Commit 894d0844 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for net-next:

1) Use array_size() in ebtables, from Gustavo A. R. Silva.

2) Attach IPS_ASSURED to internal UDP stream state, reported by
   Maciej Zenczykowski.

3) Add NFT_META_IFTYPE to match on the interface type either
   from ingress or egress.

4) Generalize pktinfo->tprot_set to flags field.

5) Allow to match on inner headers / payload data.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 2aec919f c46b38dc

include/net/netfilter/nf_tables.h

+8 −2
Original line number Diff line number Diff line
@@ -21,13 +21,19 @@ struct module; 


#define NFT_JUMP_STACK_SIZE	16



enum {

	NFT_PKTINFO_L4PROTO	= (1 << 0),

	NFT_PKTINFO_INNER	= (1 << 1),

};



struct nft_pktinfo {

	struct sk_buff			*skb;

	const struct nf_hook_state	*state;

	bool				tprot_set;

	u8				flags;

	u8				tprot;

	u16				fragoff;

	unsigned int			thoff;

	unsigned int			inneroff;

};



static inline struct sock *nft_sk(const struct nft_pktinfo *pkt)
@@ -75,7 +81,7 @@ static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, 


static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt)

{

	pkt->tprot_set = false;

	pkt->flags = 0;

	pkt->tprot = 0;

	pkt->thoff = 0;

	pkt->fragoff = 0;

include/net/netfilter/nf_tables_ipv4.h

+4 −3
Original line number Diff line number Diff line
@@ -10,7 +10,7 @@ static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt) 
	struct iphdr *ip;



	ip = ip_hdr(pkt->skb);

	pkt->tprot_set = true;

	pkt->flags = NFT_PKTINFO_L4PROTO;

	pkt->tprot = ip->protocol;

	pkt->thoff = ip_hdrlen(pkt->skb);

	pkt->fragoff = ntohs(ip->frag_off) & IP_OFFSET;
@@ -36,7 +36,7 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt) 
	else if (len < thoff)

		return -1;



	pkt->tprot_set = true;

	pkt->flags = NFT_PKTINFO_L4PROTO;

	pkt->tprot = iph->protocol;

	pkt->thoff = thoff;

	pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;
@@ -71,7 +71,7 @@ static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt) 
		goto inhdr_error;

	}



	pkt->tprot_set = true;

	pkt->flags = NFT_PKTINFO_L4PROTO;

	pkt->tprot = iph->protocol;

	pkt->thoff = thoff;

	pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;
@@ -82,4 +82,5 @@ static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt) 
	__IP_INC_STATS(nft_net(pkt), IPSTATS_MIB_INHDRERRORS);

	return -1;

}



#endif

include/net/netfilter/nf_tables_ipv6.h

+3 −3
Original line number Diff line number Diff line
@@ -18,7 +18,7 @@ static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt) 
		return;

	}



	pkt->tprot_set = true;

	pkt->flags = NFT_PKTINFO_L4PROTO;

	pkt->tprot = protohdr;

	pkt->thoff = thoff;

	pkt->fragoff = frag_off;
@@ -50,7 +50,7 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt) 
	if (protohdr < 0)

		return -1;



	pkt->tprot_set = true;

	pkt->flags = NFT_PKTINFO_L4PROTO;

	pkt->tprot = protohdr;

	pkt->thoff = thoff;

	pkt->fragoff = frag_off;
@@ -96,7 +96,7 @@ static inline int nft_set_pktinfo_ipv6_ingress(struct nft_pktinfo *pkt) 
	if (protohdr < 0)

		goto inhdr_error;



	pkt->tprot_set = true;

	pkt->flags = NFT_PKTINFO_L4PROTO;

	pkt->tprot = protohdr;

	pkt->thoff = thoff;

	pkt->fragoff = frag_off;

include/uapi/linux/netfilter/nf_tables.h

+5 −1
Original line number Diff line number Diff line
@@ -753,11 +753,13 @@ enum nft_dynset_attributes { 
 * @NFT_PAYLOAD_LL_HEADER: link layer header

 * @NFT_PAYLOAD_NETWORK_HEADER: network header

 * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header

 * @NFT_PAYLOAD_INNER_HEADER: inner header / payload

 */

enum nft_payload_bases {

	NFT_PAYLOAD_LL_HEADER,

	NFT_PAYLOAD_NETWORK_HEADER,

	NFT_PAYLOAD_TRANSPORT_HEADER,

	NFT_PAYLOAD_INNER_HEADER,

};



/**
@@ -896,7 +898,8 @@ enum nft_meta_keys { 
	NFT_META_OIF,

	NFT_META_IIFNAME,

	NFT_META_OIFNAME,

	NFT_META_IIFTYPE,

	NFT_META_IFTYPE,

#define NFT_META_IIFTYPE	NFT_META_IFTYPE

	NFT_META_OIFTYPE,

	NFT_META_SKUID,

	NFT_META_SKGID,
@@ -923,6 +926,7 @@ enum nft_meta_keys { 
	NFT_META_TIME_HOUR,

	NFT_META_SDIF,

	NFT_META_SDIFNAME,

	__NFT_META_IIFTYPE,

};



/**

net/bridge/netfilter/ebtables.c

+4 −3
Original line number Diff line number Diff line
@@ -1073,7 +1073,7 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, 
	 */

	if (repl->num_counters &&

	   copy_to_user(repl->counters, counterstmp,

	   repl->num_counters * sizeof(struct ebt_counter))) {

	   array_size(repl->num_counters, sizeof(struct ebt_counter)))) {

		/* Silent error, can't fail, new table is already in place */

		net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");

	}
@@ -1401,7 +1401,8 @@ static int do_update_counters(struct net *net, const char *name, 
		goto unlock_mutex;

	}



	if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {

	if (copy_from_user(tmp, counters,

			   array_size(num_counters, sizeof(*counters)))) {

		ret = -EFAULT;

		goto unlock_mutex;

	}
@@ -1534,7 +1535,7 @@ static int copy_counters_to_user(struct ebt_table *t, 
	write_unlock_bh(&t->lock);



	if (copy_to_user(user, counterstmp,

	   nentries * sizeof(struct ebt_counter)))

	    array_size(nentries, sizeof(struct ebt_counter))))

		ret = -EFAULT;

	vfree(counterstmp);

	return ret;