* [NETFILTER 01/04]: nfnetlink_log: fix byteorder of NFULA_SEQ_GLOBAL
2006-11-14 7:03 [NETFILTER 00/04]: Netfilter fixes Patrick McHardy
@ 2006-11-14 7:03 ` Patrick McHardy
2006-11-14 7:03 ` [NETFILTER 02/04]: Use pskb_trim in {ip,ip6,nfnetlink}_queue Patrick McHardy
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2006-11-14 7:03 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, Patrick McHardy
[NETFILTER]: nfnetlink_log: fix byteorder of NFULA_SEQ_GLOBAL
NFULA_SEQ_GLOBAL should be in network byteorder.
Spotted by Al Viro.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 7c1ac6f74a10cb9fe0800de7e9a1626497dde438
tree bae81087a86be5325fd94b6c6ec26023328e09e0
parent bb831eb2027c12a740ad4e4ad78f2a0e841ae808
author Patrick McHardy <kaber@trash.net> Tue, 14 Nov 2006 07:53:30 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 14 Nov 2006 07:53:30 +0100
net/netfilter/nfnetlink_log.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index b2bf8f2..1e5207b 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -544,7 +544,7 @@ #endif
}
/* global sequence number */
if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) {
- tmp_uint = atomic_inc_return(&global_seq);
+ tmp_uint = htonl(atomic_inc_return(&global_seq));
NFA_PUT(inst->skb, NFULA_SEQ_GLOBAL, sizeof(tmp_uint), &tmp_uint);
}
^ permalink raw reply related [flat|nested] 6+ messages in thread* [NETFILTER 02/04]: Use pskb_trim in {ip,ip6,nfnetlink}_queue
2006-11-14 7:03 [NETFILTER 00/04]: Netfilter fixes Patrick McHardy
2006-11-14 7:03 ` [NETFILTER 01/04]: nfnetlink_log: fix byteorder of NFULA_SEQ_GLOBAL Patrick McHardy
@ 2006-11-14 7:03 ` Patrick McHardy
2006-11-14 7:03 ` [NETFILTER 03/04]: ip6_tables: fixed conflicted optname for getsockopt Patrick McHardy
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2006-11-14 7:03 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, Patrick McHardy
[NETFILTER]: Use pskb_trim in {ip,ip6,nfnetlink}_queue
Based on patch by James D. Nurmi:
I've got some code very dependant on nfnetlink_queue, and turned up a
large number of warns coming from skb_trim. While it's quite possibly
my code, having not seen it on older kernels made me a bit suspect.
Anyhow, based on some googling I turned up this thread:
http://lkml.org/lkml/2006/8/13/56
And believe the issue to be related, so attached is a small patch to
the kernel -- not sure if this is completely correct, but for anyone
else hitting the WARN_ON(1) in skbuff.h, it might be helpful..
Signed-off-by: James D. Nurmi <jdnurmi@gmail.com>
Ported to ip6_queue and nfnetlink_queue and added return value
checks.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 0c9a47cafdd2f6db3e090359392efd64d5d027cd
tree ebefab5aef3e079f489a11d1072318406a72e503
parent 7c1ac6f74a10cb9fe0800de7e9a1626497dde438
author Patrick McHardy <kaber@trash.net> Tue, 14 Nov 2006 07:57:11 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 14 Nov 2006 07:57:11 +0100
net/ipv4/netfilter/ip_queue.c | 7 ++++---
net/ipv6/netfilter/ip6_queue.c | 7 ++++---
net/netfilter/nfnetlink_queue.c | 7 ++++---
3 files changed, 12 insertions(+), 9 deletions(-)
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 7edad79..97556cc 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -351,9 +351,10 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
if (v->data_len < sizeof(*user_iph))
return 0;
diff = v->data_len - e->skb->len;
- if (diff < 0)
- skb_trim(e->skb, v->data_len);
- else if (diff > 0) {
+ if (diff < 0) {
+ if (pskb_trim(e->skb, v->data_len))
+ return -ENOMEM;
+ } else if (diff > 0) {
if (v->data_len > 0xFFFF)
return -EINVAL;
if (diff > skb_tailroom(e->skb)) {
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 9510c24..9fec832 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -349,9 +349,10 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, st
if (v->data_len < sizeof(*user_iph))
return 0;
diff = v->data_len - e->skb->len;
- if (diff < 0)
- skb_trim(e->skb, v->data_len);
- else if (diff > 0) {
+ if (diff < 0) {
+ if (pskb_trim(e->skb, v->data_len))
+ return -ENOMEM;
+ } else if (diff > 0) {
if (v->data_len > 0xFFFF)
return -EINVAL;
if (diff > skb_tailroom(e->skb)) {
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 6e4ada3..e815a9a 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -622,9 +622,10 @@ nfqnl_mangle(void *data, int data_len, s
int diff;
diff = data_len - e->skb->len;
- if (diff < 0)
- skb_trim(e->skb, data_len);
- else if (diff > 0) {
+ if (diff < 0) {
+ if (pskb_trim(e->skb, data_len))
+ return -ENOMEM;
+ } else if (diff > 0) {
if (data_len > 0xFFFF)
return -EINVAL;
if (diff > skb_tailroom(e->skb)) {
^ permalink raw reply related [flat|nested] 6+ messages in thread* [NETFILTER 03/04]: ip6_tables: fixed conflicted optname for getsockopt
2006-11-14 7:03 [NETFILTER 00/04]: Netfilter fixes Patrick McHardy
2006-11-14 7:03 ` [NETFILTER 01/04]: nfnetlink_log: fix byteorder of NFULA_SEQ_GLOBAL Patrick McHardy
2006-11-14 7:03 ` [NETFILTER 02/04]: Use pskb_trim in {ip,ip6,nfnetlink}_queue Patrick McHardy
@ 2006-11-14 7:03 ` Patrick McHardy
2006-11-14 7:03 ` [NETFILTER 04/04]: ip6_tables: use correct nexthdr value in ipv6_find_hdr() Patrick McHardy
2006-11-15 3:49 ` [NETFILTER 00/04]: Netfilter fixes David Miller
4 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2006-11-14 7:03 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, Patrick McHardy
[NETFILTER]: ip6_tables: fixed conflicted optname for getsockopt
66 and 67 for getsockopt on IPv6 socket is doubly used for IPv6 Advanced
API and ip6tables. This moves numbers for ip6tables to 68 and 69.
This also kills XT_SO_* because {ip,ip6,arp}_tables doesn't have so much
common numbers now.
The old userland tools keep to behave as ever, because old kernel always
calls functions of IPv6 Advanced API for their numbers.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 73d0810541a170f679076824e0a8765ea6017a10
tree 42dad7f440cc4a9fcc91f4825dd27cedb8605dbc
parent 0c9a47cafdd2f6db3e090359392efd64d5d027cd
author Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Tue, 14 Nov 2006 07:57:41 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 14 Nov 2006 07:57:41 +0100
include/linux/in6.h | 12 +++++++++++-
include/linux/netfilter/x_tables.h | 16 ----------------
include/linux/netfilter_arp/arp_tables.h | 25 +++++++++++++------------
include/linux/netfilter_ipv4/ip_tables.h | 27 +++++++++++++++------------
include/linux/netfilter_ipv6/ip6_tables.h | 27 +++++++++++++++------------
5 files changed, 54 insertions(+), 53 deletions(-)
diff --git a/include/linux/in6.h b/include/linux/in6.h
index 9be6a47..f28621f 100644
--- a/include/linux/in6.h
+++ b/include/linux/in6.h
@@ -225,7 +225,7 @@ #define IPV6_USE_MIN_MTU 63
#endif
/*
- * Netfilter
+ * Netfilter (1)
*
* Following socket options are used in ip6_tables;
* see include/linux/netfilter_ipv6/ip6_tables.h.
@@ -240,4 +240,14 @@ #endif
#define IPV6_RECVTCLASS 66
#define IPV6_TCLASS 67
+/*
+ * Netfilter (2)
+ *
+ * Following socket options are used in ip6_tables;
+ * see include/linux/netfilter_ipv6/ip6_tables.h.
+ *
+ * IP6T_SO_GET_REVISION_MATCH 68
+ * IP6T_SO_GET_REVISION_TARGET 69
+ */
+
#endif
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 04319a7..022edfa 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -96,22 +96,6 @@ #define XT_STANDARD_TARGET ""
/* Error verdict. */
#define XT_ERROR_TARGET "ERROR"
-/*
- * New IP firewall options for [gs]etsockopt at the RAW IP level.
- * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define XT_BASE_CTL 64 /* base for firewall socket options */
-
-#define XT_SO_SET_REPLACE (XT_BASE_CTL)
-#define XT_SO_SET_ADD_COUNTERS (XT_BASE_CTL + 1)
-#define XT_SO_SET_MAX XT_SO_SET_ADD_COUNTERS
-
-#define XT_SO_GET_INFO (XT_BASE_CTL)
-#define XT_SO_GET_ENTRIES (XT_BASE_CTL + 1)
-#define XT_SO_GET_REVISION_MATCH (XT_BASE_CTL + 2)
-#define XT_SO_GET_REVISION_TARGET (XT_BASE_CTL + 3)
-#define XT_SO_GET_MAX XT_SO_GET_REVISION_TARGET
-
#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 44e39b6..0be2354 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -112,19 +112,20 @@ struct arpt_entry
* New IP firewall options for [gs]etsockopt at the RAW IP level.
* Unlike BSD Linux inherits IP options so you don't have to use a raw
* socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
*/
-#define ARPT_CTL_OFFSET 32
-#define ARPT_BASE_CTL (XT_BASE_CTL+ARPT_CTL_OFFSET)
-
-#define ARPT_SO_SET_REPLACE (XT_SO_SET_REPLACE+ARPT_CTL_OFFSET)
-#define ARPT_SO_SET_ADD_COUNTERS (XT_SO_SET_ADD_COUNTERS+ARPT_CTL_OFFSET)
-#define ARPT_SO_SET_MAX (XT_SO_SET_MAX+ARPT_CTL_OFFSET)
-
-#define ARPT_SO_GET_INFO (XT_SO_GET_INFO+ARPT_CTL_OFFSET)
-#define ARPT_SO_GET_ENTRIES (XT_SO_GET_ENTRIES+ARPT_CTL_OFFSET)
-/* #define ARPT_SO_GET_REVISION_MATCH XT_SO_GET_REVISION_MATCH */
-#define ARPT_SO_GET_REVISION_TARGET (XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
-#define ARPT_SO_GET_MAX (XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
+#define ARPT_BASE_CTL 96
+
+#define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
+#define ARPT_SO_SET_ADD_COUNTERS (ARPT_BASE_CTL + 1)
+#define ARPT_SO_SET_MAX ARPT_SO_SET_ADD_COUNTERS
+
+#define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
+#define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
+/* #define ARPT_SO_GET_REVISION_MATCH (APRT_BASE_CTL + 2) */
+#define ARPT_SO_GET_REVISION_TARGET (ARPT_BASE_CTL + 3)
+#define ARPT_SO_GET_MAX (ARPT_SO_GET_REVISION_TARGET)
/* CONTINUE verdict for targets */
#define ARPT_CONTINUE XT_CONTINUE
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index a536bbd..4f06dad 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -101,18 +101,21 @@ struct ipt_entry
/*
* New IP firewall options for [gs]etsockopt at the RAW IP level.
* Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define IPT_BASE_CTL XT_BASE_CTL
-
-#define IPT_SO_SET_REPLACE XT_SO_SET_REPLACE
-#define IPT_SO_SET_ADD_COUNTERS XT_SO_SET_ADD_COUNTERS
-#define IPT_SO_SET_MAX XT_SO_SET_MAX
-
-#define IPT_SO_GET_INFO XT_SO_GET_INFO
-#define IPT_SO_GET_ENTRIES XT_SO_GET_ENTRIES
-#define IPT_SO_GET_REVISION_MATCH XT_SO_GET_REVISION_MATCH
-#define IPT_SO_GET_REVISION_TARGET XT_SO_GET_REVISION_TARGET
-#define IPT_SO_GET_MAX XT_SO_GET_REVISION_TARGET
+ * socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
+ */
+#define IPT_BASE_CTL 64
+
+#define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
+#define IPT_SO_SET_ADD_COUNTERS (IPT_BASE_CTL + 1)
+#define IPT_SO_SET_MAX IPT_SO_SET_ADD_COUNTERS
+
+#define IPT_SO_GET_INFO (IPT_BASE_CTL)
+#define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)
+#define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2)
+#define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3)
+#define IPT_SO_GET_MAX IPT_SO_GET_REVISION_TARGET
#define IPT_CONTINUE XT_CONTINUE
#define IPT_RETURN XT_RETURN
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index d7a8e9c..4aed340 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -107,18 +107,21 @@ struct ip6t_entry
/*
* New IP firewall options for [gs]etsockopt at the RAW IP level.
* Unlike BSD Linux inherits IP options so you don't have to use
- * a raw socket for this. Instead we check rights in the calls. */
-#define IP6T_BASE_CTL XT_BASE_CTL
-
-#define IP6T_SO_SET_REPLACE XT_SO_SET_REPLACE
-#define IP6T_SO_SET_ADD_COUNTERS XT_SO_SET_ADD_COUNTERS
-#define IP6T_SO_SET_MAX XT_SO_SET_MAX
-
-#define IP6T_SO_GET_INFO XT_SO_GET_INFO
-#define IP6T_SO_GET_ENTRIES XT_SO_GET_ENTRIES
-#define IP6T_SO_GET_REVISION_MATCH XT_SO_GET_REVISION_MATCH
-#define IP6T_SO_GET_REVISION_TARGET XT_SO_GET_REVISION_TARGET
-#define IP6T_SO_GET_MAX XT_SO_GET_REVISION_TARGET
+ * a raw socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in6.h before adding new number here.
+ */
+#define IP6T_BASE_CTL 64
+
+#define IP6T_SO_SET_REPLACE (IP6T_BASE_CTL)
+#define IP6T_SO_SET_ADD_COUNTERS (IP6T_BASE_CTL + 1)
+#define IP6T_SO_SET_MAX IP6T_SO_SET_ADD_COUNTERS
+
+#define IP6T_SO_GET_INFO (IP6T_BASE_CTL)
+#define IP6T_SO_GET_ENTRIES (IP6T_BASE_CTL + 1)
+#define IP6T_SO_GET_REVISION_MATCH (IP6T_BASE_CTL + 4)
+#define IP6T_SO_GET_REVISION_TARGET (IP6T_BASE_CTL + 5)
+#define IP6T_SO_GET_MAX IP6T_SO_GET_REVISION_TARGET
/* CONTINUE verdict for targets */
#define IP6T_CONTINUE XT_CONTINUE
^ permalink raw reply related [flat|nested] 6+ messages in thread* [NETFILTER 04/04]: ip6_tables: use correct nexthdr value in ipv6_find_hdr()
2006-11-14 7:03 [NETFILTER 00/04]: Netfilter fixes Patrick McHardy
` (2 preceding siblings ...)
2006-11-14 7:03 ` [NETFILTER 03/04]: ip6_tables: fixed conflicted optname for getsockopt Patrick McHardy
@ 2006-11-14 7:03 ` Patrick McHardy
2006-11-15 3:49 ` [NETFILTER 00/04]: Netfilter fixes David Miller
4 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2006-11-14 7:03 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, Patrick McHardy
[NETFILTER]: ip6_tables: use correct nexthdr value in ipv6_find_hdr()
nexthdr is NEXTHDR_FRAGMENT, the nexthdr value from the fragment header
is hp->nexthdr.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
commit 85ac8773cc9bc1301cd3be323cb046c0b98998b7
tree 97048b2f41047e7f2bf440fe5ca8ec9986e3fe5c
parent 73d0810541a170f679076824e0a8765ea6017a10
author Patrick McHardy <kaber@trash.net> Tue, 14 Nov 2006 07:57:54 +0100
committer Patrick McHardy <kaber@trash.net> Tue, 14 Nov 2006 07:57:54 +0100
net/ipv6/netfilter/ip6_tables.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 167c2ea..204e021 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1494,7 +1494,7 @@ int ipv6_find_hdr(const struct sk_buff *
if (_frag_off) {
if (target < 0 &&
((!ipv6_ext_hdr(hp->nexthdr)) ||
- nexthdr == NEXTHDR_NONE)) {
+ hp->nexthdr == NEXTHDR_NONE)) {
if (fragoff)
*fragoff = _frag_off;
return hp->nexthdr;
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [NETFILTER 00/04]: Netfilter fixes
2006-11-14 7:03 [NETFILTER 00/04]: Netfilter fixes Patrick McHardy
` (3 preceding siblings ...)
2006-11-14 7:03 ` [NETFILTER 04/04]: ip6_tables: use correct nexthdr value in ipv6_find_hdr() Patrick McHardy
@ 2006-11-15 3:49 ` David Miller
4 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2006-11-15 3:49 UTC (permalink / raw)
To: kaber; +Cc: netfilter-devel
From: Patrick McHardy <kaber@trash.net>
Date: Tue, 14 Nov 2006 08:03:26 +0100 (MET)
> following a few netfilter fixes for 2.6.19, fixing invalid use of skb_trim
> in netfilter userspace queueing, conflicting optname values for ip6tables
> revision support and another byteorder problem in nfnetlink_log.
>
> Please apply, thanks.
All applied, thanks a lot Patrick.
^ permalink raw reply [flat|nested] 6+ messages in thread