Commit c26d0d98 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

1) Fix incorrect TCP connection tracking window reset for non-syn
   packets, from Florian Westphal.

2) Incorrect dependency on CONFIG_NFT_FLOW_OFFLOAD, from Volodymyr Mytnyk.

3) Fix nft_socket from the output path, from Florian Westphal.

* git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nft_socket: only do sk lookups when indev is available
  netfilter: conntrack: fix udp offload timeout sysctl
  netfilter: nf_conntrack_tcp: re-init for syn packets only
====================

Link: https://lore.kernel.org/r/20220428142109.38726-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents aeaf59b7 743b83f1

net/netfilter/nf_conntrack_proto_tcp.c

+6 −15
Original line number Diff line number Diff line
@@ -556,24 +556,14 @@ static bool tcp_in_window(struct nf_conn *ct, 
			}



		}

	} else if (((state->state == TCP_CONNTRACK_SYN_SENT

		     && dir == IP_CT_DIR_ORIGINAL)

		   || (state->state == TCP_CONNTRACK_SYN_RECV

		     && dir == IP_CT_DIR_REPLY))

		   && after(end, sender->td_end)) {

	} else if (tcph->syn &&

		   after(end, sender->td_end) &&

		   (state->state == TCP_CONNTRACK_SYN_SENT ||

		    state->state == TCP_CONNTRACK_SYN_RECV)) {

		/*

		 * RFC 793: "if a TCP is reinitialized ... then it need

		 * not wait at all; it must only be sure to use sequence

		 * numbers larger than those recently used."

		 */

		sender->td_end =

		sender->td_maxend = end;

		sender->td_maxwin = (win == 0 ? 1 : win);



		tcp_options(skb, dataoff, tcph, sender);

	} else if (tcph->syn && dir == IP_CT_DIR_REPLY &&

		   state->state == TCP_CONNTRACK_SYN_SENT) {

		/* Retransmitted syn-ack, or syn (simultaneous open).

		 *

		 * Re-init state for this direction, just like for the first

		 * syn(-ack) reply, it might differ in seq, ack or tcp options.
@@ -581,7 +571,8 @@ static bool tcp_in_window(struct nf_conn *ct, 
		tcp_init_sender(sender, receiver,

				skb, dataoff, tcph,

				end, win);

		if (!tcph->ack)



		if (dir == IP_CT_DIR_REPLY && !tcph->ack)

			return true;

	}

net/netfilter/nf_conntrack_standalone.c

+1 −1
Original line number Diff line number Diff line
@@ -823,7 +823,7 @@ static struct ctl_table nf_ct_sysctl_table[] = { 
		.mode		= 0644,

		.proc_handler	= proc_dointvec_jiffies,

	},

#if IS_ENABLED(CONFIG_NFT_FLOW_OFFLOAD)

#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)

	[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD] = {

		.procname	= "nf_flowtable_udp_timeout",

		.maxlen		= sizeof(unsigned int),

net/netfilter/nft_socket.c

+38 −14
Original line number Diff line number Diff line
@@ -54,34 +54,47 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo 
}

#endif



static void nft_socket_eval(const struct nft_expr *expr,

			    struct nft_regs *regs,

			    const struct nft_pktinfo *pkt)

static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt)

{

	const struct nft_socket *priv = nft_expr_priv(expr);

	struct sk_buff *skb = pkt->skb;

	struct sock *sk = skb->sk;

	u32 *dest = &regs->data[priv->dreg];

	const struct net_device *indev = nft_in(pkt);

	const struct sk_buff *skb = pkt->skb;

	struct sock *sk = NULL;



	if (sk && !net_eq(nft_net(pkt), sock_net(sk)))

		sk = NULL;

	if (!indev)

		return NULL;



	if (!sk)

	switch (nft_pf(pkt)) {

	case NFPROTO_IPV4:

			sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, nft_in(pkt));

		sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, indev);

		break;

#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)

	case NFPROTO_IPV6:

			sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, nft_in(pkt));

		sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, indev);

		break;

#endif

	default:

		WARN_ON_ONCE(1);

			regs->verdict.code = NFT_BREAK;

			return;

		break;

	}



	return sk;

}



static void nft_socket_eval(const struct nft_expr *expr,

			    struct nft_regs *regs,

			    const struct nft_pktinfo *pkt)

{

	const struct nft_socket *priv = nft_expr_priv(expr);

	struct sk_buff *skb = pkt->skb;

	struct sock *sk = skb->sk;

	u32 *dest = &regs->data[priv->dreg];



	if (sk && !net_eq(nft_net(pkt), sock_net(sk)))

		sk = NULL;



	if (!sk)

		sk = nft_socket_do_lookup(pkt);



	if (!sk) {

		regs->verdict.code = NFT_BREAK;

		return;
@@ -224,6 +237,16 @@ static bool nft_socket_reduce(struct nft_regs_track *track, 
	return nft_expr_reduce_bitwise(track, expr);

}



static int nft_socket_validate(const struct nft_ctx *ctx,

			       const struct nft_expr *expr,

			       const struct nft_data **data)

{

	return nft_chain_validate_hooks(ctx->chain,

					(1 << NF_INET_PRE_ROUTING) |

					(1 << NF_INET_LOCAL_IN) |

					(1 << NF_INET_LOCAL_OUT));

}



static struct nft_expr_type nft_socket_type;

static const struct nft_expr_ops nft_socket_ops = {

	.type		= &nft_socket_type,
@@ -231,6 +254,7 @@ static const struct nft_expr_ops nft_socket_ops = { 
	.eval		= nft_socket_eval,

	.init		= nft_socket_init,

	.dump		= nft_socket_dump,

	.validate	= nft_socket_validate,

	.reduce		= nft_socket_reduce,

};