* [PATCH net 0/3] Netfilter fixes for net
@ 2023-01-13 16:41 Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 1/3] selftests: netfilter: fix transaction test script timeout handling Pablo Neira Ayuso
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-13 16:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
[ Resend Cc'ing netdev, previous PR did not CC netdev accidentally. ]
Hi,
The following patchset contains Netfilter fixes for net:
1) Increase timeout to 120 seconds for netfilter selftests to fix
nftables transaction tests, from Florian Westphal.
2) Fix overflow in bitmap_ip_create() due to integer arithmetics
in a 64-bit bitmask, from Gavrilov Ilia.
3) Fix incorrect arithmetics in nft_payload with double-tagged
vlan matching.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8fed75653a670a4d3be0ab9949aed5e2968a03ef:
Merge tag 'mlx5-fixes-2023-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2023-01-11 12:55:09 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 696e1a48b1a1b01edad542a1ef293665864a4dd0:
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (2023-01-11 19:18:04 +0100)
----------------------------------------------------------------
Florian Westphal (1):
selftests: netfilter: fix transaction test script timeout handling
Gavrilov Ilia (1):
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
Pablo Neira Ayuso (1):
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++--
net/netfilter/nft_payload.c | 2 +-
tools/testing/selftests/netfilter/nft_trans_stress.sh | 16 +++++++++-------
tools/testing/selftests/netfilter/settings | 1 +
4 files changed, 13 insertions(+), 10 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/settings
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH net 1/3] selftests: netfilter: fix transaction test script timeout handling
2023-01-13 16:41 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
@ 2023-01-13 16:41 ` Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 2/3] netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function Pablo Neira Ayuso
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-13 16:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
From: Florian Westphal <fw@strlen.de>
The kselftest framework uses a default timeout of 45 seconds for
all test scripts.
Increase the timeout to two minutes for the netfilter tests, this
should hopefully be enough,
Make sure that, should the script be canceled, the net namespace and
the spawned ping instances are removed.
Fixes: 25d8bcedbf43 ("selftests: add script to stress-test nft packet path vs. control plane")
Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Signed-off-by: Florian Westphal <fw@strlen.de>
Tested-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
.../selftests/netfilter/nft_trans_stress.sh | 16 +++++++++-------
tools/testing/selftests/netfilter/settings | 1 +
2 files changed, 10 insertions(+), 7 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/settings
diff --git a/tools/testing/selftests/netfilter/nft_trans_stress.sh b/tools/testing/selftests/netfilter/nft_trans_stress.sh
index a7f62ad4f661..2ffba45a78bf 100755
--- a/tools/testing/selftests/netfilter/nft_trans_stress.sh
+++ b/tools/testing/selftests/netfilter/nft_trans_stress.sh
@@ -10,12 +10,20 @@
ksft_skip=4
testns=testns-$(mktemp -u "XXXXXXXX")
+tmp=""
tables="foo bar baz quux"
global_ret=0
eret=0
lret=0
+cleanup() {
+ ip netns pids "$testns" | xargs kill 2>/dev/null
+ ip netns del "$testns"
+
+ rm -f "$tmp"
+}
+
check_result()
{
local r=$1
@@ -43,6 +51,7 @@ if [ $? -ne 0 ];then
exit $ksft_skip
fi
+trap cleanup EXIT
tmp=$(mktemp)
for table in $tables; do
@@ -139,11 +148,4 @@ done
check_result $lret "add/delete with nftrace enabled"
-pkill -9 ping
-
-wait
-
-rm -f "$tmp"
-ip netns del "$testns"
-
exit $global_ret
diff --git a/tools/testing/selftests/netfilter/settings b/tools/testing/selftests/netfilter/settings
new file mode 100644
index 000000000000..6091b45d226b
--- /dev/null
+++ b/tools/testing/selftests/netfilter/settings
@@ -0,0 +1 @@
+timeout=120
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH net 2/3] netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
2023-01-13 16:41 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 1/3] selftests: netfilter: fix transaction test script timeout handling Pablo Neira Ayuso
@ 2023-01-13 16:41 ` Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 3/3] netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits Pablo Neira Ayuso
2023-01-18 3:03 ` [PATCH net 0/3] Netfilter fixes for net Jakub Kicinski
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-13 16:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of
an arithmetic expression 2 << (netmask - mask_bits - 1) is subject
to overflow due to a failure casting operands to a larger data type
before performing the arithmetic.
Note that it's harmless since the value will be checked at the next step.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Fixes: b9fed748185a ("netfilter: ipset: Check and reject crazy /0 input parameters")
Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index a8ce04a4bb72..e4fa00abde6a 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -308,8 +308,8 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
return -IPSET_ERR_BITMAP_RANGE;
pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask);
- hosts = 2 << (32 - netmask - 1);
- elements = 2 << (netmask - mask_bits - 1);
+ hosts = 2U << (32 - netmask - 1);
+ elements = 2UL << (netmask - mask_bits - 1);
}
if (elements > IPSET_BITMAP_MAX_RANGE + 1)
return -IPSET_ERR_BITMAP_RANGE_SIZE;
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH net 3/3] netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
2023-01-13 16:41 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 1/3] selftests: netfilter: fix transaction test script timeout handling Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 2/3] netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function Pablo Neira Ayuso
@ 2023-01-13 16:41 ` Pablo Neira Ayuso
2023-01-18 3:03 ` [PATCH net 0/3] Netfilter fixes for net Jakub Kicinski
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-13 16:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
If the offset + length goes over the ethernet + vlan header, then the
length is adjusted to copy the bytes that are within the boundaries of
the vlan_ethhdr scratchpad area. The remaining bytes beyond ethernet +
vlan header are copied directly from the skbuff data area.
Fix incorrect arithmetic operator: subtract, not add, the size of the
vlan header in case of double-tagged packets to adjust the length
accordingly to address CVE-2023-0179.
Reported-by: Davide Ornaghi <d.ornaghi97@gmail.com>
Fixes: f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_payload.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 17b418a5a593..3a3c7746e88f 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -63,7 +63,7 @@ nft_payload_copy_vlan(u32 *d, const struct sk_buff *skb, u8 offset, u8 len)
return false;
if (offset + len > VLAN_ETH_HLEN + vlan_hlen)
- ethlen -= offset + len - VLAN_ETH_HLEN + vlan_hlen;
+ ethlen -= offset + len - VLAN_ETH_HLEN - vlan_hlen;
memcpy(dst_u8, vlanh + offset - vlan_hlen, ethlen);
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH net 0/3] Netfilter fixes for net
2023-01-13 16:41 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2023-01-13 16:41 ` [PATCH net 3/3] netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits Pablo Neira Ayuso
@ 2023-01-18 3:03 ` Jakub Kicinski
3 siblings, 0 replies; 6+ messages in thread
From: Jakub Kicinski @ 2023-01-18 3:03 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, pabeni, edumazet
On Fri, 13 Jan 2023 17:41:03 +0100 Pablo Neira Ayuso wrote:
> 1) Increase timeout to 120 seconds for netfilter selftests to fix
> nftables transaction tests, from Florian Westphal.
>
> 2) Fix overflow in bitmap_ip_create() due to integer arithmetics
> in a 64-bit bitmask, from Gavrilov Ilia.
>
> 3) Fix incorrect arithmetics in nft_payload with double-tagged
> vlan matching.
FWIW pulled yesterday, thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-01-11 21:22 Pablo Neira Ayuso
2023-01-11 21:22 ` [PATCH net 1/3] selftests: netfilter: fix transaction test script timeout handling Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-11 21:22 UTC (permalink / raw)
To: netfilter-devel
Hi,
The following patchset contains Netfilter fixes for net:
1) Increase timeout to 120 seconds for netfilter selftests to fix
nftables transaction tests, from Florian Westphal.
2) Fix overflow in bitmap_ip_create() due to integer arithmetics
in a 64-bit bitmask, from Gavrilov Ilia.
3) Fix incorrect arithmetics in nft_payload with double-tagged
vlan matching.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8fed75653a670a4d3be0ab9949aed5e2968a03ef:
Merge tag 'mlx5-fixes-2023-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2023-01-11 12:55:09 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 696e1a48b1a1b01edad542a1ef293665864a4dd0:
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (2023-01-11 19:18:04 +0100)
----------------------------------------------------------------
Florian Westphal (1):
selftests: netfilter: fix transaction test script timeout handling
Gavrilov Ilia (1):
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
Pablo Neira Ayuso (1):
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++--
net/netfilter/nft_payload.c | 2 +-
tools/testing/selftests/netfilter/nft_trans_stress.sh | 16 +++++++++-------
tools/testing/selftests/netfilter/settings | 1 +
4 files changed, 13 insertions(+), 10 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/settings
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH net 1/3] selftests: netfilter: fix transaction test script timeout handling
2023-01-11 21:22 Pablo Neira Ayuso
@ 2023-01-11 21:22 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-11 21:22 UTC (permalink / raw)
To: netfilter-devel
From: Florian Westphal <fw@strlen.de>
The kselftest framework uses a default timeout of 45 seconds for
all test scripts.
Increase the timeout to two minutes for the netfilter tests, this
should hopefully be enough,
Make sure that, should the script be canceled, the net namespace and
the spawned ping instances are removed.
Fixes: 25d8bcedbf43 ("selftests: add script to stress-test nft packet path vs. control plane")
Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Signed-off-by: Florian Westphal <fw@strlen.de>
Tested-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
.../selftests/netfilter/nft_trans_stress.sh | 16 +++++++++-------
tools/testing/selftests/netfilter/settings | 1 +
2 files changed, 10 insertions(+), 7 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/settings
diff --git a/tools/testing/selftests/netfilter/nft_trans_stress.sh b/tools/testing/selftests/netfilter/nft_trans_stress.sh
index a7f62ad4f661..2ffba45a78bf 100755
--- a/tools/testing/selftests/netfilter/nft_trans_stress.sh
+++ b/tools/testing/selftests/netfilter/nft_trans_stress.sh
@@ -10,12 +10,20 @@
ksft_skip=4
testns=testns-$(mktemp -u "XXXXXXXX")
+tmp=""
tables="foo bar baz quux"
global_ret=0
eret=0
lret=0
+cleanup() {
+ ip netns pids "$testns" | xargs kill 2>/dev/null
+ ip netns del "$testns"
+
+ rm -f "$tmp"
+}
+
check_result()
{
local r=$1
@@ -43,6 +51,7 @@ if [ $? -ne 0 ];then
exit $ksft_skip
fi
+trap cleanup EXIT
tmp=$(mktemp)
for table in $tables; do
@@ -139,11 +148,4 @@ done
check_result $lret "add/delete with nftrace enabled"
-pkill -9 ping
-
-wait
-
-rm -f "$tmp"
-ip netns del "$testns"
-
exit $global_ret
diff --git a/tools/testing/selftests/netfilter/settings b/tools/testing/selftests/netfilter/settings
new file mode 100644
index 000000000000..6091b45d226b
--- /dev/null
+++ b/tools/testing/selftests/netfilter/settings
@@ -0,0 +1 @@
+timeout=120
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-01-18 3:03 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-13 16:41 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 1/3] selftests: netfilter: fix transaction test script timeout handling Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 2/3] netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function Pablo Neira Ayuso
2023-01-13 16:41 ` [PATCH net 3/3] netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits Pablo Neira Ayuso
2023-01-18 3:03 ` [PATCH net 0/3] Netfilter fixes for net Jakub Kicinski
-- strict thread matches above, loose matches on Subject: below --
2023-01-11 21:22 Pablo Neira Ayuso
2023-01-11 21:22 ` [PATCH net 1/3] selftests: netfilter: fix transaction test script timeout handling Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.