linux-stable.git/net/netfilter, branch v4.8.8

netfilter: xt_NFLOG: fix unexpected truncated packet

2016-11-10T15:38:56+00:00

commit 6d19375b58763fefc2f215fb45117d3353ced888 upstream.

Justin and Chris spotted that iptables NFLOG target was broken when they
upgraded the kernel to 4.8: "ulogd-2.0.5- IPs are no longer logged" or
"results in segfaults in ulogd-2.0.5".

Because "struct nf_loginfo li;" is a local variable, and flags will be
filled with garbage value, not inited to zero. So if it contains 0x1,
packets will not be logged to the userspace anymore.

Fixes: 7643507fe8b5 ("netfilter: xt_NFLOG: nflog-range does not truncate packets")
Reported-by: Justin Piszcz 
Reported-by: Chris Caputo 
Tested-by: Chris Caputo 
Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions

2016-09-13T08:50:56+00:00

When memory is exhausted, nfct_seqadj_ext_add may fail to add the
synproxy and seqadj extensions. The function nf_ct_seqadj_init doesn't
check if get valid seqadj pointer by the nfct_seqadj.

Now drop the packet directly when fail to add seqadj extension to
avoid dereference NULL pointer in nf_ct_seqadj_init from
init_conntrack().

Signed-off-by: Gao Feng 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat: handle NF_DROP from nfnetlink_parse_nat_setup()

2016-09-12T18:32:57+00:00

nf_nat_setup_info() returns NF_* verdicts, so convert them to error
codes that is what ctnelink expects. This has passed overlook without
having any impact since this nf_nat_setup_info() has always returned
NF_ACCEPT so far. Since 870190a9ec90 ("netfilter: nat: convert nat bysrc
hash to rhashtable"), this is problem.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables_trace: fix endiness when dump chain policy

2016-09-05T17:28:23+00:00

NFTA_TRACE_POLICY attribute is big endian, but we forget to call
htonl to convert it. Fortunately, this attribute is parsed as big
endian in libnftnl.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables_netdev: remove redundant ip_hdr assignment

2016-08-30T09:41:04+00:00

We have already use skb_header_pointer to get the ip header pointer,
so there's no need to use ip_hdr again. Moreover, in NETDEV INGRESS
hook, ip header maybe not linear, so use ip_hdr is not appropriate,
remove it.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_meta: improve the validity check of pkttype set expr

2016-08-25T11:12:03+00:00

"meta pkttype set" is only supported on prerouting chain with bridge
family and ingress chain with netdev family.

But the validate check is incomplete, and the user can add the nft
rules on input chain with bridge family, for example:
  # nft add table bridge filter
  # nft add chain bridge filter input {type filter hook input \
    priority 0 \;}
  # nft add chain bridge filter test
  # nft add rule bridge filter test meta pkttype set unicast
  # nft add rule bridge filter input jump test

This patch fixes the problem.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: cttimeout: unlink timeout objs in the unconfirmed ct lists

2016-08-25T11:11:30+00:00

KASAN reported this bug:
  BUG: KASAN: use-after-free in icmp_packet+0x25/0x50 [nf_conntrack_ipv4] at
  addr ffff880002db08c8
  Read of size 4 by task lt-nf-queue/19041
  Call Trace:
    [] dump_stack+0x63/0x88
  [] kasan_report_error+0x528/0x560
  [] kasan_report+0x58/0x60
  [] ? icmp_packet+0x25/0x50 [nf_conntrack_ipv4]
  [] __asan_load4+0x61/0x80
  [] icmp_packet+0x25/0x50 [nf_conntrack_ipv4]
  [] nf_conntrack_in+0x550/0x980 [nf_conntrack]
  [] ? __nf_conntrack_confirm+0xb10/0xb10 [nf_conntrack]
  [ ... ]

The main reason is that we missed to unlink the timeout objects in the
unconfirmed ct lists, so we will access the timeout objects that have
already been freed.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: cttimeout: put back l4proto when replacing timeout policy

2016-08-25T11:11:16+00:00

We forget to call nf_ct_l4proto_put when replacing the existing
timeout policy. Acctually, there's no need to get ct l4proto
before doing replace, so we can move it to a later position.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink: use list_for_each_entry_safe to delete all objects

2016-08-25T11:11:00+00:00

cttimeout and acct objects are deleted from the list while traversing
it, so use list_for_each_entry is unsafe here.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_reject: restrict to INPUT/FORWARD/OUTPUT

2016-08-25T10:55:34+00:00

After I add the nft rule "nft add rule filter prerouting reject
with tcp reset", kernel panic happened on my system:
  NULL pointer dereference at ...
  IP: [] nf_send_reset+0xaf/0x400
  Call Trace:
  [] ? nf_reject_ip_tcphdr_get+0x160/0x160
  [] nft_reject_ipv4_eval+0x61/0xb0 [nft_reject_ipv4]
  [] nft_do_chain+0x1fa/0x890 [nf_tables]
  [] ? __nft_trace_packet+0x170/0x170 [nf_tables]
  [] ? nf_ct_invert_tuple+0xb0/0xc0 [nf_conntrack]
  [] ? nf_nat_setup_info+0x5d4/0x650 [nf_nat]
  [...]

Because in the PREROUTING chain, routing information is not exist,
then we will dereference the NULL pointer and oops happen.

So we restrict reject expression to INPUT, FORWARD and OUTPUT chain.
This is consistent with iptables REJECT target.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso