Commit 29507144 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Refcount leak in ipt_CLUSTERIP rule loading path, from Xin Xiong.

2) Use socat in netfilter selftests, from Hangbin Liu.

3) Skip layer checksum 4 update for IP fragments.

4) Missing allocation of pcpu scratch maps on clone in
   nft_set_pipapo, from Florian Westphal.

* git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf:
  netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
  netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
  selftests: netfilter: switch to socat for tests using -q option
  netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
====================

Link: https://lore.kernel.org/r/20220106215139.170824-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 36595d8a 23c54263

net/ipv4/netfilter/ipt_CLUSTERIP.c

+4 −1
Original line number Diff line number Diff line
@@ -520,8 +520,11 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) 
			if (IS_ERR(config))

				return PTR_ERR(config);

		}

	} else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN))

	} else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) {

		clusterip_config_entry_put(config);

		clusterip_config_put(config);

		return -EINVAL;

	}



	ret = nf_ct_netns_get(par->net, par->family);

	if (ret < 0) {

net/netfilter/nft_payload.c

+3 −0
Original line number Diff line number Diff line
@@ -546,6 +546,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt, 
				     struct sk_buff *skb,

				     unsigned int *l4csum_offset)

{

	if (pkt->fragoff)

		return -1;



	switch (pkt->tprot) {

	case IPPROTO_TCP:

		*l4csum_offset = offsetof(struct tcphdr, check);

net/netfilter/nft_set_pipapo.c

+8 −0
Original line number Diff line number Diff line
@@ -1290,6 +1290,11 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) 
	if (!new->scratch_aligned)

		goto out_scratch;

#endif

	for_each_possible_cpu(i)

		*per_cpu_ptr(new->scratch, i) = NULL;



	if (pipapo_realloc_scratch(new, old->bsize_max))

		goto out_scratch_realloc;



	rcu_head_init(&new->rcu);
@@ -1334,6 +1339,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) 
		kvfree(dst->lt);

		dst--;

	}

out_scratch_realloc:

	for_each_possible_cpu(i)

		kfree(*per_cpu_ptr(new->scratch, i));

#ifdef NFT_PIPAPO_ALIGN

	free_percpu(new->scratch_aligned);

#endif

tools/testing/selftests/netfilter/ipip-conntrack-mtu.sh

+5 −4
Original line number Diff line number Diff line
@@ -41,7 +41,7 @@ checktool (){ 


checktool "iptables --version" "run test without iptables"

checktool "ip -Version" "run test without ip tool"

checktool "which nc" "run test without nc (netcat)"

checktool "which socat" "run test without socat"

checktool "ip netns add ${r_a}" "create net namespace"



for n in ${r_b} ${r_w} ${c_a} ${c_b};do
@@ -60,11 +60,12 @@ trap cleanup EXIT 
test_path() {

	msg="$1"



	ip netns exec ${c_b} nc -n -w 3 -q 3 -u -l -p 5000 > ${rx} < /dev/null &

	ip netns exec ${c_b} socat -t 3 - udp4-listen:5000,reuseaddr > ${rx} < /dev/null &



	sleep 1

	for i in 1 2 3; do

		head -c1400 /dev/zero | tr "\000" "a" | ip netns exec ${c_a} nc -n -w 1 -u 192.168.20.2 5000

		head -c1400 /dev/zero | tr "\000" "a" | \

			ip netns exec ${c_a} socat -t 1 -u STDIN UDP:192.168.20.2:5000

	done



	wait
@@ -189,7 +190,7 @@ ip netns exec ${r_w} sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null 
#---------------------

#Now we send a 1400 bytes UDP packet from Client A to Client B:



# clienta:~# head -c1400 /dev/zero | tr "\000" "a" | nc -u 192.168.20.2 5000

# clienta:~# head -c1400 /dev/zero | tr "\000" "a" | socat -u STDIN UDP:192.168.20.2:5000

test_path "without"



# The IPv4 stack on Client A already knows the PMTU to Client B, so the

tools/testing/selftests/netfilter/nf_nat_edemux.sh

+5 −5
Original line number Diff line number Diff line
@@ -76,23 +76,23 @@ ip netns exec $ns2 ip route add 10.96.0.1 via 192.168.1.1 
sleep 1



# add a persistent connection from the other namespace

ip netns exec $ns2 nc -q 10 -w 10 192.168.1.1 5201 > /dev/null &

ip netns exec $ns2 socat -t 10 - TCP:192.168.1.1:5201 > /dev/null &



sleep 1



# ip daddr:dport will be rewritten to 192.168.1.1 5201

# NAT must reallocate source port 10000 because

# 192.168.1.2:10000 -> 192.168.1.1:5201 is already in use

echo test | ip netns exec $ns2 nc -w 3 -q 3 10.96.0.1 443 >/dev/null

echo test | ip netns exec $ns2 socat -t 3 -u STDIN TCP:10.96.0.1:443 >/dev/null

ret=$?



kill $iperfs



# Check nc can connect to 10.96.0.1:443 (aka 192.168.1.1:5201).

# Check socat can connect to 10.96.0.1:443 (aka 192.168.1.1:5201).

if [ $ret -eq 0 ]; then

	echo "PASS: nc can connect via NAT'd address"

	echo "PASS: socat can connect via NAT'd address"

else

	echo "FAIL: nc cannot connect via NAT'd address"

	echo "FAIL: socat cannot connect via NAT'd address"

	exit 1

fi