linux.git/net/netfilter, branch v3.16-rc5

netfilter: nf_nat: fix oops on netns removal

2014-06-16T11:58:54+00:00

Quoting Samu Kallio:

 Basically what's happening is, during netns cleanup,
 nf_nat_net_exit gets called before ipv4_net_exit. As I understand
 it, nf_nat_net_exit is supposed to kill any conntrack entries which
 have NAT context (through nf_ct_iterate_cleanup), but for some
 reason this doesn't happen (perhaps something else is still holding
 refs to those entries?).

 When ipv4_net_exit is called, conntrack entries (including those
 with NAT context) are cleaned up, but the
 nat_bysource hashtable is long gone - freed in nf_nat_net_exit. The
 bug happens when attempting to free a conntrack entry whose NAT hash
 'prev' field points to a slot in the freed hash table (head for that
 bin).

We ignore conntracks with null nat bindings.  But this is wrong,
as these are in bysource hash table as well.

Restore nat-cleaning for the netns-is-being-removed case.

bug:
https://bugzilla.kernel.org/show_bug.cgi?id=65191

Fixes: c2d421e1718 ('netfilter: nf_nat: fix race when unloading protocol modules')
Reported-by: Samu Kallio 
Debugged-by: Samu Kallio 
Signed-off-by: Florian Westphal 
Tested-by: Samu Kallio 
Signed-off-by: Pablo Neira Ayuso

netfilter: ctnetlink: add zone size to length

2014-06-16T11:53:03+00:00

Signed-off-by: Ken-ichirou MATSUZAWA 
Signed-off-by: Pablo Neira Ayuso

Merge branch 'ipvs'

2014-06-16T11:22:33+00:00

Simon Horman says:

====================
Fix for panic due use of tot_stats estimator outside of CONFIG_SYSCTL

It has been present since v3.6.39.
====================

Signed-off-by: Pablo Neira Ayuso

netfilter: nft_nat: don't dump port information if unset

2014-06-16T11:08:14+00:00

Don't include port information attributes if they are unset.

Reported-by: Ana Rey 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: indicate family when dumping set elements

2014-06-16T11:08:09+00:00

Set the nfnetlink header that indicates the family of this element.

Signed-off-by: Pablo Neira Ayuso

netfilter: nft_compat: call {target, match}->destroy() to cleanup entry

2014-06-16T11:08:04+00:00

Otherwise, the reference to external objects (eg. modules) are not
released when the rules are removed.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix wrong type in transaction when replacing rules

2014-06-16T11:07:58+00:00

In b380e5c ("netfilter: nf_tables: add message type to transactions"),
I used the wrong message type in the rule replacement case. The rule
that is replaced needs to be handled as a deleted rule.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: decrement chain use counter when replacing rules

2014-06-16T11:07:50+00:00

Thus, the chain use counter remains with the same value after the
rule replacement.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: use u32 for chain use counter

2014-06-16T11:07:44+00:00

Since 4fefee5 ("netfilter: nf_tables: allow to delete several objects
from a batch"), every new rule bumps the chain use counter. However,
this is limited to 16 bits, which means that it will overrun after
2^16 rules.

Use a u32 chain counter and check for overflows (just like we do for
table objects).

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: use RCU-safe list insertion when replacing rules

2014-06-16T11:07:29+00:00

The patch 5e94846 ("netfilter: nf_tables: add insert operation") did
not include RCU-safe list insertion when replacing rules.

Signed-off-by: Pablo Neira Ayuso