linux.git/net/netfilter, branch v3.15-rc2

netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4

2014-04-14T08:38:02+00:00

nft_cmp_fast is used for equality comparisions of size <= 4. For
comparisions of size < 4 byte a mask is calculated that is applied to
both the data from userspace (during initialization) and the register
value (during runtime). Both values are stored using (in effect) memcpy
to a memory area that is then interpreted as u32 by nft_cmp_fast.

This works fine on little endian since smaller types have the same base
address, however on big endian this is not true and the smaller types
are interpreted as a big number with trailing zero bytes.

The mask therefore must not include the lower bytes, but the higher bytes
on big endian. Add a helper function that does a cpu_to_le32 to switch
the bytes on big endian. Since we're dealing with a mask of just consequitive
bits, this works out fine.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: initialize net.ct.generation

2014-04-14T08:35:28+00:00

[  251.920788] INFO: trying to register non-static key.
[  251.921386] the code is fine but needs lockdep annotation.
[  251.921386] turning off the locking correctness validator.
[  251.921386] CPU: 2 PID: 15715 Comm: socket_listen Not tainted 3.14.0+ #294
[  251.921386] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  251.921386]  0000000000000000 000000009d18c210 ffff880075f039b8 ffffffff816b7ecd
[  251.921386]  ffffffff822c3b10 ffff880075f039c8 ffffffff816b36f4 ffff880075f03aa0
[  251.921386]  ffffffff810c65ff ffffffff810c4a85 00000000fffffe01 ffffffffa0075172
[  251.921386] Call Trace:
[  251.921386]  [] dump_stack+0x45/0x56
[  251.921386]  [] register_lock_class.part.24+0x38/0x3c
[  251.921386]  [] __lock_acquire+0x168f/0x1b40
[  251.921386]  [] ? trace_hardirqs_on_caller+0x105/0x1d0
[  251.921386]  [] ? nf_nat_setup_info+0x252/0x3a0 [nf_nat]
[  251.921386]  [] ? _raw_spin_unlock_bh+0x35/0x40
[  251.921386]  [] ? nf_nat_setup_info+0x252/0x3a0 [nf_nat]
[  251.921386]  [] lock_acquire+0xa2/0x120
[  251.921386]  [] ? ipv4_confirm+0x90/0xf0 [nf_conntrack_ipv4]
[  251.921386]  [] __nf_conntrack_confirm+0x129/0x410 [nf_conntrack]
[  251.921386]  [] ? ipv4_confirm+0x90/0xf0 [nf_conntrack_ipv4]
[  251.921386]  [] ipv4_confirm+0x90/0xf0 [nf_conntrack_ipv4]
[  251.921386]  [] ? ip_fragment+0x9f0/0x9f0
[  251.921386]  [] nf_iterate+0xaa/0xc0
[  251.921386]  [] ? ip_fragment+0x9f0/0x9f0
[  251.921386]  [] nf_hook_slow+0xa4/0x190
[  251.921386]  [] ? ip_fragment+0x9f0/0x9f0
[  251.921386]  [] ip_output+0x92/0x100
[  251.921386]  [] ip_local_out+0x29/0x90
[  251.921386]  [] ip_queue_xmit+0x170/0x4c0
[  251.921386]  [] ? ip_queue_xmit+0x5/0x4c0
[  251.921386]  [] tcp_transmit_skb+0x498/0x960
[  251.921386]  [] tcp_connect+0x812/0x960
[  251.921386]  [] ? ktime_get_real+0x25/0x70
[  251.921386]  [] ? secure_tcp_sequence_number+0x6a/0xc0
[  251.921386]  [] tcp_v4_connect+0x317/0x470
[  251.921386]  [] __inet_stream_connect+0xb5/0x330
[  251.921386]  [] ? lock_sock_nested+0x33/0xa0
[  251.921386]  [] ? trace_hardirqs_on+0xd/0x10
[  251.921386]  [] ? __local_bh_enable_ip+0x75/0xe0
[  251.921386]  [] inet_stream_connect+0x38/0x50
[  251.921386]  [] SYSC_connect+0xe7/0x120
[  251.921386]  [] ? current_kernel_time+0x69/0xd0
[  251.921386]  [] ? trace_hardirqs_on_caller+0x105/0x1d0
[  251.921386]  [] ? trace_hardirqs_on+0xd/0x10
[  251.921386]  [] SyS_connect+0xe/0x10
[  251.921386]  [] system_call_fastpath+0x16/0x1b
[  312.014104] INFO: rcu_sched detected stalls on CPUs/tasks: {} (detected by 0, t=60003 jiffies, g=42359, c=42358, q=333)
[  312.015097] INFO: Stall ended before state dump start

Fixes: 93bb0ceb75be ("netfilter: conntrack: remove central spinlock nf_conntrack_lock")
Cc: Jesper Dangaard Brouer 
Cc: Pablo Neira Ayuso 
Cc: Patrick McHardy 
Cc: Jozsef Kadlecsik 
Cc: "David S. Miller" 
Signed-off-by: Andrey Vagin 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper

2014-04-08T08:56:12+00:00

nf_ct_gre_keymap_flush() removes a nf_ct_gre_keymap object from
net_gre->keymap_list and frees the object. But it doesn't clean
a reference on this object from ct_pptp_info->keymap[dir].
Then nf_ct_gre_keymap_destroy() may release the same object again.

So nf_ct_gre_keymap_flush() can be called only when we are sure that
when nf_ct_gre_keymap_destroy will not be called.

nf_ct_gre_keymap is created by nf_ct_gre_keymap_add() and the right way
to destroy it is to call nf_ct_gre_keymap_destroy().

This patch marks nf_ct_gre_keymap_flush() as static, so this patch can
break compilation of third party modules, which use
nf_ct_gre_keymap_flush. I'm not sure this is the right way to deprecate
this function.

[  226.540793] general protection fault: 0000 [#1] SMP
[  226.541750] Modules linked in: nf_nat_pptp nf_nat_proto_gre
nf_conntrack_pptp nf_conntrack_proto_gre ip_gre ip_tunnel gre
ppp_deflate bsd_comp ppp_async crc_ccitt ppp_generic slhc xt_nat
iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat
nf_conntrack veth tun bridge stp llc ppdev microcode joydev pcspkr
serio_raw virtio_console virtio_balloon floppy parport_pc parport
pvpanic i2c_piix4 virtio_net drm_kms_helper ttm ata_generic virtio_pci
virtio_ring virtio drm i2c_core pata_acpi [last unloaded: ip_tunnel]
[  226.541776] CPU: 0 PID: 49 Comm: kworker/u4:2 Not tainted 3.14.0-rc8+ #101
[  226.541776] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  226.541776] Workqueue: netns cleanup_net
[  226.541776] task: ffff8800371e0000 ti: ffff88003730c000 task.ti: ffff88003730c000
[  226.541776] RIP: 0010:[]  [] __list_del_entry+0x29/0xd0
[  226.541776] RSP: 0018:ffff88003730dbd0  EFLAGS: 00010a83
[  226.541776] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8800374e6c40 RCX: dead000000200200
[  226.541776] RDX: 6b6b6b6b6b6b6b6b RSI: ffff8800371e07d0 RDI: ffff8800374e6c40
[  226.541776] RBP: ffff88003730dbd0 R08: 0000000000000000 R09: 0000000000000000
[  226.541776] R10: 0000000000000001 R11: ffff88003730d92e R12: 0000000000000002
[  226.541776] R13: ffff88007a4c42d0 R14: ffff88007aef0000 R15: ffff880036cf0018
[  226.541776] FS:  0000000000000000(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
[  226.541776] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  226.541776] CR2: 00007f07f643f7d0 CR3: 0000000036fd2000 CR4: 00000000000006f0
[  226.541776] Stack:
[  226.541776]  ffff88003730dbe8 ffffffff81389c5d ffff8800374ffbe4 ffff88003730dc28
[  226.541776]  ffffffffa0162a43 ffffffffa01627c5 ffff88007a4c42d0 ffff88007aef0000
[  226.541776]  ffffffffa01651c0 ffff88007a4c45e0 ffff88007aef0000 ffff88003730dc40
[  226.541776] Call Trace:
[  226.541776]  [] list_del+0xd/0x30
[  226.541776]  [] nf_ct_gre_keymap_destroy+0x283/0x2d0 [nf_conntrack_proto_gre]
[  226.541776]  [] ? nf_ct_gre_keymap_destroy+0x5/0x2d0 [nf_conntrack_proto_gre]
[  226.541776]  [] gre_destroy+0x27/0x70 [nf_conntrack_proto_gre]
[  226.541776]  [] destroy_conntrack+0x83/0x200 [nf_conntrack]
[  226.541776]  [] ? destroy_conntrack+0x27/0x200 [nf_conntrack]
[  226.541776]  [] ? nf_conntrack_hash_check_insert+0x2e0/0x2e0 [nf_conntrack]
[  226.541776]  [] nf_conntrack_destroy+0x72/0x180
[  226.541776]  [] ? nf_conntrack_destroy+0x5/0x180
[  226.541776]  [] ? kill_l3proto+0x20/0x20 [nf_conntrack]
[  226.541776]  [] nf_ct_iterate_cleanup+0x14e/0x170 [nf_conntrack]
[  226.541776]  [] nf_ct_l4proto_pernet_unregister+0x5b/0x90 [nf_conntrack]
[  226.541776]  [] proto_gre_net_exit+0x19/0x30 [nf_conntrack_proto_gre]
[  226.541776]  [] ops_exit_list.isra.1+0x39/0x60
[  226.541776]  [] cleanup_net+0x100/0x1d0
[  226.541776]  [] process_one_work+0x1ea/0x4f0
[  226.541776]  [] ? process_one_work+0x188/0x4f0
[  226.541776]  [] worker_thread+0x11b/0x3a0
[  226.541776]  [] ? process_one_work+0x4f0/0x4f0
[  226.541776]  [] kthread+0xed/0x110
[  226.541776]  [] ? _raw_spin_unlock_irq+0x2c/0x40
[  226.541776]  [] ? kthread_create_on_node+0x200/0x200
[  226.541776]  [] ret_from_fork+0x7c/0xb0
[  226.541776]  [] ? kthread_create_on_node+0x200/0x200
[  226.541776] Code: 00 00 55 48 8b 17 48 b9 00 01 10 00 00 00 ad de
48 8b 47 08 48 89 e5 48 39 ca 74 29 48 b9 00 02 20 00 00 00 ad de 48
39 c8 74 7a <4c> 8b 00 4c 39 c7 75 53 4c 8b 42 08 4c 39 c7 75 2b 48 89
42 08
[  226.541776] RIP  [] __list_del_entry+0x29/0xd0
[  226.541776]  RSP 
[  226.612193] ---[ end trace 985ae23ddfcc357c ]---

Cc: Pablo Neira Ayuso 
Cc: Patrick McHardy 
Cc: Jozsef Kadlecsik 
Cc: "David S. Miller" 
Signed-off-by: Andrey Vagin 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix wrong format in request_module()

2014-04-03T21:52:50+00:00

The intended format in request_module is %.*s instead of %*.s.

Reported-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: set names cannot be larger than 15 bytes

2014-04-03T21:52:44+00:00

Currently, nf_tables trims off the set name if it exceeeds 15
bytes, so explicitly reject set names that are too large.

Reported-by: Giuseppe Longo 
Signed-off-by: Pablo Neira Ayuso

netfilter: Add {ipt,ip6t}_osf aliases for xt_osf

2014-04-03T21:52:22+00:00

There are no these aliases, so kernel can not request appropriate
match table:

$ iptables -I INPUT -p tcp -m osf --genre Windows --ttl 2 -j DROP
iptables: No chain/target/match by that name.

setsockopt() requests ipt_osf module, which is not present. Add
the aliases.

Signed-off-by: Kirill Tkhai 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks

2014-04-03T21:52:17+00:00

This simple modification allows iptables to work with INPUT chain
in combination with cgroup module. It could be useful for counting
ingress traffic per cgroup with nfacct netfilter module. There
were no problems to count the egress traffic that way formerly.

It's possible to get classified sk_buff after PREROUTING, due to
socket lookup being done in early_demux (tcp_v4_early_demux). Also
it works for udp as well.

Trivial usage example, assuming we're in the same shell every step
and we have enough permissions:

1) Classic net_cls cgroup initialization:

  mkdir /sys/fs/cgroup/net_cls
  mount -t cgroup -o net_cls net_cls /sys/fs/cgroup/net_cls

2) Set up cgroup for interesting application:

  mkdir /sys/fs/cgroup/net_cls/wget
  echo 1 > /sys/fs/cgroup/net_cls/wget/net_cls.classid
  echo $BASHPID > /sys/fs/cgroup/net_cls/wget/cgroup.procs

3) Create kernel counters:

  nfacct add wget-cgroup-in
  iptables -A INPUT -m cgroup ! --cgroup 1 -m nfacct --nfacct-name wget-cgroup-in

  nfacct add wget-cgroup-out
  iptables -A OUTPUT -m cgroup ! --cgroup 1 -m nfacct --nfacct-name wget-cgroup-out

4) Network usage:

  wget https://www.kernel.org/pub/linux/kernel/v3.x/testing/linux-3.14-rc6.tar.xz

5) Check results:

  nfacct list

Cgroup approach is being used for the DataUsage (counting & blocking
traffic) feature for Samsung's modification of the Tizen OS.

Signed-off-by: Alexey Perevalov 
Acked-by: Daniel Borkmann 
Signed-off-by: Pablo Neira Ayuso

netfilter: connlimit: move lock array out of struct connlimit_data

2014-04-03T21:52:13+00:00

Eric points out that the locks can be global.
Moreover, both Jesper and Eric note that using only 32 locks increases
false sharing as only two cache lines are used.

This increases locks to 256 (16 cache lines assuming 64byte cacheline and
4 bytes per spinlock).

Suggested-by: Jesper Dangaard Brouer 
Suggested-by: Eric Dumazet 
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: connlimit: fix UP build

2014-04-03T21:52:07+00:00

cannot use ARRAY_SIZE() if spinlock_t is empty struct.

Fixes: 1442e7507dd597 ("netfilter: connlimit: use keyed locks")
Reported-by: kbuild test robot 
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-03-29T22:48:54+00:00

Conflicts:
	drivers/net/ethernet/marvell/mvneta.c

The mvneta.c conflict is a case of overlapping changes,
a conversion to devm_ioremap_resource() vs. a conversion
to netdev_alloc_pcpu_stats.

Signed-off-by: David S. Miller