netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/8] Netfilter/IPVS fixes for net
@ 2013-12-28 22:02 Pablo Neira Ayuso
  2013-12-28 22:03 ` [PATCH 1/8] netfilter: nfnetlink_log: unset nf_loggers for netns when unloading module Pablo Neira Ayuso
                   ` (8 more replies)
  0 siblings, 9 replies; 13+ messages in thread
From: Pablo Neira Ayuso @ 2013-12-28 22:02 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

This patchset contains four nf_tables fixes, one IPVS fix due to
missing updates in the interaction with the new sedadj conntrack
extension that was added to support the netfilter synproxy code,
and a couple of one-liners to fix netnamespace netfilter issues.
More specifically, they are:

* Fix ipv6_find_hdr() call without offset being explicitly initialized
  in nft_exthdr, as required by that function, from Daniel Borkmann.

* Fix oops in nfnetlink_log when using netns and unloading the kernel
  module, from Gao feng.

* Fix BUG_ON in nf_ct_timestamp extension after netns is destroyed,
  from Helmut Schaa.

* Fix crash in IPVS due to missing sequence adjustment extension being
  allocated in the conntrack, from Jesper Dangaard Brouer.

* Add bugtrap to spot a warning in case you deference sequence adjustment
  conntrack area when not available, this should help to catch similar
  invalid dereferences in the Netfilter tree, also from Jesper.

* Fix incomple dumping of sets in nf_tables when retrieving by family,
  from me.

* Fix oops when updating the table state (dormant <-> active) and having
  user (not base ) chains, from me.

* Fix wrong validation in set element data that results in returning
  -EINVAL when using the nf_tables dictionary feature with mappings,
  also from me.

We don't usually have this amount of fixes by this time (as we're already
in -rc5 of the development cycle), although half of them are related to
nf_tables which is a relatively new thing, and I also belive that holidays
have also delayed the flight of bugfixes to mainstream a bit.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Thanks!

P.S: Have a nice entrance to new year.

----------------------------------------------------------------

The following changes since commit a7c12639bdf571a09578aed626875848d209d24f:

  Merge branch 'qlcnic' (2013-12-17 16:25:24 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to 2ee0d3c80fdb7974cfa1c7e25b5048e9fcaf69b6:

  netfilter: nf_tables: fix wrong datatype in nft_validate_data_load() (2013-12-28 22:32:28 +0100)

----------------------------------------------------------------
Daniel Borkmann (1):
      netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset

Gao feng (1):
      netfilter: nfnetlink_log: unset nf_loggers for netns when unloading module

Helmut Schaa (1):
      netfilter: nf_ct_timestamp: Fix BUG_ON after netns deletion

Jesper Dangaard Brouer (2):
      netfilter: WARN about wrong usage of sequence number adjustments
      ipvs: correct usage/allocation of seqadj ext in ipvs

Pablo Neira Ayuso (3):
      netfilter: nf_tables: fix dumping with large number of sets
      netfilter: nf_tables: fix oops when updating table with user chains
      netfilter: nf_tables: fix wrong datatype in nft_validate_data_load()

 net/netfilter/ipvs/ip_vs_nfct.c        |    6 ++++++
 net/netfilter/nf_conntrack_seqadj.c    |    5 +++++
 net/netfilter/nf_conntrack_timestamp.c |    1 -
 net/netfilter/nf_tables_api.c          |   26 ++++++++++++++++++++------
 net/netfilter/nfnetlink_log.c          |    1 +
 net/netfilter/nft_exthdr.c             |    2 +-
 6 files changed, 33 insertions(+), 8 deletions(-)

^ permalink raw reply	[flat|nested] 13+ messages in thread
* [PATCH 0/8] Netfilter/IPVS fixes for net
@ 2014-11-14 16:58 Pablo Neira Ayuso
  2014-11-14 16:58 ` Pablo Neira Ayuso
  2014-11-16 19:24 ` David Miller
  0 siblings, 2 replies; 13+ messages in thread
From: Pablo Neira Ayuso @ 2014-11-14 16:58 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter updates for your net tree,
they are:

1) Fix missing initialization of the range structure (allocated in the
   stack) in nft_masq_{ipv4, ipv6}_eval, from Daniel Borkmann.

2) Make sure the data we receive from userspace contains the req_version
   structure, otherwise return an error incomplete on truncated input.
   From Dan Carpenter.

3) Fix handling og skb->sk which may cause incorrect handling
   of connections from a local process. Via Simon Horman, patch from
   Calvin Owens.

4) Fix wrong netns in nft_compat when setting target and match params
   structure.

5) Relax chain type validation in nft_compat that was recently included,
   this broke the matches that need to be run from the route chain type.
   Now iptables-test.py automated regression tests report success again
   and we avoid the only possible problematic case, which is the use of
   nat targets out of nat chain type.

6) Use match->table to validate the tablename, instead of the match->name.
   Again patch for nft_compat.

7) Restore the synchronous release of objects from the commit and abort
   path in nf_tables. This is causing two major problems: splats when using
   nft_compat, given that matches and targets may sleep and call_rcu is
   invoked from softirq context. Moreover Patrick reported possible event
   notification reordering when rules refer to anonymous sets.

8) Fix race condition in between packets that are being confirmed by
   conntrack and the ctnetlink flush operation. This happens since the
   removal of the central spinlock. Thanks to Jesper D. Brouer to looking
   into this.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit d52fdbb735c36a209f36a628d40ca9185b349ba7:

  smc91x: retrieve IRQ and trigger flags in a modern way (2014-11-01 17:04:20 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to 5195c14c8b27cc0b18220ddbf0e5ad3328a04187:

  netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse (2014-11-14 17:43:05 +0100)

----------------------------------------------------------------
Calvin Owens (1):
      ipvs: Keep skb->sk when allocating headroom on tunnel xmit

Dan Carpenter (1):
      netfilter: ipset: small potential read beyond the end of buffer

Daniel Borkmann (1):
      netfilter: nft_masq: fix uninitialized range in nft_masq_{ipv4, ipv6}_eval

Pablo Neira Ayuso (4):
      netfilter: nft_compat: use current net namespace
      netfilter: nft_compat: relax chain type validation
      netfilter: nft_compat: use the match->table to validate dependencies
      netfilter: nf_tables: restore synchronous object release from commit/abort

bill bonaparte (1):
      netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse

 include/net/netfilter/nf_tables.h  |    2 --
 net/ipv4/netfilter/nft_masq_ipv4.c |    1 +
 net/ipv6/netfilter/nft_masq_ipv6.c |    1 +
 net/netfilter/ipset/ip_set_core.c  |    6 ++++++
 net/netfilter/ipvs/ip_vs_xmit.c    |    2 ++
 net/netfilter/nf_conntrack_core.c  |   14 +++++++------
 net/netfilter/nf_tables_api.c      |   24 ++++++++--------------
 net/netfilter/nft_compat.c         |   40 ++++++------------------------------
 8 files changed, 32 insertions(+), 58 deletions(-)

^ permalink raw reply	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2014-11-16 19:24 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-28 22:02 [PATCH 0/8] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2013-12-28 22:03 ` [PATCH 1/8] netfilter: nfnetlink_log: unset nf_loggers for netns when unloading module Pablo Neira Ayuso
2013-12-28 22:03 ` [PATCH 2/8] netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset Pablo Neira Ayuso
2013-12-28 22:03 ` [PATCH 3/8] netfilter: nf_ct_timestamp: Fix BUG_ON after netns deletion Pablo Neira Ayuso
2013-12-28 22:03 ` [PATCH 4/8] netfilter: WARN about wrong usage of sequence number adjustments Pablo Neira Ayuso
2013-12-28 22:03 ` [PATCH 5/8] ipvs: correct usage/allocation of seqadj ext in ipvs Pablo Neira Ayuso
2013-12-28 22:03 ` [PATCH 6/8] netfilter: nf_tables: fix dumping with large number of sets Pablo Neira Ayuso
2013-12-28 22:03 ` [PATCH 7/8] netfilter: nf_tables: fix oops when updating table with user chains Pablo Neira Ayuso
2013-12-28 22:03 ` [PATCH 8/8] netfilter: nf_tables: fix wrong datatype in nft_validate_data_load() Pablo Neira Ayuso
2013-12-29  5:29 ` [PATCH 0/8] Netfilter/IPVS fixes for net David Miller
  -- strict thread matches above, loose matches on Subject: below --
2014-11-14 16:58 Pablo Neira Ayuso
2014-11-14 16:58 ` Pablo Neira Ayuso
2014-11-16 19:24 ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).