* [PATCH net 0/4] Netfilter fixes for net
@ 2022-01-06 21:51 Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 1/4] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Pablo Neira Ayuso
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-06 21:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Refcount leak in ipt_CLUSTERIP rule loading path, from Xin Xiong.
2) Use socat in netfilter selftests, from Hangbin Liu.
3) Skip layer checksum 4 update for IP fragments.
4) Missing allocation of pcpu scratch maps on clone in
nft_set_pipapo, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 1d5a474240407c38ca8c7484a656ee39f585399c:
sfc: The RX page_ring is optional (2022-01-04 18:14:21 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 23c54263efd7cb605e2f7af72717a2a951999217:
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone (2022-01-06 10:43:24 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
Hangbin Liu (1):
selftests: netfilter: switch to socat for tests using -q option
Pablo Neira Ayuso (1):
netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
Xin Xiong (1):
netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++-
net/netfilter/nft_payload.c | 3 +++
net/netfilter/nft_set_pipapo.c | 8 ++++++++
tools/testing/selftests/netfilter/ipip-conntrack-mtu.sh | 9 +++++----
tools/testing/selftests/netfilter/nf_nat_edemux.sh | 10 +++++-----
5 files changed, 25 insertions(+), 10 deletions(-)
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net 1/4] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
2022-01-06 21:51 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
@ 2022-01-06 21:51 ` Pablo Neira Ayuso
2022-01-07 2:50 ` patchwork-bot+netdevbpf
2022-01-06 21:51 ` [PATCH net 2/4] selftests: netfilter: switch to socat for tests using -q option Pablo Neira Ayuso
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-06 21:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Xin Xiong <xiongx18@fudan.edu.cn>
The issue takes place in one error path of clusterip_tg_check(). When
memcmp() returns nonzero, the function simply returns the error code,
forgetting to decrease the reference count of a clusterip_config
object, which is bumped earlier by clusterip_config_find_get(). This
may incur reference count leak.
Fix this issue by decrementing the refcount of the object in specific
error path.
Fixes: 06aa151ad1fc74 ("netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set")
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 8fd1aba8af31..b518f20c9a24 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -520,8 +520,11 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
if (IS_ERR(config))
return PTR_ERR(config);
}
- } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN))
+ } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) {
+ clusterip_config_entry_put(config);
+ clusterip_config_put(config);
return -EINVAL;
+ }
ret = nf_ct_netns_get(par->net, par->family);
if (ret < 0) {
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH net 2/4] selftests: netfilter: switch to socat for tests using -q option
2022-01-06 21:51 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 1/4] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Pablo Neira Ayuso
@ 2022-01-06 21:51 ` Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 3/4] netfilter: nft_payload: do not update layer 4 checksum when mangling fragments Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 4/4] netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone Pablo Neira Ayuso
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-06 21:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Hangbin Liu <liuhangbin@gmail.com>
The nc cmd(nmap-ncat) that distributed with Fedora/Red Hat does not have
option -q. This make some tests failed with:
nc: invalid option -- 'q'
Let's switch to socat which is far more dependable.
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
.../testing/selftests/netfilter/ipip-conntrack-mtu.sh | 9 +++++----
tools/testing/selftests/netfilter/nf_nat_edemux.sh | 10 +++++-----
2 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/tools/testing/selftests/netfilter/ipip-conntrack-mtu.sh b/tools/testing/selftests/netfilter/ipip-conntrack-mtu.sh
index 4a6f5c3b3215..eb9553e4986b 100755
--- a/tools/testing/selftests/netfilter/ipip-conntrack-mtu.sh
+++ b/tools/testing/selftests/netfilter/ipip-conntrack-mtu.sh
@@ -41,7 +41,7 @@ checktool (){
checktool "iptables --version" "run test without iptables"
checktool "ip -Version" "run test without ip tool"
-checktool "which nc" "run test without nc (netcat)"
+checktool "which socat" "run test without socat"
checktool "ip netns add ${r_a}" "create net namespace"
for n in ${r_b} ${r_w} ${c_a} ${c_b};do
@@ -60,11 +60,12 @@ trap cleanup EXIT
test_path() {
msg="$1"
- ip netns exec ${c_b} nc -n -w 3 -q 3 -u -l -p 5000 > ${rx} < /dev/null &
+ ip netns exec ${c_b} socat -t 3 - udp4-listen:5000,reuseaddr > ${rx} < /dev/null &
sleep 1
for i in 1 2 3; do
- head -c1400 /dev/zero | tr "\000" "a" | ip netns exec ${c_a} nc -n -w 1 -u 192.168.20.2 5000
+ head -c1400 /dev/zero | tr "\000" "a" | \
+ ip netns exec ${c_a} socat -t 1 -u STDIN UDP:192.168.20.2:5000
done
wait
@@ -189,7 +190,7 @@ ip netns exec ${r_w} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
#---------------------
#Now we send a 1400 bytes UDP packet from Client A to Client B:
-# clienta:~# head -c1400 /dev/zero | tr "\000" "a" | nc -u 192.168.20.2 5000
+# clienta:~# head -c1400 /dev/zero | tr "\000" "a" | socat -u STDIN UDP:192.168.20.2:5000
test_path "without"
# The IPv4 stack on Client A already knows the PMTU to Client B, so the
diff --git a/tools/testing/selftests/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/netfilter/nf_nat_edemux.sh
index cfee3b65be0f..1092bbcb1fba 100755
--- a/tools/testing/selftests/netfilter/nf_nat_edemux.sh
+++ b/tools/testing/selftests/netfilter/nf_nat_edemux.sh
@@ -76,23 +76,23 @@ ip netns exec $ns2 ip route add 10.96.0.1 via 192.168.1.1
sleep 1
# add a persistent connection from the other namespace
-ip netns exec $ns2 nc -q 10 -w 10 192.168.1.1 5201 > /dev/null &
+ip netns exec $ns2 socat -t 10 - TCP:192.168.1.1:5201 > /dev/null &
sleep 1
# ip daddr:dport will be rewritten to 192.168.1.1 5201
# NAT must reallocate source port 10000 because
# 192.168.1.2:10000 -> 192.168.1.1:5201 is already in use
-echo test | ip netns exec $ns2 nc -w 3 -q 3 10.96.0.1 443 >/dev/null
+echo test | ip netns exec $ns2 socat -t 3 -u STDIN TCP:10.96.0.1:443 >/dev/null
ret=$?
kill $iperfs
-# Check nc can connect to 10.96.0.1:443 (aka 192.168.1.1:5201).
+# Check socat can connect to 10.96.0.1:443 (aka 192.168.1.1:5201).
if [ $ret -eq 0 ]; then
- echo "PASS: nc can connect via NAT'd address"
+ echo "PASS: socat can connect via NAT'd address"
else
- echo "FAIL: nc cannot connect via NAT'd address"
+ echo "FAIL: socat cannot connect via NAT'd address"
exit 1
fi
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH net 3/4] netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
2022-01-06 21:51 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 1/4] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 2/4] selftests: netfilter: switch to socat for tests using -q option Pablo Neira Ayuso
@ 2022-01-06 21:51 ` Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 4/4] netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone Pablo Neira Ayuso
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-06 21:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
IP fragments do not come with the transport header, hence skip bogus
layer 4 checksum updates.
Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields")
Reported-and-tested-by: Steffen Weinreich <steve@weinreich.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_payload.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index bd689938a2e0..58e96a0fe0b4 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -546,6 +546,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt,
struct sk_buff *skb,
unsigned int *l4csum_offset)
{
+ if (pkt->fragoff)
+ return -1;
+
switch (pkt->tprot) {
case IPPROTO_TCP:
*l4csum_offset = offsetof(struct tcphdr, check);
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH net 4/4] netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
2022-01-06 21:51 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2022-01-06 21:51 ` [PATCH net 3/4] netfilter: nft_payload: do not update layer 4 checksum when mangling fragments Pablo Neira Ayuso
@ 2022-01-06 21:51 ` Pablo Neira Ayuso
3 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-06 21:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Florian Westphal <fw@strlen.de>
This is needed in case a new transaction is made that doesn't insert any
new elements into an already existing set.
Else, after second 'nft -f ruleset.txt', lookups in such a set will fail
because ->lookup() encounters raw_cpu_ptr(m->scratch) == NULL.
For the initial rule load, insertion of elements takes care of the
allocation, but for rule reloads this isn't guaranteed: we might not
have additions to the set.
Fixes: 3c4287f62044a90e ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: etkaar <lists.netfilter.org@prvy.eu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_set_pipapo.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index dce866d93fee..2c8051d8cca6 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1290,6 +1290,11 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
if (!new->scratch_aligned)
goto out_scratch;
#endif
+ for_each_possible_cpu(i)
+ *per_cpu_ptr(new->scratch, i) = NULL;
+
+ if (pipapo_realloc_scratch(new, old->bsize_max))
+ goto out_scratch_realloc;
rcu_head_init(&new->rcu);
@@ -1334,6 +1339,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
kvfree(dst->lt);
dst--;
}
+out_scratch_realloc:
+ for_each_possible_cpu(i)
+ kfree(*per_cpu_ptr(new->scratch, i));
#ifdef NFT_PIPAPO_ALIGN
free_percpu(new->scratch_aligned);
#endif
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/4] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
2022-01-06 21:51 ` [PATCH net 1/4] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Pablo Neira Ayuso
@ 2022-01-07 2:50 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-01-07 2:50 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba
Hello:
This series was applied to netdev/net.git (master)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Thu, 6 Jan 2022 22:51:36 +0100 you wrote:
> From: Xin Xiong <xiongx18@fudan.edu.cn>
>
> The issue takes place in one error path of clusterip_tg_check(). When
> memcmp() returns nonzero, the function simply returns the error code,
> forgetting to decrease the reference count of a clusterip_config
> object, which is bumped earlier by clusterip_config_find_get(). This
> may incur reference count leak.
>
> [...]
Here is the summary with links:
- [net,1/4] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
https://git.kernel.org/netdev/net/c/d94a69cb2cfa
- [net,2/4] selftests: netfilter: switch to socat for tests using -q option
https://git.kernel.org/netdev/net/c/1585f590a2e5
- [net,3/4] netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
https://git.kernel.org/netdev/net/c/4e1860a38637
- [net,4/4] netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
https://git.kernel.org/netdev/net/c/23c54263efd7
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-01-07 2:50 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-06 21:51 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 1/4] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Pablo Neira Ayuso
2022-01-07 2:50 ` patchwork-bot+netdevbpf
2022-01-06 21:51 ` [PATCH net 2/4] selftests: netfilter: switch to socat for tests using -q option Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 3/4] netfilter: nft_payload: do not update layer 4 checksum when mangling fragments Pablo Neira Ayuso
2022-01-06 21:51 ` [PATCH net 4/4] netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).