* [PATCH net 0/4] Netfilter fixes for net
@ 2022-05-27 9:20 Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 1/4] netfilter: nfnetlink: fix warn in nfnetlink_unbind Pablo Neira Ayuso
` (3 more replies)
0 siblings, 4 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-05-27 9:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni
Hi,
The following contain more Netfilter fixes for net:
1) syzbot warning in nfnetlink bind, from Florian.
2) Refetch conntrack after __nf_conntrack_confirm(), from Florian Westphal.
3) Move struct nf_ct_timeout back at the bottom of the ctnl_time, to
where it before recent update, also from Florian.
4) Add NL_SET_BAD_ATTR() to nf_tables netlink for proper set element
commands error reporting.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 02ded5a173619b11728b8bf75a3fd995a2c1ff28:
net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (2022-05-27 08:02:33 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to b53c116642502b0c85ecef78bff4f826a7dd4145:
netfilter: nf_tables: set element extended ACK reporting support (2022-05-27 11:16:38 +0200)
----------------------------------------------------------------
Florian Westphal (3):
netfilter: nfnetlink: fix warn in nfnetlink_unbind
netfilter: conntrack: re-fetch conntrack after insertion
netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit
Pablo Neira Ayuso (1):
netfilter: nf_tables: set element extended ACK reporting support
include/net/netfilter/nf_conntrack_core.h | 7 ++++++-
net/netfilter/nf_tables_api.c | 12 +++++++++---
net/netfilter/nfnetlink.c | 24 +++++-------------------
net/netfilter/nfnetlink_cttimeout.c | 5 +++--
4 files changed, 23 insertions(+), 25 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 1/4] netfilter: nfnetlink: fix warn in nfnetlink_unbind
2022-05-27 9:20 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
@ 2022-05-27 9:20 ` Pablo Neira Ayuso
2022-05-27 10:20 ` patchwork-bot+netdevbpf
2022-05-27 9:20 ` [PATCH net 2/4] netfilter: conntrack: re-fetch conntrack after insertion Pablo Neira Ayuso
` (2 subsequent siblings)
3 siblings, 1 reply; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-05-27 9:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni
From: Florian Westphal <fw@strlen.de>
syzbot reports following warn:
WARNING: CPU: 0 PID: 3600 at net/netfilter/nfnetlink.c:703 nfnetlink_unbind+0x357/0x3b0 net/netfilter/nfnetlink.c:694
The syzbot generated program does this:
socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 3
setsockopt(3, SOL_NETLINK, NETLINK_DROP_MEMBERSHIP, [1], 4) = 0
... which triggers 'WARN_ON_ONCE(nfnlnet->ctnetlink_listeners == 0)' check.
Instead of counting, just enable reporting for every bind request
and check if we still have listeners on unbind.
While at it, also add the needed bounds check on nfnl_group2type[]
access.
Reported-by: <syzbot+4903218f7fba0a2d6226@syzkaller.appspotmail.com>
Reported-by: <syzbot+afd2d80e495f96049571@syzkaller.appspotmail.com>
Fixes: 2794cdb0b97b ("netfilter: nfnetlink: allow to detect if ctnetlink listeners exist")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nfnetlink.c | 24 +++++-------------------
1 file changed, 5 insertions(+), 19 deletions(-)
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index ad3bbe34ca88..2f7c477fc9e7 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -45,7 +45,6 @@ MODULE_DESCRIPTION("Netfilter messages via netlink socket");
static unsigned int nfnetlink_pernet_id __read_mostly;
struct nfnl_net {
- unsigned int ctnetlink_listeners;
struct sock *nfnl;
};
@@ -673,18 +672,8 @@ static int nfnetlink_bind(struct net *net, int group)
#ifdef CONFIG_NF_CONNTRACK_EVENTS
if (type == NFNL_SUBSYS_CTNETLINK) {
- struct nfnl_net *nfnlnet = nfnl_pernet(net);
-
nfnl_lock(NFNL_SUBSYS_CTNETLINK);
-
- if (WARN_ON_ONCE(nfnlnet->ctnetlink_listeners == UINT_MAX)) {
- nfnl_unlock(NFNL_SUBSYS_CTNETLINK);
- return -EOVERFLOW;
- }
-
- nfnlnet->ctnetlink_listeners++;
- if (nfnlnet->ctnetlink_listeners == 1)
- WRITE_ONCE(net->ct.ctnetlink_has_listener, true);
+ WRITE_ONCE(net->ct.ctnetlink_has_listener, true);
nfnl_unlock(NFNL_SUBSYS_CTNETLINK);
}
#endif
@@ -694,15 +683,12 @@ static int nfnetlink_bind(struct net *net, int group)
static void nfnetlink_unbind(struct net *net, int group)
{
#ifdef CONFIG_NF_CONNTRACK_EVENTS
- int type = nfnl_group2type[group];
-
- if (type == NFNL_SUBSYS_CTNETLINK) {
- struct nfnl_net *nfnlnet = nfnl_pernet(net);
+ if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
+ return;
+ if (nfnl_group2type[group] == NFNL_SUBSYS_CTNETLINK) {
nfnl_lock(NFNL_SUBSYS_CTNETLINK);
- WARN_ON_ONCE(nfnlnet->ctnetlink_listeners == 0);
- nfnlnet->ctnetlink_listeners--;
- if (nfnlnet->ctnetlink_listeners == 0)
+ if (!nfnetlink_has_listeners(net, group))
WRITE_ONCE(net->ct.ctnetlink_has_listener, false);
nfnl_unlock(NFNL_SUBSYS_CTNETLINK);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [PATCH net 2/4] netfilter: conntrack: re-fetch conntrack after insertion
2022-05-27 9:20 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 1/4] netfilter: nfnetlink: fix warn in nfnetlink_unbind Pablo Neira Ayuso
@ 2022-05-27 9:20 ` Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 3/4] netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 4/4] netfilter: nf_tables: set element extended ACK reporting support Pablo Neira Ayuso
3 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-05-27 9:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni
From: Florian Westphal <fw@strlen.de>
In case the conntrack is clashing, insertion can free skb->_nfct and
set skb->_nfct to the already-confirmed entry.
This wasn't found before because the conntrack entry and the extension
space used to free'd after an rcu grace period, plus the race needs
events enabled to trigger.
Reported-by: <syzbot+793a590957d9c1b96620@syzkaller.appspotmail.com>
Fixes: 71d8c47fc653 ("netfilter: conntrack: introduce clash resolution on insertion race")
Fixes: 2ad9d7747c10 ("netfilter: conntrack: free extension area immediately")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_core.h | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 6406cfee34c2..37866c8386e2 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -58,8 +58,13 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
int ret = NF_ACCEPT;
if (ct) {
- if (!nf_ct_is_confirmed(ct))
+ if (!nf_ct_is_confirmed(ct)) {
ret = __nf_conntrack_confirm(skb);
+
+ if (ret == NF_ACCEPT)
+ ct = (struct nf_conn *)skb_nfct(skb);
+ }
+
if (ret == NF_ACCEPT && nf_ct_ecache_exist(ct))
nf_ct_deliver_cached_events(ct);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [PATCH net 3/4] netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit
2022-05-27 9:20 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 1/4] netfilter: nfnetlink: fix warn in nfnetlink_unbind Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 2/4] netfilter: conntrack: re-fetch conntrack after insertion Pablo Neira Ayuso
@ 2022-05-27 9:20 ` Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 4/4] netfilter: nf_tables: set element extended ACK reporting support Pablo Neira Ayuso
3 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-05-27 9:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni
From: Florian Westphal <fw@strlen.de>
syzbot reports:
BUG: KASAN: slab-out-of-bounds in __list_del_entry_valid+0xcc/0xf0 lib/list_debug.c:42
[..]
list_del include/linux/list.h:148 [inline]
cttimeout_net_exit+0x211/0x540 net/netfilter/nfnetlink_cttimeout.c:617
No reproducer so far. Looking at recent changes in this area
its clear that the free_head must not be at the end of the
structure because nf_ct_timeout structure has variable size.
Reported-by: <syzbot+92968395eedbdbd3617d@syzkaller.appspotmail.com>
Fixes: 78222bacfca9 ("netfilter: cttimeout: decouple unlink and free on netns destruction")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nfnetlink_cttimeout.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index f069c24c6146..af15102bc696 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -35,12 +35,13 @@ static unsigned int nfct_timeout_id __read_mostly;
struct ctnl_timeout {
struct list_head head;
+ struct list_head free_head;
struct rcu_head rcu_head;
refcount_t refcnt;
char name[CTNL_TIMEOUT_NAME_MAX];
- struct nf_ct_timeout timeout;
- struct list_head free_head;
+ /* must be at the end */
+ struct nf_ct_timeout timeout;
};
struct nfct_timeout_pernet {
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [PATCH net 4/4] netfilter: nf_tables: set element extended ACK reporting support
2022-05-27 9:20 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2022-05-27 9:20 ` [PATCH net 3/4] netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit Pablo Neira Ayuso
@ 2022-05-27 9:20 ` Pablo Neira Ayuso
3 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-05-27 9:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni
Report the element that causes problems via netlink extended ACK for set
element commands.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f296dfe86b62..f4f1d0a2da43 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5348,8 +5348,10 @@ static int nf_tables_getsetelem(struct sk_buff *skb,
nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
err = nft_get_set_elem(&ctx, set, attr);
- if (err < 0)
+ if (err < 0) {
+ NL_SET_BAD_ATTR(extack, attr);
break;
+ }
}
return err;
@@ -6126,8 +6128,10 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags);
- if (err < 0)
+ if (err < 0) {
+ NL_SET_BAD_ATTR(extack, attr);
return err;
+ }
}
if (nft_net->validate_state == NFT_VALIDATE_DO)
@@ -6397,8 +6401,10 @@ static int nf_tables_delsetelem(struct sk_buff *skb,
nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
err = nft_del_setelem(&ctx, set, attr);
- if (err < 0)
+ if (err < 0) {
+ NL_SET_BAD_ATTR(extack, attr);
break;
+ }
}
return err;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* Re: [PATCH net 1/4] netfilter: nfnetlink: fix warn in nfnetlink_unbind
2022-05-27 9:20 ` [PATCH net 1/4] netfilter: nfnetlink: fix warn in nfnetlink_unbind Pablo Neira Ayuso
@ 2022-05-27 10:20 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 19+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-05-27 10:20 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba, pabeni
Hello:
This series was applied to netdev/net.git (master)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Fri, 27 May 2022 11:20:20 +0200 you wrote:
> From: Florian Westphal <fw@strlen.de>
>
> syzbot reports following warn:
> WARNING: CPU: 0 PID: 3600 at net/netfilter/nfnetlink.c:703 nfnetlink_unbind+0x357/0x3b0 net/netfilter/nfnetlink.c:694
>
> The syzbot generated program does this:
>
> [...]
Here is the summary with links:
- [net,1/4] netfilter: nfnetlink: fix warn in nfnetlink_unbind
https://git.kernel.org/netdev/net/c/ffd219efd9ee
- [net,2/4] netfilter: conntrack: re-fetch conntrack after insertion
https://git.kernel.org/netdev/net/c/56b14ecec97f
- [net,3/4] netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit
https://git.kernel.org/netdev/net/c/aeed55a08d0b
- [net,4/4] netfilter: nf_tables: set element extended ACK reporting support
https://git.kernel.org/netdev/net/c/b53c11664250
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2024-03-28 3:18 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-03-28 3:18 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 reject destroy chain command to delete device hooks in netdev
family, hence, only delchain commands are allowed.
Patch #2 reject table flag update interference with netdev basechain
hook updates, this can leave hooks in inconsistent
registration/unregistration state.
Patch #3 do not unregister netdev basechain hooks if table is dormant.
Otherwise, splat with double unregistration is possible.
Patch #4 fixes Kconfig to allow to restore IP_NF_ARPTABLES,
from Kuniyuki Iwashima.
There are a more fixes still in progress on my side that need more work.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-03-28
Thanks.
----------------------------------------------------------------
The following changes since commit d24b03535e5eb82e025219c2f632b485409c898f:
nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (2024-03-22 09:41:39 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-03-28
for you to fetch changes up to 15fba562f7a9f04322b8bfc8f392e04bb93d81be:
netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c (2024-03-28 03:54:02 +0100)
----------------------------------------------------------------
netfilter pull request 24-03-28
----------------------------------------------------------------
Kuniyuki Iwashima (1):
netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c
Pablo Neira Ayuso (3):
netfilter: nf_tables: reject destroy command to remove basechain hooks
netfilter: nf_tables: reject table flag and netdev basechain updates
netfilter: nf_tables: skip netdev hook unregistration if table is dormant
net/ipv4/netfilter/Kconfig | 1 +
net/netfilter/nf_tables_api.c | 50 ++++++++++++++++++++++++++++++++++++-------
2 files changed, 43 insertions(+), 8 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* Re: [PATCH net 0/4] Netfilter fixes for net
2023-03-10 11:08 ` Jeremy Sowden
@ 2023-03-10 11:44 ` Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-10 11:44 UTC (permalink / raw)
To: Jeremy Sowden; +Cc: netfilter-devel
On Fri, Mar 10, 2023 at 11:08:56AM +0000, Jeremy Sowden wrote:
> On 2023-03-09, at 18:46:51 +0100, Pablo Neira Ayuso wrote:
> > The following patchset contains Netfilter fixes for net:
> >
> > 1) nft_parse_register_load() gets an incorrect datatype size
> > as input, from Jeremy Sowden.
> >
> > 2) incorrect maximum netlink attribute in nft_redir, also
> > from Jeremy.
> >
> > Please, pull these changes from:
> >
> > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
>
> Have you actually pushed these changes to nf.git? Can't see them. :)
Oh, I pushed out to master, not main...
^ permalink raw reply [flat|nested] 19+ messages in thread
* Re: [PATCH net 0/4] Netfilter fixes for net
2023-03-09 17:46 Pablo Neira Ayuso
@ 2023-03-10 11:08 ` Jeremy Sowden
2023-03-10 11:44 ` Pablo Neira Ayuso
0 siblings, 1 reply; 19+ messages in thread
From: Jeremy Sowden @ 2023-03-10 11:08 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 499 bytes --]
On 2023-03-09, at 18:46:51 +0100, Pablo Neira Ayuso wrote:
> The following patchset contains Netfilter fixes for net:
>
> 1) nft_parse_register_load() gets an incorrect datatype size
> as input, from Jeremy Sowden.
>
> 2) incorrect maximum netlink attribute in nft_redir, also
> from Jeremy.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Have you actually pushed these changes to nf.git? Can't see them. :)
J.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2023-03-09 17:46 Pablo Neira Ayuso
2023-03-10 11:08 ` Jeremy Sowden
0 siblings, 1 reply; 19+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-09 17:46 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) nft_parse_register_load() gets an incorrect datatype size
as input, from Jeremy Sowden.
2) incorrect maximum netlink attribute in nft_redir, also
from Jeremy.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 37d9df224d1eec1b434fe9ffa40104c756478c29:
ynl: re-license uniformly under GPL-2.0 OR BSD-3-Clause (2023-03-07 13:44:30 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 493924519b1fe3faab13ee621a43b0d0939abab1:
netfilter: nft_redir: correct value of inet type `.maxattrs` (2023-03-08 12:26:42 +0100)
----------------------------------------------------------------
Jeremy Sowden (4):
netfilter: nft_nat: correct length for loading protocol registers
netfilter: nft_masq: correct length for loading protocol registers
netfilter: nft_redir: correct length for loading protocol registers
netfilter: nft_redir: correct value of inet type `.maxattrs`
net/netfilter/nft_masq.c | 2 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_redir.c | 4 ++--
3 files changed, 4 insertions(+), 4 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2023-01-24 18:39 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-24 18:39 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Perform SCTP vtag verification for ABORT/SHUTDOWN_COMPLETE according
to RFC 9260, Sect 8.5.1.
2) Fix infinite loop if SCTP chunk size is zero in for_each_sctp_chunk().
And remove useless check in this macro too.
3) Revert DATA_SENT state in the SCTP tracker, this was applied in the
previous merge window. Next patch in this series provides a more
simple approach to multihoming support.
4) Unify HEARTBEAT_ACKED and ESTABLISHED states for SCTP multihoming
support, use default ESTABLISHED of 210 seconds based on
heartbeat timeout * maximum number of retransmission + round-trip timeout.
Otherwise, SCTP conntrack entry that represents secondary paths
remain stale in the table for up to 5 days.
This is a slightly large batch with fixes for the SCTP connection
tracking helper, all patches from Sriram Yagnaraman.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 208a21107ef0ae86c92078caf84ce80053e73f7a:
Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue (2023-01-23 22:36:59 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to a44b7651489f26271ac784b70895e8a85d0cebf4:
netfilter: conntrack: unify established states for SCTP paths (2023-01-24 09:52:52 +0100)
----------------------------------------------------------------
Sriram Yagnaraman (4):
netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
netfilter: conntrack: fix bug in for_each_sctp_chunk
Revert "netfilter: conntrack: add sctp DATA_SENT state"
netfilter: conntrack: unify established states for SCTP paths
Documentation/networking/nf_conntrack-sysctl.rst | 10 +-
include/uapi/linux/netfilter/nf_conntrack_sctp.h | 3 +-
include/uapi/linux/netfilter/nfnetlink_cttimeout.h | 3 +-
net/netfilter/nf_conntrack_proto_sctp.c | 170 +++++++++------------
net/netfilter/nf_conntrack_standalone.c | 16 --
5 files changed, 77 insertions(+), 125 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2022-11-30 12:19 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-30 12:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Check for interval validity in all concatenation fields in
nft_set_pipapo, from Stefano Brivio.
2) Missing preemption disabled in conntrack and flowtable stat
updates, from Xin Long.
3) Fix compilation warning when CONFIG_NF_CONNTRACK_MARK=n.
Except for 3) which was a bug introduced in a recent fix in 6.1-rc.
Anything else, broken for several releases.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit f2fc2280faabafc8df83ee007699d21f7a6301fe:
Merge branch 'wwan-iosm-fixes' (2022-11-28 11:31:59 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 1feeae071507ad65cf9f462a1bdd543a4bf89e71:
netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark (2022-11-30 13:08:49 +0100)
----------------------------------------------------------------
Pablo Neira Ayuso (1):
netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
Stefano Brivio (1):
netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
Xin Long (2):
netfilter: flowtable_offload: fix using __this_cpu_add in preemptible
netfilter: conntrack: fix using __this_cpu_add in preemptible
net/netfilter/nf_conntrack_core.c | 6 +++---
net/netfilter/nf_conntrack_netlink.c | 19 ++++++++++---------
net/netfilter/nf_flow_table_offload.c | 6 +++---
net/netfilter/nft_set_pipapo.c | 5 +++--
4 files changed, 19 insertions(+), 17 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2022-04-25 9:16 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-04-25 9:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix incorrect printing of memory size of IPVS connection hash table,
from Pengcheng Yang.
2) Fix spurious EEXIST errors in nft_set_rbtree.
3) Remove leftover empty flowtable file, from Rongguang Wei.
4) Fix ip6_route_me_harder() with vrf driver, from Martin Willi.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 4cf35a2b627a020fe1a6b6fc7a6a12394644e474:
net: mscc: ocelot: fix broken IP multicast flooding (2022-04-19 10:33:33 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 8ddffdb9442a9d60b4a6e679ac48d7d21403a674:
netfilter: Update ip6_route_me_harder to consider L3 domain (2022-04-25 11:09:20 +0200)
----------------------------------------------------------------
Martin Willi (1):
netfilter: Update ip6_route_me_harder to consider L3 domain
Pablo Neira Ayuso (1):
netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion
Pengcheng Yang (1):
ipvs: correctly print the memory size of ip_vs_conn_tab
Rongguang Wei (1):
netfilter: flowtable: Remove the empty file
net/ipv4/netfilter/nf_flow_table_ipv4.c | 0
net/ipv6/netfilter.c | 10 ++++++++--
net/netfilter/ipvs/ip_vs_conn.c | 2 +-
net/netfilter/nft_set_rbtree.c | 6 +++++-
4 files changed, 14 insertions(+), 4 deletions(-)
delete mode 100644 net/ipv4/netfilter/nf_flow_table_ipv4.c
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2022-01-06 21:51 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-01-06 21:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Refcount leak in ipt_CLUSTERIP rule loading path, from Xin Xiong.
2) Use socat in netfilter selftests, from Hangbin Liu.
3) Skip layer checksum 4 update for IP fragments.
4) Missing allocation of pcpu scratch maps on clone in
nft_set_pipapo, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 1d5a474240407c38ca8c7484a656ee39f585399c:
sfc: The RX page_ring is optional (2022-01-04 18:14:21 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 23c54263efd7cb605e2f7af72717a2a951999217:
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone (2022-01-06 10:43:24 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
Hangbin Liu (1):
selftests: netfilter: switch to socat for tests using -q option
Pablo Neira Ayuso (1):
netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
Xin Xiong (1):
netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++-
net/netfilter/nft_payload.c | 3 +++
net/netfilter/nft_set_pipapo.c | 8 ++++++++
tools/testing/selftests/netfilter/ipip-conntrack-mtu.sh | 9 +++++----
tools/testing/selftests/netfilter/nf_nat_edemux.sh | 10 +++++-----
5 files changed, 25 insertions(+), 10 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2021-02-05 0:17 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2021-02-05 0:17 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix combination of --reap and --update in xt_recent that triggers
UAF, from Jozsef Kadlecsik.
2) Fix current year in nft_meta selftest, from Fabian Frederick.
3) Fix possible UAF in the netns destroy path of nftables.
4) Fix incorrect checksum calculation when mangling ports in flowtable,
from Sven Auhagen.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 44a674d6f79867d5652026f1cc11f7ba8a390183:
Merge tag 'mlx5-fixes-2021-01-26' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2021-01-27 19:18:37 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 8d6bca156e47d68551750a384b3ff49384c67be3:
netfilter: flowtable: fix tcp and udp header checksum update (2021-02-04 01:10:14 +0100)
----------------------------------------------------------------
Fabian Frederick (1):
selftests: netfilter: fix current year
Jozsef Kadlecsik (1):
netfilter: xt_recent: Fix attempt to update deleted entry
Pablo Neira Ayuso (1):
netfilter: nftables: fix possible UAF over chains from packet path in netns
Sven Auhagen (1):
netfilter: flowtable: fix tcp and udp header checksum update
net/netfilter/nf_flow_table_core.c | 4 ++--
net/netfilter/nf_tables_api.c | 25 +++++++++++++++++++------
net/netfilter/xt_recent.c | 12 ++++++++++--
tools/testing/selftests/netfilter/nft_meta.sh | 2 +-
4 files changed, 32 insertions(+), 11 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2020-12-18 12:04 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2020-12-18 12:04 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi Jakub, David,
The following patchset contains Netfilter fixes for net:
1) Incorrect loop in error path of nft_set_elem_expr_clone(),
from Colin Ian King.
2) Missing xt_table_get_private_protected() to access table
private data in x_tables, from Subash Abhinov Kasiviswanathan.
3) Possible oops in ipset hash type resize, from Vasily Averin.
4) Fix shift-out-of-bounds in ipset hash type, also from Vasily.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 3db1a3fa98808aa90f95ec3e0fa2fc7abf28f5c9:
Merge tag 'staging-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging (2020-12-15 14:18:40 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 5c8193f568ae16f3242abad6518dc2ca6c8eef86:
netfilter: ipset: fix shift-out-of-bounds in htable_bits() (2020-12-17 19:44:52 +0100)
----------------------------------------------------------------
Colin Ian King (1):
netfilter: nftables: fix incorrect increment of loop counter
Subash Abhinov Kasiviswanathan (1):
netfilter: x_tables: Update remaining dereference to RCU
Vasily Averin (2):
netfilter: ipset: fixes possible oops in mtype_resize
netfilter: ipset: fix shift-out-of-bounds in htable_bits()
net/ipv4/netfilter/arp_tables.c | 2 +-
net/ipv4/netfilter/ip_tables.c | 2 +-
net/ipv6/netfilter/ip6_tables.c | 2 +-
net/netfilter/ipset/ip_set_hash_gen.h | 42 +++++++++++++++--------------------
net/netfilter/nf_tables_api.c | 4 ++--
5 files changed, 23 insertions(+), 29 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* Re: [PATCH net 0/4] Netfilter fixes for net
2020-12-09 22:18 Pablo Neira Ayuso
@ 2020-12-10 2:59 ` David Miller
0 siblings, 0 replies; 19+ messages in thread
From: David Miller @ 2020-12-10 2:59 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev, kuba
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 9 Dec 2020 23:18:06 +0100
> Hi Jakub, David,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Switch to RCU in x_tables to fix possible NULL pointer dereference,
> from Subash Abhinov Kasiviswanathan.
>
> 2) Fix netlink dump of dynset timeouts later than 23 days.
>
> 3) Add comment for the indirect serialization of the nft commit mutex
> with rtnl_mutex.
>
> 4) Remove bogus check for confirmed conntrack when matching on the
> conntrack ID, from Brett Mastbergen.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
>
Pulled, thanks.
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2020-12-09 22:18 Pablo Neira Ayuso
2020-12-10 2:59 ` David Miller
0 siblings, 1 reply; 19+ messages in thread
From: Pablo Neira Ayuso @ 2020-12-09 22:18 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi Jakub, David,
The following patchset contains Netfilter fixes for net:
1) Switch to RCU in x_tables to fix possible NULL pointer dereference,
from Subash Abhinov Kasiviswanathan.
2) Fix netlink dump of dynset timeouts later than 23 days.
3) Add comment for the indirect serialization of the nft commit mutex
with rtnl_mutex.
4) Remove bogus check for confirmed conntrack when matching on the
conntrack ID, from Brett Mastbergen.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 819f56bad110cb27a8be3232467986e2baebe069:
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec (2020-12-07 18:29:54 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 2d94b20b95b009eec1a267dcf026b01af627c0cd:
netfilter: nft_ct: Remove confirmation check for NFT_CT_ID (2020-12-09 10:31:58 +0100)
----------------------------------------------------------------
Brett Mastbergen (1):
netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
Pablo Neira Ayuso (2):
netfilter: nft_dynset: fix timeouts later than 23 days
netfilter: nftables: comment indirect serialization of commit_mutex with rtnl_mutex
Subash Abhinov Kasiviswanathan (1):
netfilter: x_tables: Switch synchronization to RCU
include/linux/netfilter/x_tables.h | 5 +++-
include/net/netfilter/nf_tables.h | 4 ++++
net/ipv4/netfilter/arp_tables.c | 14 +++++------
net/ipv4/netfilter/ip_tables.c | 14 +++++------
net/ipv6/netfilter/ip6_tables.c | 14 +++++------
net/netfilter/nf_tables_api.c | 8 +++++--
net/netfilter/nft_ct.c | 2 --
net/netfilter/nft_dynset.c | 8 ++++---
net/netfilter/x_tables.c | 49 ++++++++++++--------------------------
9 files changed, 55 insertions(+), 63 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/4] Netfilter fixes for net
@ 2020-11-21 12:35 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2020-11-21 12:35 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix missing control data in flow dissector, otherwise IP address
matching in hardware offload infra does not work.
2) Fix hardware offload match on prefix IP address when userspace
does not send a bitwise expression to represent the prefix.
3) Insufficient validation of IPSET_ATTR_IPADDR_IPV6 reported
by syzbot.
4) Remove spurious reports on nf_tables when lockdep gets disabled,
from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 849920c703392957f94023f77ec89ca6cf119d43:
devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() (2020-11-14 16:23:19 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 986fbd9842ba114c74b4fb61c4dc146d87a55316:
netfilter: nf_tables: avoid false-postive lockdep splat (2020-11-20 10:18:39 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: ipset: prevent uninit-value in hash_ip6_add
Florian Westphal (1):
netfilter: nf_tables: avoid false-postive lockdep splat
Pablo Neira Ayuso (2):
netfilter: nftables_offload: set address type in control dissector
netfilter: nftables_offload: build mask based from the matching bytes
include/net/netfilter/nf_tables_offload.h | 7 ++++
net/netfilter/ipset/ip_set_core.c | 3 +-
net/netfilter/nf_tables_api.c | 3 +-
net/netfilter/nf_tables_offload.c | 18 ++++++++
net/netfilter/nft_cmp.c | 8 ++--
net/netfilter/nft_meta.c | 16 +++----
net/netfilter/nft_payload.c | 70 +++++++++++++++++++++++--------
7 files changed, 93 insertions(+), 32 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
end of thread, other threads:[~2024-03-28 3:19 UTC | newest]
Thread overview: 19+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-27 9:20 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 1/4] netfilter: nfnetlink: fix warn in nfnetlink_unbind Pablo Neira Ayuso
2022-05-27 10:20 ` patchwork-bot+netdevbpf
2022-05-27 9:20 ` [PATCH net 2/4] netfilter: conntrack: re-fetch conntrack after insertion Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 3/4] netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit Pablo Neira Ayuso
2022-05-27 9:20 ` [PATCH net 4/4] netfilter: nf_tables: set element extended ACK reporting support Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2024-03-28 3:18 [PATCH net 0/4] Netfilter fixes for net Pablo Neira Ayuso
2023-03-09 17:46 Pablo Neira Ayuso
2023-03-10 11:08 ` Jeremy Sowden
2023-03-10 11:44 ` Pablo Neira Ayuso
2023-01-24 18:39 Pablo Neira Ayuso
2022-11-30 12:19 Pablo Neira Ayuso
2022-04-25 9:16 Pablo Neira Ayuso
2022-01-06 21:51 Pablo Neira Ayuso
2021-02-05 0:17 Pablo Neira Ayuso
2020-12-18 12:04 Pablo Neira Ayuso
2020-12-09 22:18 Pablo Neira Ayuso
2020-12-10 2:59 ` David Miller
2020-11-21 12:35 Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).