linux.git/net/ipv6, branch v3.17-rc7

xfrm: Generate blackhole routes only from route lookup functions

2014-09-16T08:08:40+00:00

Currently we genarate a blackhole route route whenever we have
matching policies but can not resolve the states. Here we assume
that dst_output() is called to kill the balckholed packets.
Unfortunately this assumption is not true in all cases, so
it is possible that these packets leave the system unwanted.

We fix this by generating blackhole routes only from the
route lookup functions, here we can guarantee a call to
dst_output() afterwards.

Fixes: 2774c131b1d ("xfrm: Handle blackhole route creation via afinfo.")
Reported-by: Konstantinos Kolelis 
Signed-off-by: Steffen Klassert

ipv6: clean up anycast when an interface is destroyed

2014-09-12T21:33:06+00:00

If we try to rmmod the driver for an interface while sockets with
setsockopt(JOIN_ANYCAST) are alive, some refcounts aren't cleaned up
and we get stuck on:

  unregister_netdevice: waiting for ens3 to become free. Usage count = 1

If we LEAVE_ANYCAST/close everything before rmmod'ing, there is no
problem.

We need to perform a cleanup similar to the one for multicast in
addrconf_ifdown(how == 1).

Signed-off-by: Sabrina Dubroca 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

ipv6: restore the behavior of ipv6_sock_ac_drop()

2014-09-07T23:10:07+00:00

It is possible that the interface is already gone after joining
the list of anycast on this interface as we don't hold a refcount
for the device, in this case we are safe to ignore the error.

What's more important, for API compatibility we should not
change this behavior for applications even if it were correct.

Fixes: commit a9ed4a2986e13011 ("ipv6: fix rtnl locking in setsockopt for anycast and multicast")
Cc: Sabrina Dubroca 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

ipv6: use addrconf_get_prefix_route() to remove peer addr

2014-09-06T00:13:24+00:00

addrconf_get_prefix_route() ensures to get the right route in the right table.

Signed-off-by: Nicolas Dichtel 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

ipv6: fix a refcnt leak with peer addr

2014-09-06T00:13:24+00:00

There is no reason to take a refcnt before deleting the peer address route.
It's done some lines below for the local prefix route because
inet6_ifa_finish_destroy() will release it at the end.
For the peer address route, we want to free it right now.

This bug has been introduced by commit
caeaba79009c ("ipv6: add support of peer address").

Signed-off-by: Nicolas Dichtel 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

ipv6: fix rtnl locking in setsockopt for anycast and multicast

2014-09-05T18:52:28+00:00

Calling setsockopt with IPV6_JOIN_ANYCAST or IPV6_LEAVE_ANYCAST
triggers the assertion in addrconf_join_solict()/addrconf_leave_solict()

ipv6_sock_ac_join(), ipv6_sock_ac_drop(), ipv6_sock_ac_close() need to
take RTNL before calling ipv6_dev_ac_inc/dec. Same thing with
ipv6_sock_mc_join(), ipv6_sock_mc_drop(), ipv6_sock_mc_close() before
calling ipv6_dev_mc_inc/dec.

This patch moves ASSERT_RTNL() up a level in the call stack.

Signed-off-by: Cong Wang 
Signed-off-by: Sabrina Dubroca 
Reported-by: Tommi Rantala 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

netfilter: fix missing dependencies in NETFILTER_XT_TARGET_LOG

2014-09-02T20:59:54+00:00

make defconfig reports:

warning: (NETFILTER_XT_TARGET_LOG) selects NF_LOG_IPV6 which has unmet direct dependencies (NET && INET && IPV6 && NETFILTER && NETFILTER_ADVANCED)

Fixes: d79a61d netfilter: NETFILTER_XT_TARGET_LOG selects NF_LOG_*
Reported-by: kbuild test robot 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

2014-09-02T20:56:30+00:00

Pablo Neira Ayuso says:

====================
pull request: Netfilter/IPVS fixes for net

The following patchset contains seven Netfilter fixes for your net
tree, they are:

1) Make the NAT infrastructure independent of x_tables, some users are
   already starting to test nf_tables with NAT without enabling x_tables.
   Without this patch for Kconfig, there's a superfluous dependency
   between NAT and x_tables.
2) Allow to use 0 in the cgroup match, the kernel rejects with -EINVAL
   with no good reason. From Daniel Borkmann.

3) Select CONFIG_NF_NAT from the nf_tables NAT expression, this also
   resolves another NAT dependency with x_tables.

4) Use HAVE_JUMP_LABEL instead of CONFIG_JUMP_LABEL in the Netfilter hook
   code as elsewhere in the kernel to resolve toolchain problems, from
   Zhouyi Zhou.

5) Use iptunnel_handle_offloads() to set up tunnel encapsulation
   depending on the offload capabilities, reported by Alex Gartrell
   patch from Julian Anastasov.

6) Fix wrong family when registering the ip_vs_local_reply6() hook,
   also from Julian.

7) Select the NF_LOG_* symbols from NETFILTER_XT_TARGET_LOG. Rafał
   Miłecki reported that when jumping from 3.16 to 3.17-rc, his log
   target is not selected anymore due to changes in the previous
   development cycle to accomodate the full logging support for
   nf_tables.
====================

Signed-off-by: David S. Miller

net: ipv6: fib: don't sleep inside atomic lock

2014-08-22T17:54:49+00:00

The function fib6_commit_metrics() allocates a piece of memory in mode
GFP_KERNEL while holding an atomic lock from higher up in the stack, in
the function __ip6_ins_rt(). This produces the following BUG:

> BUG: sleeping function called from invalid context at mm/slub.c:1250
> in_atomic(): 1, irqs_disabled(): 0, pid: 2909, name: dhcpcd
> 2 locks held by dhcpcd/2909:
>  #0:  (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x20
>  #1:  (&tb->tb6_lock){++--+.}, at: [] ip6_route_add+0x65a/0x800
> CPU: 1 PID: 2909 Comm: dhcpcd Not tainted 3.17.0-rc1 #1
> Hardware name: ASUS All Series/Q87T, BIOS 0216 10/16/2013
>  0000000000000008 ffff8800c8f13858 ffffffff81af135a 0000000000000000
>  ffff880212202430 ffff8800c8f13878 ffffffff810f8d3a ffff880212202c98
>  0000000000000010 ffff8800c8f138c8 ffffffff8121ad0e 0000000000000001
> Call Trace:
>  [] dump_stack+0x4e/0x68
>  [] __might_sleep+0x10a/0x120
>  [] kmem_cache_alloc_trace+0x4e/0x190
>  [] ? fib6_commit_metrics+0x66/0x110
>  [] fib6_commit_metrics+0x66/0x110
>  [] fib6_add+0x883/0xa80
>  [] ? ip6_route_add+0x65a/0x800
>  [] ip6_route_add+0x675/0x800
>  [] ? ip6_route_add+0x6a/0x800
>  [] inet6_rtm_newroute+0x5c/0x80
>  [] rtnetlink_rcv_msg+0x211/0x260
>  [] ? rtnl_lock+0x17/0x20
>  [] ? lock_release_holdtime+0x28/0x180
>  [] ? rtnl_lock+0x17/0x20
>  [] ? __rtnl_unlock+0x20/0x20
>  [] netlink_rcv_skb+0x6e/0xd0
>  [] rtnetlink_rcv+0x25/0x40
>  [] netlink_unicast+0xd9/0x180
>  [] netlink_sendmsg+0x700/0x770
>  [] ? local_clock+0x25/0x30
>  [] sock_sendmsg+0x6c/0x90
>  [] ? might_fault+0xa3/0xb0
>  [] ? verify_iovec+0x7d/0xf0
>  [] ___sys_sendmsg+0x37e/0x3b0
>  [] ? trace_hardirqs_on_caller+0x185/0x220
>  [] ? mutex_unlock+0xe/0x10
>  [] ? netlink_insert+0xbc/0xe0
>  [] ? netlink_autobind.isra.30+0x125/0x150
>  [] ? netlink_autobind.isra.30+0x60/0x150
>  [] ? netlink_bind+0x159/0x230
>  [] ? might_fault+0x5a/0xb0
>  [] ? SYSC_bind+0x7e/0xd0
>  [] __sys_sendmsg+0x4d/0x80
>  [] SyS_sendmsg+0x12/0x20
>  [] system_call_fastpath+0x16/0x1b

Fixing this by replacing the mode GFP_KERNEL with GFP_ATOMIC.

Signed-off-by: Benjamin Block 
Acked-by: David Rientjes 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

netfilter: move NAT Kconfig switches out of the iptables scope

2014-08-18T19:55:54+00:00

Currently, the NAT configs depend on iptables and ip6tables. However,
users should be capable of enabling NAT for nft without having to
switch on iptables.

Fix this by adding new specific IP_NF_NAT and IP6_NF_NAT config
switches for iptables and ip6tables NAT support. I have also moved
the original NF_NAT_IPV4 and NF_NAT_IPV6 configs out of the scope
of iptables to make them independent of it.

This patch also adds NETFILTER_XT_NAT which selects the xt_nat
combo that provides snat/dnat for iptables. We cannot use NF_NAT
anymore since nf_tables can select this.

Reported-by: Matteo Croce 
Signed-off-by: Pablo Neira Ayuso