Commit 05a5474e authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Florian Westphal says:

====================
netfilter: bug fixes for net

1. Fix IP address check in irc DCC conntrack helper, this should check
   the opposite direction rather than the destination address of the
   packets' direction, from David Leadbeater.

2. bridge netfilter needs to drop dst references, from Harsh Modi.
   This was fine back in the day the code was originally written,
   but nowadays various tunnels can pre-set metadata dsts on packets.

3. Remove nf_conntrack_helper sysctl and the modparam toggle, users
   need to explicitily assign the helpers to use via nftables or
   iptables.  Conntrack helpers, by design, may be used to add dynamic
   port redirections to internal machines, so its necessary to restrict
   which hosts/peers are allowed to use them.
   It was discovered that improper checking in the irc DCC helper makes
   it possible to trigger the 'please do dynamic port forward'
   from outside by embedding a 'DCC' in a PING request; if the client
   echos that back a expectation/port forward gets added.
   The auto-assign-for-everything mechanism has been in "please don't do this"
   territory since 2012.  From Pablo.

4. Fix a memory leak in the netdev hook error unwind path, also from Pablo.

* git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nf_conntrack_irc: Fix forged IP logic
  netfilter: nf_tables: clean up hook list when offload flags check fails
  netfilter: br_netfilter: Drop dst references before setting.
  netfilter: remove nf_conntrack_helper sysctl and modparam toggles
====================

Link: https://lore.kernel.org/r/20220901071238.3044-1-fw@strlen.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents e7506d34 0efe125c

include/net/netfilter/nf_conntrack.h

+0 −2
Original line number Diff line number Diff line
@@ -53,8 +53,6 @@ struct nf_conntrack_net { 
	/* only used when new connection is allocated: */

	atomic_t count;

	unsigned int expect_count;

	u8 sysctl_auto_assign_helper;

	bool auto_assign_helper_warned;



	/* only used from work queues, configuration plane, and so on: */

	unsigned int users4;

include/net/netns/conntrack.h

+0 −1
Original line number Diff line number Diff line
@@ -101,7 +101,6 @@ struct netns_ct { 
	u8			sysctl_log_invalid; /* Log invalid packets */

	u8			sysctl_events;

	u8			sysctl_acct;

	u8			sysctl_auto_assign_helper;

	u8			sysctl_tstamp;

	u8			sysctl_checksum;

net/bridge/br_netfilter_hooks.c

+2 −0
Original line number Diff line number Diff line
@@ -384,6 +384,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ 
				/* - Bridged-and-DNAT'ed traffic doesn't

				 *   require ip_forwarding. */

				if (rt->dst.dev == dev) {

					skb_dst_drop(skb);

					skb_dst_set(skb, &rt->dst);

					goto bridged_dnat;

				}
@@ -413,6 +414,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ 
			kfree_skb(skb);

			return 0;

		}

		skb_dst_drop(skb);

		skb_dst_set_noref(skb, &rt->dst);

	}

net/bridge/br_netfilter_ipv6.c

+1 −0
Original line number Diff line number Diff line
@@ -197,6 +197,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc 
			kfree_skb(skb);

			return 0;

		}

		skb_dst_drop(skb);

		skb_dst_set_noref(skb, &rt->dst);

	}

net/netfilter/nf_conntrack_core.c

+1 −6
Original line number Diff line number Diff line
@@ -1782,7 +1782,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl, 
		}

		spin_unlock_bh(&nf_conntrack_expect_lock);

	}

	if (!exp)

	if (!exp && tmpl)

		__nf_ct_try_assign_helper(ct, tmpl, GFP_ATOMIC);



	/* Other CPU might have obtained a pointer to this object before it was
@@ -2068,10 +2068,6 @@ void nf_conntrack_alter_reply(struct nf_conn *ct, 
	ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;

	if (ct->master || (help && !hlist_empty(&help->expectations)))

		return;



	rcu_read_lock();

	__nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC);

	rcu_read_unlock();

}

EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
@@ -2797,7 +2793,6 @@ int nf_conntrack_init_net(struct net *net) 
	nf_conntrack_acct_pernet_init(net);

	nf_conntrack_tstamp_pernet_init(net);

	nf_conntrack_ecache_pernet_init(net);

	nf_conntrack_helper_pernet_init(net);

	nf_conntrack_proto_pernet_init(net);



	return 0;