linux-stable.git/net/bridge/netfilter, branch v4.1

Revert "netfilter: ensure number of counters is >0 in do_replace()"

2015-06-01T17:45:47+00:00

This partially reverts commit 1086bbe97a07 ("netfilter: ensure number of
counters is >0 in do_replace()") in net/bridge/netfilter/ebtables.c.

Setting rules with ebtables does not work any more with 1086bbe97a07 place.

There is an error message and no rules set in the end.

e.g.

~# ebtables -t nat -A POSTROUTING --src 12:34:56:78:9a:bc -j DROP
Unable to update the kernel. Two possible causes:
1. Multiple ebtables programs were executing simultaneously. The ebtables
   userspace tool doesn't by default support multiple ebtables programs
running

Reverting the ebtables part of 1086bbe97a07 makes this work again.

Signed-off-by: Bernhard Thaler 
Signed-off-by: Pablo Neira Ayuso

netfilter: ensure number of counters is >0 in do_replace()

2015-05-20T11:46:49+00:00

After improving setsockopt() coverage in trinity, I started triggering
vmalloc failures pretty reliably from this code path:

warn_alloc_failed+0xe9/0x140
__vmalloc_node_range+0x1be/0x270
vzalloc+0x4b/0x50
__do_replace+0x52/0x260 [ip_tables]
do_ipt_set_ctl+0x15d/0x1d0 [ip_tables]
nf_setsockopt+0x65/0x90
ip_setsockopt+0x61/0xa0
raw_setsockopt+0x16/0x60
sock_common_setsockopt+0x14/0x20
SyS_setsockopt+0x71/0xd0

It turns out we don't validate that the num_counters field in the
struct we pass in from userspace is initialized.

The same problem also exists in ebtables, arptables, ipv6, and the
compat variants.

Signed-off-by: Dave Jones 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13T15:17:29+00:00

Switch the nf_tables registers from 128 bit addressing to 32 bit
addressing to support so called concatenations, where multiple values
can be concatenated over multiple registers for O(1) exact matches of
multiple dimensions using sets.

The old register values are mapped to areas of 128 bits for compatibility.
When dumping register numbers, values are expressed using the old values
if they refer to the beginning of a 128 bit area for compatibility.

To support concatenations, register loads of less than a full 32 bit
value need to be padded. This mainly affects the payload and exthdr
expressions, which both unconditionally zero the last word before
copying the data.

Userspace fully passes the testsuite using both old and new register
addressing.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add register parsing/dumping helpers

2015-04-13T15:17:28+00:00

Add helper functions to parse and dump register values in netlink attributes.
These helpers will later be changed to take care of translation between the
old 128 bit and the new 32 bit register numbers.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: convert expressions to u32 register pointers

2015-04-13T15:17:25+00:00

Simple conversion to use u32 pointers to the beginning of the registers
to keep follow up patches smaller.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: get rid of NFT_REG_VERDICT usage

2015-04-13T15:17:07+00:00

Replace the array of registers passed to expressions by a struct nft_regs,
containing the verdict as a seperate member, which aliases to the
NFT_REG_VERDICT register.

This is needed to seperate the verdict from the data registers completely,
so their size can be changed.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: kill nft_validate_output_register()

2015-04-13T14:25:50+00:00

All users of nft_validate_register_store() first invoke
nft_validate_output_register(). There is in fact no use for using it
on its own, so simplify the code by folding the functionality into
nft_validate_register_store() and kill it.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: rename nft_validate_data_load()

2015-04-13T14:25:49+00:00

The existing name is ambiguous, data is loaded as well when we read from
a register. Rename to nft_validate_register_store() for clarity and
consistency with the upcoming patch to introduce its counterpart,
nft_validate_register_load().

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: validate len in nft_validate_data_load()

2015-04-13T14:25:49+00:00

For values spanning multiple registers, we need to validate that enough
space is available from the destination register onwards. Add a len
argument to nft_validate_data_load() and consolidate the existing length
validations in preparation of that.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: Fix switch statement warnings with recent gcc.

2015-04-08T19:20:50+00:00

More recent GCC warns about two kinds of switch statement uses:

1) Switching on an enumeration, but not having an explicit case
   statement for all members of the enumeration.  To show the
   compiler this is intentional, we simply add a default case
   with nothing more than a break statement.

2) Switching on a boolean value.  I think this warning is dumb
   but nevertheless you get it wholesale with -Wswitch.

This patch cures all such warnings in netfilter.

Signed-off-by: David S. Miller 
Acked-by: Pablo Neira Ayuso