linux-stable.git/net/ipv4/netfilter, branch v6.1.2

netfilter: conntrack: Fix data-races around ct mark

2022-11-18T14:21:00+00:00

nf_conn:mark can be read from and written to in parallel. Use
READ_ONCE()/WRITE_ONCE() for reads and writes to prevent unwanted
compiler optimizations.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Daniel Xu 
Signed-off-by: Pablo Neira Ayuso

netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces.

2022-10-19T06:46:48+00:00

Currently netfilter's rpfilter and fib modules implicitely initialise
->flowic_uid with 0. This is normally the root UID. However, this isn't
the case in user namespaces, where user ID 0 is mapped to a different
kernel UID. By initialising ->flowic_uid with sock_net_uid(), we get
the root UID of the user namespace, thus keeping the same behaviour
whether or not we're running in a user namepspace.

Note, this is similar to commit 8bcfd0925ef1 ("ipv4: add missing
initialization for flowi4_uid"), which fixed the rp_filter sysctl.

Fixes: 622ec2c9d524 ("net: core: add UID to flows, rules, and routes")
Signed-off-by: Guillaume Nault 
Signed-off-by: Pablo Neira Ayuso

netfilter: rpfilter/fib: Populate flowic_l3mdev field

2022-10-12T12:08:15+00:00

Use the introduced field for correct operation with VRF devices instead
of conditionally overwriting flowic_oif. This is a partial revert of
commit b575b24b8eee3 ("netfilter: Fix rpfilter dropping vrf packets by
mistake"), implementing a simpler solution.

Signed-off-by: Phil Sutter 
Reviewed-by: David Ahern 
Reviewed-by: Guillaume Nault 
Signed-off-by: Florian Westphal

netfilter: nft_fib: Fix for rpath check with VRF devices

2022-09-28T11:33:26+00:00

Analogous to commit b575b24b8eee3 ("netfilter: Fix rpfilter
dropping vrf packets by mistake") but for nftables fib expression:
Add special treatment of VRF devices so that typical reverse path
filtering via 'fib saddr . iif oif' expression works as expected.

Fixes: f6d0cbcf09c50 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Phil Sutter 
Signed-off-by: Florian Westphal

netfilter: rpfilter: Remove unused variable 'ret'.

2022-09-21T08:44:56+00:00

Commit 91a178258aea ("netfilter: rpfilter: Convert
rpfilter_lookup_reverse to new dev helper") removed the need for the
'ret' variable. This went unnoticed because of the __maybe_unused
annotation.

Signed-off-by: Guillaume Nault 
Signed-off-by: Florian Westphal

tcp: Access &tcp_hashinfo via net.

2022-09-20T17:21:49+00:00

We will soon introduce an optional per-netns ehash.

This means we cannot use tcp_hashinfo directly in most places.

Instead, access it via net->ipv4.tcp_death_row.hashinfo.

The access will be valid only while initialising tcp_hashinfo
itself and creating/destroying each netns.

Signed-off-by: Kuniyuki Iwashima 
Reviewed-by: Eric Dumazet 
Signed-off-by: Jakub Kicinski

netfilter: nat: move repetitive nat port reserve loop to a helper

2022-09-07T14:46:04+00:00

Almost all nat helpers reserve an expecation port the same way:
Try the port inidcated by the peer, then move to next port if that
port is already in use.

We can squash this into a helper.

Suggested-by: Pablo Neira Ayuso 
Signed-off-by: Florian Westphal

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2022-07-21T20:03:39+00:00

No conflicts.

Signed-off-by: Jakub Kicinski

ip: Fix data-races around sysctl_ip_default_ttl.

2022-07-15T10:49:55+00:00

While reading sysctl_ip_default_ttl, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima 
Signed-off-by: David S. Miller

netfilter: h323: merge nat hook pointers into one

2022-07-11T14:25:16+00:00

sparse complains about incorrect rcu usage.

Code uses the correct rcu access primitives, but the function pointers
lack rcu annotations.

Collapse all of them into a single structure, then annotate the pointer.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso