Commit 807192de authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for your net tree:

1) rbtree lookup from control plane returns the left-hand side element
   of the range when the interval end flag is set on.

2) osf extension is not supported from the input path, reject this from
   the control plane, from Fernando Fernandez Mancera.

3) xt_TEE is leaving output interface unset due to a recent incorrect
   netns rework, from Taehee Yoo.

4) xt_TEE allows to select an interface which does not belong to this
   netnamespace, from Taehee Yoo.

5) Zero private extension area in nft_compat, just like we do in x_tables,
   otherwise we leak kernel memory to userspace.

6) Missing .checkentry and .destroy entries in new DNAT extensions breaks
   it since we never load nf_conntrack dependencies, from Paolo Abeni.

7) Do not remove flowtable hook from netns exit path, the netdevice handler
   already deals with this, also from Taehee Yoo.

8) Only cleanup flowtable entries that reside in this netnamespace, also
   from Taehee Yoo.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents e929ceb6 a3fb3698

net/netfilter/nf_flow_table_core.c

+6 −3
Original line number Diff line number Diff line
@@ -465,14 +465,17 @@ EXPORT_SYMBOL_GPL(nf_flow_table_init); 
static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)

{

	struct net_device *dev = data;

	struct flow_offload_entry *e;



	e = container_of(flow, struct flow_offload_entry, flow);



	if (!dev) {

		flow_offload_teardown(flow);

		return;

	}



	if (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||

	    flow->tuplehash[1].tuple.iifidx == dev->ifindex)

	if (net_eq(nf_ct_net(e->ct), dev_net(dev)) &&

	    (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||

	     flow->tuplehash[1].tuple.iifidx == dev->ifindex))

		flow_offload_dead(flow);

}

net/netfilter/nf_tables_api.c

+0 −3
Original line number Diff line number Diff line
@@ -7280,9 +7280,6 @@ static void __nft_release_tables(struct net *net) 


		list_for_each_entry(chain, &table->chains, list)

			nf_tables_unregister_hook(net, table, chain);

		list_for_each_entry(flowtable, &table->flowtables, list)

			nf_unregister_net_hooks(net, flowtable->ops,

						flowtable->ops_len);

		/* No packets are walking on these chains anymore. */

		ctx.table = table;

		list_for_each_entry(chain, &table->chains, list) {

net/netfilter/nft_compat.c

+22 −2
Original line number Diff line number Diff line
@@ -290,6 +290,24 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) 
		module_put(target->me);

}



static int nft_extension_dump_info(struct sk_buff *skb, int attr,

				   const void *info,

				   unsigned int size, unsigned int user_size)

{

	unsigned int info_size, aligned_size = XT_ALIGN(size);

	struct nlattr *nla;



	nla = nla_reserve(skb, attr, aligned_size);

	if (!nla)

		return -1;



	info_size = user_size ? : size;

	memcpy(nla_data(nla), info, info_size);

	memset(nla_data(nla) + info_size, 0, aligned_size - info_size);



	return 0;

}



static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr)

{

	const struct xt_target *target = expr->ops->data;
@@ -297,7 +315,8 @@ static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr) 


	if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) ||

	    nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) ||

	    nla_put(skb, NFTA_TARGET_INFO, XT_ALIGN(target->targetsize), info))

	    nft_extension_dump_info(skb, NFTA_TARGET_INFO, info,

				    target->targetsize, target->usersize))

		goto nla_put_failure;



	return 0;
@@ -532,7 +551,8 @@ static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr, 


	if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) ||

	    nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) ||

	    nla_put(skb, NFTA_MATCH_INFO, XT_ALIGN(match->matchsize), info))

	    nft_extension_dump_info(skb, NFTA_MATCH_INFO, info,

				    match->matchsize, match->usersize))

		goto nla_put_failure;



	return 0;

net/netfilter/nft_osf.c

+10 −0
Original line number Diff line number Diff line
@@ -82,6 +82,15 @@ nla_put_failure: 
	return -1;

}



static int nft_osf_validate(const struct nft_ctx *ctx,

			    const struct nft_expr *expr,

			    const struct nft_data **data)

{

	return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |

						    (1 << NF_INET_PRE_ROUTING) |

						    (1 << NF_INET_FORWARD));

}



static struct nft_expr_type nft_osf_type;

static const struct nft_expr_ops nft_osf_op = {

	.eval		= nft_osf_eval,
@@ -89,6 +98,7 @@ static const struct nft_expr_ops nft_osf_op = { 
	.init		= nft_osf_init,

	.dump		= nft_osf_dump,

	.type		= &nft_osf_type,

	.validate	= nft_osf_validate,

};



static struct nft_expr_type nft_osf_type __read_mostly = {

net/netfilter/nft_set_rbtree.c

+8 −2
Original line number Diff line number Diff line
@@ -135,9 +135,12 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, 
		d = memcmp(this, key, set->klen);

		if (d < 0) {

			parent = rcu_dereference_raw(parent->rb_left);

			if (!(flags & NFT_SET_ELEM_INTERVAL_END))

				interval = rbe;

		} else if (d > 0) {

			parent = rcu_dereference_raw(parent->rb_right);

			if (flags & NFT_SET_ELEM_INTERVAL_END)

				interval = rbe;

		} else {

			if (!nft_set_elem_active(&rbe->ext, genmask))

				parent = rcu_dereference_raw(parent->rb_left);
@@ -154,7 +157,10 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set, 


	if (set->flags & NFT_SET_INTERVAL && interval != NULL &&

	    nft_set_elem_active(&interval->ext, genmask) &&

	    !nft_rbtree_interval_end(interval)) {

	    ((!nft_rbtree_interval_end(interval) &&

	      !(flags & NFT_SET_ELEM_INTERVAL_END)) ||

	     (nft_rbtree_interval_end(interval) &&

	      (flags & NFT_SET_ELEM_INTERVAL_END)))) {

		*elem = interval;

		return true;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE