,