[PATCH 0/3] [-stable] Netfilter updates for stable 3.6

[PATCH 0/3] [-stable] Netfilter updates for stable 3.6

[pablo]

From: Pablo Neira Ayuso <pablo@netfilter.org>

Hi!

Please, consider the following Netfilter patches for stable 3.6 and
onwards inclusion.

The selected three patches are:

2ad5b9e netfilter: xt_TEE: don't use destination address found in header
bbb5823 netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper
0153d5a netfilter: xt_CT: fix timeout setting with IPv6 [REQUIRES: 236df00 netfilter: xt_CT: refactorize xt_ct_tg_check]

More relevantly, the first patch fix the TEE target, which is broken in 3.6.

Please, cherry-pick them. Thanks!

Eric Dumazet (1):
  netfilter: xt_TEE: don't use destination address found in header

Julian Anastasov (1):
  netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper

Pablo Neira Ayuso (1):
  netfilter: xt_CT: fix timeout setting with IPv6

--
1.7.10.4

[PATCH 1/3] [-stable] netfilter: xt_TEE: don't use destination address found in header

[pablo]

From: Eric Dumazet <eric.dumazet@gmail.com>

Torsten Luettgert bisected TEE regression starting with commit
f8126f1d5136be1 (ipv4: Adjust semantics of rt->rt_gateway.)

The problem is that it tries to ARP-lookup the original destination
address of the forwarded packet, not the address of the gateway.

Fix this using FLOWI_FLAG_KNOWN_NH Julian added in commit
c92b96553a80c1 (ipv4: Add FLOWI_FLAG_KNOWN_NH), so that known
nexthop (info->gw.ip) has preference on resolving.

Reported-by: Torsten Luettgert <ml-netfilter@enda.eu>
Bisected-by: Torsten Luettgert <ml-netfilter@enda.eu>
Tested-by: Torsten Luettgert <ml-netfilter@enda.eu>
Cc: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/xt_TEE.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index ee2e5bc..bd93e51 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -70,6 +70,7 @@ tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
 	fl4.daddr = info->gw.ip;
 	fl4.flowi4_tos = RT_TOS(iph->tos);
 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+	fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
 	rt = ip_route_output_key(net, &fl4);
 	if (IS_ERR(rt))
 		return false;
-- 
1.7.10.4

[PATCH 2/3] [-stable] netfilter: xt_CT: fix timeout setting with IPv6

[pablo]

From: Pablo Neira Ayuso <pablo@netfilter.org>

This patch fixes ip6tables and the CT target if it is used to set
some custom conntrack timeout policy for IPv6.

Use xt_ct_find_proto which already handles the ip6tables case for us.

[ This patch requires: 236df00 netfilter: xt_CT: refactorize xt_ct_tg_check ]

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/xt_CT.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 16c7125..ae7f5da 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -180,9 +180,9 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
 	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
 	struct ctnl_timeout *timeout;
 	struct nf_conn_timeout *timeout_ext;
-	const struct ipt_entry *e = par->entryinfo;
 	struct nf_conntrack_l4proto *l4proto;
 	int ret = 0;
+	u8 proto;
 
 	rcu_read_lock();
 	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
@@ -192,9 +192,11 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
 		goto out;
 	}
 
-	if (e->ip.invflags & IPT_INV_PROTO) {
+	proto = xt_ct_find_proto(par);
+	if (!proto) {
 		ret = -EINVAL;
-		pr_info("You cannot use inversion on L4 protocol\n");
+		pr_info("You must specify a L4 protocol, and not use "
+			"inversions on it.\n");
 		goto out;
 	}
 
@@ -214,7 +216,7 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
 	/* Make sure the timeout policy matches any existing protocol tracker,
 	 * otherwise default to generic.
 	 */
-	l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);
+	l4proto = __nf_ct_l4proto_find(par->family, proto);
 	if (timeout->l4proto->l4proto != l4proto->l4proto) {
 		ret = -EINVAL;
 		pr_info("Timeout policy `%s' can only be used by L4 protocol "
-- 
1.7.10.4

[PATCH 3/3] [-stable] netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper

[pablo]

From: Julian Anastasov <ja@ssi.bg>

After the change "Adjust semantics of rt->rt_gateway"
(commit f8126f1d51) we should properly match the nexthop when
destinations are directly connected because rt_gateway can be 0.

The rt_gateway checks in H.323 helper try to avoid the creation
of an unnecessary expectation in this call-forwarding case:

http://people.netfilter.org/zhaojingmin/h323_conntrack_nat_helper/#_Toc133598073

However, the existing code fails to avoid that in many cases,
see this thread:

http://marc.info/?l=linux-netdev&m=135043175028620&w=2

It seems it is not trivial to know from the kernel if two hosts
have to go through the firewall to communicate each other, which
is the main point of the call-forwarding filter code to avoid
creating unnecessary expectations.

So this patch just gets things the way they were as before
commit f8126f1d51.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_conntrack_h323_main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 4283b20..02f65bc 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -733,7 +733,8 @@ static int callforward_do_filter(const union nf_inet_addr *src,
 				   flowi4_to_flowi(&fl1), false)) {
 			if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
 					   flowi4_to_flowi(&fl2), false)) {
-				if (rt1->rt_gateway == rt2->rt_gateway &&
+				if (rt_nexthop(rt1, fl1.daddr) ==
+				    rt_nexthop(rt2, fl2.daddr) &&
 				    rt1->dst.dev  == rt2->dst.dev)
 					ret = 1;
 				dst_release(&rt2->dst);
-- 
1.7.10.4

Re: [PATCH 0/3] [-stable] Netfilter updates for stable 3.6

[Pablo Neira Ayuso]

On Fri, Nov 16, 2012 at 03:02:27PM +0100, pablo@netfilter.org wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> Hi!
> 
> Please, consider the following Netfilter patches for stable 3.6 and
> onwards inclusion.

The "onwards" is obviously a typo from the template I've used, these
are already in 3.7-rc :-)

> The selected three patches are:
> 
> 2ad5b9e netfilter: xt_TEE: don't use destination address found in header
> bbb5823 netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper
> 0153d5a netfilter: xt_CT: fix timeout setting with IPv6 [REQUIRES: 236df00 netfilter: xt_CT: refactorize xt_ct_tg_check]
> 
> More relevantly, the first patch fix the TEE target, which is broken in 3.6.
> 
> Please, cherry-pick them. Thanks!
> 
> Eric Dumazet (1):
>   netfilter: xt_TEE: don't use destination address found in header
> 
> Julian Anastasov (1):
>   netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper
> 
> Pablo Neira Ayuso (1):
>   netfilter: xt_CT: fix timeout setting with IPv6
> 
> --
> 1.7.10.4
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 2/3] [-stable] netfilter: xt_CT: fix timeout setting with IPv6

[Greg KH]

On Fri, Nov 16, 2012 at 03:02:29PM +0100, pablo@netfilter.org wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> This patch fixes ip6tables and the CT target if it is used to set
> some custom conntrack timeout policy for IPv6.
> 
> Use xt_ct_find_proto which already handles the ip6tables case for us.
> 
> [ This patch requires: 236df00 netfilter: xt_CT: refactorize xt_ct_tg_check ]
> 
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  net/netfilter/xt_CT.c |   10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)

This one doesn't apply to the 3.6-stable tree, care to provide a
backport that works properly?

thanks,

greg k-h

Re: [PATCH 0/3] [-stable] Netfilter updates for stable 3.6

[Greg KH]

On Fri, Nov 16, 2012 at 03:02:27PM +0100, pablo@netfilter.org wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> Hi!
> 
> Please, consider the following Netfilter patches for stable 3.6 and
> onwards inclusion.
> 
> The selected three patches are:
> 
> 2ad5b9e netfilter: xt_TEE: don't use destination address found in header
> bbb5823 netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper

These two now applied to the 3.6-stable tree.

> 0153d5a netfilter: xt_CT: fix timeout setting with IPv6 [REQUIRES: 236df00 netfilter: xt_CT: refactorize xt_ct_tg_check]

This one didn't apply :(

thanks,

greg k-h