linux-stable.git/net/netfilter, branch v6.3

netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements

2023-04-18T07:30:21+00:00

If NFT_SET_ELEM_CATCHALL is set on, then userspace provides no set element
key. Otherwise, bail out with -EINVAL.

Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: validate catch-all set elements

2023-04-18T07:12:22+00:00

catch-all set element might jump/goto to chain that uses expressions
that require validation.

Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: Modify nla_memdup's flag to GFP_KERNEL_ACCOUNT

2023-04-06T09:33:52+00:00

For memory alloc that store user data from nla[NFTA_OBJ_USERDATA],
use GFP_KERNEL_ACCOUNT is more suitable.

Fixes: 33758c891479 ("memcg: enable accounting for nft objects")
Signed-off-by: Chen Aotian 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_redir: correct value of inet type `.maxattrs`

2023-03-08T11:26:42+00:00

`nft_redir_inet_type.maxattrs` was being set, presumably because of a
cut-and-paste error, to `NFTA_MASQ_MAX`, instead of `NFTA_REDIR_MAX`.

Fixes: 63ce3940f3ab ("netfilter: nft_redir: add inet support")
Signed-off-by: Jeremy Sowden 
Reviewed-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_redir: correct length for loading protocol registers

2023-03-08T11:26:37+00:00

The values in the protocol registers are two bytes wide.  However, when
parsing the register loads, the code currently uses the larger 16-byte
size of a `union nf_inet_addr`.  Change it to use the (correct) size of
a `union nf_conntrack_man_proto` instead.

Fixes: d07db9884a5f ("netfilter: nf_tables: introduce nft_validate_register_load()")
Signed-off-by: Jeremy Sowden 
Reviewed-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_masq: correct length for loading protocol registers

2023-03-08T11:26:31+00:00

The values in the protocol registers are two bytes wide.  However, when
parsing the register loads, the code currently uses the larger 16-byte
size of a `union nf_inet_addr`.  Change it to use the (correct) size of
a `union nf_conntrack_man_proto` instead.

Fixes: 8a6bf5da1aef ("netfilter: nft_masq: support port range")
Signed-off-by: Jeremy Sowden 
Reviewed-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_nat: correct length for loading protocol registers

2023-03-08T11:25:59+00:00

The values in the protocol registers are two bytes wide.  However, when
parsing the register loads, the code currently uses the larger 16-byte
size of a `union nf_inet_addr`.  Change it to use the (correct) size of
a `union nf_conntrack_man_proto` instead.

Fixes: d07db9884a5f ("netfilter: nf_tables: introduce nft_validate_register_load()")
Signed-off-by: Jeremy Sowden 
Reviewed-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: conntrack: adopt safer max chain length

2023-03-07T09:58:06+00:00

Customers using GKE 1.25 and 1.26 are facing conntrack issues
root caused to commit c9c3b6811f74 ("netfilter: conntrack: make
max chain length random").

Even if we assume Uniform Hashing, a bucket often reachs 8 chained
items while the load factor of the hash table is smaller than 0.5

With a limit of 16, we reach load factors of 3.
With a limit of 32, we reach load factors of 11.
With a limit of 40, we reach load factors of 15.
With a limit of 50, we reach load factors of 24.

This patch changes MIN_CHAINLEN to 50, to minimize risks.

Ideally, we could in the future add a cushion based on expected
load factor (2 * nf_conntrack_max / nf_conntrack_buckets),
because some setups might expect unusual values.

Fixes: c9c3b6811f74 ("netfilter: conntrack: make max chain length random")
Signed-off-by: Eric Dumazet 
Signed-off-by: Pablo Neira Ayuso

netfilter: ctnetlink: revert to dumping mark regardless of event type

2023-03-06T11:09:23+00:00

It seems that change was unintentional, we have userspace code that
needs the mark while listening for events like REPLY, DESTROY, etc.
Also include 0-marks in requested dumps, as they were before that fix.

Fixes: 1feeae071507 ("netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark")
Signed-off-by: Ivan Delalande 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_quota: copy content when cloning expression

2023-03-01T16:23:23+00:00

If the ruleset contains consumed quota, restore them accordingly.
Otherwise, listing after restoration shows never used items.

Restore the user-defined quota and flags too.

Fixes: ed0a0c60f0e5 ("netfilter: nft_quota: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso