* [PATCH 0/3] netfilter updates for the net tree
@ 2012-10-30 10:19 pablo
2012-10-30 10:19 ` [PATCH 1/3] netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper pablo
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: pablo @ 2012-10-30 10:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Hi David,
The following patchset contains fixes for your net tree, two of them
are due to relatively recent changes, one has been a longstanding bug,
they are:
* Fix incorrect usage of rt_gateway in the H.323 helper, from
Julian Anastasov.
* Skip re-route in nf_nat code for ICMP traffic. If CONFIG_XFRM is
enabled, we waste cycles to look up for the route again. This problem
seems to be there since really long time. From Ulrich Weber.
* Fix mismatching section in nf_conntrack_reasm, from Hein Tibosch.
You can pull this changes from:
git://1984.lsi.us.es/nf master
Thanks!
Hein Tibosch (1):
netfilter: nf_defrag_ipv6: solve section mismatch in nf_conntrack_reasm
Julian Anastasov (1):
netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper
Ulrich Weber (1):
netfilter: nf_nat: don't check for port change on ICMP tuples
net/ipv4/netfilter/iptable_nat.c | 4 +++-
net/ipv6/netfilter/ip6table_nat.c | 4 +++-
net/ipv6/netfilter/nf_conntrack_reasm.c | 4 ++--
net/netfilter/nf_conntrack_h323_main.c | 3 ++-
4 files changed, 10 insertions(+), 5 deletions(-)
--
1.7.10.4
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 1/3] netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper
2012-10-30 10:19 [PATCH 0/3] netfilter updates for the net tree pablo
@ 2012-10-30 10:19 ` pablo
2012-10-30 10:19 ` [PATCH 2/3] netfilter: nf_nat: don't check for port change on ICMP tuples pablo
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: pablo @ 2012-10-30 10:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Julian Anastasov <ja@ssi.bg>
After the change "Adjust semantics of rt->rt_gateway"
(commit f8126f1d51) we should properly match the nexthop when
destinations are directly connected because rt_gateway can be 0.
The rt_gateway checks in H.323 helper try to avoid the creation
of an unnecessary expectation in this call-forwarding case:
http://people.netfilter.org/zhaojingmin/h323_conntrack_nat_helper/#_Toc133598073
However, the existing code fails to avoid that in many cases,
see this thread:
http://marc.info/?l=linux-netdev&m=135043175028620&w=2
It seems it is not trivial to know from the kernel if two hosts
have to go through the firewall to communicate each other, which
is the main point of the call-forwarding filter code to avoid
creating unnecessary expectations.
So this patch just gets things the way they were as before
commit f8126f1d51.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_h323_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 1b30b0d..962795e 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -753,7 +753,8 @@ static int callforward_do_filter(const union nf_inet_addr *src,
flowi4_to_flowi(&fl1), false)) {
if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
flowi4_to_flowi(&fl2), false)) {
- if (rt1->rt_gateway == rt2->rt_gateway &&
+ if (rt_nexthop(rt1, fl1.daddr) ==
+ rt_nexthop(rt2, fl2.daddr) &&
rt1->dst.dev == rt2->dst.dev)
ret = 1;
dst_release(&rt2->dst);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 2/3] netfilter: nf_nat: don't check for port change on ICMP tuples
2012-10-30 10:19 [PATCH 0/3] netfilter updates for the net tree pablo
2012-10-30 10:19 ` [PATCH 1/3] netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper pablo
@ 2012-10-30 10:19 ` pablo
2012-10-30 10:19 ` [PATCH 3/3] netfilter: nf_defrag_ipv6: solve section mismatch in nf_conntrack_reasm pablo
2012-10-31 18:57 ` [PATCH 0/3] netfilter updates for the net tree David Miller
3 siblings, 0 replies; 5+ messages in thread
From: pablo @ 2012-10-30 10:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Ulrich Weber <ulrich.weber@sophos.com>
ICMP tuples have id in src and type/code in dst.
So comparing src.u.all with dst.u.all will always fail here
and ip_xfrm_me_harder() is called for every ICMP packet,
even if there was no NAT.
Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/iptable_nat.c | 4 +++-
net/ipv6/netfilter/ip6table_nat.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c
index 9e0ffaf..a820472 100644
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -184,7 +184,8 @@ nf_nat_ipv4_out(unsigned int hooknum,
if ((ct->tuplehash[dir].tuple.src.u3.ip !=
ct->tuplehash[!dir].tuple.dst.u3.ip) ||
- (ct->tuplehash[dir].tuple.src.u.all !=
+ (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+ ct->tuplehash[dir].tuple.src.u.all !=
ct->tuplehash[!dir].tuple.dst.u.all))
if (nf_xfrm_me_harder(skb, AF_INET) < 0)
ret = NF_DROP;
@@ -221,6 +222,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum,
}
#ifdef CONFIG_XFRM
else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
+ ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
ct->tuplehash[dir].tuple.dst.u.all !=
ct->tuplehash[!dir].tuple.src.u.all)
if (nf_xfrm_me_harder(skb, AF_INET) < 0)
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index e418bd6..d57dab1 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -186,7 +186,8 @@ nf_nat_ipv6_out(unsigned int hooknum,
if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
&ct->tuplehash[!dir].tuple.dst.u3) ||
- (ct->tuplehash[dir].tuple.src.u.all !=
+ (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
+ ct->tuplehash[dir].tuple.src.u.all !=
ct->tuplehash[!dir].tuple.dst.u.all))
if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
ret = NF_DROP;
@@ -222,6 +223,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
}
#ifdef CONFIG_XFRM
else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
+ ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
ct->tuplehash[dir].tuple.dst.u.all !=
ct->tuplehash[!dir].tuple.src.u.all)
if (nf_xfrm_me_harder(skb, AF_INET6))
--
1.7.10.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 3/3] netfilter: nf_defrag_ipv6: solve section mismatch in nf_conntrack_reasm
2012-10-30 10:19 [PATCH 0/3] netfilter updates for the net tree pablo
2012-10-30 10:19 ` [PATCH 1/3] netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper pablo
2012-10-30 10:19 ` [PATCH 2/3] netfilter: nf_nat: don't check for port change on ICMP tuples pablo
@ 2012-10-30 10:19 ` pablo
2012-10-31 18:57 ` [PATCH 0/3] netfilter updates for the net tree David Miller
3 siblings, 0 replies; 5+ messages in thread
From: pablo @ 2012-10-30 10:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Hein Tibosch <hein_tibosch@yahoo.es>
WARNING: net/ipv6/netfilter/nf_defrag_ipv6.o(.text+0xe0): Section mismatch in
reference from the function nf_ct_net_init() to the function
.init.text:nf_ct_frag6_sysctl_register()
The function nf_ct_net_init() references the function
__init nf_ct_frag6_sysctl_register().
In case nf_conntrack_ipv6 is compiled as a module, nf_ct_net_init could be
called after the init code and data are unloaded. Therefore remove the
"__net_init" annotation from nf_ct_frag6_sysctl_register().
Signed-off-by: Hein Tibosch <hein_tibosch@yahoo.es>
Acked-by: Cong Wang <amwang@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv6/netfilter/nf_conntrack_reasm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 18bd9bb..22c8ea9 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -85,7 +85,7 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = {
{ }
};
-static int __net_init nf_ct_frag6_sysctl_register(struct net *net)
+static int nf_ct_frag6_sysctl_register(struct net *net)
{
struct ctl_table *table;
struct ctl_table_header *hdr;
@@ -127,7 +127,7 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
}
#else
-static int __net_init nf_ct_frag6_sysctl_register(struct net *net)
+static int nf_ct_frag6_sysctl_register(struct net *net)
{
return 0;
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 0/3] netfilter updates for the net tree
2012-10-30 10:19 [PATCH 0/3] netfilter updates for the net tree pablo
` (2 preceding siblings ...)
2012-10-30 10:19 ` [PATCH 3/3] netfilter: nf_defrag_ipv6: solve section mismatch in nf_conntrack_reasm pablo
@ 2012-10-31 18:57 ` David Miller
3 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2012-10-31 18:57 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: pablo@netfilter.org
Date: Tue, 30 Oct 2012 11:19:17 +0100
> The following patchset contains fixes for your net tree, two of them
> are due to relatively recent changes, one has been a longstanding bug,
> they are:
>
> * Fix incorrect usage of rt_gateway in the H.323 helper, from
> Julian Anastasov.
>
> * Skip re-route in nf_nat code for ICMP traffic. If CONFIG_XFRM is
> enabled, we waste cycles to look up for the route again. This problem
> seems to be there since really long time. From Ulrich Weber.
>
> * Fix mismatching section in nf_conntrack_reasm, from Hein Tibosch.
>
> You can pull this changes from:
>
> git://1984.lsi.us.es/nf master
Pulled, thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-10-31 18:58 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-10-30 10:19 [PATCH 0/3] netfilter updates for the net tree pablo
2012-10-30 10:19 ` [PATCH 1/3] netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper pablo
2012-10-30 10:19 ` [PATCH 2/3] netfilter: nf_nat: don't check for port change on ICMP tuples pablo
2012-10-30 10:19 ` [PATCH 3/3] netfilter: nf_defrag_ipv6: solve section mismatch in nf_conntrack_reasm pablo
2012-10-31 18:57 ` [PATCH 0/3] netfilter updates for the net tree David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).