Skip to content
  1. Nov 16, 2019
    • Phil Sutter's avatar
      netfilter: Support iif matches in POSTROUTING · 28f8bfd1
      Phil Sutter authored 
      

Instead of generally passing NULL to NF_HOOK_COND() for input device,
pass skb->dev which contains input device for routed skbs.

Note that iptables (both legacy and nft) reject rules with input
interface match from being added to POSTROUTING chains, but nftables
allows this.

Cc: Eric Garver <eric@garver.life>
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      28f8bfd1
    • Pablo Neira Ayuso's avatar
      netfilter: nf_flow_table_offload: add IPv6 support · 5c27d8d7
      Pablo Neira Ayuso authored 
      

Add nf_flow_rule_route_ipv6() and use it from the IPv6 and the inet
flowtable type definitions. Rename the nf_flow_rule_route() function to
nf_flow_rule_route_ipv4().

Adjust maximum number of actions, which now becomes 16 to leave
sufficient room for the IPv6 address mangling for NAT.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      5c27d8d7
    • Pablo Neira Ayuso's avatar
      netfilter: nf_flow_table_offload: add flow_action_entry_next() and use it · 4a766d49
      Pablo Neira Ayuso authored 
      

This function retrieves a spare action entry from the array of actions.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4a766d49
    • Arnd Bergmann's avatar
      netfilter: nft_meta: use 64-bit time arithmetic · 6408c40c
      Arnd Bergmann authored 
      

On 32-bit architectures, get_seconds() returns an unsigned 32-bit
time value, which also matches the type used in the nft_meta
code. This will not overflow in year 2038 as a time_t would, but
it still suffers from the overflow problem later on in year 2106.

Change this instance to use the time64_t type consistently
and avoid the deprecated get_seconds().

The nft_meta_weekday() calculation potentially gets a little slower
on 32-bit architectures, but now it has the same behavior as on
64-bit architectures and does not overflow.

Fixes: 63d10e12 ("netfilter: nft_meta: support for time matching")
Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Acked-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      6408c40c
    • Arnd Bergmann's avatar
      netfilter: xt_time: use time64_t · fcbad829
      Arnd Bergmann authored 
      

The current xt_time driver suffers from the y2038 overflow on 32-bit
architectures, when the time of day calculations break.

Also, on both 32-bit and 64-bit architectures, there is a problem with
info->date_start/stop, which is part of the user ABI and overflows in
in 2106.

Fix the first issue by using time64_t and explicit calls to div_u64()
and div_u64_rem(), and document the seconds issue.

The explicit 64-bit division is unfortunately slower on 32-bit
architectures, but doing it as unsigned lets us use the optimized
division-through-multiplication path in most configurations.  This should
be fine, as the code already does not allow any negative time of day
values.

Using u32 seconds values consistently would probably also work and
be a little more efficient, but that doesn't feel right as it would
propagate the y2106 overflow to more place rather than fewer.

Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      fcbad829
  3. Nov 13, 2019