linux-stable.git/net/bridge/netfilter, branch linux-4.6.y

netfilter: ebtables: Fix extension lookup with identical name

2016-04-12T23:16:57+00:00

If a requested extension exists as module and is not loaded,
ebt_check_match() might accidentally use an NFPROTO_UNSPEC one with same
name and fail.

Reproduced with limit match: Given xt_limit and ebt_limit both built as
module, the following would fail:

  modprobe xt_limit
  ebtables -I INPUT --limit 1/s -j ACCEPT

The fix is to make ebt_check_match() distrust a found NFPROTO_UNSPEC
extension and retry after requesting an appropriate module.

Cc: Florian Westphal 
Signed-off-by: Phil Sutter 
Acked-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipv4: fix NULL dereference

2016-03-28T15:59:29+00:00

Commit fa50d974d104 ("ipv4: Namespaceify ip_default_ttl sysctl knob")
use sock_net(skb->sk) to get the net namespace, but we can't assume
that sk_buff->sk is always exist, so when it is NULL, oops will happen.

Signed-off-by: Liping Zhang 
Reviewed-by: Nikolay Borisov 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES

2016-03-28T15:59:24+00:00

Make sure the table names via getsockopt GET_ENTRIES is nul-terminated
in ebtables and all the x_tables variants and their respective compat
code. Uncovered by KASAN.

Reported-by: Baozeng Ding 
Signed-off-by: Pablo Neira Ayuso

ipv4: Namespaceify ip_default_ttl sysctl knob

2016-02-17T01:42:54+00:00

Signed-off-by: Nikolay Borisov 
Signed-off-by: David S. Miller

netfilter: nf_tables: release objects on netns destruction

2015-12-28T17:34:35+00:00

We have to release the existing objects on netns removal otherwise we
leak them. Chains are unregistered in first place to make sure no
packets are walking on our rules and sets anymore.

The object release happens by when we unregister the family via
nft_release_afinfo() which is called from nft_unregister_afinfo() from
the corresponding __net_exit path in every family.

Reported-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: wrap tracing with a static key

2015-12-09T12:23:13+00:00

Only needed when meta nftrace rule(s) were added.
The assumption is that no such rules are active, so the call to
nft_trace_init is "never" needed.

When nftrace rules are active, we always call the nft_trace_* functions,
but will only send netlink messages when all of the following are true:

 - traceinfo structure was initialised
 - skb->nf_trace == 1
 - at least one subscriber to trace group.

Adding an extra conditional
(static_branch ... && skb->nf_trace)
	nft_trace_init( ..)

Is possible but results in a larger nft_do_chain footprint.

Signed-off-by: Florian Westphal 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter-bridge: layout of if statements

2015-11-23T16:54:41+00:00

Eliminate some checkpatch issues by improved layout of if statements.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter-bridge: brace placement

2015-11-23T16:54:40+00:00

Change brace placement to eliminate checkpatch error.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter-bridge: use netdev style comments

2015-11-23T16:54:39+00:00

Changes comments to use netdev style.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter-bridge: Cleanse indentation

2015-11-23T16:54:39+00:00

Fixes a bunch of issues detected by checkpatch with regards to code
indentation.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso