* [PATCH net 0/4] Netfilter fixes for net
@ 2022-11-30 12:19 Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 1/4] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one Pablo Neira Ayuso
` (3 more replies)
0 siblings, 4 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-30 12:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Check for interval validity in all concatenation fields in
nft_set_pipapo, from Stefano Brivio.
2) Missing preemption disabled in conntrack and flowtable stat
updates, from Xin Long.
3) Fix compilation warning when CONFIG_NF_CONNTRACK_MARK=n.
Except for 3) which was a bug introduced in a recent fix in 6.1-rc.
Anything else, broken for several releases.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit f2fc2280faabafc8df83ee007699d21f7a6301fe:
Merge branch 'wwan-iosm-fixes' (2022-11-28 11:31:59 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 1feeae071507ad65cf9f462a1bdd543a4bf89e71:
netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark (2022-11-30 13:08:49 +0100)
----------------------------------------------------------------
Pablo Neira Ayuso (1):
netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
Stefano Brivio (1):
netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
Xin Long (2):
netfilter: flowtable_offload: fix using __this_cpu_add in preemptible
netfilter: conntrack: fix using __this_cpu_add in preemptible
net/netfilter/nf_conntrack_core.c | 6 +++---
net/netfilter/nf_conntrack_netlink.c | 19 ++++++++++---------
net/netfilter/nf_flow_table_offload.c | 6 +++---
net/netfilter/nft_set_pipapo.c | 5 +++--
4 files changed, 19 insertions(+), 17 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 1/4] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
2022-11-30 12:19 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
@ 2022-11-30 12:19 ` Pablo Neira Ayuso
2022-12-01 6:10 ` patchwork-bot+netdevbpf
2022-11-30 12:19 ` [PATCH net 2/4] netfilter: flowtable_offload: fix using __this_cpu_add in preemptible Pablo Neira Ayuso
` (2 subsequent siblings)
3 siblings, 1 reply; 17+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-30 12:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
From: Stefano Brivio <sbrivio@redhat.com>
Embarrassingly, nft_pipapo_insert() checked for interval validity in
the first field only.
The start_p and end_p pointers were reset to key data from the first
field at every iteration of the loop which was supposed to go over
the set fields.
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_set_pipapo.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 4f9299b9dcdd..06d46d182634 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1162,6 +1162,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,
struct nft_pipapo_match *m = priv->clone;
u8 genmask = nft_genmask_next(net);
struct nft_pipapo_field *f;
+ const u8 *start_p, *end_p;
int i, bsize_max, err = 0;
if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
@@ -1202,9 +1203,9 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,
}
/* Validate */
+ start_p = start;
+ end_p = end;
nft_pipapo_for_each_field(f, i, m) {
- const u8 *start_p = start, *end_p = end;
-
if (f->rules >= (unsigned long)NFT_PIPAPO_RULE0_MAX)
return -ENOSPC;
--
2.30.2
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH net 2/4] netfilter: flowtable_offload: fix using __this_cpu_add in preemptible
2022-11-30 12:19 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 1/4] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one Pablo Neira Ayuso
@ 2022-11-30 12:19 ` Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 3/4] netfilter: conntrack: " Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 4/4] netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark Pablo Neira Ayuso
3 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-30 12:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
From: Xin Long <lucien.xin@gmail.com>
flow_offload_queue_work() can be called in workqueue without
bh disabled, like the call trace showed in my act_ct testing,
calling NF_FLOW_TABLE_STAT_INC() there would cause a call
trace:
BUG: using __this_cpu_add() in preemptible [00000000] code: kworker/u4:0/138560
caller is flow_offload_queue_work+0xec/0x1b0 [nf_flow_table]
Workqueue: act_ct_workqueue tcf_ct_flow_table_cleanup_work [act_ct]
Call Trace:
<TASK>
dump_stack_lvl+0x33/0x46
check_preemption_disabled+0xc3/0xf0
flow_offload_queue_work+0xec/0x1b0 [nf_flow_table]
nf_flow_table_iterate+0x138/0x170 [nf_flow_table]
nf_flow_table_free+0x140/0x1a0 [nf_flow_table]
tcf_ct_flow_table_cleanup_work+0x2f/0x2b0 [act_ct]
process_one_work+0x6a3/0x1030
worker_thread+0x8a/0xdf0
This patch fixes it by using NF_FLOW_TABLE_STAT_INC_ATOMIC()
instead in flow_offload_queue_work().
Note that for FLOW_CLS_REPLACE branch in flow_offload_queue_work(),
it may not be called in preemptible path, but it's good to use
NF_FLOW_TABLE_STAT_INC_ATOMIC() for all cases in
flow_offload_queue_work().
Fixes: b038177636f8 ("netfilter: nf_flow_table: count pending offload workqueue tasks")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_flow_table_offload.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 00b522890d77..0fdcdb2c9ae4 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -997,13 +997,13 @@ static void flow_offload_queue_work(struct flow_offload_work *offload)
struct net *net = read_pnet(&offload->flowtable->net);
if (offload->cmd == FLOW_CLS_REPLACE) {
- NF_FLOW_TABLE_STAT_INC(net, count_wq_add);
+ NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_add);
queue_work(nf_flow_offload_add_wq, &offload->work);
} else if (offload->cmd == FLOW_CLS_DESTROY) {
- NF_FLOW_TABLE_STAT_INC(net, count_wq_del);
+ NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_del);
queue_work(nf_flow_offload_del_wq, &offload->work);
} else {
- NF_FLOW_TABLE_STAT_INC(net, count_wq_stats);
+ NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_stats);
queue_work(nf_flow_offload_stats_wq, &offload->work);
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH net 3/4] netfilter: conntrack: fix using __this_cpu_add in preemptible
2022-11-30 12:19 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 1/4] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 2/4] netfilter: flowtable_offload: fix using __this_cpu_add in preemptible Pablo Neira Ayuso
@ 2022-11-30 12:19 ` Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 4/4] netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark Pablo Neira Ayuso
3 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-30 12:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
From: Xin Long <lucien.xin@gmail.com>
Currently in nf_conntrack_hash_check_insert(), when it fails in
nf_ct_ext_valid_pre/post(), NF_CT_STAT_INC() will be called in the
preemptible context, a call trace can be triggered:
BUG: using __this_cpu_add() in preemptible [00000000] code: conntrack/1636
caller is nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]
Call Trace:
<TASK>
dump_stack_lvl+0x33/0x46
check_preemption_disabled+0xc3/0xf0
nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]
ctnetlink_create_conntrack+0x3cd/0x4e0 [nf_conntrack_netlink]
ctnetlink_new_conntrack+0x1c0/0x450 [nf_conntrack_netlink]
nfnetlink_rcv_msg+0x277/0x2f0 [nfnetlink]
netlink_rcv_skb+0x50/0x100
nfnetlink_rcv+0x65/0x144 [nfnetlink]
netlink_unicast+0x1ae/0x290
netlink_sendmsg+0x257/0x4f0
sock_sendmsg+0x5f/0x70
This patch is to fix it by changing to use NF_CT_STAT_INC_ATOMIC() for
nf_ct_ext_valid_pre/post() check in nf_conntrack_hash_check_insert(),
as well as nf_ct_ext_valid_post() in __nf_conntrack_confirm().
Note that nf_ct_ext_valid_pre() check in __nf_conntrack_confirm() is
safe to use NF_CT_STAT_INC(), as it's under local_bh_disable().
Fixes: c56716c69ce1 ("netfilter: extensions: introduce extension genid count")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 2692139ce417..23b3fedd619a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -891,7 +891,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
zone = nf_ct_zone(ct);
if (!nf_ct_ext_valid_pre(ct->ext)) {
- NF_CT_STAT_INC(net, insert_failed);
+ NF_CT_STAT_INC_ATOMIC(net, insert_failed);
return -ETIMEDOUT;
}
@@ -938,7 +938,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
if (!nf_ct_ext_valid_post(ct->ext)) {
nf_ct_kill(ct);
- NF_CT_STAT_INC(net, drop);
+ NF_CT_STAT_INC_ATOMIC(net, drop);
return -ETIMEDOUT;
}
@@ -1275,7 +1275,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
*/
if (!nf_ct_ext_valid_post(ct->ext)) {
nf_ct_kill(ct);
- NF_CT_STAT_INC(net, drop);
+ NF_CT_STAT_INC_ATOMIC(net, drop);
return NF_DROP;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH net 4/4] netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
2022-11-30 12:19 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2022-11-30 12:19 ` [PATCH net 3/4] netfilter: conntrack: " Pablo Neira Ayuso
@ 2022-11-30 12:19 ` Pablo Neira Ayuso
3 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-30 12:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
All warnings (new ones prefixed by >>):
net/netfilter/nf_conntrack_netlink.c: In function '__ctnetlink_glue_build':
>> net/netfilter/nf_conntrack_netlink.c:2674:13: warning: unused variable 'mark' [-Wunused-variable]
2674 | u32 mark;
| ^~~~
Fixes: 52d1aa8b8249 ("netfilter: conntrack: Fix data-races around ct mark")
Reported-by: kernel test robot <lkp@intel.com>
Tested-by: Ivan Babrou <ivan@ivan.computer>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_netlink.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d71150a40fb0..1286ae7d4609 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -328,8 +328,13 @@ ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct)
}
#ifdef CONFIG_NF_CONNTRACK_MARK
-static int ctnetlink_dump_mark(struct sk_buff *skb, u32 mark)
+static int ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
{
+ u32 mark = READ_ONCE(ct->mark);
+
+ if (!mark)
+ return 0;
+
if (nla_put_be32(skb, CTA_MARK, htonl(mark)))
goto nla_put_failure;
return 0;
@@ -543,7 +548,7 @@ static int ctnetlink_dump_extinfo(struct sk_buff *skb,
static int ctnetlink_dump_info(struct sk_buff *skb, struct nf_conn *ct)
{
if (ctnetlink_dump_status(skb, ct) < 0 ||
- ctnetlink_dump_mark(skb, READ_ONCE(ct->mark)) < 0 ||
+ ctnetlink_dump_mark(skb, ct) < 0 ||
ctnetlink_dump_secctx(skb, ct) < 0 ||
ctnetlink_dump_id(skb, ct) < 0 ||
ctnetlink_dump_use(skb, ct) < 0 ||
@@ -722,7 +727,6 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item)
struct sk_buff *skb;
unsigned int type;
unsigned int flags = 0, group;
- u32 mark;
int err;
if (events & (1 << IPCT_DESTROY)) {
@@ -827,9 +831,8 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item)
}
#ifdef CONFIG_NF_CONNTRACK_MARK
- mark = READ_ONCE(ct->mark);
- if ((events & (1 << IPCT_MARK) || mark) &&
- ctnetlink_dump_mark(skb, mark) < 0)
+ if (events & (1 << IPCT_MARK) &&
+ ctnetlink_dump_mark(skb, ct) < 0)
goto nla_put_failure;
#endif
nlmsg_end(skb, nlh);
@@ -2671,7 +2674,6 @@ static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct)
{
const struct nf_conntrack_zone *zone;
struct nlattr *nest_parms;
- u32 mark;
zone = nf_ct_zone(ct);
@@ -2733,8 +2735,7 @@ static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct)
goto nla_put_failure;
#ifdef CONFIG_NF_CONNTRACK_MARK
- mark = READ_ONCE(ct->mark);
- if (mark && ctnetlink_dump_mark(skb, mark) < 0)
+ if (ctnetlink_dump_mark(skb, ct) < 0)
goto nla_put_failure;
#endif
if (ctnetlink_dump_labels(skb, ct) < 0)
--
2.30.2
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [PATCH net 1/4] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
2022-11-30 12:19 ` [PATCH net 1/4] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one Pablo Neira Ayuso
@ 2022-12-01 6:10 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 17+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-12-01 6:10 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet
Hello:
This series was applied to netdev/net.git (master)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Wed, 30 Nov 2022 13:19:31 +0100 you wrote:
> From: Stefano Brivio <sbrivio@redhat.com>
>
> Embarrassingly, nft_pipapo_insert() checked for interval validity in
> the first field only.
>
> The start_p and end_p pointers were reset to key data from the first
> field at every iteration of the loop which was supposed to go over
> the set fields.
>
> [...]
Here is the summary with links:
- [net,1/4] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
https://git.kernel.org/netdev/net/c/97d4d394b587
- [net,2/4] netfilter: flowtable_offload: fix using __this_cpu_add in preemptible
https://git.kernel.org/netdev/net/c/a81047154e7c
- [net,3/4] netfilter: conntrack: fix using __this_cpu_add in preemptible
https://git.kernel.org/netdev/net/c/9464d0b68f11
- [net,4/4] netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
https://git.kernel.org/netdev/net/c/1feeae071507
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2024-03-28 3:18 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2024-03-28 3:18 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 reject destroy chain command to delete device hooks in netdev
family, hence, only delchain commands are allowed.
Patch #2 reject table flag update interference with netdev basechain
hook updates, this can leave hooks in inconsistent
registration/unregistration state.
Patch #3 do not unregister netdev basechain hooks if table is dormant.
Otherwise, splat with double unregistration is possible.
Patch #4 fixes Kconfig to allow to restore IP_NF_ARPTABLES,
from Kuniyuki Iwashima.
There are a more fixes still in progress on my side that need more work.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-03-28
Thanks.
----------------------------------------------------------------
The following changes since commit d24b03535e5eb82e025219c2f632b485409c898f:
nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (2024-03-22 09:41:39 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-03-28
for you to fetch changes up to 15fba562f7a9f04322b8bfc8f392e04bb93d81be:
netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c (2024-03-28 03:54:02 +0100)
----------------------------------------------------------------
netfilter pull request 24-03-28
----------------------------------------------------------------
Kuniyuki Iwashima (1):
netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c
Pablo Neira Ayuso (3):
netfilter: nf_tables: reject destroy command to remove basechain hooks
netfilter: nf_tables: reject table flag and netdev basechain updates
netfilter: nf_tables: skip netdev hook unregistration if table is dormant
net/ipv4/netfilter/Kconfig | 1 +
net/netfilter/nf_tables_api.c | 50 ++++++++++++++++++++++++++++++++++++-------
2 files changed, 43 insertions(+), 8 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2023-03-09 17:46 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-09 17:46 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) nft_parse_register_load() gets an incorrect datatype size
as input, from Jeremy Sowden.
2) incorrect maximum netlink attribute in nft_redir, also
from Jeremy.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 37d9df224d1eec1b434fe9ffa40104c756478c29:
ynl: re-license uniformly under GPL-2.0 OR BSD-3-Clause (2023-03-07 13:44:30 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 493924519b1fe3faab13ee621a43b0d0939abab1:
netfilter: nft_redir: correct value of inet type `.maxattrs` (2023-03-08 12:26:42 +0100)
----------------------------------------------------------------
Jeremy Sowden (4):
netfilter: nft_nat: correct length for loading protocol registers
netfilter: nft_masq: correct length for loading protocol registers
netfilter: nft_redir: correct length for loading protocol registers
netfilter: nft_redir: correct value of inet type `.maxattrs`
net/netfilter/nft_masq.c | 2 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_redir.c | 4 ++--
3 files changed, 4 insertions(+), 4 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2023-01-24 18:39 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-24 18:39 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Perform SCTP vtag verification for ABORT/SHUTDOWN_COMPLETE according
to RFC 9260, Sect 8.5.1.
2) Fix infinite loop if SCTP chunk size is zero in for_each_sctp_chunk().
And remove useless check in this macro too.
3) Revert DATA_SENT state in the SCTP tracker, this was applied in the
previous merge window. Next patch in this series provides a more
simple approach to multihoming support.
4) Unify HEARTBEAT_ACKED and ESTABLISHED states for SCTP multihoming
support, use default ESTABLISHED of 210 seconds based on
heartbeat timeout * maximum number of retransmission + round-trip timeout.
Otherwise, SCTP conntrack entry that represents secondary paths
remain stale in the table for up to 5 days.
This is a slightly large batch with fixes for the SCTP connection
tracking helper, all patches from Sriram Yagnaraman.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 208a21107ef0ae86c92078caf84ce80053e73f7a:
Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue (2023-01-23 22:36:59 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to a44b7651489f26271ac784b70895e8a85d0cebf4:
netfilter: conntrack: unify established states for SCTP paths (2023-01-24 09:52:52 +0100)
----------------------------------------------------------------
Sriram Yagnaraman (4):
netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
netfilter: conntrack: fix bug in for_each_sctp_chunk
Revert "netfilter: conntrack: add sctp DATA_SENT state"
netfilter: conntrack: unify established states for SCTP paths
Documentation/networking/nf_conntrack-sysctl.rst | 10 +-
include/uapi/linux/netfilter/nf_conntrack_sctp.h | 3 +-
include/uapi/linux/netfilter/nfnetlink_cttimeout.h | 3 +-
net/netfilter/nf_conntrack_proto_sctp.c | 170 +++++++++------------
net/netfilter/nf_conntrack_standalone.c | 16 --
5 files changed, 77 insertions(+), 125 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2022-05-27 9:20 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2022-05-27 9:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni
Hi,
The following contain more Netfilter fixes for net:
1) syzbot warning in nfnetlink bind, from Florian.
2) Refetch conntrack after __nf_conntrack_confirm(), from Florian Westphal.
3) Move struct nf_ct_timeout back at the bottom of the ctnl_time, to
where it before recent update, also from Florian.
4) Add NL_SET_BAD_ATTR() to nf_tables netlink for proper set element
commands error reporting.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 02ded5a173619b11728b8bf75a3fd995a2c1ff28:
net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (2022-05-27 08:02:33 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to b53c116642502b0c85ecef78bff4f826a7dd4145:
netfilter: nf_tables: set element extended ACK reporting support (2022-05-27 11:16:38 +0200)
----------------------------------------------------------------
Florian Westphal (3):
netfilter: nfnetlink: fix warn in nfnetlink_unbind
netfilter: conntrack: re-fetch conntrack after insertion
netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit
Pablo Neira Ayuso (1):
netfilter: nf_tables: set element extended ACK reporting support
include/net/netfilter/nf_conntrack_core.h | 7 ++++++-
net/netfilter/nf_tables_api.c | 12 +++++++++---
net/netfilter/nfnetlink.c | 24 +++++-------------------
net/netfilter/nfnetlink_cttimeout.c | 5 +++--
4 files changed, 23 insertions(+), 25 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2022-04-25 9:16 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2022-04-25 9:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix incorrect printing of memory size of IPVS connection hash table,
from Pengcheng Yang.
2) Fix spurious EEXIST errors in nft_set_rbtree.
3) Remove leftover empty flowtable file, from Rongguang Wei.
4) Fix ip6_route_me_harder() with vrf driver, from Martin Willi.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 4cf35a2b627a020fe1a6b6fc7a6a12394644e474:
net: mscc: ocelot: fix broken IP multicast flooding (2022-04-19 10:33:33 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 8ddffdb9442a9d60b4a6e679ac48d7d21403a674:
netfilter: Update ip6_route_me_harder to consider L3 domain (2022-04-25 11:09:20 +0200)
----------------------------------------------------------------
Martin Willi (1):
netfilter: Update ip6_route_me_harder to consider L3 domain
Pablo Neira Ayuso (1):
netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion
Pengcheng Yang (1):
ipvs: correctly print the memory size of ip_vs_conn_tab
Rongguang Wei (1):
netfilter: flowtable: Remove the empty file
net/ipv4/netfilter/nf_flow_table_ipv4.c | 0
net/ipv6/netfilter.c | 10 ++++++++--
net/netfilter/ipvs/ip_vs_conn.c | 2 +-
net/netfilter/nft_set_rbtree.c | 6 +++++-
4 files changed, 14 insertions(+), 4 deletions(-)
delete mode 100644 net/ipv4/netfilter/nf_flow_table_ipv4.c
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2022-01-06 21:51 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-06 21:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Refcount leak in ipt_CLUSTERIP rule loading path, from Xin Xiong.
2) Use socat in netfilter selftests, from Hangbin Liu.
3) Skip layer checksum 4 update for IP fragments.
4) Missing allocation of pcpu scratch maps on clone in
nft_set_pipapo, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 1d5a474240407c38ca8c7484a656ee39f585399c:
sfc: The RX page_ring is optional (2022-01-04 18:14:21 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 23c54263efd7cb605e2f7af72717a2a951999217:
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone (2022-01-06 10:43:24 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
Hangbin Liu (1):
selftests: netfilter: switch to socat for tests using -q option
Pablo Neira Ayuso (1):
netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
Xin Xiong (1):
netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++-
net/netfilter/nft_payload.c | 3 +++
net/netfilter/nft_set_pipapo.c | 8 ++++++++
tools/testing/selftests/netfilter/ipip-conntrack-mtu.sh | 9 +++++----
tools/testing/selftests/netfilter/nf_nat_edemux.sh | 10 +++++-----
5 files changed, 25 insertions(+), 10 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2021-02-05 0:17 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2021-02-05 0:17 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix combination of --reap and --update in xt_recent that triggers
UAF, from Jozsef Kadlecsik.
2) Fix current year in nft_meta selftest, from Fabian Frederick.
3) Fix possible UAF in the netns destroy path of nftables.
4) Fix incorrect checksum calculation when mangling ports in flowtable,
from Sven Auhagen.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 44a674d6f79867d5652026f1cc11f7ba8a390183:
Merge tag 'mlx5-fixes-2021-01-26' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2021-01-27 19:18:37 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 8d6bca156e47d68551750a384b3ff49384c67be3:
netfilter: flowtable: fix tcp and udp header checksum update (2021-02-04 01:10:14 +0100)
----------------------------------------------------------------
Fabian Frederick (1):
selftests: netfilter: fix current year
Jozsef Kadlecsik (1):
netfilter: xt_recent: Fix attempt to update deleted entry
Pablo Neira Ayuso (1):
netfilter: nftables: fix possible UAF over chains from packet path in netns
Sven Auhagen (1):
netfilter: flowtable: fix tcp and udp header checksum update
net/netfilter/nf_flow_table_core.c | 4 ++--
net/netfilter/nf_tables_api.c | 25 +++++++++++++++++++------
net/netfilter/xt_recent.c | 12 ++++++++++--
tools/testing/selftests/netfilter/nft_meta.sh | 2 +-
4 files changed, 32 insertions(+), 11 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2020-12-18 12:04 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2020-12-18 12:04 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi Jakub, David,
The following patchset contains Netfilter fixes for net:
1) Incorrect loop in error path of nft_set_elem_expr_clone(),
from Colin Ian King.
2) Missing xt_table_get_private_protected() to access table
private data in x_tables, from Subash Abhinov Kasiviswanathan.
3) Possible oops in ipset hash type resize, from Vasily Averin.
4) Fix shift-out-of-bounds in ipset hash type, also from Vasily.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 3db1a3fa98808aa90f95ec3e0fa2fc7abf28f5c9:
Merge tag 'staging-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging (2020-12-15 14:18:40 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 5c8193f568ae16f3242abad6518dc2ca6c8eef86:
netfilter: ipset: fix shift-out-of-bounds in htable_bits() (2020-12-17 19:44:52 +0100)
----------------------------------------------------------------
Colin Ian King (1):
netfilter: nftables: fix incorrect increment of loop counter
Subash Abhinov Kasiviswanathan (1):
netfilter: x_tables: Update remaining dereference to RCU
Vasily Averin (2):
netfilter: ipset: fixes possible oops in mtype_resize
netfilter: ipset: fix shift-out-of-bounds in htable_bits()
net/ipv4/netfilter/arp_tables.c | 2 +-
net/ipv4/netfilter/ip_tables.c | 2 +-
net/ipv6/netfilter/ip6_tables.c | 2 +-
net/netfilter/ipset/ip_set_hash_gen.h | 42 +++++++++++++++--------------------
net/netfilter/nf_tables_api.c | 4 ++--
5 files changed, 23 insertions(+), 29 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH net 0/4] Netfilter fixes for net
2020-12-09 22:18 Pablo Neira Ayuso
@ 2020-12-10 2:59 ` David Miller
0 siblings, 0 replies; 17+ messages in thread
From: David Miller @ 2020-12-10 2:59 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev, kuba
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 9 Dec 2020 23:18:06 +0100
> Hi Jakub, David,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Switch to RCU in x_tables to fix possible NULL pointer dereference,
> from Subash Abhinov Kasiviswanathan.
>
> 2) Fix netlink dump of dynset timeouts later than 23 days.
>
> 3) Add comment for the indirect serialization of the nft commit mutex
> with rtnl_mutex.
>
> 4) Remove bogus check for confirmed conntrack when matching on the
> conntrack ID, from Brett Mastbergen.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
>
Pulled, thanks.
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2020-12-09 22:18 Pablo Neira Ayuso
2020-12-10 2:59 ` David Miller
0 siblings, 1 reply; 17+ messages in thread
From: Pablo Neira Ayuso @ 2020-12-09 22:18 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi Jakub, David,
The following patchset contains Netfilter fixes for net:
1) Switch to RCU in x_tables to fix possible NULL pointer dereference,
from Subash Abhinov Kasiviswanathan.
2) Fix netlink dump of dynset timeouts later than 23 days.
3) Add comment for the indirect serialization of the nft commit mutex
with rtnl_mutex.
4) Remove bogus check for confirmed conntrack when matching on the
conntrack ID, from Brett Mastbergen.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 819f56bad110cb27a8be3232467986e2baebe069:
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec (2020-12-07 18:29:54 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 2d94b20b95b009eec1a267dcf026b01af627c0cd:
netfilter: nft_ct: Remove confirmation check for NFT_CT_ID (2020-12-09 10:31:58 +0100)
----------------------------------------------------------------
Brett Mastbergen (1):
netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
Pablo Neira Ayuso (2):
netfilter: nft_dynset: fix timeouts later than 23 days
netfilter: nftables: comment indirect serialization of commit_mutex with rtnl_mutex
Subash Abhinov Kasiviswanathan (1):
netfilter: x_tables: Switch synchronization to RCU
include/linux/netfilter/x_tables.h | 5 +++-
include/net/netfilter/nf_tables.h | 4 ++++
net/ipv4/netfilter/arp_tables.c | 14 +++++------
net/ipv4/netfilter/ip_tables.c | 14 +++++------
net/ipv6/netfilter/ip6_tables.c | 14 +++++------
net/netfilter/nf_tables_api.c | 8 +++++--
net/netfilter/nft_ct.c | 2 --
net/netfilter/nft_dynset.c | 8 ++++---
net/netfilter/x_tables.c | 49 ++++++++++++--------------------------
9 files changed, 55 insertions(+), 63 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2020-11-21 12:35 Pablo Neira Ayuso
0 siblings, 0 replies; 17+ messages in thread
From: Pablo Neira Ayuso @ 2020-11-21 12:35 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix missing control data in flow dissector, otherwise IP address
matching in hardware offload infra does not work.
2) Fix hardware offload match on prefix IP address when userspace
does not send a bitwise expression to represent the prefix.
3) Insufficient validation of IPSET_ATTR_IPADDR_IPV6 reported
by syzbot.
4) Remove spurious reports on nf_tables when lockdep gets disabled,
from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 849920c703392957f94023f77ec89ca6cf119d43:
devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() (2020-11-14 16:23:19 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 986fbd9842ba114c74b4fb61c4dc146d87a55316:
netfilter: nf_tables: avoid false-postive lockdep splat (2020-11-20 10:18:39 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: ipset: prevent uninit-value in hash_ip6_add
Florian Westphal (1):
netfilter: nf_tables: avoid false-postive lockdep splat
Pablo Neira Ayuso (2):
netfilter: nftables_offload: set address type in control dissector
netfilter: nftables_offload: build mask based from the matching bytes
include/net/netfilter/nf_tables_offload.h | 7 ++++
net/netfilter/ipset/ip_set_core.c | 3 +-
net/netfilter/nf_tables_api.c | 3 +-
net/netfilter/nf_tables_offload.c | 18 ++++++++
net/netfilter/nft_cmp.c | 8 ++--
net/netfilter/nft_meta.c | 16 +++----
net/netfilter/nft_payload.c | 70 +++++++++++++++++++++++--------
7 files changed, 93 insertions(+), 32 deletions(-)
^ permalink raw reply [flat|nested] 17+ messages in thread
end of thread, other threads:[~2024-03-28 3:19 UTC | newest]
Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-30 12:19 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 1/4] netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one Pablo Neira Ayuso
2022-12-01 6:10 ` patchwork-bot+netdevbpf
2022-11-30 12:19 ` [PATCH net 2/4] netfilter: flowtable_offload: fix using __this_cpu_add in preemptible Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 3/4] netfilter: conntrack: " Pablo Neira Ayuso
2022-11-30 12:19 ` [PATCH net 4/4] netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2024-03-28 3:18 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2023-03-09 17:46 Pablo Neira Ayuso
2023-01-24 18:39 Pablo Neira Ayuso
2022-05-27 9:20 Pablo Neira Ayuso
2022-04-25 9:16 Pablo Neira Ayuso
2022-01-06 21:51 Pablo Neira Ayuso
2021-02-05 0:17 Pablo Neira Ayuso
2020-12-18 12:04 Pablo Neira Ayuso
2020-12-09 22:18 Pablo Neira Ayuso
2020-12-10 2:59 ` David Miller
2020-11-21 12:35 Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).