linux.git/net/netfilter/nft_socket.c, branch v5.15

netfilter: nft_socket: fix build with CONFIG_SOCK_CGROUP_DATA=n

2021-04-27T20:34:05+00:00

In some configurations, the sock_cgroup_ptr() function is not available:

net/netfilter/nft_socket.c: In function 'nft_sock_get_eval_cgroupv2':
net/netfilter/nft_socket.c:47:16: error: implicit declaration of function 'sock_cgroup_ptr'; did you mean 'obj_cgroup_put'? [-Werror=implicit-function-declaration]
   47 |         cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
      |                ^~~~~~~~~~~~~~~
      |                obj_cgroup_put
net/netfilter/nft_socket.c:47:14: error: assignment to 'struct cgroup *' from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
   47 |         cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
      |              ^

Change the caller to match the same #ifdef check, only calling it
when the function is defined.

Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_socket: fix an unused variable warning

2021-04-27T20:34:00+00:00

The variable is only used in an #ifdef, causing a harmless warning:

net/netfilter/nft_socket.c: In function 'nft_socket_init':
net/netfilter/nft_socket.c:137:27: error: unused variable 'level' [-Werror=unused-variable]
  137 |         unsigned int len, level;
      |                           ^~~~~

Move it into the same #ifdef block.

Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_socket: add support for cgroupsv2

2021-04-26T01:20:07+00:00

Allow to match on the cgroupsv2 id from ancestor level.

Signed-off-by: Pablo Neira Ayuso

netfilter: nftables: add nft_parse_register_store() and use it

2021-01-27T22:16:02+00:00

This new function combines the netlink register attribute parser
and the store validation function.

This update requires to replace:

        enum nft_registers      dreg:8;

in many of the expression private areas otherwise compiler complains
with:

        error: cannot take address of bit-field ‘dreg’

when passing the register field as reference.

Signed-off-by: Pablo Neira Ayuso

netfilter: nft_socket: add wildcard support

2020-08-29T11:04:44+00:00

Add NFT_SOCKET_WILDCARD to match to wildcard socket listener.

Signed-off-by: Balazs Scheidler 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_socket: fix erroneous socket assignment

2019-09-02T21:20:59+00:00

The socket assignment is wrong, see skb_orphan():
When skb->destructor callback is not set, but skb->sk is set, this hits BUG().

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1651813
Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket matching")
Signed-off-by: Fernando Fernandez Mancera 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_socket: Expose socket mark

2018-07-18T09:26:52+00:00

Signed-off-by: Máté Eckl 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_socket: Break evaluation if no socket found

2018-07-18T09:26:51+00:00

Actual implementation stores 0 in the destination register if no socket
is found by the lookup, but that is not intentional as it is not really
a value of any socket metadata.

This patch fixes this and breaks rule evaluation in this case.

Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket matching")
Signed-off-by: Máté Eckl 
Signed-off-by: Pablo Neira Ayuso

netfilter: Kconfig: Change select IPv6 dependencies

2018-07-17T13:27:54+00:00

... from IPV6 to NF_TABLES_IPV6 and IP6_NF_IPTABLES.

In some cases module selects depend on IPV6, but this means that they
select another module even if eg. NF_TABLES_IPV6 is not set in which
case the selected module is useless due to the lack of IPv6 nf_tables
functionality.

The same applies for IP6_NF_IPTABLES and iptables.

Joint work with: Arnd Bermann 

Signed-off-by: Máté Eckl 
Signed-off-by: Pablo Neira Ayuso

netfilter: check if the socket netns is correct.

2018-06-28T13:21:32+00:00

Netfilter assumes that if the socket is present in the skb, then
it can be used because that reference is cleaned up while the skb
is crossing netns.

We want to change that to preserve the socket reference in a future
patch, so this is a preparation updating netfilter to check if the
socket netns matches before use it.

Signed-off-by: Flavio Leitner 
Acked-by: Florian Westphal 
Signed-off-by: David S. Miller