GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-19 05:04:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Browse source 
Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) br_netfilter drops IPv6 packets if ipv6 is disabled, from Leonardo Bras.

2) nft_socket hits BUG() due to illegal skb->sk caching, patch from
   Fernando Fernandez Mancera.

3) nft_fib_netdev could be called with ipv6 disabled, leading to crash
   in the fib lookup, also from Leonardo.

4) ctnetlink honors IPS_OFFLOAD flag, just like nf_conntrack sysctl does.

5) Properly set up flowtable entry timeout, otherwise immediate
   removal by garbage collector might occur.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2019-09-05 00:03:55 +02:00
commit d471c6f774
5 changed files with 16 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
net/bridge/br_netfilter_hooks.c
View file

@ -496,6 +496,10 @@ static unsigned int br_nf_pre_routing(void *priv,
if (!brnet->call_ip6tables && if (!brnet->call_ip6tables &&
!br_opt_get(br, BROPT_NF_CALL_IP6TABLES)) !br_opt_get(br, BROPT_NF_CALL_IP6TABLES))
return NF_ACCEPT; return NF_ACCEPT;
if (!ipv6_mod_enabled()) {
pr_warn_once("Module ipv6 is disabled, so call_ip6tables is not supported.");
return NF_DROP;
}
nf_bridge_pull_encap_header_rcsum(skb); nf_bridge_pull_encap_header_rcsum(skb);
return br_nf_pre_routing_ipv6(priv, skb, state); return br_nf_pre_routing_ipv6(priv, skb, state);

7
net/netfilter/nf_conntrack_netlink.c
View file

@ -553,10 +553,8 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
goto nla_put_failure; goto nla_put_failure;
if (ctnetlink_dump_status(skb, ct) < 0 || if (ctnetlink_dump_status(skb, ct) < 0 ||
ctnetlink_dump_timeout(skb, ct) < 0 ||
ctnetlink_dump_acct(skb, ct, type) < 0 || ctnetlink_dump_acct(skb, ct, type) < 0 ||
ctnetlink_dump_timestamp(skb, ct) < 0 || ctnetlink_dump_timestamp(skb, ct) < 0 ||
ctnetlink_dump_protoinfo(skb, ct) < 0 ||
ctnetlink_dump_helpinfo(skb, ct) < 0 || ctnetlink_dump_helpinfo(skb, ct) < 0 ||
ctnetlink_dump_mark(skb, ct) < 0 || ctnetlink_dump_mark(skb, ct) < 0 ||
ctnetlink_dump_secctx(skb, ct) < 0 || ctnetlink_dump_secctx(skb, ct) < 0 ||
@ -568,6 +566,11 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
ctnetlink_dump_ct_synproxy(skb, ct) < 0) ctnetlink_dump_ct_synproxy(skb, ct) < 0)
goto nla_put_failure; goto nla_put_failure;
if (!test_bit(IPS_OFFLOAD_BIT, &ct->status) &&
(ctnetlink_dump_timeout(skb, ct) < 0 ||
ctnetlink_dump_protoinfo(skb, ct) < 0))
goto nla_put_failure;
nlmsg_end(skb, nlh); nlmsg_end(skb, nlh);
return skb->len; return skb->len;

2
net/netfilter/nf_flow_table_core.c
View file

@ -217,7 +217,7 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
return err; return err;
} }
flow->timeout = (u32)jiffies; flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
return 0; return 0;
} }
EXPORT_SYMBOL_GPL(flow_offload_add); EXPORT_SYMBOL_GPL(flow_offload_add);

3
net/netfilter/nft_fib_netdev.c
View file

@ -14,6 +14,7 @@
#include <linux/netfilter/nf_tables.h> #include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h> #include <net/netfilter/nf_tables_core.h>
#include <net/netfilter/nf_tables.h> #include <net/netfilter/nf_tables.h>
#include <net/ipv6.h>
#include <net/netfilter/nft_fib.h> #include <net/netfilter/nft_fib.h>
@ -34,6 +35,8 @@ static void nft_fib_netdev_eval(const struct nft_expr *expr,
} }
break; break;
case ETH_P_IPV6: case ETH_P_IPV6:
if (!ipv6_mod_enabled())
break;
switch (priv->result) { switch (priv->result) {
case NFT_FIB_RESULT_OIF: case NFT_FIB_RESULT_OIF:
case NFT_FIB_RESULT_OIFNAME: case NFT_FIB_RESULT_OIFNAME:

6
net/netfilter/nft_socket.c
View file

@ -47,9 +47,6 @@ static void nft_socket_eval(const struct nft_expr *expr,
return; return;
} }
/* So that subsequent socket matching not to require other lookups. */
skb->sk = sk;
switch(priv->key) { switch(priv->key) {
case NFT_SOCKET_TRANSPARENT: case NFT_SOCKET_TRANSPARENT:
nft_reg_store8(dest, inet_sk_transparent(sk)); nft_reg_store8(dest, inet_sk_transparent(sk));
@ -66,6 +63,9 @@ static void nft_socket_eval(const struct nft_expr *expr,
WARN_ON(1); WARN_ON(1);
regs->verdict.code = NFT_BREAK; regs->verdict.code = NFT_BREAK;
} }
if (sk != skb->sk)
sock_gen_put(sk);
} }
static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = { static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {