[PATCH nf-next,v2 1/2] netfilter: nfnetlink_queue: add helper function to retrieve hook entries

[PATCH nf-next,v2 1/2] netfilter: nfnetlink_queue: add helper function to retrieve hook entries

[Pablo Neira Ayuso]

Add nf_queue_hook_entry() and nf_queue_hook_entries() helper functions
to retrieve hook entries and use them.

This comes in preparation for a fix to restrict expectation creation to
nfnetlink_cthelper.

No functional changes are intended.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: no changes

 net/netfilter/nfnetlink_queue.c | 43 ++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 12 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 00b76c25d55c..bd3567f29752 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -358,30 +358,45 @@ static int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry)
 	return ret;
 }
 
+static const struct nf_hook_entries *
+nf_queue_hook_entries(struct nf_queue_entry *entry)
+{
+	const struct net *net = entry->state.net;
+	u8 pf = entry->state.pf;
+
+	return nf_hook_entries_head(net, pf, entry->state.hook);
+}
+
+static const struct nf_hook_entry *
+nf_queue_hook_entry(const struct nf_hook_entries *hooks,
+		    struct nf_queue_entry *entry)
+{
+	unsigned int i = entry->hook_index;
+
+	if (i >= hooks->num_hook_entries)
+		return NULL;
+
+	return &hooks->hooks[i];
+}
+
 /* caller must hold rcu read-side lock */
 static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
 {
 	const struct nf_hook_entry *hook_entry;
 	const struct nf_hook_entries *hooks;
 	struct sk_buff *skb = entry->skb;
-	const struct net *net;
 	unsigned int i;
 	int err;
-	u8 pf;
 
-	net = entry->state.net;
-	pf = entry->state.pf;
+	hooks = nf_queue_hook_entries(entry);
+	if (!hooks)
+		goto drop;
 
-	hooks = nf_hook_entries_head(net, pf, entry->state.hook);
+	hook_entry = nf_queue_hook_entry(hooks, entry);
+	if (!hook_entry)
+		goto drop;
 
 	i = entry->hook_index;
-	if (!hooks || i >= hooks->num_hook_entries) {
-		kfree_skb_reason(skb, SKB_DROP_REASON_NETFILTER_DROP);
-		nf_queue_entry_free(entry);
-		return;
-	}
-
-	hook_entry = &hooks->hooks[i];
 
 	/* Continue traversal iff userspace said ok... */
 	if (verdict == NF_REPEAT)
@@ -417,6 +432,10 @@ static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
 	}
 
 	nf_queue_entry_free(entry);
+	return;
+drop:
+	kfree_skb_reason(skb, SKB_DROP_REASON_NETFILTER_DROP);
+	nf_queue_entry_free(entry);
 }
 
 /* return true if the entry has an unconfirmed conntrack attached that isn't owned by us
-- 
2.47.3

[PATCH nf-next,v2 2/2] netfilter: nfnetlink_queue: restrict NFQA_EXP to userspace helpers

[Pablo Neira Ayuso]

Adding expectations to unconfirmed conntracks are problematic because of
reallocations of the ct extension area can happen while expectations are
placed in the ct extension expectation list.

NFQA_EXP was added with the purpose of supporting userspace conntrack
helpers, which create expectations in the postrouting hook with priority
NF_IP_PRI_CONNTRACK_CONFIRM.

Restrict this feature to userspace conntrack helpers.

Fixes: bd0779370588 ("netfilter: nfnetlink_queue: allow to attach expectations to conntracks")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: refine hook check for ipv4 and ipv6.

 net/netfilter/nfnetlink_queue.c | 35 +++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index bd3567f29752..728b4041890a 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1795,10 +1795,37 @@ static struct nf_conn *nfqnl_ct_parse(const struct nfnl_ct_hook *nfnl_ct,
 	if (nfnl_ct->parse(nfqa[NFQA_CT], ct) < 0)
 		return NULL;
 
-	if (nfqa[NFQA_EXP])
-		nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct,
-				      NETLINK_CB(entry->skb).portid,
-				      nlmsg_report(nlh));
+	if (nfqa[NFQA_EXP]) {
+		const struct nf_hook_entries *hooks;
+		struct nf_hook_ops **ops;
+		unsigned int i;
+
+		hooks = nf_queue_hook_entries(entry);
+		if (!hooks)
+			return NULL;
+
+		ops = nf_hook_entries_get_hook_ops(hooks);
+		if (!ops)
+			return NULL;
+
+		i = entry->hook_index;
+		if (i >= hooks->num_hook_entries)
+			return NULL;
+
+		if ((ops[i]->pf == NFPROTO_IPV4 &&
+		     (ops[i]->hooknum == NF_INET_POST_ROUTING ||
+		      ops[i]->hooknum == NF_INET_LOCAL_IN) &&
+		     ops[i]->priority == NF_IP_PRI_CONNTRACK_CONFIRM) ||
+		    (ops[i]->pf == NFPROTO_IPV6 &&
+		     ((ops[i]->hooknum == NF_INET_POST_ROUTING &&
+		       ops[i]->priority == NF_IP6_PRI_LAST) ||
+		      (ops[i]->hooknum == NF_INET_LOCAL_IN &&
+		       ops[i]->priority == NF_IP6_PRI_LAST - 1)))) {
+			nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct,
+					       NETLINK_CB(entry->skb).portid,
+					       nlmsg_report(nlh));
+		}
+	}
 	return ct;
 #else
 	return NULL;
-- 
2.47.3