* [PATCH net 0/5] Netfilter fixes for net
@ 2020-11-27 19:03 Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 1/5] netfilter: ipset: prevent uninit-value in hash_ip6_add Pablo Neira Ayuso
` (5 more replies)
0 siblings, 6 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-11-27 19:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix insufficient validation of IPSET_ATTR_IPADDR_IPV6 reported
by syzbot.
2) Remove spurious reports on nf_tables when lockdep gets disabled,
from Florian Westphal.
3) Fix memleak in the error path of error path of
ip_vs_control_net_init(), from Wang Hai.
4) Fix missing control data in flow dissector, otherwise IP address
matching in hardware offload infra does not work.
5) Fix hardware offload match on prefix IP address when userspace
does not send a bitwise expression to represent the prefix.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks Jakub.
----------------------------------------------------------------
The following changes since commit 90cf87d16bd566cff40c2bc8e32e6d4cd3af23f0:
enetc: Let the hardware auto-advance the taprio base-time of 0 (2020-11-25 12:36:27 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to a5d45bc0dc50f9dd83703510e9804d813a9cac32:
netfilter: nftables_offload: build mask based from the matching bytes (2020-11-27 12:10:47 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: ipset: prevent uninit-value in hash_ip6_add
Florian Westphal (1):
netfilter: nf_tables: avoid false-postive lockdep splat
Pablo Neira Ayuso (2):
netfilter: nftables_offload: set address type in control dissector
netfilter: nftables_offload: build mask based from the matching bytes
Wang Hai (1):
ipvs: fix possible memory leak in ip_vs_control_net_init
include/net/netfilter/nf_tables_offload.h | 7 ++++
net/netfilter/ipset/ip_set_core.c | 3 +-
net/netfilter/ipvs/ip_vs_ctl.c | 31 +++++++++++---
net/netfilter/nf_tables_api.c | 3 +-
net/netfilter/nf_tables_offload.c | 17 ++++++++
net/netfilter/nft_cmp.c | 8 ++--
net/netfilter/nft_meta.c | 16 +++----
net/netfilter/nft_payload.c | 70 +++++++++++++++++++++++--------
8 files changed, 117 insertions(+), 38 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 1/5] netfilter: ipset: prevent uninit-value in hash_ip6_add
2020-11-27 19:03 [PATCH net 0/5] Netfilter fixes for net Pablo Neira Ayuso
@ 2020-11-27 19:03 ` Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 2/5] netfilter: nf_tables: avoid false-postive lockdep splat Pablo Neira Ayuso
` (4 subsequent siblings)
5 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-11-27 19:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Eric Dumazet <edumazet@google.com>
syzbot found that we are not validating user input properly
before copying 16 bytes [1].
Using NLA_BINARY in ipaddr_policy[] for IPv6 address is not correct,
since it ensures at most 16 bytes were provided.
We should instead make sure user provided exactly 16 bytes.
In old kernels (before v4.20), fix would be to remove the NLA_BINARY,
since NLA_POLICY_EXACT_LEN() was not yet available.
[1]
BUG: KMSAN: uninit-value in hash_ip6_add+0x1cba/0x3a50 net/netfilter/ipset/ip_set_hash_gen.h:892
CPU: 1 PID: 11611 Comm: syz-executor.0 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x21c/0x280 lib/dump_stack.c:118
kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
__msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
hash_ip6_add+0x1cba/0x3a50 net/netfilter/ipset/ip_set_hash_gen.h:892
hash_ip6_uadt+0x976/0xbd0 net/netfilter/ipset/ip_set_hash_ip.c:267
call_ad+0x329/0xd00 net/netfilter/ipset/ip_set_core.c:1720
ip_set_ad+0x111f/0x1440 net/netfilter/ipset/ip_set_core.c:1808
ip_set_uadd+0xf6/0x110 net/netfilter/ipset/ip_set_core.c:1833
nfnetlink_rcv_msg+0xc7d/0xdf0 net/netfilter/nfnetlink.c:252
netlink_rcv_skb+0x70a/0x820 net/netlink/af_netlink.c:2494
nfnetlink_rcv+0x4f0/0x4380 net/netfilter/nfnetlink.c:600
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x11da/0x14b0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x173c/0x1840 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg net/socket.c:671 [inline]
____sys_sendmsg+0xc7a/0x1240 net/socket.c:2353
___sys_sendmsg net/socket.c:2407 [inline]
__sys_sendmsg+0x6d5/0x830 net/socket.c:2440
__do_sys_sendmsg net/socket.c:2449 [inline]
__se_sys_sendmsg+0x97/0xb0 net/socket.c:2447
__x64_sys_sendmsg+0x4a/0x70 net/socket.c:2447
do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45deb9
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fe2e503fc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000029ec0 RCX: 000000000045deb9
RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003
RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c
R13: 000000000169fb7f R14: 00007fe2e50409c0 R15: 000000000118bf2c
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:289
__msan_chain_origin+0x57/0xa0 mm/kmsan/kmsan_instr.c:147
ip6_netmask include/linux/netfilter/ipset/pfxlen.h:49 [inline]
hash_ip6_netmask net/netfilter/ipset/ip_set_hash_ip.c:185 [inline]
hash_ip6_uadt+0xb1c/0xbd0 net/netfilter/ipset/ip_set_hash_ip.c:263
call_ad+0x329/0xd00 net/netfilter/ipset/ip_set_core.c:1720
ip_set_ad+0x111f/0x1440 net/netfilter/ipset/ip_set_core.c:1808
ip_set_uadd+0xf6/0x110 net/netfilter/ipset/ip_set_core.c:1833
nfnetlink_rcv_msg+0xc7d/0xdf0 net/netfilter/nfnetlink.c:252
netlink_rcv_skb+0x70a/0x820 net/netlink/af_netlink.c:2494
nfnetlink_rcv+0x4f0/0x4380 net/netfilter/nfnetlink.c:600
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x11da/0x14b0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x173c/0x1840 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg net/socket.c:671 [inline]
____sys_sendmsg+0xc7a/0x1240 net/socket.c:2353
___sys_sendmsg net/socket.c:2407 [inline]
__sys_sendmsg+0x6d5/0x830 net/socket.c:2440
__do_sys_sendmsg net/socket.c:2449 [inline]
__se_sys_sendmsg+0x97/0xb0 net/socket.c:2447
__x64_sys_sendmsg+0x4a/0x70 net/socket.c:2447
do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:289
kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:226
kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:246
__msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:110
ip_set_get_ipaddr6+0x2cb/0x370 net/netfilter/ipset/ip_set_core.c:310
hash_ip6_uadt+0x439/0xbd0 net/netfilter/ipset/ip_set_hash_ip.c:255
call_ad+0x329/0xd00 net/netfilter/ipset/ip_set_core.c:1720
ip_set_ad+0x111f/0x1440 net/netfilter/ipset/ip_set_core.c:1808
ip_set_uadd+0xf6/0x110 net/netfilter/ipset/ip_set_core.c:1833
nfnetlink_rcv_msg+0xc7d/0xdf0 net/netfilter/nfnetlink.c:252
netlink_rcv_skb+0x70a/0x820 net/netlink/af_netlink.c:2494
nfnetlink_rcv+0x4f0/0x4380 net/netfilter/nfnetlink.c:600
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x11da/0x14b0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x173c/0x1840 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg net/socket.c:671 [inline]
____sys_sendmsg+0xc7a/0x1240 net/socket.c:2353
___sys_sendmsg net/socket.c:2407 [inline]
__sys_sendmsg+0x6d5/0x830 net/socket.c:2440
__do_sys_sendmsg net/socket.c:2449 [inline]
__se_sys_sendmsg+0x97/0xb0 net/socket.c:2447
__x64_sys_sendmsg+0x4a/0x70 net/socket.c:2447
do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76
slab_alloc_node mm/slub.c:2906 [inline]
__kmalloc_node_track_caller+0xc61/0x15f0 mm/slub.c:4512
__kmalloc_reserve net/core/skbuff.c:142 [inline]
__alloc_skb+0x309/0xae0 net/core/skbuff.c:210
alloc_skb include/linux/skbuff.h:1094 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1176 [inline]
netlink_sendmsg+0xdb8/0x1840 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg net/socket.c:671 [inline]
____sys_sendmsg+0xc7a/0x1240 net/socket.c:2353
___sys_sendmsg net/socket.c:2407 [inline]
__sys_sendmsg+0x6d5/0x830 net/socket.c:2440
__do_sys_sendmsg net/socket.c:2449 [inline]
__se_sys_sendmsg+0x97/0xb0 net/socket.c:2447
__x64_sys_sendmsg+0x4a/0x70 net/socket.c:2447
do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: a7b4f989a629 ("netfilter: ipset: IP set core support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipset/ip_set_core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 7cff6e5e7445..2b19189a930f 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -271,8 +271,7 @@ flag_nested(const struct nlattr *nla)
static const struct nla_policy ipaddr_policy[IPSET_ATTR_IPADDR_MAX + 1] = {
[IPSET_ATTR_IPADDR_IPV4] = { .type = NLA_U32 },
- [IPSET_ATTR_IPADDR_IPV6] = { .type = NLA_BINARY,
- .len = sizeof(struct in6_addr) },
+ [IPSET_ATTR_IPADDR_IPV6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
};
int
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH net 2/5] netfilter: nf_tables: avoid false-postive lockdep splat
2020-11-27 19:03 [PATCH net 0/5] Netfilter fixes for net Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 1/5] netfilter: ipset: prevent uninit-value in hash_ip6_add Pablo Neira Ayuso
@ 2020-11-27 19:03 ` Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 3/5] ipvs: fix possible memory leak in ip_vs_control_net_init Pablo Neira Ayuso
` (3 subsequent siblings)
5 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-11-27 19:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Florian Westphal <fw@strlen.de>
There are reports wrt lockdep splat in nftables, e.g.:
------------[ cut here ]------------
WARNING: CPU: 2 PID: 31416 at net/netfilter/nf_tables_api.c:622
lockdep_nfnl_nft_mutex_not_held+0x28/0x38 [nf_tables]
...
These are caused by an earlier, unrelated bug such as a n ABBA deadlock
in a different subsystem.
In such an event, lockdep is disabled and lockdep_is_held returns true
unconditionally. This then causes the WARN() in nf_tables.
Make the WARN conditional on lockdep still active to avoid this.
Fixes: f102d66b335a417 ("netfilter: nf_tables: use dedicated mutex to guard transactions")
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Link: https://lore.kernel.org/linux-kselftest/CA+G9fYvFUpODs+NkSYcnwKnXm62tmP=ksLeBPmB+KFrB2rvCtQ@mail.gmail.com/
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0f58e98542be..23abf1578594 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -619,7 +619,8 @@ static int nft_request_module(struct net *net, const char *fmt, ...)
static void lockdep_nfnl_nft_mutex_not_held(void)
{
#ifdef CONFIG_PROVE_LOCKING
- WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
+ if (debug_locks)
+ WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
#endif
}
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH net 3/5] ipvs: fix possible memory leak in ip_vs_control_net_init
2020-11-27 19:03 [PATCH net 0/5] Netfilter fixes for net Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 1/5] netfilter: ipset: prevent uninit-value in hash_ip6_add Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 2/5] netfilter: nf_tables: avoid false-postive lockdep splat Pablo Neira Ayuso
@ 2020-11-27 19:03 ` Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 4/5] netfilter: nftables_offload: set address type in control dissector Pablo Neira Ayuso
` (2 subsequent siblings)
5 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-11-27 19:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Wang Hai <wanghai38@huawei.com>
kmemleak report a memory leak as follows:
BUG: memory leak
unreferenced object 0xffff8880759ea000 (size 256):
backtrace:
[<00000000c0bf2deb>] kmem_cache_zalloc include/linux/slab.h:656 [inline]
[<00000000c0bf2deb>] __proc_create+0x23d/0x7d0 fs/proc/generic.c:421
[<000000009d718d02>] proc_create_reg+0x8e/0x140 fs/proc/generic.c:535
[<0000000097bbfc4f>] proc_create_net_data+0x8c/0x1b0 fs/proc/proc_net.c:126
[<00000000652480fc>] ip_vs_control_net_init+0x308/0x13a0 net/netfilter/ipvs/ip_vs_ctl.c:4169
[<000000004c927ebe>] __ip_vs_init+0x211/0x400 net/netfilter/ipvs/ip_vs_core.c:2429
[<00000000aa6b72d9>] ops_init+0xa8/0x3c0 net/core/net_namespace.c:151
[<00000000153fd114>] setup_net+0x2de/0x7e0 net/core/net_namespace.c:341
[<00000000be4e4f07>] copy_net_ns+0x27d/0x530 net/core/net_namespace.c:482
[<00000000f1c23ec9>] create_new_namespaces+0x382/0xa30 kernel/nsproxy.c:110
[<00000000098a5757>] copy_namespaces+0x2e6/0x3b0 kernel/nsproxy.c:179
[<0000000026ce39e9>] copy_process+0x220a/0x5f00 kernel/fork.c:2072
[<00000000b71f4efe>] _do_fork+0xc7/0xda0 kernel/fork.c:2428
[<000000002974ee96>] __do_sys_clone3+0x18a/0x280 kernel/fork.c:2703
[<0000000062ac0a4d>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
[<0000000093f1ce2c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
In the error path of ip_vs_control_net_init(), remove_proc_entry() needs
to be called to remove the added proc entry, otherwise a memory leak
will occur.
Also, add some '#ifdef CONFIG_PROC_FS' because proc_create_net* return NULL
when PROC is not used.
Fixes: b17fc9963f83 ("IPVS: netns, ip_vs_stats and its procfs")
Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipvs/ip_vs_ctl.c | 31 +++++++++++++++++++++++++------
1 file changed, 25 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index e279ded4e306..d45dbcba8b49 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -4167,12 +4167,18 @@ int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
spin_lock_init(&ipvs->tot_stats.lock);
- proc_create_net("ip_vs", 0, ipvs->net->proc_net, &ip_vs_info_seq_ops,
- sizeof(struct ip_vs_iter));
- proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net,
- ip_vs_stats_show, NULL);
- proc_create_net_single("ip_vs_stats_percpu", 0, ipvs->net->proc_net,
- ip_vs_stats_percpu_show, NULL);
+#ifdef CONFIG_PROC_FS
+ if (!proc_create_net("ip_vs", 0, ipvs->net->proc_net,
+ &ip_vs_info_seq_ops, sizeof(struct ip_vs_iter)))
+ goto err_vs;
+ if (!proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net,
+ ip_vs_stats_show, NULL))
+ goto err_stats;
+ if (!proc_create_net_single("ip_vs_stats_percpu", 0,
+ ipvs->net->proc_net,
+ ip_vs_stats_percpu_show, NULL))
+ goto err_percpu;
+#endif
if (ip_vs_control_net_init_sysctl(ipvs))
goto err;
@@ -4180,6 +4186,17 @@ int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
return 0;
err:
+#ifdef CONFIG_PROC_FS
+ remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net);
+
+err_percpu:
+ remove_proc_entry("ip_vs_stats", ipvs->net->proc_net);
+
+err_stats:
+ remove_proc_entry("ip_vs", ipvs->net->proc_net);
+
+err_vs:
+#endif
free_percpu(ipvs->tot_stats.cpustats);
return -ENOMEM;
}
@@ -4188,9 +4205,11 @@ void __net_exit ip_vs_control_net_cleanup(struct netns_ipvs *ipvs)
{
ip_vs_trash_cleanup(ipvs);
ip_vs_control_net_cleanup_sysctl(ipvs);
+#ifdef CONFIG_PROC_FS
remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net);
remove_proc_entry("ip_vs_stats", ipvs->net->proc_net);
remove_proc_entry("ip_vs", ipvs->net->proc_net);
+#endif
free_percpu(ipvs->tot_stats.cpustats);
}
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH net 4/5] netfilter: nftables_offload: set address type in control dissector
2020-11-27 19:03 [PATCH net 0/5] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2020-11-27 19:03 ` [PATCH net 3/5] ipvs: fix possible memory leak in ip_vs_control_net_init Pablo Neira Ayuso
@ 2020-11-27 19:03 ` Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 5/5] netfilter: nftables_offload: build mask based from the matching bytes Pablo Neira Ayuso
2020-11-28 21:23 ` [PATCH net 0/5] Netfilter fixes for net Jakub Kicinski
5 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-11-27 19:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
This patch adds nft_flow_rule_set_addr_type() to set the address type
from the nft_payload expression accordingly.
If the address type is not set in the control dissector then a rule that
matches either on source or destination IP address does not work.
After this patch, nft hardware offload generates the flow dissector
configuration as tc-flower does to match on an IP address.
This patch has been also tested functionally to make sure packets are
filtered out by the NIC.
This is also getting the code aligned with the existing netfilter flow
offload infrastructure which is also setting the control dissector.
Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables_offload.h | 4 ++++
net/netfilter/nf_tables_offload.c | 17 +++++++++++++++++
net/netfilter/nft_payload.c | 4 ++++
3 files changed, 25 insertions(+)
diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
index ea7d1d78b92d..bddd34c5bd79 100644
--- a/include/net/netfilter/nf_tables_offload.h
+++ b/include/net/netfilter/nf_tables_offload.h
@@ -37,6 +37,7 @@ void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
struct nft_flow_key {
struct flow_dissector_key_basic basic;
+ struct flow_dissector_key_control control;
union {
struct flow_dissector_key_ipv4_addrs ipv4;
struct flow_dissector_key_ipv6_addrs ipv6;
@@ -62,6 +63,9 @@ struct nft_flow_rule {
#define NFT_OFFLOAD_F_ACTION (1 << 0)
+void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
+ enum flow_dissector_key_id addr_type);
+
struct nft_rule;
struct nft_flow_rule *nft_flow_rule_create(struct net *net, const struct nft_rule *rule);
void nft_flow_rule_destroy(struct nft_flow_rule *flow);
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 9f625724a20f..9ae14270c543 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -28,6 +28,23 @@ static struct nft_flow_rule *nft_flow_rule_alloc(int num_actions)
return flow;
}
+void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
+ enum flow_dissector_key_id addr_type)
+{
+ struct nft_flow_match *match = &flow->match;
+ struct nft_flow_key *mask = &match->mask;
+ struct nft_flow_key *key = &match->key;
+
+ if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_CONTROL))
+ return;
+
+ key->control.addr_type = addr_type;
+ mask->control.addr_type = 0xffff;
+ match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CONTROL);
+ match->dissector.offset[FLOW_DISSECTOR_KEY_CONTROL] =
+ offsetof(struct nft_flow_key, control);
+}
+
struct nft_flow_rule *nft_flow_rule_create(struct net *net,
const struct nft_rule *rule)
{
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index dcd3c7b8a367..bbf811d030d5 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -244,6 +244,7 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, src,
sizeof(struct in_addr), reg);
+ nft_flow_rule_set_addr_type(flow, FLOW_DISSECTOR_KEY_IPV4_ADDRS);
break;
case offsetof(struct iphdr, daddr):
if (priv->len != sizeof(struct in_addr))
@@ -251,6 +252,7 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, dst,
sizeof(struct in_addr), reg);
+ nft_flow_rule_set_addr_type(flow, FLOW_DISSECTOR_KEY_IPV4_ADDRS);
break;
case offsetof(struct iphdr, protocol):
if (priv->len != sizeof(__u8))
@@ -280,6 +282,7 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, src,
sizeof(struct in6_addr), reg);
+ nft_flow_rule_set_addr_type(flow, FLOW_DISSECTOR_KEY_IPV6_ADDRS);
break;
case offsetof(struct ipv6hdr, daddr):
if (priv->len != sizeof(struct in6_addr))
@@ -287,6 +290,7 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, dst,
sizeof(struct in6_addr), reg);
+ nft_flow_rule_set_addr_type(flow, FLOW_DISSECTOR_KEY_IPV6_ADDRS);
break;
case offsetof(struct ipv6hdr, nexthdr):
if (priv->len != sizeof(__u8))
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH net 5/5] netfilter: nftables_offload: build mask based from the matching bytes
2020-11-27 19:03 [PATCH net 0/5] Netfilter fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2020-11-27 19:03 ` [PATCH net 4/5] netfilter: nftables_offload: set address type in control dissector Pablo Neira Ayuso
@ 2020-11-27 19:03 ` Pablo Neira Ayuso
2020-11-28 21:23 ` [PATCH net 0/5] Netfilter fixes for net Jakub Kicinski
5 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-11-27 19:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Userspace might match on prefix bytes of header fields if they are on
the byte boundary, this requires that the mask is adjusted accordingly.
Use NFT_OFFLOAD_MATCH_EXACT() for meta since prefix byte matching is not
allowed for this type of selector.
The bitwise expression might be optimized out by userspace, hence the
kernel needs to infer the prefix from the number of payload bytes to
match on. This patch adds nft_payload_offload_mask() to calculate the
bitmask to match on the prefix.
Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables_offload.h | 3 ++
net/netfilter/nft_cmp.c | 8 +--
net/netfilter/nft_meta.c | 16 +++---
net/netfilter/nft_payload.c | 66 +++++++++++++++++------
4 files changed, 64 insertions(+), 29 deletions(-)
diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
index bddd34c5bd79..1d34fe154fe0 100644
--- a/include/net/netfilter/nf_tables_offload.h
+++ b/include/net/netfilter/nf_tables_offload.h
@@ -78,6 +78,9 @@ int nft_flow_rule_offload_commit(struct net *net);
offsetof(struct nft_flow_key, __base.__field); \
(__reg)->len = __len; \
(__reg)->key = __key; \
+
+#define NFT_OFFLOAD_MATCH_EXACT(__key, __base, __field, __len, __reg) \
+ NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \
memset(&(__reg)->mask, 0xff, (__reg)->len);
int nft_chain_offload_priority(struct nft_base_chain *basechain);
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index bc079d68a536..00e563a72d3d 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -123,11 +123,11 @@ static int __nft_cmp_offload(struct nft_offload_ctx *ctx,
u8 *mask = (u8 *)&flow->match.mask;
u8 *key = (u8 *)&flow->match.key;
- if (priv->op != NFT_CMP_EQ || reg->len != priv->len)
+ if (priv->op != NFT_CMP_EQ || priv->len > reg->len)
return -EOPNOTSUPP;
- memcpy(key + reg->offset, &priv->data, priv->len);
- memcpy(mask + reg->offset, ®->mask, priv->len);
+ memcpy(key + reg->offset, &priv->data, reg->len);
+ memcpy(mask + reg->offset, ®->mask, reg->len);
flow->match.dissector.used_keys |= BIT(reg->key);
flow->match.dissector.offset[reg->key] = reg->base_offset;
@@ -137,7 +137,7 @@ static int __nft_cmp_offload(struct nft_offload_ctx *ctx,
nft_reg_load16(priv->data.data) != ARPHRD_ETHER)
return -EOPNOTSUPP;
- nft_offload_update_dependency(ctx, &priv->data, priv->len);
+ nft_offload_update_dependency(ctx, &priv->data, reg->len);
return 0;
}
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index b37bd02448d8..bf4b3ad5314c 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -724,22 +724,22 @@ static int nft_meta_get_offload(struct nft_offload_ctx *ctx,
switch (priv->key) {
case NFT_META_PROTOCOL:
- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, n_proto,
- sizeof(__u16), reg);
+ NFT_OFFLOAD_MATCH_EXACT(FLOW_DISSECTOR_KEY_BASIC, basic, n_proto,
+ sizeof(__u16), reg);
nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK);
break;
case NFT_META_L4PROTO:
- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
- sizeof(__u8), reg);
+ NFT_OFFLOAD_MATCH_EXACT(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
+ sizeof(__u8), reg);
nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
break;
case NFT_META_IIF:
- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_META, meta,
- ingress_ifindex, sizeof(__u32), reg);
+ NFT_OFFLOAD_MATCH_EXACT(FLOW_DISSECTOR_KEY_META, meta,
+ ingress_ifindex, sizeof(__u32), reg);
break;
case NFT_META_IIFTYPE:
- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_META, meta,
- ingress_iftype, sizeof(__u16), reg);
+ NFT_OFFLOAD_MATCH_EXACT(FLOW_DISSECTOR_KEY_META, meta,
+ ingress_iftype, sizeof(__u16), reg);
break;
default:
return -EOPNOTSUPP;
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index bbf811d030d5..47d4e0e21651 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -165,6 +165,34 @@ static int nft_payload_dump(struct sk_buff *skb, const struct nft_expr *expr)
return -1;
}
+static bool nft_payload_offload_mask(struct nft_offload_reg *reg,
+ u32 priv_len, u32 field_len)
+{
+ unsigned int remainder, delta, k;
+ struct nft_data mask = {};
+ __be32 remainder_mask;
+
+ if (priv_len == field_len) {
+ memset(®->mask, 0xff, priv_len);
+ return true;
+ } else if (priv_len > field_len) {
+ return false;
+ }
+
+ memset(&mask, 0xff, field_len);
+ remainder = priv_len % sizeof(u32);
+ if (remainder) {
+ k = priv_len / sizeof(u32);
+ delta = field_len - priv_len;
+ remainder_mask = htonl(~((1 << (delta * BITS_PER_BYTE)) - 1));
+ mask.data[k] = (__force u32)remainder_mask;
+ }
+
+ memcpy(®->mask, &mask, field_len);
+
+ return true;
+}
+
static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
struct nft_flow_rule *flow,
const struct nft_payload *priv)
@@ -173,21 +201,21 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
switch (priv->offset) {
case offsetof(struct ethhdr, h_source):
- if (priv->len != ETH_ALEN)
+ if (!nft_payload_offload_mask(reg, priv->len, ETH_ALEN))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
src, ETH_ALEN, reg);
break;
case offsetof(struct ethhdr, h_dest):
- if (priv->len != ETH_ALEN)
+ if (!nft_payload_offload_mask(reg, priv->len, ETH_ALEN))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
dst, ETH_ALEN, reg);
break;
case offsetof(struct ethhdr, h_proto):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic,
@@ -195,14 +223,14 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK);
break;
case offsetof(struct vlan_ethhdr, h_vlan_TCI):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_VLAN, vlan,
vlan_tci, sizeof(__be16), reg);
break;
case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_VLAN, vlan,
@@ -210,7 +238,7 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK);
break;
case offsetof(struct vlan_ethhdr, h_vlan_TCI) + sizeof(struct vlan_hdr):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, vlan,
@@ -218,7 +246,7 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
break;
case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto) +
sizeof(struct vlan_hdr):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, vlan,
@@ -239,7 +267,8 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
switch (priv->offset) {
case offsetof(struct iphdr, saddr):
- if (priv->len != sizeof(struct in_addr))
+ if (!nft_payload_offload_mask(reg, priv->len,
+ sizeof(struct in_addr)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, src,
@@ -247,7 +276,8 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
nft_flow_rule_set_addr_type(flow, FLOW_DISSECTOR_KEY_IPV4_ADDRS);
break;
case offsetof(struct iphdr, daddr):
- if (priv->len != sizeof(struct in_addr))
+ if (!nft_payload_offload_mask(reg, priv->len,
+ sizeof(struct in_addr)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, dst,
@@ -255,7 +285,7 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
nft_flow_rule_set_addr_type(flow, FLOW_DISSECTOR_KEY_IPV4_ADDRS);
break;
case offsetof(struct iphdr, protocol):
- if (priv->len != sizeof(__u8))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__u8)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
@@ -277,7 +307,8 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
switch (priv->offset) {
case offsetof(struct ipv6hdr, saddr):
- if (priv->len != sizeof(struct in6_addr))
+ if (!nft_payload_offload_mask(reg, priv->len,
+ sizeof(struct in6_addr)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, src,
@@ -285,7 +316,8 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
nft_flow_rule_set_addr_type(flow, FLOW_DISSECTOR_KEY_IPV6_ADDRS);
break;
case offsetof(struct ipv6hdr, daddr):
- if (priv->len != sizeof(struct in6_addr))
+ if (!nft_payload_offload_mask(reg, priv->len,
+ sizeof(struct in6_addr)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, dst,
@@ -293,7 +325,7 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
nft_flow_rule_set_addr_type(flow, FLOW_DISSECTOR_KEY_IPV6_ADDRS);
break;
case offsetof(struct ipv6hdr, nexthdr):
- if (priv->len != sizeof(__u8))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__u8)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
@@ -335,14 +367,14 @@ static int nft_payload_offload_tcp(struct nft_offload_ctx *ctx,
switch (priv->offset) {
case offsetof(struct tcphdr, source):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
sizeof(__be16), reg);
break;
case offsetof(struct tcphdr, dest):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
@@ -363,14 +395,14 @@ static int nft_payload_offload_udp(struct nft_offload_ctx *ctx,
switch (priv->offset) {
case offsetof(struct udphdr, source):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
sizeof(__be16), reg);
break;
case offsetof(struct udphdr, dest):
- if (priv->len != sizeof(__be16))
+ if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))
return -EOPNOTSUPP;
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
--
2.20.1
^ permalink raw reply related [flat|nested] 24+ messages in thread
* Re: [PATCH net 0/5] Netfilter fixes for net
2020-11-27 19:03 [PATCH net 0/5] Netfilter fixes for net Pablo Neira Ayuso
` (4 preceding siblings ...)
2020-11-27 19:03 ` [PATCH net 5/5] netfilter: nftables_offload: build mask based from the matching bytes Pablo Neira Ayuso
@ 2020-11-28 21:23 ` Jakub Kicinski
5 siblings, 0 replies; 24+ messages in thread
From: Jakub Kicinski @ 2020-11-28 21:23 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Fri, 27 Nov 2020 20:03:08 +0100 Pablo Neira Ayuso wrote:
> 1) Fix insufficient validation of IPSET_ATTR_IPADDR_IPV6 reported
> by syzbot.
>
> 2) Remove spurious reports on nf_tables when lockdep gets disabled,
> from Florian Westphal.
>
> 3) Fix memleak in the error path of error path of
> ip_vs_control_net_init(), from Wang Hai.
>
> 4) Fix missing control data in flow dissector, otherwise IP address
> matching in hardware offload infra does not work.
>
> 5) Fix hardware offload match on prefix IP address when userspace
> does not send a bitwise expression to represent the prefix.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks!
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2024-03-07 2:15 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2024-03-07 2:15 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains fixes for net:
Patch #1 disallows anonymous sets with timeout, except for dynamic sets.
Anonymous sets with timeouts using the pipapo set backend makes
no sense from userspace perspective.
Patch #2 rejects constant sets with timeout which has no practical usecase.
This kind of set, once bound, contains elements that expire but
no new elements can be added.
Patch #3 restores custom conntrack expectations with NFPROTO_INET,
from Florian Westphal.
Patch #4 marks rhashtable anonymous set with timeout as dead from the
commit path to avoid that async GC collects these elements. Rules
that refers to the anonymous set get released with no mutex held
from the commit path.
Patch #5 fixes a UBSAN shift overflow in H.323 conntrack helper,
from Lena Wang.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-03-07
Thanks.
----------------------------------------------------------------
The following changes since commit c055fc00c07be1f0df7375ab0036cebd1106ed38:
net/rds: fix WARNING in rds_conn_connect_if_down (2024-03-06 11:58:42 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-03-07
for you to fetch changes up to 767146637efc528b5e3d31297df115e85a2fd362:
netfilter: nf_conntrack_h323: Add protection for bmp length out of range (2024-03-07 03:10:35 +0100)
----------------------------------------------------------------
netfilter pull request 24-03-07
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nft_ct: fix l3num expectations with inet pseudo family
Lena Wang (1):
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
Pablo Neira Ayuso (3):
netfilter: nf_tables: disallow anonymous set with timeout flag
netfilter: nf_tables: reject constant set with timeout
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
net/netfilter/nf_conntrack_h323_asn1.c | 4 ++++
net/netfilter/nf_tables_api.c | 7 +++++++
net/netfilter/nft_ct.c | 11 +++++------
3 files changed, 16 insertions(+), 6 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2024-02-22 0:08 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2024-02-22 0:08 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
1) If user requests to wake up a table and hook fails, restore the
dormant flag from the error path, from Florian Westphal.
2) Reset dst after transferring it to the flow object, otherwise dst
gets released twice from the error path.
3) Release dst in case the flowtable selects a direct xmit path, eg.
transmission to bridge port. Otherwise, dst is memleaked.
4) Register basechain and flowtable hooks at the end of the command.
Error path releases these datastructure without waiting for the
rcu grace period.
5) Use kzalloc() to initialize struct nft_hook to fix a KMSAN report
on access to hook type, also from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-02-22
Thanks.
----------------------------------------------------------------
The following changes since commit 40b9385dd8e6a0515e1c9cd06a277483556b7286:
enic: Avoid false positive under FORTIFY_SOURCE (2024-02-19 10:57:27 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-02-22
for you to fetch changes up to 195e5f88c2e48330ba5483e0bad2de3b3fad484f:
netfilter: nf_tables: use kzalloc for hook allocation (2024-02-22 00:15:58 +0100)
----------------------------------------------------------------
netfilter pull request 24-02-22
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_tables: set dormant flag on hook register failure
netfilter: nf_tables: use kzalloc for hook allocation
Pablo Neira Ayuso (3):
netfilter: nft_flow_offload: reset dst in route object after setting up flow
netfilter: nft_flow_offload: release dst in case direct xmit path is used
netfilter: nf_tables: register hooks last when adding new chain/flowtable
include/net/netfilter/nf_flow_table.h | 2 +-
net/netfilter/nf_flow_table_core.c | 17 ++++++--
net/netfilter/nf_tables_api.c | 81 ++++++++++++++++++-----------------
3 files changed, 57 insertions(+), 43 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2023-11-08 15:57 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2023-11-08 15:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw, kadlec
Hi,
The following patchset contains Netfilter fixes for net:
1) Add missing netfilter modules description to fix W=1, from Florian Westphal.
2) Fix catch-all element GC with timeout when use with the pipapo set
backend, this remained broken since I tried to fix it this summer,
then another attempt to fix it recently.
3) Add missing IPVS modules descriptions to fix W=1, also from Florian.
4) xt_recent allocated a too small buffer to store an IPv4-mapped IPv6
address which can be parsed by in6_pton(), from Maciej Zenczykowski.
Broken for many releases.
5) Skip IPv4-mapped IPv6, IPv4-compat IPv6, site/link local scoped IPv6
addressses to set up IPv6 NAT redirect, also from Florian. This is
broken since 2012.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-11-08
Thanks.
----------------------------------------------------------------
The following changes since commit d93f9528573e1d419b69ca5ff4130201d05f6b90:
nfsd: regenerate user space parsers after ynl-gen changes (2023-11-06 09:03:46 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-11-08
for you to fetch changes up to 80abbe8a8263106fe45a4f293b92b5c74cc9cc8a:
netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses (2023-11-08 16:40:30 +0100)
----------------------------------------------------------------
netfilter pull request 23-11-08
----------------------------------------------------------------
Florian Westphal (3):
netfilter: add missing module descriptions
ipvs: add missing module descriptions
netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
Maciej Żenczykowski (1):
netfilter: xt_recent: fix (increase) ipv6 literal buffer length
Pablo Neira Ayuso (1):
netfilter: nf_tables: remove catchall element in GC sync path
net/bridge/netfilter/ebtable_broute.c | 1 +
net/bridge/netfilter/ebtable_filter.c | 1 +
net/bridge/netfilter/ebtable_nat.c | 1 +
net/bridge/netfilter/ebtables.c | 1 +
net/bridge/netfilter/nf_conntrack_bridge.c | 1 +
net/ipv4/netfilter/iptable_nat.c | 1 +
net/ipv4/netfilter/iptable_raw.c | 1 +
net/ipv4/netfilter/nf_defrag_ipv4.c | 1 +
net/ipv4/netfilter/nf_reject_ipv4.c | 1 +
net/ipv6/netfilter/ip6table_nat.c | 1 +
net/ipv6/netfilter/ip6table_raw.c | 1 +
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 1 +
net/ipv6/netfilter/nf_reject_ipv6.c | 1 +
net/netfilter/ipvs/ip_vs_core.c | 1 +
net/netfilter/ipvs/ip_vs_dh.c | 1 +
net/netfilter/ipvs/ip_vs_fo.c | 1 +
net/netfilter/ipvs/ip_vs_ftp.c | 1 +
net/netfilter/ipvs/ip_vs_lblc.c | 1 +
net/netfilter/ipvs/ip_vs_lblcr.c | 1 +
net/netfilter/ipvs/ip_vs_lc.c | 1 +
net/netfilter/ipvs/ip_vs_nq.c | 1 +
net/netfilter/ipvs/ip_vs_ovf.c | 1 +
net/netfilter/ipvs/ip_vs_pe_sip.c | 1 +
net/netfilter/ipvs/ip_vs_rr.c | 1 +
net/netfilter/ipvs/ip_vs_sed.c | 1 +
net/netfilter/ipvs/ip_vs_sh.c | 1 +
net/netfilter/ipvs/ip_vs_twos.c | 1 +
net/netfilter/ipvs/ip_vs_wlc.c | 1 +
net/netfilter/ipvs/ip_vs_wrr.c | 1 +
net/netfilter/nf_conntrack_broadcast.c | 1 +
net/netfilter/nf_conntrack_netlink.c | 1 +
net/netfilter/nf_conntrack_proto.c | 1 +
net/netfilter/nf_nat_core.c | 1 +
net/netfilter/nf_nat_redirect.c | 27 ++++++++++++++++++++++++++-
net/netfilter/nf_tables_api.c | 23 ++++++++++++++++++-----
net/netfilter/nfnetlink_osf.c | 1 +
net/netfilter/nft_chain_nat.c | 1 +
net/netfilter/nft_fib.c | 1 +
net/netfilter/nft_fwd_netdev.c | 1 +
net/netfilter/xt_recent.c | 2 +-
40 files changed, 82 insertions(+), 7 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2023-08-30 23:59 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2023-08-30 23:59 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix mangling of TCP options with non-linear skbuff, from Xiao Liang.
2) OOB read in xt_sctp due to missing sanitization of array length field.
From Wander Lairson Costa.
3) OOB read in xt_u32 due to missing sanitization of array length field.
Also from Wander Lairson Costa.
All of them above, always broken for several releases.
4) Missing audit log for set element reset command, from Phil Sutter.
5) Missing audit log for rule reset command, also from Phil.
These audit log support are missing in 6.5.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-08-31
Thanks.
----------------------------------------------------------------
The following changes since commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5:
Merge tag 'net-next-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next (2023-08-29 11:33:01 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-08-31
for you to fetch changes up to ea078ae9108e25fc881c84369f7c03931d22e555:
netfilter: nf_tables: Audit log rule reset (2023-08-31 01:29:28 +0200)
----------------------------------------------------------------
netfilter pull request 23-08-31
----------------------------------------------------------------
Phil Sutter (2):
netfilter: nf_tables: Audit log setelem reset
netfilter: nf_tables: Audit log rule reset
Wander Lairson Costa (2):
netfilter: xt_sctp: validate the flag_info count
netfilter: xt_u32: validate user space input
Xiao Liang (1):
netfilter: nft_exthdr: Fix non-linear header modification
include/linux/audit.h | 2 ++
kernel/auditsc.c | 2 ++
net/netfilter/nf_tables_api.c | 49 ++++++++++++++++++++++++++++++++++++++++---
net/netfilter/nft_exthdr.c | 20 +++++++-----------
net/netfilter/xt_sctp.c | 2 ++
net/netfilter/xt_u32.c | 21 +++++++++++++++++++
6 files changed, 81 insertions(+), 15 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2023-08-10 7:08 Pablo Neira Ayuso
2023-08-10 7:49 ` Greg KH
2023-08-10 17:46 ` Jakub Kicinski
0 siblings, 2 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2023-08-10 7:08 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, stable
Hi,
The following patchset contains Netfilter fixes for net.
The existing attempt to resolve races between control plane and GC work
is error prone, as reported by Bien Pham <phamnnb@sea.com>, some places
forgot to call nft_set_elem_mark_busy(), leading to double-deactivation
of elements.
This series contains the following patches:
1) Do not skip expired elements during walk otherwise elements might
never decrement the reference counter on data, leading to memleak.
2) Add a GC transaction API to replace the former attempt to deal with
races between control plane and GC. GC worker sets on NFT_SET_ELEM_DEAD_BIT
on elements and it creates a GC transaction to remove the expired
elements, GC transaction could abort in case of interference with
control plane and retried later (GC async). Set backends such as
rbtree and pipapo also perform GC from control plane (GC sync), in
such case, element deactivation and removal is safe because mutex
is held then collected elements are released via call_rcu().
3) Adapt existing set backends to use the GC transaction API.
4) Update rhash set backend to set on _DEAD bit to report deleted
elements from datapath for GC.
5) Remove old GC batch API and the NFT_SET_ELEM_BUSY_BIT.
Florian Westphal (1):
netfilter: nf_tables: don't skip expired elements during walk
Pablo Neira Ayuso (4):
netfilter: nf_tables: GC transaction API to avoid race with control plane
netfilter: nf_tables: adapt set backend to use GC transaction API
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
netfilter: nf_tables: remove busy mark and gc batch API
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-08-10
Thanks.
----------------------------------------------------------------
The following changes since commit c5ccff70501d92db445a135fa49cf9bc6b98c444:
Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route' (2023-07-31 20:10:39 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-08-10
for you to fetch changes up to a2dd0233cbc4d8a0abb5f64487487ffc9265beb5:
netfilter: nf_tables: remove busy mark and gc batch API (2023-08-10 08:25:27 +0200)
----------------------------------------------------------------
netfilter pull request 23-08-10
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nf_tables: don't skip expired elements during walk
Pablo Neira Ayuso (4):
netfilter: nf_tables: GC transaction API to avoid race with control plane
netfilter: nf_tables: adapt set backend to use GC transaction API
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
netfilter: nf_tables: remove busy mark and gc batch API
include/net/netfilter/nf_tables.h | 120 ++++++---------
net/netfilter/nf_tables_api.c | 307 ++++++++++++++++++++++++++++++--------
net/netfilter/nft_set_hash.c | 85 +++++++----
net/netfilter/nft_set_pipapo.c | 66 +++++---
net/netfilter/nft_set_rbtree.c | 146 ++++++++++--------
5 files changed, 476 insertions(+), 248 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH net 0/5] Netfilter fixes for net
2023-08-10 7:08 Pablo Neira Ayuso
@ 2023-08-10 7:49 ` Greg KH
2023-08-10 10:29 ` Pablo Neira Ayuso
2023-08-10 17:46 ` Jakub Kicinski
1 sibling, 1 reply; 24+ messages in thread
From: Greg KH @ 2023-08-10 7:49 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet, stable
On Thu, Aug 10, 2023 at 09:08:25AM +0200, Pablo Neira Ayuso wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net.
>
> The existing attempt to resolve races between control plane and GC work
> is error prone, as reported by Bien Pham <phamnnb@sea.com>, some places
> forgot to call nft_set_elem_mark_busy(), leading to double-deactivation
> of elements.
>
> This series contains the following patches:
>
> 1) Do not skip expired elements during walk otherwise elements might
> never decrement the reference counter on data, leading to memleak.
>
> 2) Add a GC transaction API to replace the former attempt to deal with
> races between control plane and GC. GC worker sets on NFT_SET_ELEM_DEAD_BIT
> on elements and it creates a GC transaction to remove the expired
> elements, GC transaction could abort in case of interference with
> control plane and retried later (GC async). Set backends such as
> rbtree and pipapo also perform GC from control plane (GC sync), in
> such case, element deactivation and removal is safe because mutex
> is held then collected elements are released via call_rcu().
>
> 3) Adapt existing set backends to use the GC transaction API.
>
> 4) Update rhash set backend to set on _DEAD bit to report deleted
> elements from datapath for GC.
>
> 5) Remove old GC batch API and the NFT_SET_ELEM_BUSY_BIT.
>
> Florian Westphal (1):
> netfilter: nf_tables: don't skip expired elements during walk
>
> Pablo Neira Ayuso (4):
> netfilter: nf_tables: GC transaction API to avoid race with control plane
> netfilter: nf_tables: adapt set backend to use GC transaction API
> netfilter: nft_set_hash: mark set element as dead when deleting from packet path
> netfilter: nf_tables: remove busy mark and gc batch API
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-08-10
>
> Thanks.
>
> ----------------------------------------------------------------
>
> The following changes since commit c5ccff70501d92db445a135fa49cf9bc6b98c444:
>
> Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route' (2023-07-31 20:10:39 -0700)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-08-10
>
> for you to fetch changes up to a2dd0233cbc4d8a0abb5f64487487ffc9265beb5:
>
> netfilter: nf_tables: remove busy mark and gc batch API (2023-08-10 08:25:27 +0200)
>
> ----------------------------------------------------------------
> netfilter pull request 23-08-10
>
> ----------------------------------------------------------------
> Florian Westphal (1):
> netfilter: nf_tables: don't skip expired elements during walk
>
> Pablo Neira Ayuso (4):
> netfilter: nf_tables: GC transaction API to avoid race with control plane
> netfilter: nf_tables: adapt set backend to use GC transaction API
> netfilter: nft_set_hash: mark set element as dead when deleting from packet path
> netfilter: nf_tables: remove busy mark and gc batch API
>
> include/net/netfilter/nf_tables.h | 120 ++++++---------
> net/netfilter/nf_tables_api.c | 307 ++++++++++++++++++++++++++++++--------
> net/netfilter/nft_set_hash.c | 85 +++++++----
> net/netfilter/nft_set_pipapo.c | 66 +++++---
> net/netfilter/nft_set_rbtree.c | 146 ++++++++++--------
> 5 files changed, 476 insertions(+), 248 deletions(-)
<formletter>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.
</formletter>
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH net 0/5] Netfilter fixes for net
2023-08-10 7:49 ` Greg KH
@ 2023-08-10 10:29 ` Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2023-08-10 10:29 UTC (permalink / raw)
To: Greg KH; +Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet, stable
On Thu, Aug 10, 2023 at 09:49:11AM +0200, Greg KH wrote:
> On Thu, Aug 10, 2023 at 09:08:25AM +0200, Pablo Neira Ayuso wrote:
> > Hi,
> >
> > The following patchset contains Netfilter fixes for net.
> >
> > The existing attempt to resolve races between control plane and GC work
> > is error prone, as reported by Bien Pham <phamnnb@sea.com>, some places
> > forgot to call nft_set_elem_mark_busy(), leading to double-deactivation
> > of elements.
> >
> > This series contains the following patches:
> >
> > 1) Do not skip expired elements during walk otherwise elements might
> > never decrement the reference counter on data, leading to memleak.
> >
> > 2) Add a GC transaction API to replace the former attempt to deal with
> > races between control plane and GC. GC worker sets on NFT_SET_ELEM_DEAD_BIT
> > on elements and it creates a GC transaction to remove the expired
> > elements, GC transaction could abort in case of interference with
> > control plane and retried later (GC async). Set backends such as
> > rbtree and pipapo also perform GC from control plane (GC sync), in
> > such case, element deactivation and removal is safe because mutex
> > is held then collected elements are released via call_rcu().
> >
> > 3) Adapt existing set backends to use the GC transaction API.
> >
> > 4) Update rhash set backend to set on _DEAD bit to report deleted
> > elements from datapath for GC.
> >
> > 5) Remove old GC batch API and the NFT_SET_ELEM_BUSY_BIT.
> >
> > Florian Westphal (1):
> > netfilter: nf_tables: don't skip expired elements during walk
> >
> > Pablo Neira Ayuso (4):
> > netfilter: nf_tables: GC transaction API to avoid race with control plane
> > netfilter: nf_tables: adapt set backend to use GC transaction API
> > netfilter: nft_set_hash: mark set element as dead when deleting from packet path
> > netfilter: nf_tables: remove busy mark and gc batch API
> >
> > Please, pull these changes from:
> >
> > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-08-10
> >
> > Thanks.
> >
> > ----------------------------------------------------------------
> >
> > The following changes since commit c5ccff70501d92db445a135fa49cf9bc6b98c444:
> >
> > Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route' (2023-07-31 20:10:39 -0700)
> >
> > are available in the Git repository at:
> >
> > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-08-10
> >
> > for you to fetch changes up to a2dd0233cbc4d8a0abb5f64487487ffc9265beb5:
> >
> > netfilter: nf_tables: remove busy mark and gc batch API (2023-08-10 08:25:27 +0200)
> >
> > ----------------------------------------------------------------
> > netfilter pull request 23-08-10
> >
> > ----------------------------------------------------------------
> > Florian Westphal (1):
> > netfilter: nf_tables: don't skip expired elements during walk
> >
> > Pablo Neira Ayuso (4):
> > netfilter: nf_tables: GC transaction API to avoid race with control plane
> > netfilter: nf_tables: adapt set backend to use GC transaction API
> > netfilter: nft_set_hash: mark set element as dead when deleting from packet path
> > netfilter: nf_tables: remove busy mark and gc batch API
> >
> > include/net/netfilter/nf_tables.h | 120 ++++++---------
> > net/netfilter/nf_tables_api.c | 307 ++++++++++++++++++++++++++++++--------
> > net/netfilter/nft_set_hash.c | 85 +++++++----
> > net/netfilter/nft_set_pipapo.c | 66 +++++---
> > net/netfilter/nft_set_rbtree.c | 146 ++++++++++--------
> > 5 files changed, 476 insertions(+), 248 deletions(-)
>
> <formletter>
>
> This is not the correct way to submit patches for inclusion in the
> stable kernel tree. Please read:
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> for how to do this properly.
I will re-submit this once this hit upstream.
Thanks.
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH net 0/5] Netfilter fixes for net
2023-08-10 7:08 Pablo Neira Ayuso
2023-08-10 7:49 ` Greg KH
@ 2023-08-10 17:46 ` Jakub Kicinski
1 sibling, 0 replies; 24+ messages in thread
From: Jakub Kicinski @ 2023-08-10 17:46 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, davem, netdev, pabeni, edumazet, stable
We've got some new kdoc warnings here:
net/netfilter/nft_set_pipapo.c:1557: warning: Function parameter or member '_set' not described in 'pipapo_gc'
net/netfilter/nft_set_pipapo.c:1557: warning: Excess function parameter 'set' description in 'pipapo_gc'
include/net/netfilter/nf_tables.h:577: warning: Function parameter or member 'dead' not described in 'nft_set'
Don't think Linus will care enough to complain but it'd be good to get
those cleaned up.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2023-06-06 22:58 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2023-06-06 22:58 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
1) Missing nul-check in basechain hook netlink dump path, from Gavrilov Ilia.
2) Fix bitwise register tracking, from Jeremy Sowden.
3) Null pointer dereference when accessing conntrack helper,
from Tijs Van Buggenhout.
4) Add schedule point to ipset's call_ad, from Kuniyuki Iwashima.
5) Incorrect boundary check when building chain blob.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-06-07
Thanks.
----------------------------------------------------------------
The following changes since commit 9025944fddfed5966c8f102f1fe921ab3aee2c12:
net: fec: add dma_wmb to ensure correct descriptor values (2023-05-19 09:17:53 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-06-07
for you to fetch changes up to 08e42a0d3ad30f276f9597b591f975971a1b0fcf:
netfilter: nf_tables: out-of-bound check in chain blob (2023-06-07 00:43:44 +0200)
----------------------------------------------------------------
netfilter pull request 23-06-07
----------------------------------------------------------------
Gavrilov Ilia (1):
netfilter: nf_tables: Add null check for nla_nest_start_noflag() in nft_dump_basechain_hook()
Jeremy Sowden (1):
netfilter: nft_bitwise: fix register tracking
Kuniyuki Iwashima (1):
netfilter: ipset: Add schedule point in call_ad().
Pablo Neira Ayuso (1):
netfilter: nf_tables: out-of-bound check in chain blob
Tijs Van Buggenhout (1):
netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
net/netfilter/ipset/ip_set_core.c | 8 ++++++++
net/netfilter/nf_conntrack_core.c | 3 +++
net/netfilter/nf_tables_api.c | 4 +++-
net/netfilter/nft_bitwise.c | 2 +-
4 files changed, 15 insertions(+), 2 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2023-04-18 14:50 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2023-04-18 14:50 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Unbreak br_netfilter physdev match support, from Florian Westphal.
2) Use GFP_KERNEL_ACCOUNT for stateful/policy objects, from Chen Aotian.
3) Use IS_ENABLED() in nf_reset_trace(), from Florian Westphal.
4) Fix validation of catch-all set element.
5) Tighten requirements for catch-all set elements.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 24e3fce00c0b557491ff596c0682a29dee6fe848:
net: stmmac: Add queue reset into stmmac_xdp_open() function (2023-04-05 19:02:56 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to d4eb7e39929a3b1ff30fb751b4859fc2410702a0:
netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements (2023-04-18 09:30:21 +0200)
----------------------------------------------------------------
Chen Aotian (1):
netfilter: nf_tables: Modify nla_memdup's flag to GFP_KERNEL_ACCOUNT
Florian Westphal (2):
netfilter: br_netfilter: fix recent physdev match breakage
netfilter: nf_tables: fix ifdef to also consider nf_tables=m
Pablo Neira Ayuso (2):
netfilter: nf_tables: validate catch-all set elements
netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements
include/linux/skbuff.h | 5 +--
include/net/netfilter/nf_tables.h | 4 +++
net/bridge/br_netfilter_hooks.c | 17 ++++++----
net/netfilter/nf_tables_api.c | 69 ++++++++++++++++++++++++++++++++++-----
net/netfilter/nft_lookup.c | 36 +++-----------------
5 files changed, 83 insertions(+), 48 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2022-06-21 8:56 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2022-06-21 8:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Use get_random_u32() instead of prandom_u32_state() in nft_meta
and nft_numgen, from Florian Westphal.
2) Incorrect list head in nfnetlink_cttimeout in recent update coming
from previous development cycle. Also from Florian.
3) Incorrect path to pktgen scripts for nft_concat_range.sh selftest.
From Jie2x Zhou.
4) Two fixes for the for nft_fwd and nft_dup egress support, from Florian.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit f5826c8c9d57210a17031af5527056eefdc2b7eb:
net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure (2022-06-07 20:49:58 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to fcd53c51d03709bc429822086f1e9b3e88904284:
netfilter: nf_dup_netdev: add and use recursion counter (2022-06-21 10:50:41 +0200)
----------------------------------------------------------------
Florian Westphal (4):
netfilter: use get_random_u32 instead of prandom
netfilter: cttimeout: fix slab-out-of-bounds read typo in cttimeout_net_exit
netfilter: nf_dup_netdev: do not push mac header a second time
netfilter: nf_dup_netdev: add and use recursion counter
Jie2x Zhou (1):
selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh
net/netfilter/nf_dup_netdev.c | 25 ++++++++++++++++++----
net/netfilter/nfnetlink_cttimeout.c | 2 +-
net/netfilter/nft_meta.c | 13 ++---------
net/netfilter/nft_numgen.c | 12 +++--------
.../selftests/netfilter/nft_concat_range.sh | 2 +-
5 files changed, 28 insertions(+), 26 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2022-05-31 21:58 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2022-05-31 21:58 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
1) Missing proper sanitization for nft_set_desc_concat_parse().
2) Missing mutex in nf_tables pre_exit path.
3) Possible double hook unregistration from clean_net path.
4) Missing FLOWI_FLAG_ANYSRC flag in flowtable route lookup.
Fix incorrect source and destination address in case of NAT.
Patch from wenxu.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 09e545f7381459c015b6fa0cd0ac6f010ef8cc25:
xen/netback: fix incorrect usage of RING_HAS_UNCONSUMED_REQUESTS() (2022-05-31 12:22:22 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 97629b237a8cb7ac655c3969b8d5e57300ff6598:
netfilter: flowtable: fix nft_flow_route source address for nat case (2022-05-31 23:32:53 +0200)
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nf_tables: sanitize nft_set_desc_concat_parse()
netfilter: nf_tables: hold mutex on netns pre_exit path
netfilter: nf_tables: double hook unregistration in netns path
wenxu (2):
netfilter: flowtable: fix missing FLOWI_FLAG_ANYSRC flag
netfilter: flowtable: fix nft_flow_route source address for nat case
net/netfilter/nf_tables_api.c | 75 +++++++++++++++++++++++++++++++---------
net/netfilter/nft_flow_offload.c | 6 ++--
2 files changed, 62 insertions(+), 19 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2022-01-20 12:52 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-20 12:52 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Incorrect helper module alias in netbios_ns, from Florian Westphal.
2) Remove unused variable in nf_tables.
3) Uninitialized last expression in nf_tables register tracking.
4) Memleak in nft_connlimit after moving stateful data out of the
expression data area.
5) Bogus invalid stats update when NF_REPEAT is returned, from Florian.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 7d6019b602de660bfc6a542a68630006ace83b90:
Revert "net: vertexcom: default to disabled on kbuild" (2022-01-10 21:11:07 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 830af2eba40327abec64325a5b08b1e85c37a2e0:
netfilter: conntrack: don't increment invalid counter on NF_REPEAT (2022-01-16 00:55:27 +0100)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_conntrack_netbios_ns: fix helper module alias
netfilter: conntrack: don't increment invalid counter on NF_REPEAT
Pablo Neira Ayuso (3):
netfilter: nf_tables: remove unused variable
netfilter: nf_tables: set last expression in register tracking area
netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
net/netfilter/nf_conntrack_core.c | 8 +++++---
net/netfilter/nf_conntrack_netbios_ns.c | 5 +++--
net/netfilter/nf_tables_api.c | 4 +---
net/netfilter/nft_connlimit.c | 11 ++++++++++-
4 files changed, 19 insertions(+), 9 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2021-09-29 23:04 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2021-09-29 23:04 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Move back the defrag users fields to the global netns_nf area.
Kernel fails to boot if conntrack is builtin and kernel is booted
with: nf_conntrack.enable_hooks=1. From Florian Westphal.
2) Rule event notification is missing relevant context such as
the position handle and the NLM_F_APPEND flag.
3) Rule replacement is expanded to add + delete using the existing
rule handle, reverse order of this operation so it makes sense
from rule notification standpoint.
4) Remove superfluous check in the dynamic set extension which
disallow update commands on a set without timeout.
5) Propagate to userspace the NLM_F_CREATE and NLM_F_EXCL flags
from the rule notification path.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 3b1b6e82fb5e08e2cb355d7b2ee8644ec289de66:
net: phy: enhance GPY115 loopback disable function (2021-09-27 13:49:38 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 3d3b30175a51cf027201670af3e2e5b05447b985:
netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event notification (2021-09-28 13:04:56 +0200)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1
Pablo Neira Ayuso (4):
netfilter: nf_tables: add position handle in event notification
netfilter: nf_tables: reverse order in rule replacement expansion
netfilter: nft_dynset: relax superfluous check on set updates
netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event notification
include/net/netfilter/ipv6/nf_defrag_ipv6.h | 1 -
include/net/netfilter/nf_tables.h | 2 +-
include/net/netns/netfilter.h | 6 ++
net/ipv4/netfilter/nf_defrag_ipv4.c | 30 +++-------
net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +-
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 25 +++-----
net/netfilter/nf_tables_api.c | 91 ++++++++++++++++++++---------
net/netfilter/nft_dynset.c | 11 +---
net/netfilter/nft_quota.c | 2 +-
9 files changed, 92 insertions(+), 78 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2021-09-03 16:30 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2021-09-03 16:30 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Protect nft_ct template with global mutex, from Pavel Skripkin.
2) Two recent commits switched inet rt and nexthop exception hashes
from jhash to siphash. If those two spots are problematic then
conntrack is affected as well, so switch voer to siphash too.
While at it, add a hard upper limit on chain lengths and reject
insertion if this is hit. Patches from Florian Westphal.
3) Fix use-after-scope in nf_socket_ipv6 reported by KASAN,
from Benjamin Hesmans.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 519133debcc19f5c834e7e28480b60bdc234fe02:
net: bridge: fix memleak in br_add_if() (2021-08-10 13:25:14 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 730affed24bffcd1eebd5903171960f5ff9f1f22:
netfilter: socket: icmp6: fix use-after-scope (2021-09-03 18:25:31 +0200)
----------------------------------------------------------------
Benjamin Hesmans (1):
netfilter: socket: icmp6: fix use-after-scope
Florian Westphal (3):
netfilter: conntrack: sanitize table size default settings
netfilter: conntrack: switch to siphash
netfilter: refuse insertion if chain has grown too large
Pavel Skripkin (1):
netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex
Documentation/networking/nf_conntrack-sysctl.rst | 13 ++-
include/linux/netfilter/nf_conntrack_common.h | 1 +
include/uapi/linux/netfilter/nfnetlink_conntrack.h | 1 +
net/ipv6/netfilter/nf_socket_ipv6.c | 4 +-
net/netfilter/nf_conntrack_core.c | 103 ++++++++++++++-------
net/netfilter/nf_conntrack_expect.c | 25 +++--
net/netfilter/nf_conntrack_netlink.c | 4 +-
net/netfilter/nf_conntrack_standalone.c | 4 +-
net/netfilter/nf_nat_core.c | 18 +++-
net/netfilter/nft_ct.c | 9 +-
10 files changed, 123 insertions(+), 59 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH net 0/5] Netfilter fixes for net
@ 2020-10-31 18:14 Pablo Neira Ayuso
2020-11-01 1:02 ` Jakub Kicinski
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-31 18:14 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for net:
1) Incorrect netlink report logic in flowtable and genID.
2) Add a selftest to check that wireguard passes the right sk
to ip_route_me_harder, from Jason A. Donenfeld.
3) Pass the actual sk to ip_route_me_harder(), also from Jason.
4) Missing expression validation of updates via nft --check.
5) Update byte and packet counters regardless of whether they
match, from Stefano Brivio.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 07e0887302450a62f51dba72df6afb5fabb23d1c:
Merge tag 'fallthrough-fixes-clang-5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux (2020-10-29 13:02:52 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 7d10e62c2ff8e084c136c94d32d9a94de4d31248:
netfilter: ipset: Update byte and packet counters regardless of whether they match (2020-10-31 11:11:11 +0100)
----------------------------------------------------------------
Jason A. Donenfeld (2):
wireguard: selftests: check that route_me_harder packets use the right sk
netfilter: use actual socket sk rather than skb sk when routing harder
Pablo Neira Ayuso (2):
netfilter: nftables: fix netlink report logic in flowtable and genid
netfilter: nf_tables: missing validation from the abort path
Stefano Brivio (1):
netfilter: ipset: Update byte and packet counters regardless of whether they match
include/linux/netfilter/nfnetlink.h | 9 ++++++++-
include/linux/netfilter_ipv4.h | 2 +-
include/linux/netfilter_ipv6.h | 10 +++++-----
net/ipv4/netfilter.c | 8 +++++---
net/ipv4/netfilter/iptable_mangle.c | 2 +-
net/ipv4/netfilter/nf_reject_ipv4.c | 2 +-
net/ipv6/netfilter.c | 6 +++---
net/ipv6/netfilter/ip6table_mangle.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 3 ++-
net/netfilter/ipvs/ip_vs_core.c | 4 ++--
net/netfilter/nf_nat_proto.c | 4 ++--
net/netfilter/nf_synproxy_core.c | 2 +-
net/netfilter/nf_tables_api.c | 19 ++++++++++++-------
net/netfilter/nfnetlink.c | 22 ++++++++++++++++++----
net/netfilter/nft_chain_route.c | 4 ++--
net/netfilter/utils.c | 4 ++--
tools/testing/selftests/wireguard/netns.sh | 8 ++++++++
.../testing/selftests/wireguard/qemu/kernel.config | 2 ++
18 files changed, 76 insertions(+), 37 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH net 0/5] Netfilter fixes for net
2020-10-31 18:14 Pablo Neira Ayuso
@ 2020-11-01 1:02 ` Jakub Kicinski
0 siblings, 0 replies; 24+ messages in thread
From: Jakub Kicinski @ 2020-11-01 1:02 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Sat, 31 Oct 2020 19:14:32 +0100 Pablo Neira Ayuso wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Incorrect netlink report logic in flowtable and genID.
>
> 2) Add a selftest to check that wireguard passes the right sk
> to ip_route_me_harder, from Jason A. Donenfeld.
>
> 3) Pass the actual sk to ip_route_me_harder(), also from Jason.
>
> 4) Missing expression validation of updates via nft --check.
>
> 5) Update byte and packet counters regardless of whether they
> match, from Stefano Brivio.
Pulled, thanks Pablo!
^ permalink raw reply [flat|nested] 24+ messages in thread
end of thread, other threads:[~2024-03-07 2:15 UTC | newest]
Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-27 19:03 [PATCH net 0/5] Netfilter fixes for net Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 1/5] netfilter: ipset: prevent uninit-value in hash_ip6_add Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 2/5] netfilter: nf_tables: avoid false-postive lockdep splat Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 3/5] ipvs: fix possible memory leak in ip_vs_control_net_init Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 4/5] netfilter: nftables_offload: set address type in control dissector Pablo Neira Ayuso
2020-11-27 19:03 ` [PATCH net 5/5] netfilter: nftables_offload: build mask based from the matching bytes Pablo Neira Ayuso
2020-11-28 21:23 ` [PATCH net 0/5] Netfilter fixes for net Jakub Kicinski
-- strict thread matches above, loose matches on Subject: below --
2024-03-07 2:15 Pablo Neira Ayuso
2024-02-22 0:08 Pablo Neira Ayuso
2023-11-08 15:57 Pablo Neira Ayuso
2023-08-30 23:59 Pablo Neira Ayuso
2023-08-10 7:08 Pablo Neira Ayuso
2023-08-10 7:49 ` Greg KH
2023-08-10 10:29 ` Pablo Neira Ayuso
2023-08-10 17:46 ` Jakub Kicinski
2023-06-06 22:58 Pablo Neira Ayuso
2023-04-18 14:50 Pablo Neira Ayuso
2022-06-21 8:56 Pablo Neira Ayuso
2022-05-31 21:58 Pablo Neira Ayuso
2022-01-20 12:52 Pablo Neira Ayuso
2021-09-29 23:04 Pablo Neira Ayuso
2021-09-03 16:30 Pablo Neira Ayuso
2020-10-31 18:14 Pablo Neira Ayuso
2020-11-01 1:02 ` Jakub Kicinski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.