Commit 6bdc5f49 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://1984.lsi.us.es/nf-next 



Pablo says:

====================
The following patchset provides fixes for issues that were recently introduced
by my new cthelper infrastructure. They have been spotted by Randy Dunlap,
Andrew Morton and Dan Carpenter.

The patches provide:

* compilation fixes if CONFIG_NF_CONNTRACK is disabled: I moved all the
  conntrack code from nfnetlink_queue.c to nfnetlink_queue_ct.c to avoid
  peppering the entire code with lots of ifdefs. I needed to rename
  nfnetlink_queue.c to nfnetlink_queue_core.c to get it working with the
  Makefile tweaks I've added.

* fix NULL pointer dereference via ctnetlink while trying to change the helper
  for an existing conntrack entry. I don't find any reasonable use case for
  changing the helper from one to another in run-time. Thus, now ctnetlink
  returns -EOPNOTSUPP for this operation.

* fix possible out-of-bound zeroing of the conntrack extension area due to
  the helper automatic assignation routine.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f032537f 7c622345

include/net/netfilter/nfnetlink_queue.h

0 → 100644
+43 −0
Original line number Diff line number Diff line 
#ifndef _NET_NFNL_QUEUE_H_

#define _NET_NFNL_QUEUE_H_



#include <linux/netfilter/nf_conntrack_common.h>



struct nf_conn;



#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)

struct nf_conn *nfqnl_ct_get(struct sk_buff *entskb, size_t *size,

			     enum ip_conntrack_info *ctinfo);

struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,

			       const struct nlattr *attr,

			       enum ip_conntrack_info *ctinfo);

int nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct,

		 enum ip_conntrack_info ctinfo);

void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,

			 enum ip_conntrack_info ctinfo, int diff);

#else

inline struct nf_conn *

nfqnl_ct_get(struct sk_buff *entskb, size_t *size, enum ip_conntrack_info *ctinfo)

{

	return NULL;

}



inline struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,

				      const struct nlattr *attr,

				      enum ip_conntrack_info *ctinfo)

{

	return NULL;

}



inline int

nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo)

{

	return 0;

}



inline void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,

				enum ip_conntrack_info ctinfo, int diff)

{

}

#endif /* NF_CONNTRACK */

#endif

net/netfilter/Kconfig

+21 −8
Original line number Diff line number Diff line
@@ -12,14 +12,6 @@ tristate "Netfilter NFACCT over NFNETLINK interface" 
	  If this option is enabled, the kernel will include support

	  for extended accounting via NFNETLINK.



config NETFILTER_NETLINK_CTHELPER

tristate "Netfilter CTHELPER over NFNETLINK interface"

	depends on NETFILTER_ADVANCED

	select NETFILTER_NETLINK

	help

	  If this option is enabled, the kernel will include support

	  for user-space connection tracking helpers via NFNETLINK.



config NETFILTER_NETLINK_QUEUE

	tristate "Netfilter NFQUEUE over NFNETLINK interface"

	depends on NETFILTER_ADVANCED
@@ -343,6 +335,27 @@ config NF_CT_NETLINK_TIMEOUT 


	  If unsure, say `N'.



config NF_CT_NETLINK_HELPER

	tristate 'Connection tracking helpers in user-space via Netlink'

	select NETFILTER_NETLINK

	depends on NF_CT_NETLINK

	depends on NETFILTER_NETLINK_QUEUE

	depends on NETFILTER_NETLINK_QUEUE_CT

	depends on NETFILTER_ADVANCED

	help

	  This option enables the user-space connection tracking helpers

	  infrastructure.



	  If unsure, say `N'.



config NETFILTER_NETLINK_QUEUE_CT

        bool "NFQUEUE integration with Connection Tracking"

        default n

        depends on NETFILTER_NETLINK_QUEUE

	help

	  If this option is enabled, NFQUEUE can include Connection Tracking

	  information together with the packet is the enqueued via NFNETLINK.



endif # NF_CONNTRACK



# transparent proxy support

net/netfilter/Makefile

+3 −1
Original line number Diff line number Diff line
@@ -9,7 +9,8 @@ obj-$(CONFIG_NETFILTER) = netfilter.o 


obj-$(CONFIG_NETFILTER_NETLINK) += nfnetlink.o

obj-$(CONFIG_NETFILTER_NETLINK_ACCT) += nfnetlink_acct.o

obj-$(CONFIG_NETFILTER_NETLINK_CTHELPER) += nfnetlink_cthelper.o

nfnetlink_queue-y := nfnetlink_queue_core.o

nfnetlink_queue-$(CONFIG_NETFILTER_NETLINK_QUEUE_CT) += nfnetlink_queue_ct.o

obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o

obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
@@ -25,6 +26,7 @@ obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o 
# netlink interface for nf_conntrack

obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o

obj-$(CONFIG_NF_CT_NETLINK_TIMEOUT) += nfnetlink_cttimeout.o

obj-$(CONFIG_NF_CT_NETLINK_HELPER) += nfnetlink_cthelper.o



# connection tracking helpers

nf_conntrack_h323-objs := nf_conntrack_h323_main.o nf_conntrack_h323_asn1.o

net/netfilter/nf_conntrack_helper.c

+7 −1
Original line number Diff line number Diff line
@@ -229,7 +229,13 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, 
			goto out;

		}

	} else {

		memset(help->data, 0, helper->data_len);

		/* We only allow helper re-assignment of the same sort since

		 * we cannot reallocate the helper extension area.

		 */

		if (help->helper != helper) {

			RCU_INIT_POINTER(help->helper, NULL);

			goto out;

		}

	}



	rcu_assign_pointer(help->helper, helper);

net/netfilter/nf_conntrack_netlink.c

+7 −17
Original line number Diff line number Diff line
@@ -1224,19 +1224,12 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[]) 
			if (helper->from_nlattr && helpinfo)

				helper->from_nlattr(helpinfo, ct);

			return 0;

		}

		if (help->helper)

		} else

			return -EBUSY;

		/* need to zero data of old helper */

		memset(help->data, 0, help->helper->data_len);

	} else {

		/* we cannot set a helper for an existing conntrack */

		return -EOPNOTSUPP;

	}



	rcu_assign_pointer(help->helper, helper);



	return 0;

	/* we cannot set a helper for an existing conntrack */

	return -EOPNOTSUPP;

}



static inline int
@@ -1634,8 +1627,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, 
	return err;

}



#if defined(CONFIG_NETFILTER_NETLINK_QUEUE) ||	\

    defined(CONFIG_NETFILTER_NETLINK_QUEUE_MODULE)

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

static size_t

ctnetlink_nfqueue_build_size(const struct nf_conn *ct)

{
@@ -1769,7 +1761,7 @@ static struct nfq_ct_hook ctnetlink_nfqueue_hook = { 
	.seq_adjust	= nf_nat_tcp_seq_adjust,

#endif

};

#endif /* CONFIG_NETFILTER_NETLINK_QUEUE */

#endif /* CONFIG_NETFILTER_NETLINK_QUEUE_CT */



/***********************************************************************

 * EXPECT
@@ -2575,8 +2567,7 @@ static int __init ctnetlink_init(void) 
		pr_err("ctnetlink_init: cannot register pernet operations\n");

		goto err_unreg_exp_subsys;

	}

#if defined(CONFIG_NETFILTER_NETLINK_QUEUE) ||	\

    defined(CONFIG_NETFILTER_NETLINK_QUEUE_MODULE)

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

	/* setup interaction between nf_queue and nf_conntrack_netlink. */

	RCU_INIT_POINTER(nfq_ct_hook, &ctnetlink_nfqueue_hook);

#endif
@@ -2597,8 +2588,7 @@ static void __exit ctnetlink_exit(void) 
	unregister_pernet_subsys(&ctnetlink_net_ops);

	nfnetlink_subsys_unregister(&ctnl_exp_subsys);

	nfnetlink_subsys_unregister(&ctnl_subsys);

#if defined(CONFIG_NETFILTER_NETLINK_QUEUE) ||	\

    defined(CONFIG_NETFILTER_NETLINK_QUEUE_MODULE)

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

	RCU_INIT_POINTER(nfq_ct_hook, NULL);

#endif

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE