linux.git/net/netfilter, branch v3.15

ipvs: Fix panic due to non-linear skb

2014-05-26T01:22:46+00:00

Receiving a ICMP response to an IPIP packet in a non-linear skb could
cause a kernel panic in __skb_pull.

The problem was introduced in
commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e ("ipvs: implement
passive PMTUD for IPIP packets").

Signed-off-by: Peter Christensen 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

netfilter: nf_tables: fix trace of matching non-terminal rule

2014-05-15T17:44:20+00:00

Add the corresponding trace if we have a full match in a non-terminal
rule. Note that the traces will look slightly different than in
x_tables since the log message after all expressions have been
evaluated (contrary to x_tables, that emits it before the target
action). This manifests in two differences in nf_tables wrt. x_tables:

1) The rule that enables the tracing is included in the trace.

2) If the rule emits some log message, that is shown before the
   trace log message.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix missing return trace at the end of non-base chain

2014-05-12T14:33:11+00:00

Display "return" for implicit rule at the end of a non-base chain,
instead of when popping chain from the stack.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix bogus rulenum after goto action

2014-05-12T14:33:10+00:00

After returning from the chain that we just went to with no matchings,
we get a bogus rule number in the trace. To fix this, we would need
to iterate over the list of remaining rules in the chain to update the
rule number counter.

Patrick suggested to set this to the maximum value since the default
base chain policy is the very last action when the processing the base
chain is over.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix tracing of the goto action

2014-05-12T14:33:08+00:00

Add missing code to trace goto actions.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix goto action

2014-05-12T14:32:41+00:00

This patch fixes a crash when trying to access the counters and the
default chain policy from the non-base chain that we have reached
via the goto chain. Fix this by falling back on the original base
chain after returning from the custom chain.

While fixing this, kill the inline function to account chain statistics
to improve source code readability.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: reset rule number counter after jump and goto

2014-05-10T17:12:04+00:00

Otherwise we start incrementing the rule number counter from the
previous chain iteration.

Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: Fix use after free when it fails to process batch

2014-05-04T13:14:08+00:00

This bug manifests when calling the nft command line tool without
nf_tables kernel support.

kernel message:
[   44.071555] Netfilter messages via NETLINK v0.30.
[   44.072253] BUG: unable to handle kernel NULL pointer dereference at 0000000000000119
[   44.072264] IP: [] netlink_getsockbyportid+0xf/0x70
[   44.072272] PGD 7f2b74067 PUD 7f2b73067 PMD 0
[   44.072277] Oops: 0000 [#1] SMP
[...]
[   44.072369] Call Trace:
[   44.072373]  [] netlink_unicast+0x91/0x200
[   44.072377]  [] netlink_ack+0x99/0x110
[   44.072381]  [] nfnetlink_rcv+0x3c1/0x408 [nfnetlink]
[   44.072385]  [] netlink_unicast+0xf3/0x200
[   44.072389]  [] netlink_sendmsg+0x2ff/0x740
[   44.072394]  [] ? __mmdrop+0x62/0x90
[   44.072398]  [] sock_sendmsg+0x8b/0xc0
[   44.072403]  [] ? copy_user_enhanced_fast_string+0x5/0x10
[   44.072406]  [] ? move_addr_to_kernel+0x2c/0x50
[   44.072410]  [] ___sys_sendmsg+0x3c3/0x3d0
[   44.072415]  [] ? handle_mm_fault+0xa9a/0xc60
[   44.072420]  [] ? mmap_region+0x166/0x5a0
[   44.072424]  [] ? __do_page_fault+0x1dc/0x510
[   44.072428]  [] ? apparmor_capable+0x1c/0x60
[   44.072435]  [] ? _raw_spin_unlock_bh+0x1a/0x20
[   44.072439]  [] ? release_sock+0x106/0x150
[   44.072443]  [] __sys_sendmsg+0x42/0x80
[   44.072446]  [] SyS_sendmsg+0x12/0x20
[   44.072450]  [] system_call_fastpath+0x1a/0x1f

Signed-off-by: Denys Fedoryshchenko 
Signed-off-by: Pablo Neira Ayuso

netfilter: ctnetlink: don't add null bindings if no nat requested

2014-04-29T18:49:08+00:00

commit 0eba801b64cc8284d9024c7ece30415a2b981a72 tried to fix a race
where nat initialisation can happen after ctnetlink-created conntrack
has been created.

However, it causes the nat module(s) to be loaded needlessly on
systems that are not using NAT.

Fortunately, we do not have to create null bindings in that case.

conntracks injected via ctnetlink always have the CONFIRMED bit set,
which prevents addition of the nat extension in nf_nat_ipv4/6_fn().

We only need to make sure that either no nat extension is added
or that we've created both src and dst manips.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: Fix warning in nfnetlink_receive().

2014-04-24T17:51:29+00:00

net/netfilter/nfnetlink.c: In function ‘nfnetlink_rcv’:
net/netfilter/nfnetlink.c:371:14: warning: unused variable ‘net’ [-Wunused-variable]

Signed-off-by: David S. Miller