* [PATCH net 0/2] Netfilter fixes for net
@ 2021-02-09 21:35 Pablo Neira Ayuso
2021-02-09 21:35 ` [PATCH net 1/2] netfilter: conntrack: skip identical origin tuple in same zone only Pablo Neira Ayuso
2021-02-09 21:35 ` [PATCH net 2/2] netfilter: nftables: relax check for stateful expressions in set definition Pablo Neira Ayuso
0 siblings, 2 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2021-02-09 21:35 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) nf_conntrack_tuple_taken() needs to recheck zone for
NAT clash resolution, from Florian Westphal.
2) Restore support for stateful expressions when set definition
specifies no stateful expressions.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit ce7536bc7398e2ae552d2fabb7e0e371a9f1fe46:
vsock/virtio: update credit only if socket is not closed (2021-02-08 13:27:46 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 664899e85c1312e51d2761e7f8b2f25d053e8489:
netfilter: nftables: relax check for stateful expressions in set definition (2021-02-09 00:50:14 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: skip identical origin tuple in same zone only
Pablo Neira Ayuso (1):
netfilter: nftables: relax check for stateful expressions in set definition
net/netfilter/nf_conntrack_core.c | 3 ++-
net/netfilter/nf_tables_api.c | 28 +++++++++++++++-------------
2 files changed, 17 insertions(+), 14 deletions(-)
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH net 1/2] netfilter: conntrack: skip identical origin tuple in same zone only 2021-02-09 21:35 [PATCH net 0/2] Netfilter fixes for net Pablo Neira Ayuso @ 2021-02-09 21:35 ` Pablo Neira Ayuso 2021-02-10 0:00 ` patchwork-bot+netdevbpf 2021-02-09 21:35 ` [PATCH net 2/2] netfilter: nftables: relax check for stateful expressions in set definition Pablo Neira Ayuso 1 sibling, 1 reply; 4+ messages in thread From: Pablo Neira Ayuso @ 2021-02-09 21:35 UTC (permalink / raw) To: netfilter-devel; +Cc: davem, netdev, kuba From: Florian Westphal <fw@strlen.de> The origin skip check needs to re-test the zone. Else, we might skip a colliding tuple in the reply direction. This only occurs when using 'directional zones' where origin tuples reside in different zones but the reply tuples share the same zone. This causes the new conntrack entry to be dropped at confirmation time because NAT clash resolution was elided. Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_conntrack_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 234b7cab37c3..ff0168736f6e 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1229,7 +1229,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, * Let nf_ct_resolve_clash() deal with this later. */ if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple, - &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)) + &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) && + nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL)) continue; NF_CT_STAT_INC_ATOMIC(net, found); -- 2.20.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net 1/2] netfilter: conntrack: skip identical origin tuple in same zone only 2021-02-09 21:35 ` [PATCH net 1/2] netfilter: conntrack: skip identical origin tuple in same zone only Pablo Neira Ayuso @ 2021-02-10 0:00 ` patchwork-bot+netdevbpf 0 siblings, 0 replies; 4+ messages in thread From: patchwork-bot+netdevbpf @ 2021-02-10 0:00 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba Hello: This series was applied to netdev/net.git (refs/heads/master): On Tue, 9 Feb 2021 22:35:10 +0100 you wrote: > From: Florian Westphal <fw@strlen.de> > > The origin skip check needs to re-test the zone. Else, we might skip > a colliding tuple in the reply direction. > > This only occurs when using 'directional zones' where origin tuples > reside in different zones but the reply tuples share the same zone. > > [...] Here is the summary with links: - [net,1/2] netfilter: conntrack: skip identical origin tuple in same zone only https://git.kernel.org/netdev/net/c/07998281c268 - [net,2/2] netfilter: nftables: relax check for stateful expressions in set definition https://git.kernel.org/netdev/net/c/664899e85c13 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH net 2/2] netfilter: nftables: relax check for stateful expressions in set definition 2021-02-09 21:35 [PATCH net 0/2] Netfilter fixes for net Pablo Neira Ayuso 2021-02-09 21:35 ` [PATCH net 1/2] netfilter: conntrack: skip identical origin tuple in same zone only Pablo Neira Ayuso @ 2021-02-09 21:35 ` Pablo Neira Ayuso 1 sibling, 0 replies; 4+ messages in thread From: Pablo Neira Ayuso @ 2021-02-09 21:35 UTC (permalink / raw) To: netfilter-devel; +Cc: davem, netdev, kuba Restore the original behaviour where users are allowed to add an element with any stateful expression if the set definition specifies no stateful expressions. Make sure upper maximum number of stateful expressions of NFT_SET_EXPR_MAX is not reached. Fixes: 8cfd9b0f8515 ("netfilter: nftables: generalize set expressions support") Fixes: 48b0ae046ee9 ("netfilter: nftables: netlink support for several set element expressions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_tables_api.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 43fe80f10313..8ee9f40cc0ea 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5281,6 +5281,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {}; struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; u8 genmask = nft_genmask_next(ctx->net); + u32 flags = 0, size = 0, num_exprs = 0; struct nft_set_ext_tmpl tmpl; struct nft_set_ext *ext, *ext2; struct nft_set_elem elem; @@ -5290,7 +5291,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, struct nft_data_desc desc; enum nft_registers dreg; struct nft_trans *trans; - u32 flags = 0, size = 0; u64 timeout; u64 expiration; int err, i; @@ -5356,7 +5356,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, if (nla[NFTA_SET_ELEM_EXPR]) { struct nft_expr *expr; - if (set->num_exprs != 1) + if (set->num_exprs && set->num_exprs != 1) return -EOPNOTSUPP; expr = nft_set_elem_expr_alloc(ctx, set, @@ -5365,8 +5365,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, return PTR_ERR(expr); expr_array[0] = expr; + num_exprs = 1; - if (set->exprs[0] && set->exprs[0]->ops != expr->ops) { + if (set->num_exprs && set->exprs[0]->ops != expr->ops) { err = -EOPNOTSUPP; goto err_set_elem_expr; } @@ -5375,12 +5376,10 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, struct nlattr *tmp; int left; - if (set->num_exprs == 0) - return -EOPNOTSUPP; - i = 0; nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) { - if (i == set->num_exprs) { + if (i == NFT_SET_EXPR_MAX || + (set->num_exprs && set->num_exprs == i)) { err = -E2BIG; goto err_set_elem_expr; } @@ -5394,14 +5393,15 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, goto err_set_elem_expr; } expr_array[i] = expr; + num_exprs++; - if (expr->ops != set->exprs[i]->ops) { + if (set->num_exprs && expr->ops != set->exprs[i]->ops) { err = -EOPNOTSUPP; goto err_set_elem_expr; } i++; } - if (set->num_exprs != i) { + if (set->num_exprs && set->num_exprs != i) { err = -EOPNOTSUPP; goto err_set_elem_expr; } @@ -5409,6 +5409,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, err = nft_set_elem_expr_clone(ctx, set, expr_array); if (err < 0) goto err_set_elem_expr_clone; + + num_exprs = set->num_exprs; } err = nft_setelem_parse_key(ctx, set, &elem.key.val, @@ -5433,8 +5435,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); } - if (set->num_exprs) { - for (i = 0; i < set->num_exprs; i++) + if (num_exprs) { + for (i = 0; i < num_exprs; i++) size += expr_array[i]->ops->size; nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, @@ -5522,7 +5524,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, *nft_set_ext_obj(ext) = obj; obj->use++; } - for (i = 0; i < set->num_exprs; i++) + for (i = 0; i < num_exprs; i++) nft_set_elem_expr_setup(ext, i, expr_array); trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); @@ -5584,7 +5586,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, err_parse_key: nft_data_release(&elem.key.val, NFT_DATA_VALUE); err_set_elem_expr: - for (i = 0; i < set->num_exprs && expr_array[i]; i++) + for (i = 0; i < num_exprs && expr_array[i]; i++) nft_expr_destroy(ctx, expr_array[i]); err_set_elem_expr_clone: return err; -- 2.20.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-02-10 0:12 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2021-02-09 21:35 [PATCH net 0/2] Netfilter fixes for net Pablo Neira Ayuso 2021-02-09 21:35 ` [PATCH net 1/2] netfilter: conntrack: skip identical origin tuple in same zone only Pablo Neira Ayuso 2021-02-10 0:00 ` patchwork-bot+netdevbpf 2021-02-09 21:35 ` [PATCH net 2/2] netfilter: nftables: relax check for stateful expressions in set definition Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).