* [PATCH 1/9] netfilter: nf_ct_h323: do not re-activate already expired timer
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 2/9] netfilter: nf_tables: s/MFT_REG32_01/NFT_REG32_01 Pablo Neira Ayuso
` (7 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Liping Zhang <liping.zhang@spreadtrum.com>
Commit 96d1327ac2e3 ("netfilter: h323: Use mod_timer instead of
set_expect_timeout") just simplify the source codes
if (!del_timer(&exp->timeout))
return 0;
add_timer(&exp->timeout);
to mod_timer(&exp->timeout, jiffies + info->timeout * HZ);
This is not correct, and introduce a race codition:
CPU0 CPU1
- timer expire
process_rcf expectation_timed_out
lock(exp_lock) -
find_exp waiting exp_lock...
re-activate timer!! waiting exp_lock...
unlock(exp_lock) lock(exp_lock)
- unlink expect
- free(expect)
- unlock(exp_lock)
So when the timer expires again, we will access the memory that
was already freed.
Replace mod_timer with mod_timer_pending here to fix this problem.
Fixes: 96d1327ac2e3 ("netfilter: h323: Use mod_timer instead of set_expect_timeout")
Cc: Gao Feng <fgao@ikuai8.com>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_h323_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index bb77a97..5c0db5c 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1473,7 +1473,8 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
"timeout to %u seconds for",
info->timeout);
nf_ct_dump_tuple(&exp->tuple);
- mod_timer(&exp->timeout, jiffies + info->timeout * HZ);
+ mod_timer_pending(&exp->timeout,
+ jiffies + info->timeout * HZ);
}
spin_unlock_bh(&nf_conntrack_expect_lock);
}
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 2/9] netfilter: nf_tables: s/MFT_REG32_01/NFT_REG32_01
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 1/9] netfilter: nf_ct_h323: do not re-activate already expired timer Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 3/9] netfilter: nft_rbtree: ignore inactive matching element with no descendants Pablo Neira Ayuso
` (6 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
MFT_REG32_01 is a typo, rename this to NFT_REG32_01.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_tables.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 01751fa..c674ba2 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -24,7 +24,7 @@ enum nft_registers {
__NFT_REG_MAX,
NFT_REG32_00 = 8,
- MFT_REG32_01,
+ NFT_REG32_01,
NFT_REG32_02,
NFT_REG32_03,
NFT_REG32_04,
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 3/9] netfilter: nft_rbtree: ignore inactive matching element with no descendants
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 1/9] netfilter: nf_ct_h323: do not re-activate already expired timer Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 2/9] netfilter: nf_tables: s/MFT_REG32_01/NFT_REG32_01 Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 4/9] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq Pablo Neira Ayuso
` (5 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
If we find a matching element that is inactive with no descendants, we
jump to the found label, then crash because of nul-dereference on the
left branch.
Fix this by checking that the element is active and not an interval end
and skipping the logic that only applies to the tree iteration.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Anders K. Pedersen <akp@akp.dk>
---
net/netfilter/nft_rbtree.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index 6473936..ffe9ae0 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -70,7 +70,6 @@ static bool nft_rbtree_lookup(const struct net *net, const struct nft_set *set,
} else if (d > 0)
parent = parent->rb_right;
else {
-found:
if (!nft_set_elem_active(&rbe->ext, genmask)) {
parent = parent->rb_left;
continue;
@@ -84,9 +83,12 @@ found:
}
}
- if (set->flags & NFT_SET_INTERVAL && interval != NULL) {
- rbe = interval;
- goto found;
+ if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
+ nft_set_elem_active(&interval->ext, genmask) &&
+ !nft_rbtree_interval_end(interval)) {
+ spin_unlock_bh(&nft_rbtree_lock);
+ *ext = &interval->ext;
+ return true;
}
out:
spin_unlock_bh(&nft_rbtree_lock);
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 4/9] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2016-08-10 19:16 ` [PATCH 3/9] netfilter: nft_rbtree: ignore inactive matching element with no descendants Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 5/9] netfilter: nf_ct_expect: remove the redundant slash when policy name is empty Pablo Neira Ayuso
` (4 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Christophe Leroy <christophe.leroy@c-s.fr>
Do not drop packet when CSeq is 0 as 0 is also a valid value for CSeq.
simple_strtoul() will return 0 either when all digits are 0
or if there are no digits at all. Therefore when simple_strtoul()
returns 0 we check if first character is digit 0 or not.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_sip.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 8d9db9d..7d77217 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1383,7 +1383,7 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
return NF_DROP;
}
cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
- if (!cseq) {
+ if (!cseq && *(*dptr + matchoff) != '0') {
nf_ct_helper_log(skb, ct, "cannot get cseq");
return NF_DROP;
}
@@ -1446,7 +1446,7 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
return NF_DROP;
}
cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
- if (!cseq) {
+ if (!cseq && *(*dptr + matchoff) != '0') {
nf_ct_helper_log(skb, ct, "cannot get cseq");
return NF_DROP;
}
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 5/9] netfilter: nf_ct_expect: remove the redundant slash when policy name is empty
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2016-08-10 19:16 ` [PATCH 4/9] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 6/9] netfilter: nfnetlink_queue: fix memory leak when attach expectation successfully Pablo Neira Ayuso
` (3 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Liping Zhang <liping.zhang@spreadtrum.com>
The 'name' filed in struct nf_conntrack_expect_policy{} is not a
pointer, so check it is NULL or not will always return true. Even if the
name is empty, slash will always be displayed like follows:
# cat /proc/net/nf_conntrack_expect
297 l3proto = 2 proto=6 src=1.1.1.1 dst=2.2.2.2 sport=1 dport=1025 ftp/
^
Fixes: 3a8fc53a45c4 ("netfilter: nf_ct_helper: allocate 16 bytes for the helper and policy names")
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_expect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 9e36931..f8dbacf 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -574,7 +574,7 @@ static int exp_seq_show(struct seq_file *s, void *v)
helper = rcu_dereference(nfct_help(expect->master)->helper);
if (helper) {
seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);
- if (helper->expect_policy[expect->class].name)
+ if (helper->expect_policy[expect->class].name[0])
seq_printf(s, "/%s",
helper->expect_policy[expect->class].name);
}
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 6/9] netfilter: nfnetlink_queue: fix memory leak when attach expectation successfully
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
` (4 preceding siblings ...)
2016-08-10 19:16 ` [PATCH 5/9] netfilter: nf_ct_expect: remove the redundant slash when policy name is empty Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid Pablo Neira Ayuso
` (2 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Liping Zhang <liping.zhang@spreadtrum.com>
User can use NFQA_EXP to attach expectations to conntracks, but we
forget to put back nf_conntrack_expect when it is inserted successfully,
i.e. in this normal case, expect's use refcnt will be 3. So even we
unlink it and put it back later, the use refcnt is still 1, then the
memory will be leaked forever.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_netlink.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 050bb34..b9bfe64 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2362,12 +2362,8 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
return PTR_ERR(exp);
err = nf_ct_expect_related_report(exp, portid, report);
- if (err < 0) {
- nf_ct_expect_put(exp);
- return err;
- }
-
- return 0;
+ nf_ct_expect_put(exp);
+ return err;
}
static void ctnetlink_glue_seqadj(struct sk_buff *skb, struct nf_conn *ct,
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
` (5 preceding siblings ...)
2016-08-10 19:16 ` [PATCH 6/9] netfilter: nfnetlink_queue: fix memory leak when attach expectation successfully Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 8/9] netfilter: ctnetlink: reject new conntrack request with different l4proto Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 9/9] netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes Pablo Neira Ayuso
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Liping Zhang <liping.zhang@spreadtrum.com>
Like NFQNL_MSG_VERDICT_BATCH do, we should also reject the verdict
request when the portid is not same with the initial portid(maybe
from another process).
Fixes: 97d32cf9440d ("netfilter: nfnetlink_queue: batch verdict support")
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nfnetlink_queue.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 5d36a09..f49f450 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
struct nfnl_queue_net *q = nfnl_queue_pernet(net);
int err;
- queue = instance_lookup(q, queue_num);
- if (!queue)
- queue = verdict_instance_lookup(q, queue_num,
- NETLINK_CB(skb).portid);
+ queue = verdict_instance_lookup(q, queue_num,
+ NETLINK_CB(skb).portid);
if (IS_ERR(queue))
return PTR_ERR(queue);
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 8/9] netfilter: ctnetlink: reject new conntrack request with different l4proto
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
` (6 preceding siblings ...)
2016-08-10 19:16 ` [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 9/9] netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes Pablo Neira Ayuso
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Liping Zhang <liping.zhang@spreadtrum.com>
Currently, user can add a conntrack with different l4proto via nfnetlink.
For example, original tuple is TCP while reply tuple is SCTP. This is
invalid combination, we should report EINVAL to userspace.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_netlink.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index b9bfe64..fdfc71f 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1894,6 +1894,8 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,
if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
return -EINVAL;
+ if (otuple.dst.protonum != rtuple.dst.protonum)
+ return -EINVAL;
ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,
&rtuple, u3);
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 9/9] netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes
2016-08-10 19:16 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
` (7 preceding siblings ...)
2016-08-10 19:16 ` [PATCH 8/9] netfilter: ctnetlink: reject new conntrack request with different l4proto Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
8 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Laura Garcia Liebana <nevola@gmail.com>
Fix the direct assignment of offset and length attributes included in
nft_exthdr structure from u32 data to u8.
Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_exthdr.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index ba7aed1..82c264e 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -59,6 +59,7 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
{
struct nft_exthdr *priv = nft_expr_priv(expr);
+ u32 offset, len;
if (tb[NFTA_EXTHDR_DREG] == NULL ||
tb[NFTA_EXTHDR_TYPE] == NULL ||
@@ -66,9 +67,15 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
tb[NFTA_EXTHDR_LEN] == NULL)
return -EINVAL;
+ offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
+ len = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+
+ if (offset > U8_MAX || len > U8_MAX)
+ return -ERANGE;
+
priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
- priv->offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
- priv->len = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+ priv->offset = offset;
+ priv->len = len;
priv->dreg = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
return nft_validate_register_store(ctx, priv->dreg, NULL,
--
2.1.4
^ permalink raw reply related [flat|nested] 11+ messages in thread