Commit d57609fa authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Use signed integer in ipv6_skip_exthdr() called from nf_confirm().
   Reported by static analysis tooling, patch from Florian Westphal.

2) Missing set type checks in nf_tables: Validate that set declaration
   matches the an existing set type, otherwise bail out with EEXIST.
   Currently, nf_tables silently accepts the re-declaration with a
   different type but it bails out later with EINVAL when the user adds
   entries to the set. This fix is relatively large because it requires
   two preparation patches that are included in this batch.

3) Do not ignore updates of timeout and gc_interval parameters in
   existing sets.

4) Fix a hang when 0/0 subnets is added to a hash:net,port,net type of
   ipset. Except hash:net,port,net and hash:net,iface, the set types don't
   support 0/0 and the auxiliary functions rely on this fact. So 0/0 needs
   a special handling in hash:net,port,net which was missing (hash:net,iface
   was not affected by this bug), from Jozsef Kadlecsik.

5) When adding/deleting large number of elements in one step in ipset,
   it can take a reasonable amount of time and can result in soft lockup
   errors. This patch is a complete rework of the previous version in order
   to use a smaller internal batch limit and at the same time removing
   the external hard limit to add arbitrary number of elements in one step.
   Also from Jozsef Kadlecsik.

Except for patch #1, which fixes a bug introduced in the previous net-next
development cycle, anything else has been broken for several releases.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 588ab2dc 5e29dc36

include/linux/netfilter/ipset/ip_set.h

+1 −1
Original line number Diff line number Diff line
@@ -197,7 +197,7 @@ struct ip_set_region { 
};



/* Max range where every element is added/deleted in one step */

#define IPSET_MAX_RANGE		(1<<20)

#define IPSET_MAX_RANGE		(1<<14)



/* The max revision number supported by any set type + 1 */

#define IPSET_REVISION_MAX	9

include/net/netfilter/nf_tables.h

+24 −1
Original line number Diff line number Diff line
@@ -312,17 +312,29 @@ struct nft_set_iter { 
/**

 *	struct nft_set_desc - description of set elements

 *

 *	@ktype: key type

 *	@klen: key length

 *	@dtype: data type

 *	@dlen: data length

 *	@objtype: object type

 *	@flags: flags

 *	@size: number of set elements

 *	@policy: set policy

 *	@gc_int: garbage collector interval

 *	@field_len: length of each field in concatenation, bytes

 *	@field_count: number of concatenated fields in element

 *	@expr: set must support for expressions

 */

struct nft_set_desc {

	u32			ktype;

	unsigned int		klen;

	u32			dtype;

	unsigned int		dlen;

	u32			objtype;

	unsigned int		size;

	u32			policy;

	u32			gc_int;

	u64			timeout;

	u8			field_len[NFT_REG32_COUNT];

	u8			field_count;

	bool			expr;
@@ -585,7 +597,9 @@ void *nft_set_catchall_gc(const struct nft_set *set); 


static inline unsigned long nft_set_gc_interval(const struct nft_set *set)

{

	return set->gc_int ? msecs_to_jiffies(set->gc_int) : HZ;

	u32 gc_int = READ_ONCE(set->gc_int);



	return gc_int ? msecs_to_jiffies(gc_int) : HZ;

}



/**
@@ -1558,6 +1572,9 @@ struct nft_trans_rule { 
struct nft_trans_set {

	struct nft_set			*set;

	u32				set_id;

	u32				gc_int;

	u64				timeout;

	bool				update;

	bool				bound;

};
@@ -1567,6 +1584,12 @@ struct nft_trans_set { 
	(((struct nft_trans_set *)trans->data)->set_id)

#define nft_trans_set_bound(trans)	\

	(((struct nft_trans_set *)trans->data)->bound)

#define nft_trans_set_update(trans)	\

	(((struct nft_trans_set *)trans->data)->update)

#define nft_trans_set_timeout(trans)	\

	(((struct nft_trans_set *)trans->data)->timeout)

#define nft_trans_set_gc_int(trans)	\

	(((struct nft_trans_set *)trans->data)->gc_int)



struct nft_trans_chain {

	bool				update;

net/netfilter/ipset/ip_set_core.c

+4 −3
Original line number Diff line number Diff line
@@ -1698,9 +1698,10 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb, 
		ret = set->variant->uadt(set, tb, adt, &lineno, flags, retried);

		ip_set_unlock(set);

		retried = true;

	} while (ret == -EAGAIN &&

	} while (ret == -ERANGE ||

		 (ret == -EAGAIN &&

		  set->variant->resize &&

		 (ret = set->variant->resize(set, retried)) == 0);

		  (ret = set->variant->resize(set, retried)) == 0));



	if (!ret || (ret == -IPSET_ERR_EXIST && eexist))

		return 0;

net/netfilter/ipset/ip_set_hash_ip.c

+7 −7
Original line number Diff line number Diff line
@@ -100,11 +100,11 @@ static int 
hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],

	      enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)

{

	const struct hash_ip4 *h = set->data;

	struct hash_ip4 *h = set->data;

	ipset_adtfn adtfn = set->variant->adt[adt];

	struct hash_ip4_elem e = { 0 };

	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);

	u32 ip = 0, ip_to = 0, hosts;

	u32 ip = 0, ip_to = 0, hosts, i = 0;

	int ret = 0;



	if (tb[IPSET_ATTR_LINENO])
@@ -149,14 +149,14 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[], 


	hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);



	/* 64bit division is not allowed on 32bit */

	if (((u64)ip_to - ip + 1) >> (32 - h->netmask) > IPSET_MAX_RANGE)

		return -ERANGE;



	if (retried)

		ip = ntohl(h->next.ip);

	for (; ip <= ip_to;) {

	for (; ip <= ip_to; i++) {

		e.ip = htonl(ip);

		if (i > IPSET_MAX_RANGE) {

			hash_ip4_data_next(&h->next, &e);

			return -ERANGE;

		}

		ret = adtfn(set, &e, &ext, &ext, flags);

		if (ret && !ip_set_eexist(ret, flags))

			return ret;

net/netfilter/ipset/ip_set_hash_ipmark.c

+7 −6
Original line number Diff line number Diff line
@@ -97,11 +97,11 @@ static int 
hash_ipmark4_uadt(struct ip_set *set, struct nlattr *tb[],

		  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)

{

	const struct hash_ipmark4 *h = set->data;

	struct hash_ipmark4 *h = set->data;

	ipset_adtfn adtfn = set->variant->adt[adt];

	struct hash_ipmark4_elem e = { };

	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);

	u32 ip, ip_to = 0;

	u32 ip, ip_to = 0, i = 0;

	int ret;



	if (tb[IPSET_ATTR_LINENO])
@@ -148,13 +148,14 @@ hash_ipmark4_uadt(struct ip_set *set, struct nlattr *tb[], 
		ip_set_mask_from_to(ip, ip_to, cidr);

	}



	if (((u64)ip_to - ip + 1) > IPSET_MAX_RANGE)

		return -ERANGE;



	if (retried)

		ip = ntohl(h->next.ip);

	for (; ip <= ip_to; ip++) {

	for (; ip <= ip_to; ip++, i++) {

		e.ip = htonl(ip);

		if (i > IPSET_MAX_RANGE) {

			hash_ipmark4_data_next(&h->next, &e);

			return -ERANGE;

		}

		ret = adtfn(set, &e, &ext, &ext, flags);



		if (ret && !ip_set_eexist(ret, flags))