Commit 9270bbe2 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Fix incorrect enum type definition in nfnetlink_cthelper UAPI,
   from Dmitry V. Levin.

2) Remove extra space in deprecated automatic helper assignment
   notice, from Klemen Košir.

3) Drop early socket demux socket after NAT mangling, from
   Florian Westphal. Add a test to exercise this bug.

4) Fix bogus invalid packet report in the conntrack TCP tracker,
   also from Florian.

5) Fix access to xt[NFPROTO_UNSPEC] list with no mutex
   in target/match_revfn(), from Vasily Averin.

6) Disallow updates on the table ownership flag.

7) Fix double hook unregistration of tables with owner.

8) Remove bogus check on the table owner in __nft_release_tables().
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents a4dcfbc4 bd1777b3

include/uapi/linux/netfilter/nfnetlink_cthelper.h

+1 −1
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
#define NFCT_HELPER_STATUS_DISABLED	0

#define NFCT_HELPER_STATUS_ENABLED	1



enum nfnl_acct_msg_types {

enum nfnl_cthelper_msg_types {

	NFNL_MSG_CTHELPER_NEW,

	NFNL_MSG_CTHELPER_GET,

	NFNL_MSG_CTHELPER_DEL,

net/netfilter/nf_conntrack_helper.c

+1 −2
Original line number Diff line number Diff line
@@ -228,7 +228,6 @@ nf_ct_lookup_helper(struct nf_conn *ct, struct net *net) 
	return __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);

}





int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,

			      gfp_t flags)

{

net/netfilter/nf_conntrack_proto_tcp.c

+4 −2
Original line number Diff line number Diff line
@@ -982,8 +982,10 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, 
					IP_CT_EXP_CHALLENGE_ACK;

		}

		spin_unlock_bh(&ct->lock);

		nf_ct_l4proto_log_invalid(skb, ct, "invalid packet ignored in "

					  "state %s ", tcp_conntrack_names[old_state]);

		nf_ct_l4proto_log_invalid(skb, ct,

					  "packet (index %d) in dir %d ignored, state %s",

					  index, dir,

					  tcp_conntrack_names[old_state]);

		return NF_ACCEPT;

	case TCP_CONNTRACK_MAX:

		/* Special case for SYN proxy: when the SYN to the server or

net/netfilter/nf_nat_proto.c

+21 −4
Original line number Diff line number Diff line
@@ -646,7 +646,7 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb, 
}



static unsigned int

nf_nat_ipv4_in(void *priv, struct sk_buff *skb,

nf_nat_ipv4_pre_routing(void *priv, struct sk_buff *skb,

			const struct nf_hook_state *state)

{

	unsigned int ret;
@@ -659,6 +659,23 @@ nf_nat_ipv4_in(void *priv, struct sk_buff *skb, 
	return ret;

}



static unsigned int

nf_nat_ipv4_local_in(void *priv, struct sk_buff *skb,

		     const struct nf_hook_state *state)

{

	__be32 saddr = ip_hdr(skb)->saddr;

	struct sock *sk = skb->sk;

	unsigned int ret;



	ret = nf_nat_ipv4_fn(priv, skb, state);



	if (ret == NF_ACCEPT && sk && saddr != ip_hdr(skb)->saddr &&

	    !inet_sk_transparent(sk))

		skb_orphan(skb); /* TCP edemux obtained wrong socket */



	return ret;

}



static unsigned int

nf_nat_ipv4_out(void *priv, struct sk_buff *skb,

		const struct nf_hook_state *state)
@@ -736,7 +753,7 @@ nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb, 
static const struct nf_hook_ops nf_nat_ipv4_ops[] = {

	/* Before packet filtering, change destination */

	{

		.hook		= nf_nat_ipv4_in,

		.hook		= nf_nat_ipv4_pre_routing,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_PRE_ROUTING,

		.priority	= NF_IP_PRI_NAT_DST,
@@ -757,7 +774,7 @@ static const struct nf_hook_ops nf_nat_ipv4_ops[] = { 
	},

	/* After packet filtering, change source */

	{

		.hook		= nf_nat_ipv4_fn,

		.hook		= nf_nat_ipv4_local_in,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP_PRI_NAT_SRC,

net/netfilter/nf_tables_api.c

+14 −5
Original line number Diff line number Diff line
@@ -916,6 +916,12 @@ static int nf_tables_updtable(struct nft_ctx *ctx) 
	if (flags == ctx->table->flags)

		return 0;



	if ((nft_table_has_owner(ctx->table) &&

	     !(flags & NFT_TABLE_F_OWNER)) ||

	    (!nft_table_has_owner(ctx->table) &&

	     flags & NFT_TABLE_F_OWNER))

		return -EOPNOTSUPP;



	trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,

				sizeof(struct nft_trans_table));

	if (trans == NULL)
@@ -9022,9 +9028,13 @@ static void __nft_release_hooks(struct net *net) 
{

	struct nft_table *table;



	list_for_each_entry(table, &net->nft.tables, list)

	list_for_each_entry(table, &net->nft.tables, list) {

		if (nft_table_has_owner(table))

			continue;



		__nft_release_hook(net, table);

	}

}



static void __nft_release_table(struct net *net, struct nft_table *table)

{
@@ -9073,13 +9083,12 @@ static void __nft_release_table(struct net *net, struct nft_table *table) 
	nf_tables_table_destroy(&ctx);

}



static void __nft_release_tables(struct net *net, u32 nlpid)

static void __nft_release_tables(struct net *net)

{

	struct nft_table *table, *nt;



	list_for_each_entry_safe(table, nt, &net->nft.tables, list) {

		if (nft_table_has_owner(table) &&

		    nlpid != table->nlpid)

		if (nft_table_has_owner(table))

			continue;



		__nft_release_table(net, table);
@@ -9145,7 +9154,7 @@ static void __net_exit nf_tables_exit_net(struct net *net) 
	mutex_lock(&net->nft.commit_mutex);

	if (!list_empty(&net->nft.commit_list))

		__nf_tables_abort(net, NFNL_ABORT_NONE);

	__nft_release_tables(net, 0);

	__nft_release_tables(net);

	mutex_unlock(&net->nft.commit_mutex);

	WARN_ON_ONCE(!list_empty(&net->nft.tables));

	WARN_ON_ONCE(!list_empty(&net->nft.module_list));