[NETFILTER 00/04]: Netfilter fixes

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

following are a few small netfilter fixes for 2.6.19, fixing multiple
refcount leaks and a nf_conntrack helper assignment race which can
lead to use-after-free.

Please apply, thanks.


 net/ipv4/netfilter/ip_conntrack_core.c    |    6 +++---
 net/ipv4/netfilter/ip_conntrack_netlink.c |    1 +
 net/netfilter/nf_conntrack_core.c         |   19 +++++++++----------
 net/netfilter/nf_conntrack_netlink.c      |    9 +++++++++
 4 files changed, 22 insertions(+), 13 deletions(-)

Patrick McHardy:
      [NETFILTER]: ctnetlink: fix reference count leak

Yasuyuki Kozakai:
      [NETFILTER]: nfctnetlink: assign helper to newly created conntrack
      [NETFILTER]: nf_conntrack: fix the race on assign helper to new conntrack
      [NETFILTER]: conntrack: fix refcount leak when finding expectation

[NETFILTER 01/04]: nfctnetlink: assign helper to newly created conntrack

[Patrick McHardy]

[NETFILTER]: nfctnetlink: assign helper to newly created conntrack

This fixes the bug which doesn't assign helper to newly created
conntrack via nf_conntrack_netlink.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit cbf15ed58d4934fe480fc1760a5ea71d35eafcf7
tree ce0afad3be2d1944b321c5e135f3cee84281f29e
parent a07a4f6c88cef7a5cbe0950229913dd087434f88
author Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Mon, 27 Nov 2006 18:56:24 +0100
committer Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 19:10:44 +0100

 net/netfilter/nf_conntrack_netlink.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bd0156a..77a46ee 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -949,6 +949,7 @@ ctnetlink_create_conntrack(struct nfattr
 {
 	struct nf_conn *ct;
 	int err = -EINVAL;
+	struct nf_conn_help *help;
 
 	ct = nf_conntrack_alloc(otuple, rtuple);
 	if (ct == NULL || IS_ERR(ct))
@@ -976,9 +977,16 @@ #if defined(CONFIG_NF_CONNTRACK_MARK)
 		ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
+	help = nfct_help(ct);
+	if (help)
+		help->helper = nf_ct_helper_find_get(rtuple);
+
 	add_timer(&ct->timeout);
 	nf_conntrack_hash_insert(ct);
 
+	if (help && help->helper)
+		nf_ct_helper_put(help->helper);
+
 	return 0;
 
 err:	

[NETFILTER 02/04]: nf_conntrack: fix the race on assign helper to new conntrack

[Patrick McHardy]

[NETFILTER]: nf_conntrack: fix the race on assign helper to new conntrack

The found helper cannot be assigned to conntrack after unlocking
nf_conntrack_lock. This tries to find helper to assign again.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit a88ad2f562c2c108f76adfda4d5ee954e09e6d98
tree c0b7259465e28021e6c7a2c3892e742876f45bbf
parent cbf15ed58d4934fe480fc1760a5ea71d35eafcf7
author Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Mon, 27 Nov 2006 18:56:25 +0100
committer Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 19:10:44 +0100

 net/netfilter/nf_conntrack_core.c |   13 ++++++-------
 1 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 836541e..0f58307 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -893,12 +893,6 @@ __nf_conntrack_alloc(const struct nf_con
 
 	memset(conntrack, 0, nf_ct_cache[features].size);
 	conntrack->features = features;
-	if (helper) {
-		struct nf_conn_help *help = nfct_help(conntrack);
-		NF_CT_ASSERT(help);
-		help->helper = helper;
-	}
-
 	atomic_set(&conntrack->ct_general.use, 1);
 	conntrack->ct_general.destroy = destroy_conntrack;
 	conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
@@ -982,8 +976,13 @@ #ifdef CONFIG_NF_CONNTRACK_SECMARK
 #endif
 		nf_conntrack_get(&conntrack->master->ct_general);
 		NF_CT_STAT_INC(expect_new);
-	} else
+	} else {
+		struct nf_conn_help *help = nfct_help(conntrack);
+
+		if (help)
+			help->helper = __nf_ct_helper_find(&repl_tuple);
 		NF_CT_STAT_INC(new);
+	}
 
 	/* Overload tuple linked list to put us in unconfirmed list. */
 	list_add(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list, &unconfirmed);

[NETFILTER 03/04]: ctnetlink: fix reference count leak

[Patrick McHardy]

[NETFILTER]: ctnetlink: fix reference count leak

When NFA_NEST exceeds the skb size the protocol reference is leaked.

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 7d79b94fc3d91498b8f2ff655839ad84d3390b13
tree 696fa16de7c8051fee047121a9747301c65b94f5
parent a88ad2f562c2c108f76adfda4d5ee954e09e6d98
author Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 18:56:26 +0100
committer Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 19:10:45 +0100

 net/ipv4/netfilter/ip_conntrack_netlink.c |    1 +
 net/netfilter/nf_conntrack_netlink.c      |    1 +
 2 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 262d0d4..55f0ae6 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -153,6 +153,7 @@ ctnetlink_dump_protoinfo(struct sk_buff 
 	return ret;
 
 nfattr_failure:
+	ip_conntrack_proto_put(proto);
 	return -1;
 }
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 77a46ee..ab67c2b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -161,6 +161,7 @@ ctnetlink_dump_protoinfo(struct sk_buff 
 	return ret;
 
 nfattr_failure:
+	nf_ct_proto_put(proto);
 	return -1;
 }
 

[NETFILTER 04/04]: conntrack: fix refcount leak when finding expectation

[Patrick McHardy]

[NETFILTER]: conntrack: fix refcount leak when finding expectation

All users of __{ip,nf}_conntrack_expect_find() don't expect that
it increments the reference count of expectation.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit a9c71b046b2ba5ced529e0cf53a061c02b2bbf4b
tree f0d31367b29c1ebccdd3aaa35771a2f5adfcae11
parent 7d79b94fc3d91498b8f2ff655839ad84d3390b13
author Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Mon, 27 Nov 2006 18:56:27 +0100
committer Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 19:10:45 +0100

 net/ipv4/netfilter/ip_conntrack_core.c |    6 +++---
 net/netfilter/nf_conntrack_core.c      |    6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 143c466..8b848aa 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -225,10 +225,8 @@ __ip_conntrack_expect_find(const struct 
 	struct ip_conntrack_expect *i;
 	
 	list_for_each_entry(i, &ip_conntrack_expect_list, list) {
-		if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
-			atomic_inc(&i->use);
+		if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
 			return i;
-		}
 	}
 	return NULL;
 }
@@ -241,6 +239,8 @@ ip_conntrack_expect_find(const struct ip
 	
 	read_lock_bh(&ip_conntrack_lock);
 	i = __ip_conntrack_expect_find(tuple);
+	if (i)
+		atomic_inc(&i->use);
 	read_unlock_bh(&ip_conntrack_lock);
 
 	return i;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 0f58307..de0567b 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -469,10 +469,8 @@ __nf_conntrack_expect_find(const struct 
 	struct nf_conntrack_expect *i;
 	
 	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
-		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
-			atomic_inc(&i->use);
+		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
 			return i;
-		}
 	}
 	return NULL;
 }
@@ -485,6 +483,8 @@ nf_conntrack_expect_find(const struct nf
 	
 	read_lock_bh(&nf_conntrack_lock);
 	i = __nf_conntrack_expect_find(tuple);
+	if (i)
+		atomic_inc(&i->use);
 	read_unlock_bh(&nf_conntrack_lock);
 
 	return i;

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Mon, 27 Nov 2006 19:20:53 +0100 (MET)

> following are a few small netfilter fixes for 2.6.19, fixing multiple
> refcount leaks and a nf_conntrack helper assignment race which can
> lead to use-after-free.
> 
> Please apply, thanks.

Applied, thanks a lot Patrick.

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

These patches fix a couple of bugs in netfilter: a bug in ct_extend,
causing invalid memory accesses when DNATing a connection to a port
using a connection tracking helper, the TCP connection reopening bug,
causing slowdowns by dropping connection reopening attempts, and
a typo and missing #include in xt_iprange.

Please apply, thanks.


 include/net/netfilter/nf_conntrack_extend.h |    2 +-
 net/ipv4/netfilter/nf_nat_core.c            |    6 ++--
 net/netfilter/nf_conntrack_extend.c         |    3 +-
 net/netfilter/nf_conntrack_proto_tcp.c      |   32 +++++++++++++++++++++-----
 net/netfilter/xt_iprange.c                  |    3 +-
 5 files changed, 34 insertions(+), 12 deletions(-)

Jan Engelhardt (1):
      [NETFILTER]: xt_iprange: add missing #include

Jozsef Kadlecsik (1):
      [NETFILTER]: nf_conntrack: TCP conntrack reopening fix

Patrick McHardy (2):
      [NETFILTER]: nf_conntrack: fix ct_extend ->move operation
      [NETFILTER]: xt_iprange: fix typo in address family

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Wed,  6 Feb 2008 14:33:59 +0100 (MET)

> These patches fix a couple of bugs in netfilter: a bug in ct_extend,
> causing invalid memory accesses when DNATing a connection to a port
> using a connection tracking helper, the TCP connection reopening bug,
> causing slowdowns by dropping connection reopening attempts, and
> a typo and missing #include in xt_iprange.
> 
> Please apply, thanks.

All applied, thanks Patrick.

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

these patches fix an extraneous ";" in the new u32 match and three minor
bugs in the SIP conntrack helper. Please apply, thanks.


 net/ipv4/netfilter/nf_nat_sip.c  |    2 +-
 net/netfilter/nf_conntrack_sip.c |    8 ++++++--
 net/netfilter/xt_u32.c           |    2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

Eric Dumazet (1):
      [NETFILTER]: netfilter: xt_u32 bug correction

Patrick McHardy (3):
      [NETFILTER]: nf_conntrack_sip: check sname != NULL before calling strncmp
      [NETFILTER]: nf_conntrack_sip: fix SIP-URI parsing
      [NETFILTER]: nf_nat_sip: don't drop short packets

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Tue, 14 Aug 2007 18:40:12 +0200 (MEST)

> Hi Dave,
> 
> these patches fix an extraneous ";" in the new u32 match and three minor
> bugs in the SIP conntrack helper. Please apply, thanks.

All applied, thanks Patrick.

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

following are a few more netfilter fixes for 2.6.20, fixing a
nf_conntrack_ipv6 crash when dealing with fragments, hanging
connections when loading the nf_nat module, an incorrect value
for a TCP connection tracking flag and compilation of arp_tables
userspace. I'll also pass on the relevant ones to -stable.

Please apply, thanks.


 include/linux/netfilter/nf_conntrack_tcp.h |    2 +-
 include/linux/netfilter_arp/arp_tables.h   |    1 +
 net/ipv4/netfilter/nf_nat_standalone.c     |    2 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c    |    2 ++
 4 files changed, 5 insertions(+), 2 deletions(-)

Bart De Schuymer:
      [NETFILTER]: arp_tables: fix userspace compilation

Patrick McHardy:
      [NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments
      [NETFILTER]: nf_nat: fix hanging connections when loading the NAT module
      [NETFILTER]: tcp conntrack: fix IP_CT_TCP_FLAG_CLOSE_INIT value

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Tue,  9 Jan 2007 17:29:52 +0100 (MET)

> Hi Dave,
> 
> following are a few more netfilter fixes for 2.6.20, fixing a
> nf_conntrack_ipv6 crash when dealing with fragments, hanging
> connections when loading the nf_nat module, an incorrect value
> for a TCP connection tracking flag and compilation of arp_tables
> userspace. I'll also pass on the relevant ones to -stable.
> 
> Please apply, thanks.

It all looks good, applied, thanks Patrick.

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

following a few netfilter fixes for 2.6.19, fixing invalid use of skb_trim
in netfilter userspace queueing, conflicting optname values for ip6tables
revision support and another byteorder problem in nfnetlink_log.

Please apply, thanks.


 include/linux/in6.h                       |   12 +++++++++++-
 include/linux/netfilter/x_tables.h        |   16 ----------------
 include/linux/netfilter_arp/arp_tables.h  |   25 +++++++++++++------------
 include/linux/netfilter_ipv4/ip_tables.h  |   27 +++++++++++++++------------
 include/linux/netfilter_ipv6/ip6_tables.h |   27 +++++++++++++++------------
 net/ipv4/netfilter/ip_queue.c             |    7 ++++---
 net/ipv6/netfilter/ip6_queue.c            |    7 ++++---
 net/ipv6/netfilter/ip6_tables.c           |    2 +-
 net/netfilter/nfnetlink_log.c             |    2 +-
 net/netfilter/nfnetlink_queue.c           |    7 ++++---
 10 files changed, 68 insertions(+), 64 deletions(-)

Patrick McHardy:
      [NETFILTER]: nfnetlink_log: fix byteorder of NFULA_SEQ_GLOBAL
      [NETFILTER]: Use pskb_trim in {ip,ip6,nfnetlink}_queue
      [NETFILTER]: ip6_tables: use correct nexthdr value in ipv6_find_hdr()

Yasuyuki Kozakai:
      [NETFILTER]: ip6_tables: fixed conflicted optname for getsockopt

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Tue, 14 Nov 2006 08:03:26 +0100 (MET)

> following a few netfilter fixes for 2.6.19, fixing invalid use of skb_trim
> in netfilter userspace queueing, conflicting optname values for ip6tables
> revision support and another byteorder problem in nfnetlink_log.
> 
> Please apply, thanks.

All applied, thanks a lot Patrick.