Skip to content

Commit 9a3cd87

Browse files
author
Paolo Abeni
committed
Merge tag 'nf-24-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Restrict xtables extensions to families that are safe, syzbot found a way to combine ebtables with extensions that are never used by userspace tools. From Florian Westphal. 2) Set l3mdev inconditionally whenever possible in nft_fib to fix lookup mismatch, also from Florian. netfilter pull request 24-10-09 * tag 'nf-24-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: netfilter: conntrack_vrf.sh: add fib test case netfilter: fib: check correct rtable in vrf setups netfilter: xtables: avoid NFPROTO_UNSPEC where needed ==================== Link: https://patch.msgid.link/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
2 parents ac888d5 + c6a0862 commit 9a3cd87

File tree

19 files changed

+459
-170
lines changed

19 files changed

+459
-170
lines changed

‎net/ipv4/netfilter/nft_fib_ipv4.c‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
6565
.flowi4_scope = RT_SCOPE_UNIVERSE,
6666
.flowi4_iif = LOOPBACK_IFINDEX,
6767
.flowi4_uid = sock_net_uid(nft_net(pkt), NULL),
68+
.flowi4_l3mdev = l3mdev_master_ifindex_rcu(nft_in(pkt)),
6869
};
6970
const struct net_device *oif;
7071
const struct net_device *found;
@@ -83,9 +84,6 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
8384
else
8485
oif = NULL;
8586

86-
if (priv->flags & NFTA_FIB_F_IIF)
87-
fl4.flowi4_l3mdev = l3mdev_master_ifindex_rcu(oif);
88-
8987
if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
9088
nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
9189
nft_fib_store_result(dest, priv, nft_in(pkt));

‎net/ipv6/netfilter/nft_fib_ipv6.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,6 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv,
4141
if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) {
4242
lookup_flags |= RT6_LOOKUP_F_IFACE;
4343
fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev);
44-
} else if (priv->flags & NFTA_FIB_F_IIF) {
45-
fl6->flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev);
4644
}
4745

4846
if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST)
@@ -75,6 +73,8 @@ static u32 __nft_fib6_eval_type(const struct nft_fib *priv,
7573
else if (priv->flags & NFTA_FIB_F_OIF)
7674
dev = nft_out(pkt);
7775

76+
fl6.flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev);
77+
7878
nft_fib6_flowi_init(&fl6, priv, pkt, dev, iph);
7979

8080
if (dev && nf_ipv6_chk_addr(nft_net(pkt), &fl6.daddr, dev, true))
@@ -165,6 +165,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
165165
.flowi6_iif = LOOPBACK_IFINDEX,
166166
.flowi6_proto = pkt->tprot,
167167
.flowi6_uid = sock_net_uid(nft_net(pkt), NULL),
168+
.flowi6_l3mdev = l3mdev_master_ifindex_rcu(nft_in(pkt)),
168169
};
169170
struct rt6_info *rt;
170171
int lookup_flags;

‎net/netfilter/xt_CHECKSUM.c‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -63,24 +63,37 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)
6363
return 0;
6464
}
6565

66-
static struct xt_target checksum_tg_reg __read_mostly = {
67-
.name = "CHECKSUM",
68-
.family = NFPROTO_UNSPEC,
69-
.target = checksum_tg,
70-
.targetsize = sizeof(struct xt_CHECKSUM_info),
71-
.table = "mangle",
72-
.checkentry = checksum_tg_check,
73-
.me = THIS_MODULE,
66+
static struct xt_target checksum_tg_reg[] __read_mostly = {
67+
{
68+
.name = "CHECKSUM",
69+
.family = NFPROTO_IPV4,
70+
.target = checksum_tg,
71+
.targetsize = sizeof(struct xt_CHECKSUM_info),
72+
.table = "mangle",
73+
.checkentry = checksum_tg_check,
74+
.me = THIS_MODULE,
75+
},
76+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
77+
{
78+
.name = "CHECKSUM",
79+
.family = NFPROTO_IPV6,
80+
.target = checksum_tg,
81+
.targetsize = sizeof(struct xt_CHECKSUM_info),
82+
.table = "mangle",
83+
.checkentry = checksum_tg_check,
84+
.me = THIS_MODULE,
85+
},
86+
#endif
7487
};
7588

7689
static int __init checksum_tg_init(void)
7790
{
78-
return xt_register_target(&checksum_tg_reg);
91+
return xt_register_targets(checksum_tg_reg, ARRAY_SIZE(checksum_tg_reg));
7992
}
8093

8194
static void __exit checksum_tg_exit(void)
8295
{
83-
xt_unregister_target(&checksum_tg_reg);
96+
xt_unregister_targets(checksum_tg_reg, ARRAY_SIZE(checksum_tg_reg));
8497
}
8598

8699
module_init(checksum_tg_init);

‎net/netfilter/xt_CLASSIFY.c‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,9 @@ static struct xt_target classify_tg_reg[] __read_mostly = {
3838
{
3939
.name = "CLASSIFY",
4040
.revision = 0,
41-
.family = NFPROTO_UNSPEC,
41+
.family = NFPROTO_IPV4,
4242
.hooks = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
43-
(1 << NF_INET_POST_ROUTING),
43+
(1 << NF_INET_POST_ROUTING),
4444
.target = classify_tg,
4545
.targetsize = sizeof(struct xt_classify_target_info),
4646
.me = THIS_MODULE,
@@ -54,6 +54,18 @@ static struct xt_target classify_tg_reg[] __read_mostly = {
5454
.targetsize = sizeof(struct xt_classify_target_info),
5555
.me = THIS_MODULE,
5656
},
57+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
58+
{
59+
.name = "CLASSIFY",
60+
.revision = 0,
61+
.family = NFPROTO_IPV6,
62+
.hooks = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
63+
(1 << NF_INET_POST_ROUTING),
64+
.target = classify_tg,
65+
.targetsize = sizeof(struct xt_classify_target_info),
66+
.me = THIS_MODULE,
67+
},
68+
#endif
5769
};
5870

5971
static int __init classify_tg_init(void)

‎net/netfilter/xt_CONNSECMARK.c‎

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -114,25 +114,39 @@ static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par)
114114
nf_ct_netns_put(par->net, par->family);
115115
}
116116

117-
static struct xt_target connsecmark_tg_reg __read_mostly = {
118-
.name = "CONNSECMARK",
119-
.revision = 0,
120-
.family = NFPROTO_UNSPEC,
121-
.checkentry = connsecmark_tg_check,
122-
.destroy = connsecmark_tg_destroy,
123-
.target = connsecmark_tg,
124-
.targetsize = sizeof(struct xt_connsecmark_target_info),
125-
.me = THIS_MODULE,
117+
static struct xt_target connsecmark_tg_reg[] __read_mostly = {
118+
{
119+
.name = "CONNSECMARK",
120+
.revision = 0,
121+
.family = NFPROTO_IPV4,
122+
.checkentry = connsecmark_tg_check,
123+
.destroy = connsecmark_tg_destroy,
124+
.target = connsecmark_tg,
125+
.targetsize = sizeof(struct xt_connsecmark_target_info),
126+
.me = THIS_MODULE,
127+
},
128+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
129+
{
130+
.name = "CONNSECMARK",
131+
.revision = 0,
132+
.family = NFPROTO_IPV6,
133+
.checkentry = connsecmark_tg_check,
134+
.destroy = connsecmark_tg_destroy,
135+
.target = connsecmark_tg,
136+
.targetsize = sizeof(struct xt_connsecmark_target_info),
137+
.me = THIS_MODULE,
138+
},
139+
#endif
126140
};
127141

128142
static int __init connsecmark_tg_init(void)
129143
{
130-
return xt_register_target(&connsecmark_tg_reg);
144+
return xt_register_targets(connsecmark_tg_reg, ARRAY_SIZE(connsecmark_tg_reg));
131145
}
132146

133147
static void __exit connsecmark_tg_exit(void)
134148
{
135-
xt_unregister_target(&connsecmark_tg_reg);
149+
xt_unregister_targets(connsecmark_tg_reg, ARRAY_SIZE(connsecmark_tg_reg));
136150
}
137151

138152
module_init(connsecmark_tg_init);

‎net/netfilter/xt_CT.c‎

Lines changed: 69 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -313,10 +313,30 @@ static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
313313
xt_ct_tg_destroy(par, par->targinfo);
314314
}
315315

316+
static unsigned int
317+
notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
318+
{
319+
/* Previously seen (loopback)? Ignore. */
320+
if (skb->_nfct != 0)
321+
return XT_CONTINUE;
322+
323+
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
324+
325+
return XT_CONTINUE;
326+
}
327+
316328
static struct xt_target xt_ct_tg_reg[] __read_mostly = {
329+
{
330+
.name = "NOTRACK",
331+
.revision = 0,
332+
.family = NFPROTO_IPV4,
333+
.target = notrack_tg,
334+
.table = "raw",
335+
.me = THIS_MODULE,
336+
},
317337
{
318338
.name = "CT",
319-
.family = NFPROTO_UNSPEC,
339+
.family = NFPROTO_IPV4,
320340
.targetsize = sizeof(struct xt_ct_target_info),
321341
.usersize = offsetof(struct xt_ct_target_info, ct),
322342
.checkentry = xt_ct_tg_check_v0,
@@ -327,7 +347,7 @@ static struct xt_target xt_ct_tg_reg[] __read_mostly = {
327347
},
328348
{
329349
.name = "CT",
330-
.family = NFPROTO_UNSPEC,
350+
.family = NFPROTO_IPV4,
331351
.revision = 1,
332352
.targetsize = sizeof(struct xt_ct_target_info_v1),
333353
.usersize = offsetof(struct xt_ct_target_info, ct),
@@ -339,7 +359,7 @@ static struct xt_target xt_ct_tg_reg[] __read_mostly = {
339359
},
340360
{
341361
.name = "CT",
342-
.family = NFPROTO_UNSPEC,
362+
.family = NFPROTO_IPV4,
343363
.revision = 2,
344364
.targetsize = sizeof(struct xt_ct_target_info_v1),
345365
.usersize = offsetof(struct xt_ct_target_info, ct),
@@ -349,49 +369,61 @@ static struct xt_target xt_ct_tg_reg[] __read_mostly = {
349369
.table = "raw",
350370
.me = THIS_MODULE,
351371
},
352-
};
353-
354-
static unsigned int
355-
notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
356-
{
357-
/* Previously seen (loopback)? Ignore. */
358-
if (skb->_nfct != 0)
359-
return XT_CONTINUE;
360-
361-
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
362-
363-
return XT_CONTINUE;
364-
}
365-
366-
static struct xt_target notrack_tg_reg __read_mostly = {
367-
.name = "NOTRACK",
368-
.revision = 0,
369-
.family = NFPROTO_UNSPEC,
370-
.target = notrack_tg,
371-
.table = "raw",
372-
.me = THIS_MODULE,
372+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
373+
{
374+
.name = "NOTRACK",
375+
.revision = 0,
376+
.family = NFPROTO_IPV6,
377+
.target = notrack_tg,
378+
.table = "raw",
379+
.me = THIS_MODULE,
380+
},
381+
{
382+
.name = "CT",
383+
.family = NFPROTO_IPV6,
384+
.targetsize = sizeof(struct xt_ct_target_info),
385+
.usersize = offsetof(struct xt_ct_target_info, ct),
386+
.checkentry = xt_ct_tg_check_v0,
387+
.destroy = xt_ct_tg_destroy_v0,
388+
.target = xt_ct_target_v0,
389+
.table = "raw",
390+
.me = THIS_MODULE,
391+
},
392+
{
393+
.name = "CT",
394+
.family = NFPROTO_IPV6,
395+
.revision = 1,
396+
.targetsize = sizeof(struct xt_ct_target_info_v1),
397+
.usersize = offsetof(struct xt_ct_target_info, ct),
398+
.checkentry = xt_ct_tg_check_v1,
399+
.destroy = xt_ct_tg_destroy_v1,
400+
.target = xt_ct_target_v1,
401+
.table = "raw",
402+
.me = THIS_MODULE,
403+
},
404+
{
405+
.name = "CT",
406+
.family = NFPROTO_IPV6,
407+
.revision = 2,
408+
.targetsize = sizeof(struct xt_ct_target_info_v1),
409+
.usersize = offsetof(struct xt_ct_target_info, ct),
410+
.checkentry = xt_ct_tg_check_v2,
411+
.destroy = xt_ct_tg_destroy_v1,
412+
.target = xt_ct_target_v1,
413+
.table = "raw",
414+
.me = THIS_MODULE,
415+
},
416+
#endif
373417
};
374418

375419
static int __init xt_ct_tg_init(void)
376420
{
377-
int ret;
378-
379-
ret = xt_register_target(&notrack_tg_reg);
380-
if (ret < 0)
381-
return ret;
382-
383-
ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
384-
if (ret < 0) {
385-
xt_unregister_target(&notrack_tg_reg);
386-
return ret;
387-
}
388-
return 0;
421+
return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
389422
}
390423

391424
static void __exit xt_ct_tg_exit(void)
392425
{
393426
xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
394-
xt_unregister_target(&notrack_tg_reg);
395427
}
396428

397429
module_init(xt_ct_tg_init);

‎net/netfilter/xt_IDLETIMER.c‎

Lines changed: 40 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -458,28 +458,49 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
458458

459459
static struct xt_target idletimer_tg[] __read_mostly = {
460460
{
461-
.name = "IDLETIMER",
462-
.family = NFPROTO_UNSPEC,
463-
.target = idletimer_tg_target,
464-
.targetsize = sizeof(struct idletimer_tg_info),
465-
.usersize = offsetof(struct idletimer_tg_info, timer),
466-
.checkentry = idletimer_tg_checkentry,
467-
.destroy = idletimer_tg_destroy,
468-
.me = THIS_MODULE,
461+
.name = "IDLETIMER",
462+
.family = NFPROTO_IPV4,
463+
.target = idletimer_tg_target,
464+
.targetsize = sizeof(struct idletimer_tg_info),
465+
.usersize = offsetof(struct idletimer_tg_info, timer),
466+
.checkentry = idletimer_tg_checkentry,
467+
.destroy = idletimer_tg_destroy,
468+
.me = THIS_MODULE,
469469
},
470470
{
471-
.name = "IDLETIMER",
472-
.family = NFPROTO_UNSPEC,
473-
.revision = 1,
474-
.target = idletimer_tg_target_v1,
475-
.targetsize = sizeof(struct idletimer_tg_info_v1),
476-
.usersize = offsetof(struct idletimer_tg_info_v1, timer),
477-
.checkentry = idletimer_tg_checkentry_v1,
478-
.destroy = idletimer_tg_destroy_v1,
479-
.me = THIS_MODULE,
471+
.name = "IDLETIMER",
472+
.family = NFPROTO_IPV4,
473+
.revision = 1,
474+
.target = idletimer_tg_target_v1,
475+
.targetsize = sizeof(struct idletimer_tg_info_v1),
476+
.usersize = offsetof(struct idletimer_tg_info_v1, timer),
477+
.checkentry = idletimer_tg_checkentry_v1,
478+
.destroy = idletimer_tg_destroy_v1,
479+
.me = THIS_MODULE,
480480
},
481-
482-
481+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
482+
{
483+
.name = "IDLETIMER",
484+
.family = NFPROTO_IPV6,
485+
.target = idletimer_tg_target,
486+
.targetsize = sizeof(struct idletimer_tg_info),
487+
.usersize = offsetof(struct idletimer_tg_info, timer),
488+
.checkentry = idletimer_tg_checkentry,
489+
.destroy = idletimer_tg_destroy,
490+
.me = THIS_MODULE,
491+
},
492+
{
493+
.name = "IDLETIMER",
494+
.family = NFPROTO_IPV6,
495+
.revision = 1,
496+
.target = idletimer_tg_target_v1,
497+
.targetsize = sizeof(struct idletimer_tg_info_v1),
498+
.usersize = offsetof(struct idletimer_tg_info_v1, timer),
499+
.checkentry = idletimer_tg_checkentry_v1,
500+
.destroy = idletimer_tg_destroy_v1,
501+
.me = THIS_MODULE,
502+
},
503+
#endif
483504
};
484505

485506
static struct class *idletimer_tg_class;

0 commit comments

Comments
 (0)