linux.git/net/netfilter, branch v4.9-rc5

netfilter: fix nf_queue handling

2016-10-20T17:59:59+00:00

nf_queue handling is broken since e3b37f11e6e4 ("netfilter: replace
list_head with single linked list") for two reasons:

1) If the bypass flag is set on, there are no userspace listeners and
   we still have more hook entries to iterate over, then jump to the
   next hook. Otherwise accept the packet. On nf_reinject() path, the
   okfn() needs to be invoked.

2) We should not re-enter the same hook on packet reinjection. If the
   packet is accepted, we have to skip the current hook from where the
   packet was enqueued, otherwise the packets gets enqueued over and
   over again.

This restores the previous list_for_each_entry_continue() behaviour
happening from nf_iterate() that was dealing with these two cases.
This patch introduces a new nf_queue() wrapper function so this fix
becomes simpler.

Fixes: e3b37f11e6e4 ("netfilter: replace list_head with single linked list")
Signed-off-by: Pablo Neira Ayuso

netfilter: conntrack: restart gc immediately if GC_MAX_EVICTS is reached

2016-10-20T17:59:53+00:00

When the maximum evictions number is reached, do not wait 5 seconds before
the next run.

CC: Florian Westphal 
Signed-off-by: Nicolas Dichtel 
Acked-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: suppress kmemcheck warning

2016-10-19T16:32:24+00:00

Markus Trippelsdorf reports:

WARNING: kmemcheck: Caught 64-bit read from uninitialized memory (ffff88001e605480)
4055601e0088ffff000000000000000090686d81ffffffff0000000000000000
 u u u u u u u u u u u u u u u u i i i i i i i i u u u u u u u u
 ^
|RIP: 0010:[]  [] nf_register_net_hook+0x51/0x160
[..]
 [] nf_register_net_hook+0x51/0x160
 [] nf_register_net_hooks+0x3f/0xa0
 [] ipt_register_table+0xe5/0x110
[..]

This warning is harmless; we copy 'uninitialized' data from the hook ops
but it will not be used.
Long term the structures keeping run-time data should be disentangled
from those only containing config-time data (such as where in the list
to insert a hook), but thats -next material.

Reported-by: Markus Trippelsdorf 
Suggested-by: Al Viro 
Signed-off-by: Florian Westphal 
Acked-by: Aaron Conole 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: avoid uninitialized variable warning

2016-10-18T15:35:10+00:00

The newly added nft_range_eval() function handles the two possible
nft range operations, but as the compiler warning points out,
any unexpected value would lead to the 'mismatch' variable being
used without being initialized:

net/netfilter/nft_range.c: In function 'nft_range_eval':
net/netfilter/nft_range.c:45:5: error: 'mismatch' may be used uninitialized in this function [-Werror=maybe-uninitialized]

This removes the variable in question and instead moves the
condition into the switch itself, which is potentially more
efficient than adding a bogus 'default' clause as in my
first approach, and is nicer than using the 'uninitialized_var'
macro.

Fixes: 0f3cd9b36977 ("netfilter: nf_tables: add range expression")
Link: http://patchwork.ozlabs.org/patch/677114/
Signed-off-by: Arnd Bergmann 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_range: validate operation netlink attribute

2016-10-17T16:57:02+00:00

Use nft_parse_u32_check() to make sure we don't get a value over the
unsigned 8-bit integer. Moreover, make sure this value doesn't go over
the two supported range comparison modes.

Fixes: 9286c2eb1fda ("netfilter: nft_range: validate operation netlink attribute")
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_exthdr: fix error handling in nft_exthdr_init()

2016-10-17T15:43:54+00:00

"err" needs to be signed for the error handling to work.

Fixes: 36b701fae12a ('netfilter: nf_tables: validate maximum value of u32 netlink attributes')
Signed-off-by: Dan Carpenter 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: underflow in nft_parse_u32_check()

2016-10-17T15:43:53+00:00

We don't want to allow negatives here.

Fixes: 36b701fae12a ('netfilter: nf_tables: validate maximum value of u32 netlink attributes')
Signed-off-by: Dan Carpenter 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_hash: add missing NFTA_HASH_OFFSET's nla_policy

2016-10-17T15:43:53+00:00

Missing the nla_policy description will also miss the validation check
in kernel.

Fixes: 70ca767ea1b2 ("netfilter: nft_hash: Add hash offset value")
Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_ipcomp: add "ip[6]t_ipcomp" module alias name

2016-10-17T15:38:19+00:00

Otherwise, user cannot add related rules if xt_ipcomp.ko is not loaded:
  # iptables -A OUTPUT -p 108 -m ipcomp --ipcompspi 1
  iptables: No chain/target/match by that name.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_NFLOG: fix unexpected truncated packet

2016-10-17T15:38:19+00:00

Justin and Chris spotted that iptables NFLOG target was broken when they
upgraded the kernel to 4.8: "ulogd-2.0.5- IPs are no longer logged" or
"results in segfaults in ulogd-2.0.5".

Because "struct nf_loginfo li;" is a local variable, and flags will be
filled with garbage value, not inited to zero. So if it contains 0x1,
packets will not be logged to the userspace anymore.

Fixes: 7643507fe8b5 ("netfilter: xt_NFLOG: nflog-range does not truncate packets")
Reported-by: Justin Piszcz 
Reported-by: Chris Caputo 
Tested-by: Chris Caputo 
Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso