linux.git/net/netfilter, branch v3.8-rc7

netfilter: x_tables: print correct hook names for ARP

2013-01-13T11:54:12+00:00

arptables 0.0.4 (released on 10th Jan 2013) supports calling the
CLASSIFY target, but on adding a rule to the wrong chain, the
diagnostic is as follows:

	# arptables -A INPUT -j CLASSIFY --set-class 0:0
	arptables: Invalid argument
	# dmesg | tail -n1
	x_tables: arp_tables: CLASSIFY target: used from hooks
	PREROUTING, but only usable from INPUT/FORWARD

This is incorrect, since xt_CLASSIFY.c does specify
(1 << NF_ARP_OUT) | (1 << NF_ARP_FORWARD).

This patch corrects the x_tables diagnostic message to print the
proper hook names for the NFPROTO_ARP case.

Affects all kernels down to and including v2.6.31.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: fix BUG_ON while removing nf_conntrack with netns

2013-01-12T13:12:36+00:00

canqun zhang reported that we're hitting BUG_ON in the
nf_conntrack_destroy path when calling kfree_skb while
rmmod'ing the nf_conntrack module.

Currently, the nf_ct_destroy hook is being set to NULL in the
destroy path of conntrack.init_net. However, this is a problem
since init_net may be destroyed before any other existing netns
(we cannot assume any specific ordering while releasing existing
netns according to what I read in recent emails).

Thanks to Gao feng for initial patch to address this issue.

Reported-by: canqun zhang 
Acked-by: Gao feng 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_CT: fix unset return value if conntrack zone are disabled

2013-01-10T12:11:00+00:00

net/netfilter/xt_CT.c: In function ‘xt_ct_tg_check_v1’:
net/netfilter/xt_CT.c:250:6: warning: ‘ret’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_CT.c: In function ‘xt_ct_tg_check_v0’:
net/netfilter/xt_CT.c:112:6: warning: ‘ret’ may be used uninitialized in this function [-Wmaybe-uninitialized]

Reported-by: Borislav Petkov 
Acked-by: Borislav Petkov 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_recent: avoid high order page allocations

2013-01-04T19:14:42+00:00

xt_recent can try high order page allocations and this can fail.

iptables: page allocation failure: order:9, mode:0xc0d0

It also wastes about half the allocated space because of kmalloc()
power-of-two roundups and struct recent_table layout.

Use vmalloc() instead to save space and be less prone to allocation
errors when memory is fragmented.

Reported-by: Miroslav Kratochvil 
Reported-by: Dave Jones 
Reported-by: Harald Reindl 
Signed-off-by: Eric Dumazet 
Signed-off-by: Pablo Neira Ayuso

netfilter: fix missing dependencies for the NOTRACK target

2013-01-04T19:14:38+00:00

warning: (NETFILTER_XT_TARGET_NOTRACK) selects NETFILTER_XT_TARGET_CT which has unmet direct
+dependencies (NET && INET && NETFILTER && NETFILTER_XTABLES && NF_CONNTRACK && (IP_NF_RAW ||
+IP6_NF_RAW) && NETFILTER_ADVANCED)

Reported-by: Randy Dunlap 
Reported-by: kbuild test robot 
Acked-by: Randy Dunlap 
Signed-off-by: Pablo Neira Ayuso

netfilter: ctnetlink: fix leak in error path of ctnetlink_create_expect

2012-12-26T22:02:09+00:00

This patch fixes a leak in one of the error paths of
ctnetlink_create_expect if no helper and no timeout is specified.

Signed-off-by: Jesper Juhl 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_hashlimit: fix namespace destroy path

2012-12-26T17:14:48+00:00

recent_net_exit() is called before recent_mt_destroy() in the
destroy path of network namespaces. Make sure there are no entries
in the parent proc entry xt_recent before removing it.

Signed-off-by: Vitaly E. Lavrov 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_recent: fix namespace destroy path

2012-12-26T17:14:48+00:00

recent_net_exit() is called before recent_mt_destroy() in the
destroy path of network namespaces. Make sure there are no entries
in the parent proc entry xt_recent before removing it.

Signed-off-by: Vitaly E. Lavrov 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_hashlimit: fix race that results in duplicated entries

2012-12-26T17:14:44+00:00

Two packets may race to create the same entry in the hashtable,
double check if this packet lost race. This double checking only
happens in the path of the packet that creates the hashtable for
first time.

Note that, with this patch, no packet drops occur if the race happens.

Reported-by: Feng Gao 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_CT: recover NOTRACK target support

2012-12-24T11:55:09+00:00

Florian Westphal reported that the removal of the NOTRACK target
(9655050 netfilter: remove xt_NOTRACK) is breaking some existing
setups.

That removal was scheduled for removal since long time ago as
described in Documentation/feature-removal-schedule.txt

What:  xt_NOTRACK
Files: net/netfilter/xt_NOTRACK.c
When:  April 2011
Why:   Superseded by xt_CT

Still, people may have not notice / may have decided to stick to an
old iptables version. I agree with him in that some more conservative
approach by spotting some printk to warn users for some time is less
agressive.

Current iptables 1.4.16.3 already contains the aliasing support
that makes it point to the CT target, so upgrading would fix it.
Still, the policy so far has been to avoid pushing our users to
upgrade.

As a solution, this patch recovers the NOTRACK target inside the CT
target and it now spots a warning.

Reported-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso