* [PATCH 0/8] netfilter fixes for net
@ 2014-04-05 16:03 Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 1/8] netfilter: connlimit: fix UP build Pablo Neira Ayuso
` (7 more replies)
0 siblings, 8 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for your net tree, they
are:
* Use 16-bits offset and length fields instead of 8-bits in the conntrack
extension to avoid an overflow when many conntrack extension are used,
from Andrey Vagin.
* Allow to use cgroup match from LOCAL_IN, there is no apparent reason
for not allowing this, from Alexey Perevalov.
* Fix build of the connlimit match after recent changes to let it scale
up that result in a divide by zero compilation error in UP, from
Florian Westphal.
* Move the lock out of the structure connlimit_data to avoid a false
sharing spotted by Eric Dumazet and Jesper D. Brouer, this needed as
part of the recent connlimit scalability improvements, also from
Florian Westphal.
* Add missing module aliases in xt_osf to fix loading of rules using
this match, from Kirill Tkhai.
* Restrict set names in nf_tables to 15 characters instead of silently
trimming them off, from me.
* Fix wrong format in nf_tables request module call for chain types,
spotted by Florian Westphal, patch from me.
* Fix crash in xtables when it fails to copy the counters back to userspace
after having replaced the table already.
You can pull these changes from:
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 1/8] netfilter: connlimit: fix UP build
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
@ 2014-04-05 16:03 ` Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 2/8] netfilter: connlimit: move lock array out of struct connlimit_data Pablo Neira Ayuso
` (6 subsequent siblings)
7 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Florian Westphal <fw@strlen.de>
cannot use ARRAY_SIZE() if spinlock_t is empty struct.
Fixes: 1442e7507dd597 ("netfilter: connlimit: use keyed locks")
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_connlimit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 458464e..a6e129e 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -377,7 +377,7 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
return -ENOMEM;
}
- for (i = 0; i < ARRAY_SIZE(info->data->locks); ++i)
+ for (i = 0; i < CONNLIMIT_LOCK_SLOTS; ++i)
spin_lock_init(&info->data->locks[i]);
for (i = 0; i < ARRAY_SIZE(info->data->climit_root4); ++i)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 2/8] netfilter: connlimit: move lock array out of struct connlimit_data
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 1/8] netfilter: connlimit: fix UP build Pablo Neira Ayuso
@ 2014-04-05 16:03 ` Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 3/8] netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks Pablo Neira Ayuso
` (5 subsequent siblings)
7 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Florian Westphal <fw@strlen.de>
Eric points out that the locks can be global.
Moreover, both Jesper and Eric note that using only 32 locks increases
false sharing as only two cache lines are used.
This increases locks to 256 (16 cache lines assuming 64byte cacheline and
4 bytes per spinlock).
Suggested-by: Jesper Dangaard Brouer <brouer@redhat.com>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_connlimit.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index a6e129e..fbc66bb 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -32,8 +32,14 @@
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_zones.h>
-#define CONNLIMIT_SLOTS 32
-#define CONNLIMIT_LOCK_SLOTS 32
+#define CONNLIMIT_SLOTS 256U
+
+#ifdef CONFIG_LOCKDEP
+#define CONNLIMIT_LOCK_SLOTS 8U
+#else
+#define CONNLIMIT_LOCK_SLOTS 256U
+#endif
+
#define CONNLIMIT_GC_MAX_NODES 8
/* we will save the tuples of all connections we care about */
@@ -49,10 +55,11 @@ struct xt_connlimit_rb {
union nf_inet_addr addr; /* search key */
};
+static spinlock_t xt_connlimit_locks[CONNLIMIT_LOCK_SLOTS] __cacheline_aligned_in_smp;
+
struct xt_connlimit_data {
struct rb_root climit_root4[CONNLIMIT_SLOTS];
struct rb_root climit_root6[CONNLIMIT_SLOTS];
- spinlock_t locks[CONNLIMIT_LOCK_SLOTS];
};
static u_int32_t connlimit_rnd __read_mostly;
@@ -297,11 +304,11 @@ static int count_them(struct net *net,
root = &data->climit_root4[hash];
}
- spin_lock_bh(&data->locks[hash % CONNLIMIT_LOCK_SLOTS]);
+ spin_lock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
count = count_tree(net, root, tuple, addr, mask, family);
- spin_unlock_bh(&data->locks[hash % CONNLIMIT_LOCK_SLOTS]);
+ spin_unlock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
return count;
}
@@ -377,9 +384,6 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
return -ENOMEM;
}
- for (i = 0; i < CONNLIMIT_LOCK_SLOTS; ++i)
- spin_lock_init(&info->data->locks[i]);
-
for (i = 0; i < ARRAY_SIZE(info->data->climit_root4); ++i)
info->data->climit_root4[i] = RB_ROOT;
for (i = 0; i < ARRAY_SIZE(info->data->climit_root6); ++i)
@@ -435,11 +439,14 @@ static struct xt_match connlimit_mt_reg __read_mostly = {
static int __init connlimit_mt_init(void)
{
- int ret;
+ int ret, i;
BUILD_BUG_ON(CONNLIMIT_LOCK_SLOTS > CONNLIMIT_SLOTS);
BUILD_BUG_ON((CONNLIMIT_SLOTS % CONNLIMIT_LOCK_SLOTS) != 0);
+ for (i = 0; i < CONNLIMIT_LOCK_SLOTS; ++i)
+ spin_lock_init(&xt_connlimit_locks[i]);
+
connlimit_conn_cachep = kmem_cache_create("xt_connlimit_conn",
sizeof(struct xt_connlimit_conn),
0, 0, NULL);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 3/8] netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 1/8] netfilter: connlimit: fix UP build Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 2/8] netfilter: connlimit: move lock array out of struct connlimit_data Pablo Neira Ayuso
@ 2014-04-05 16:03 ` Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 4/8] netfilter: Add {ipt,ip6t}_osf aliases for xt_osf Pablo Neira Ayuso
` (4 subsequent siblings)
7 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Alexey Perevalov <a.perevalov@samsung.com>
This simple modification allows iptables to work with INPUT chain
in combination with cgroup module. It could be useful for counting
ingress traffic per cgroup with nfacct netfilter module. There
were no problems to count the egress traffic that way formerly.
It's possible to get classified sk_buff after PREROUTING, due to
socket lookup being done in early_demux (tcp_v4_early_demux). Also
it works for udp as well.
Trivial usage example, assuming we're in the same shell every step
and we have enough permissions:
1) Classic net_cls cgroup initialization:
mkdir /sys/fs/cgroup/net_cls
mount -t cgroup -o net_cls net_cls /sys/fs/cgroup/net_cls
2) Set up cgroup for interesting application:
mkdir /sys/fs/cgroup/net_cls/wget
echo 1 > /sys/fs/cgroup/net_cls/wget/net_cls.classid
echo $BASHPID > /sys/fs/cgroup/net_cls/wget/cgroup.procs
3) Create kernel counters:
nfacct add wget-cgroup-in
iptables -A INPUT -m cgroup ! --cgroup 1 -m nfacct --nfacct-name wget-cgroup-in
nfacct add wget-cgroup-out
iptables -A OUTPUT -m cgroup ! --cgroup 1 -m nfacct --nfacct-name wget-cgroup-out
4) Network usage:
wget https://www.kernel.org/pub/linux/kernel/v3.x/testing/linux-3.14-rc6.tar.xz
5) Check results:
nfacct list
Cgroup approach is being used for the DataUsage (counting & blocking
traffic) feature for Samsung's modification of the Tizen OS.
Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_cgroup.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 9a8e77e7..f4e8330 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -54,7 +54,8 @@ static struct xt_match cgroup_mt_reg __read_mostly = {
.matchsize = sizeof(struct xt_cgroup_info),
.me = THIS_MODULE,
.hooks = (1 << NF_INET_LOCAL_OUT) |
- (1 << NF_INET_POST_ROUTING),
+ (1 << NF_INET_POST_ROUTING) |
+ (1 << NF_INET_LOCAL_IN),
};
static int __init cgroup_mt_init(void)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 4/8] netfilter: Add {ipt,ip6t}_osf aliases for xt_osf
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2014-04-05 16:03 ` [PATCH 3/8] netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks Pablo Neira Ayuso
@ 2014-04-05 16:03 ` Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 5/8] netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len Pablo Neira Ayuso
` (3 subsequent siblings)
7 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Kirill Tkhai <ktkhai@parallels.com>
There are no these aliases, so kernel can not request appropriate
match table:
$ iptables -I INPUT -p tcp -m osf --genre Windows --ttl 2 -j DROP
iptables: No chain/target/match by that name.
setsockopt() requests ipt_osf module, which is not present. Add
the aliases.
Signed-off-by: Kirill Tkhai <ktkhai@parallels.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_osf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 7174611..c529161 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -422,4 +422,6 @@ module_exit(xt_osf_fini);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
MODULE_DESCRIPTION("Passive OS fingerprint matching.");
+MODULE_ALIAS("ipt_osf");
+MODULE_ALIAS("ip6t_osf");
MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 5/8] netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2014-04-05 16:03 ` [PATCH 4/8] netfilter: Add {ipt,ip6t}_osf aliases for xt_osf Pablo Neira Ayuso
@ 2014-04-05 16:03 ` Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 6/8] netfilter: nf_tables: set names cannot be larger than 15 bytes Pablo Neira Ayuso
` (2 subsequent siblings)
7 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Andrey Vagin <avagin@openvz.org>
"len" contains sizeof(nf_ct_ext) and size of extensions. In a worst
case it can contain all extensions. Bellow you can find sizes for all
types of extensions. Their sum is definitely bigger than 256.
nf_ct_ext_types[0]->len = 24
nf_ct_ext_types[1]->len = 32
nf_ct_ext_types[2]->len = 24
nf_ct_ext_types[3]->len = 32
nf_ct_ext_types[4]->len = 152
nf_ct_ext_types[5]->len = 2
nf_ct_ext_types[6]->len = 16
nf_ct_ext_types[7]->len = 8
I have seen "len" up to 280 and my host has crashes w/o this patch.
The right way to fix this problem is reducing the size of the ecache
extension (4) and Florian is going to do this, but these changes will
be quite large to be appropriate for a stable tree.
Fixes: 5b423f6a40a0 (netfilter: nf_conntrack: fix racy timer handling with reliable)
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_extend.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index 956b175..55d1504 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -47,8 +47,8 @@ enum nf_ct_ext_id {
/* Extensions: optional stuff which isn't permanently in struct. */
struct nf_ct_ext {
struct rcu_head rcu;
- u8 offset[NF_CT_EXT_NUM];
- u8 len;
+ u16 offset[NF_CT_EXT_NUM];
+ u16 len;
char data[0];
};
--
1.7.10.4
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 6/8] netfilter: nf_tables: set names cannot be larger than 15 bytes
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (4 preceding siblings ...)
2014-04-05 16:03 ` [PATCH 5/8] netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len Pablo Neira Ayuso
@ 2014-04-05 16:03 ` Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 7/8] netfilter: nf_tables: fix wrong format in request_module() Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 8/8] netfilter: Can't fail and free after table replacement Pablo Neira Ayuso
7 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Currently, nf_tables trims off the set name if it exceeeds 15
bytes, so explicitly reject set names that are too large.
Reported-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 33045a5..43ae487 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1946,7 +1946,8 @@ static const struct nft_set_ops *nft_select_set_ops(const struct nlattr * const
static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
[NFTA_SET_TABLE] = { .type = NLA_STRING },
- [NFTA_SET_NAME] = { .type = NLA_STRING },
+ [NFTA_SET_NAME] = { .type = NLA_STRING,
+ .len = IFNAMSIZ - 1 },
[NFTA_SET_FLAGS] = { .type = NLA_U32 },
[NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
[NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
--
1.7.10.4
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 7/8] netfilter: nf_tables: fix wrong format in request_module()
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (5 preceding siblings ...)
2014-04-05 16:03 ` [PATCH 6/8] netfilter: nf_tables: set names cannot be larger than 15 bytes Pablo Neira Ayuso
@ 2014-04-05 16:03 ` Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 8/8] netfilter: Can't fail and free after table replacement Pablo Neira Ayuso
7 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
The intended format in request_module is %.*s instead of %*.s.
Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 43ae487..3fd159d 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -152,8 +152,8 @@ nf_tables_chain_type_lookup(const struct nft_af_info *afi,
#ifdef CONFIG_MODULES
if (autoload) {
nfnl_unlock(NFNL_SUBSYS_NFTABLES);
- request_module("nft-chain-%u-%*.s", afi->family,
- nla_len(nla)-1, (const char *)nla_data(nla));
+ request_module("nft-chain-%u-%.*s", afi->family,
+ nla_len(nla), (const char *)nla_data(nla));
nfnl_lock(NFNL_SUBSYS_NFTABLES);
type = __nf_tables_chain_type_lookup(afi->family, nla);
if (type != NULL)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 8/8] netfilter: Can't fail and free after table replacement
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (6 preceding siblings ...)
2014-04-05 16:03 ` [PATCH 7/8] netfilter: nf_tables: fix wrong format in request_module() Pablo Neira Ayuso
@ 2014-04-05 16:03 ` Pablo Neira Ayuso
7 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Thomas Graf <tgraf@suug.ch>
All xtables variants suffer from the defect that the copy_to_user()
to copy the counters to user memory may fail after the table has
already been exchanged and thus exposed. Return an error at this
point will result in freeing the already exposed table. Any
subsequent packet processing will result in a kernel panic.
We can't copy the counters before exposing the new tables as we
want provide the counter state after the old table has been
unhooked. Therefore convert this into a silent error.
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/ebtables.c | 5 ++---
net/ipv4/netfilter/arp_tables.c | 6 ++++--
net/ipv4/netfilter/ip_tables.c | 6 ++++--
net/ipv6/netfilter/ip6_tables.c | 6 ++++--
4 files changed, 14 insertions(+), 9 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 0e474b1..1059ed3 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
if (repl->num_counters &&
copy_to_user(repl->counters, counterstmp,
repl->num_counters * sizeof(struct ebt_counter))) {
- ret = -EFAULT;
+ /* Silent error, can't fail, new table is already in place */
+ net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
}
- else
- ret = 0;
/* decrease module count and free resources */
EBT_ENTRY_ITERATE(table->entries, table->entries_size,
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 59da7cd..f95b6f9 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1044,8 +1044,10 @@ static int __do_replace(struct net *net, const char *name,
xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters,
- sizeof(struct xt_counters) * num_counters) != 0)
- ret = -EFAULT;
+ sizeof(struct xt_counters) * num_counters) != 0) {
+ /* Silent error, can't fail, new table is already in place */
+ net_warn_ratelimited("arptables: counters copy to user failed while replacing table\n");
+ }
vfree(counters);
xt_table_unlock(t);
return ret;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 718dfbd..99e810f 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1231,8 +1231,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters,
- sizeof(struct xt_counters) * num_counters) != 0)
- ret = -EFAULT;
+ sizeof(struct xt_counters) * num_counters) != 0) {
+ /* Silent error, can't fail, new table is already in place */
+ net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n");
+ }
vfree(counters);
xt_table_unlock(t);
return ret;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 710238f..e080fbb 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1241,8 +1241,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters,
- sizeof(struct xt_counters) * num_counters) != 0)
- ret = -EFAULT;
+ sizeof(struct xt_counters) * num_counters) != 0) {
+ /* Silent error, can't fail, new table is already in place */
+ net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
+ }
vfree(counters);
xt_table_unlock(t);
return ret;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 0/8] netfilter fixes for net
@ 2014-04-05 16:21 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:21 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Resending the cover letter, sent the wrong template, sorry
-o-
Hi,
The following patchset contains Netfilter fixes for your net tree, they
are:
* Use 16-bits offset and length fields instead of 8-bits in the conntrack
extension to avoid an overflow when many conntrack extension are used,
from Andrey Vagin.
* Allow to use cgroup match from LOCAL_IN, there is no apparent reason
for not allowing this, from Alexey Perevalov.
* Fix build of the connlimit match after recent changes to let it scale
up that result in a divide by zero compilation error in UP, from
Florian Westphal.
* Move the lock out of the structure connlimit_data to avoid a false
sharing spotted by Eric Dumazet and Jesper D. Brouer, this needed as
part of the recent connlimit scalability improvements, also from
Florian Westphal.
* Add missing module aliases in xt_osf to fix loading of rules using
this match, from Kirill Tkhai.
* Restrict set names in nf_tables to 15 characters instead of silently
trimming them off, from me.
* Fix wrong format in nf_tables request module call for chain types,
spotted by Florian Westphal, patch from me.
* Fix crash in xtables when it fails to copy the counters back to userspace
after having replaced the table already.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
Thanks.
----------------------------------------------------------------
The following changes since commit e33d0ba8047b049c9262fdb1fcafb93cb52ceceb:
net-gro: reset skb->truesize in napi_reuse_skb() (2014-04-03 16:17:52 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to c58dd2dd443c26d856a168db108a0cd11c285bf3:
netfilter: Can't fail and free after table replacement (2014-04-05 17:46:22 +0200)
----------------------------------------------------------------
Alexey Perevalov (1):
netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks
Andrey Vagin (1):
netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len
Florian Westphal (2):
netfilter: connlimit: fix UP build
netfilter: connlimit: move lock array out of struct connlimit_data
Kirill Tkhai (1):
netfilter: Add {ipt,ip6t}_osf aliases for xt_osf
Pablo Neira Ayuso (2):
netfilter: nf_tables: set names cannot be larger than 15 bytes
netfilter: nf_tables: fix wrong format in request_module()
Thomas Graf (1):
netfilter: Can't fail and free after table replacement
include/net/netfilter/nf_conntrack_extend.h | 4 ++--
net/bridge/netfilter/ebtables.c | 5 ++---
net/ipv4/netfilter/arp_tables.c | 6 ++++--
net/ipv4/netfilter/ip_tables.c | 6 ++++--
net/ipv6/netfilter/ip6_tables.c | 6 ++++--
net/netfilter/nf_tables_api.c | 7 ++++---
net/netfilter/xt_cgroup.c | 3 ++-
net/netfilter/xt_connlimit.c | 25 ++++++++++++++++---------
net/netfilter/xt_osf.c | 2 ++
9 files changed, 40 insertions(+), 24 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2014-10-27 21:37 Pablo Neira Ayuso
2014-10-27 22:49 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-10-27 21:37 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Allow to recycle a TCP port in conntrack when the change role from
server to client, from Marcelo Leitner.
2) Fix possible off by one access in ip_set_nfnl_get_byindex(), patch
from Dan Carpenter.
3) alloc_percpu returns NULL on error, no need for IS_ERR() in nf_tables
chain statistic updates. From Sabrina Dubroca.
4) Don't compile ip options in bridge netfilter, this mangles the packet
and bridge should not alter layer >= 3 headers when forwarding packets.
Patch from Herbert Xu and tested by Florian Westphal.
5) Account the final NLMSG_DONE message when calculating the size of the
nflog netlink batches. Patch from Florian Westphal.
6) Fix a possible netlink attribute length overflow with large packets.
Again from Florian Westphal.
7) Release the skbuff if nfnetlink_log fails to put the final
NLMSG_DONE message. This fixes a leak on error. This shouldn't ever
happen though, otherwise this means we miscalculate the netlink batch
size, so spot a warning if this ever happens so we can track down the
problem. This patch from Houcheng Lin.
8) Look at the right list when recycling targets in the nft_compat,
patch from Arturo Borrero.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 7c1c97d54f9bfc810908d3903cb8bcacf734df18:
net: sched: initialize bstats syncp (2014-10-21 21:45:21 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to 7965ee93719921ea5978f331da653dfa2d7b99f5:
netfilter: nft_compat: fix wrong target lookup in nft_target_select_ops() (2014-10-27 22:17:46 +0100)
----------------------------------------------------------------
Arturo Borrero (1):
netfilter: nft_compat: fix wrong target lookup in nft_target_select_ops()
Dan Carpenter (1):
netfilter: ipset: off by one in ip_set_nfnl_get_byindex()
Florian Westphal (2):
netfilter: nf_log: account for size of NLMSG_DONE attribute
netfilter: nfnetlink_log: fix maximum packet length logged to userspace
Herbert Xu (1):
bridge: Do not compile options in br_parse_ip_options
Houcheng Lin (1):
netfilter: nf_log: release skbuff on nlmsg put failure
Marcelo Leitner (1):
netfilter: nf_conntrack: allow server to become a client in TW handling
Sabrina Dubroca (1):
netfilter: nf_tables: check for NULL in nf_tables_newchain pcpu stats allocation
net/bridge/br_netfilter.c | 24 +++++-------------------
net/netfilter/ipset/ip_set_core.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 4 ++--
net/netfilter/nf_tables_api.c | 4 ++--
net/netfilter/nfnetlink_log.c | 31 ++++++++++++++++---------------
net/netfilter/nft_compat.c | 2 +-
6 files changed, 27 insertions(+), 40 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2017-02-23 11:14 Pablo Neira Ayuso
2017-02-23 16:00 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2017-02-23 11:14 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Revisit warning logic when not applying default helper assignment.
Jiri Kosina considers we are breaking existing setups and not warning
our users accordinly now that automatic helper assignment has been
turned off by default. So let's make him happy by spotting the warning
by when we find a helper but we cannot attach, instead of warning on the
former deprecated behaviour. Patch from Jiri Kosina.
2) Two patches to fix regression in ctnetlink interfaces with
nfnetlink_queue. Specifically, perform more relaxed in CTA_STATUS
and do not bail out if CTA_HELP indicates the same helper that we
already have. Patches from Kevin Cernekee.
3) A couple of bugfixes for ipset via Jozsef Kadlecsik. Due to wrong
index logic in hash set types and null pointer exception in the
list:set type.
4) hashlimit bails out with correct userspace parameters due to wrong
arithmetics in the code that avoids "divide by zero" when
transforming the userspace timing in milliseconds to token credits.
Patch from Alban Browaeys.
5) Fix incorrect NFQA_VLAN_MAX definition, patch from
Ken-ichirou MATSUZAWA.
6) Don't not declare nfnetlink batch error list as static, since this
may be used by several subsystems at the same time. Patch from
Liping Zhang.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit cafe8df8b9bc9aa3dffa827c1a6757c6cd36f657:
net: phy: Fix lack of reference count on PHY driver (2017-02-02 22:59:43 -0500)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 3ef767e5cbd405abfd01339c7e5daaf98e037be2:
Merge branch 'master' of git://blackhole.kfki.hu/nf (2017-02-21 14:01:05 +0100)
----------------------------------------------------------------
Alban Browaeys (1):
netfilter: xt_hashlimit: Fix integer divide round to zero.
Jiri Kosina (1):
netfilter: nf_ct_helper: warn when not applying default helper assignment
Jozsef Kadlecsik (1):
Fix bug: sometimes valid entries in hash:* types of sets were evicted
Ken-ichirou MATSUZAWA (1):
netfilter: nfnetlink_queue: fix NFQA_VLAN_MAX definition
Kevin Cernekee (2):
netfilter: ctnetlink: Fix regression in CTA_STATUS processing
netfilter: ctnetlink: Fix regression in CTA_HELP processing
Liping Zhang (1):
netfilter: nfnetlink: remove static declaration from err_list
Pablo Neira Ayuso (1):
Merge branch 'master' of git://blackhole.kfki.hu/nf
Vishwanath Pai (1):
netfilter: ipset: Null pointer exception in ipset list:set
include/uapi/linux/netfilter/nf_conntrack_common.h | 4 ++
include/uapi/linux/netfilter/nfnetlink_queue.h | 2 +-
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
net/netfilter/ipset/ip_set_list_set.c | 9 +++--
net/netfilter/nf_conntrack_helper.c | 39 +++++++++++++-------
net/netfilter/nf_conntrack_netlink.c | 43 +++++++++++++++++++---
net/netfilter/nfnetlink.c | 2 +-
net/netfilter/xt_hashlimit.c | 25 +++++--------
8 files changed, 86 insertions(+), 40 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2017-03-29 12:14 Pablo Neira Ayuso
2017-03-29 21:39 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2017-03-29 12:14 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains a rather large update with Netfilter
fixes, specifically targeted to incorrect RCU usage in several spots and
the userspace conntrack helper infrastructure (nfnetlink_cthelper),
more specifically they are:
1) expect_class_max is incorrect set via cthelper, as in kernel semantics
mandate that this represents the array of expectation classes minus 1.
Patch from Liping Zhang.
2) Expectation policy updates via cthelper are currently broken for several
reasons: This code allows illegal changes in the policy such as changing
the number of expeciation classes, it is leaking the updated policy and
such update occurs with no RCU protection at all. Fix this by adding a
new nfnl_cthelper_update_policy() that describes what is really legal on
the update path.
3) Fix several memory leaks in cthelper, from Jeffy Chen.
4) synchronize_rcu() is missing in the removal path of several modules,
this may lead to races since CPU may still be running on code that has
just gone. Also from Liping Zhang.
5) Don't use the helper hashtable from cthelper, it is not safe to walk
over those bits without the helper mutex. Fix this by introducing a
new independent list for userspace helpers. From Liping Zhang.
6) nf_ct_extend_unregister() needs synchronize_rcu() to make sure no
packets are walking on any conntrack extension that is gone after
module removal, again from Liping.
7) nf_nat_snmp may crash if we fail to unregister the helper due to
accidental leftover code, from Gao Feng.
8) Fix leak in nfnetlink_queue with secctx support, from Liping Zhang.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit db7f00b8dba6d687b6ab1f2e9309acfd214fcb4b:
tcp: tcp_get_info() should read tcp_time_stamp later (2017-03-16 21:37:13 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 77c1c03c5b8ef28e55bb0aff29b1e006037ca645:
netfilter: nfnetlink_queue: fix secctx memory leak (2017-03-29 12:20:50 +0200)
----------------------------------------------------------------
Gao Feng (1):
netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register
Jeffy Chen (1):
netfilter: nfnl_cthelper: Fix memory leak
Liping Zhang (5):
netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table
netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
netfilter: nfnetlink_queue: fix secctx memory leak
Pablo Neira Ayuso (1):
netfilter: nfnl_cthelper: fix runtime expectation policy updates
net/ipv4/netfilter/nf_nat_snmp_basic.c | 20 +--
net/netfilter/nf_conntrack_ecache.c | 2 +
net/netfilter/nf_conntrack_extend.c | 13 +-
net/netfilter/nf_conntrack_netlink.c | 1 +
net/netfilter/nf_nat_core.c | 2 +
net/netfilter/nfnetlink_cthelper.c | 287 +++++++++++++++++++++------------
net/netfilter/nfnetlink_cttimeout.c | 2 +-
net/netfilter/nfnetlink_queue.c | 9 +-
8 files changed, 206 insertions(+), 130 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2017-03-29 12:14 Pablo Neira Ayuso
@ 2017-03-29 21:39 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2017-03-29 21:39 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 29 Mar 2017 14:14:02 +0200
> Hi David,
>
> The following patchset contains a rather large update with Netfilter
> fixes, specifically targeted to incorrect RCU usage in several spots and
> the userspace conntrack helper infrastructure (nfnetlink_cthelper),
> more specifically they are:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2018-10-22 20:07 Pablo Neira Ayuso
2018-10-23 3:21 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2018-10-22 20:07 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree:
1) rbtree lookup from control plane returns the left-hand side element
of the range when the interval end flag is set on.
2) osf extension is not supported from the input path, reject this from
the control plane, from Fernando Fernandez Mancera.
3) xt_TEE is leaving output interface unset due to a recent incorrect
netns rework, from Taehee Yoo.
4) xt_TEE allows to select an interface which does not belong to this
netnamespace, from Taehee Yoo.
5) Zero private extension area in nft_compat, just like we do in x_tables,
otherwise we leak kernel memory to userspace.
6) Missing .checkentry and .destroy entries in new DNAT extensions breaks
it since we never load nf_conntrack dependencies, from Paolo Abeni.
7) Do not remove flowtable hook from netns exit path, the netdevice handler
already deals with this, also from Taehee Yoo.
8) Only cleanup flowtable entries that reside in this netnamespace, also
from Taehee Yoo.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 9a4890bd6d6325a1c88564a20ab310b2d56f6094:
rds: RDS (tcp) hangs on sendto() to unresponding address (2018-10-10 22:19:52 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to a3fb3698cadf27dc142b24394c401625e14d80d0:
netfilter: nf_flow_table: do not remove offload when other netns's interface is down (2018-10-19 13:30:48 +0200)
----------------------------------------------------------------
Fernando Fernandez Mancera (1):
netfilter: nft_osf: usage from output path is not valid
Pablo Neira Ayuso (2):
netfilter: nft_set_rbtree: allow loose matching of closing element in interval
netfilter: nft_compat: do not dump private area
Paolo Abeni (1):
netfilter: xt_nat: fix DNAT target for shifted portmap ranges
Taehee Yoo (4):
netfilter: xt_TEE: fix wrong interface selection
netfilter: xt_TEE: add missing code to get interface index in checkentry.
netfilter: nf_flow_table: remove flowtable hook flush routine in netns exit routine
netfilter: nf_flow_table: do not remove offload when other netns's interface is down
net/netfilter/nf_flow_table_core.c | 9 +++--
net/netfilter/nf_tables_api.c | 3 --
net/netfilter/nft_compat.c | 24 +++++++++++-
net/netfilter/nft_osf.c | 10 +++++
net/netfilter/nft_set_rbtree.c | 10 ++++-
net/netfilter/xt_TEE.c | 76 +++++++++++++++++++++++++++++---------
net/netfilter/xt_nat.c | 2 +
7 files changed, 107 insertions(+), 27 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2018-10-22 20:07 Pablo Neira Ayuso
@ 2018-10-23 3:21 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2018-10-23 3:21 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 22 Oct 2018 22:07:16 +0200
> The following patchset contains Netfilter fixes for your net tree:
>
> 1) rbtree lookup from control plane returns the left-hand side element
> of the range when the interval end flag is set on.
>
> 2) osf extension is not supported from the input path, reject this from
> the control plane, from Fernando Fernandez Mancera.
>
> 3) xt_TEE is leaving output interface unset due to a recent incorrect
> netns rework, from Taehee Yoo.
>
> 4) xt_TEE allows to select an interface which does not belong to this
> netnamespace, from Taehee Yoo.
>
> 5) Zero private extension area in nft_compat, just like we do in x_tables,
> otherwise we leak kernel memory to userspace.
>
> 6) Missing .checkentry and .destroy entries in new DNAT extensions breaks
> it since we never load nf_conntrack dependencies, from Paolo Abeni.
>
> 7) Do not remove flowtable hook from netns exit path, the netdevice handler
> already deals with this, also from Taehee Yoo.
>
> 8) Only cleanup flowtable entries that reside in this netnamespace, also
> from Taehee Yoo.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] netfilter fixes for net
@ 2019-07-31 11:51 Pablo Neira Ayuso
2019-07-31 15:50 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for your net tree:
1) memleak in ebtables from the error path for the 32/64 compat layer,
from Florian Westphal.
2) Fix inverted meta ifname/ifidx matching when no interface is set
on either from the input/output path, from Phil Sutter.
3) Remove goto label in nft_meta_bridge, also from Phil.
4) Missing include guard in xt_connlabel, from Masahiro Yamada.
5) Two patch to fix ipset destination MAC matching coming from
Stephano Brivio, via Jozsef Kadlecsik.
6) Fix set rename and listing concurrency problem, from Shijie Luo.
Patch also coming via Jozsef Kadlecsik.
7) ebtables 32/64 compat missing base chain policy in rule count,
from Florian Westphal.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 0cea0e1148fe134a4a3aaf0b1496f09241fb943a:
net: phy: sfp: hwmon: Fix scaling of RX power (2019-07-21 11:51:50 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 7cdc4412284777c76c919e2ab33b3b8dbed18559:
Merge branch 'master' of git://blackhole.kfki.hu/nf (2019-07-30 13:39:20 +0200)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: ebtables: also count base chain policies
Jozsef Kadlecsik (1):
netfilter: ipset: Fix rename concurrency with listing
Masahiro Yamada (1):
netfilter: add include guard to xt_connlabel.h
Pablo Neira Ayuso (1):
Merge branch 'master' of git://blackhole.kfki.hu/nf
Phil Sutter (2):
netfilter: nf_tables: Make nft_meta expression more robust
netfilter: nft_meta_bridge: Eliminate 'out' label
Stefano Brivio (2):
netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too
netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets
Wenwen Wang (1):
netfilter: ebtables: fix a memory leak bug in compat
include/uapi/linux/netfilter/xt_connlabel.h | 6 ++++++
net/bridge/netfilter/ebtables.c | 32 ++++++++++++++++++-----------
net/bridge/netfilter/nft_meta_bridge.c | 10 ++-------
net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 2 +-
net/netfilter/ipset/ip_set_hash_ipmac.c | 6 +-----
net/netfilter/nft_meta.c | 16 ++++-----------
7 files changed, 35 insertions(+), 39 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2020-08-15 10:31 Pablo Neira Ayuso
2020-08-16 23:05 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-08-15 10:31 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Endianness issue in IPv4 option support in nft_exthdr,
from Stephen Suryaputra.
2) Removes the waitcount optimization in nft_compat,
from Florian Westphal.
3) Remove ipv6 -> nf_defrag_ipv6 module dependency, from
Florian Westphal.
4) Memleak in chain binding support, also from Florian.
5) Simplify nft_flowtable.sh selftest, from Fabian Frederick.
6) Optional MTU arguments for selftest nft_flowtable.sh,
also from Fabian.
7) Remove noise error report when killing process in
selftest nft_flowtable.sh, from Fabian Frederick.
8) Reject bogus getsockopt option length in ebtables,
from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 7c7ab580db49cc7befe5f4b91bb1920cd6b07575:
net: Convert to use the fallthrough macro (2020-08-08 14:29:09 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 5c04da55c754c44937b3d19c6522f9023fd5c5d5:
netfilter: ebtables: reject bogus getopt len value (2020-08-14 11:59:08 +0200)
----------------------------------------------------------------
Fabian Frederick (3):
selftests: netfilter: add checktool function
selftests: netfilter: add MTU arguments to flowtables
selftests: netfilter: kill running process only
Florian Westphal (4):
netfilter: nft_compat: remove flush counter optimization
netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
netfilter: nf_tables: free chain context when BINDING flag is missing
netfilter: ebtables: reject bogus getopt len value
Stephen Suryaputra (1):
netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian
include/linux/netfilter_ipv6.h | 18 ------
net/bridge/netfilter/ebtables.c | 4 ++
net/bridge/netfilter/nf_conntrack_bridge.c | 8 ++-
net/ipv6/netfilter.c | 3 -
net/netfilter/nf_tables_api.c | 6 +-
net/netfilter/nft_compat.c | 37 +++++------
net/netfilter/nft_exthdr.c | 4 +-
tools/testing/selftests/netfilter/nft_flowtable.sh | 73 +++++++++++++---------
8 files changed, 73 insertions(+), 80 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2020-08-15 10:31 [PATCH 0/8] Netfilter " Pablo Neira Ayuso
@ 2020-08-16 23:05 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2020-08-16 23:05 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev, kuba
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sat, 15 Aug 2020 12:31:53 +0200
> The following patchset contains Netfilter fixes for net:
>
> 1) Endianness issue in IPv4 option support in nft_exthdr,
> from Stephen Suryaputra.
>
> 2) Removes the waitcount optimization in nft_compat,
> from Florian Westphal.
>
> 3) Remove ipv6 -> nf_defrag_ipv6 module dependency, from
> Florian Westphal.
>
> 4) Memleak in chain binding support, also from Florian.
>
> 5) Simplify nft_flowtable.sh selftest, from Fabian Frederick.
>
> 6) Optional MTU arguments for selftest nft_flowtable.sh,
> also from Fabian.
>
> 7) Remove noise error report when killing process in
> selftest nft_flowtable.sh, from Fabian Frederick.
>
> 8) Reject bogus getsockopt option length in ebtables,
> from Florian Westphal.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2020-08-31 9:36 Pablo Neira Ayuso
2020-08-31 18:22 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-08-31 9:36 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Do not delete clash entries on reply, let them expire instead,
from Florian Westphal.
2) Do not report EAGAIN to nfnetlink, otherwise this enters a busy loop.
Update nfnetlink_unicast() to translate EAGAIN to ENOBUFS.
3) Remove repeated words in code comments, from Randy Dunlap.
4) Several patches for the flowtable selftests, from Fabian Frederick.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 5438dd45831ee33869779bd1919b05816ae4dbc9:
net_sched: fix error path in red_init() (2020-08-28 07:16:46 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to c46172147ebbeb70094db48d76ab7945d96c638b:
netfilter: conntrack: do not auto-delete clash entries on reply (2020-08-29 13:03:06 +0200)
----------------------------------------------------------------
Fabian Frederick (5):
selftests: netfilter: fix header example
selftests: netfilter: exit on invalid parameters
selftests: netfilter: remove unused variable in make_file()
selftests: netfilter: simplify command testing
selftests: netfilter: add command usage
Florian Westphal (1):
netfilter: conntrack: do not auto-delete clash entries on reply
Pablo Neira Ayuso (1):
netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
Randy Dunlap (1):
netfilter: delete repeated words
include/linux/netfilter/nfnetlink.h | 3 +-
net/ipv4/netfilter/nf_nat_pptp.c | 2 +-
net/netfilter/nf_conntrack_pptp.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 2 +-
net/netfilter/nf_conntrack_proto_udp.c | 26 ++++-----
net/netfilter/nf_tables_api.c | 61 ++++++++++----------
net/netfilter/nfnetlink.c | 11 +++-
net/netfilter/nfnetlink_log.c | 3 +-
net/netfilter/nfnetlink_queue.c | 2 +-
net/netfilter/nft_flow_offload.c | 2 +-
net/netfilter/xt_recent.c | 2 +-
tools/testing/selftests/netfilter/nft_flowtable.sh | 67 ++++++++++++----------
12 files changed, 92 insertions(+), 91 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2020-08-31 9:36 Pablo Neira Ayuso
@ 2020-08-31 18:22 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2020-08-31 18:22 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev, kuba
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 31 Aug 2020 11:36:40 +0200
> The following patchset contains Netfilter fixes for net:
>
> 1) Do not delete clash entries on reply, let them expire instead,
> from Florian Westphal.
>
> 2) Do not report EAGAIN to nfnetlink, otherwise this enters a busy loop.
> Update nfnetlink_unicast() to translate EAGAIN to ENOBUFS.
>
> 3) Remove repeated words in code comments, from Randy Dunlap.
>
> 4) Several patches for the flowtable selftests, from Fabian Frederick.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 24+ messages in thread
end of thread, other threads:[~2020-08-31 18:23 UTC | newest]
Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-04-05 16:03 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 1/8] netfilter: connlimit: fix UP build Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 2/8] netfilter: connlimit: move lock array out of struct connlimit_data Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 3/8] netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 4/8] netfilter: Add {ipt,ip6t}_osf aliases for xt_osf Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 5/8] netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 6/8] netfilter: nf_tables: set names cannot be larger than 15 bytes Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 7/8] netfilter: nf_tables: fix wrong format in request_module() Pablo Neira Ayuso
2014-04-05 16:03 ` [PATCH 8/8] netfilter: Can't fail and free after table replacement Pablo Neira Ayuso
2014-04-05 16:21 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
2014-10-27 21:37 [PATCH 0/8] Netfilter " Pablo Neira Ayuso
2014-10-27 22:49 ` David Miller
2017-02-23 11:14 Pablo Neira Ayuso
2017-02-23 16:00 ` David Miller
2017-03-29 12:14 Pablo Neira Ayuso
2017-03-29 21:39 ` David Miller
2018-10-22 20:07 Pablo Neira Ayuso
2018-10-23 3:21 ` David Miller
2019-07-31 11:51 [PATCH 0/8] netfilter " Pablo Neira Ayuso
2019-07-31 15:50 ` David Miller
2020-08-15 10:31 [PATCH 0/8] Netfilter " Pablo Neira Ayuso
2020-08-16 23:05 ` David Miller
2020-08-31 9:36 Pablo Neira Ayuso
2020-08-31 18:22 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).