github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter pull request nf-26-07-10

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJdBAABCABHFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmpRAaIbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyDRxmd0BzdHJsZW4uZGUACgkQcJGo2a1f9gAQJw/+
 Kj3gIsC+IWVsyF4zVvQrYlNkE6SELujsS7OkzY2voyaMS2waA2awl2Wep7G5Z6B7
 o36vez8ajnMCvGzfJKOtLgo2H32qxW4XzRuJVROlHRgSpJjASVTP9WREK4pCmfJr
 cU/D8YujTMxoEcdaIjDgjKyDogMtfbEyUqbiguLuym9NEX4izXXMv9tfWlFfWDtH
 RhmDV25WXLTa/h1Iz7rl2m1FPZ48oB7VOaar0seIPYF+kQ+tVr0CsSnfx22uHfoj
 H2g8ahfjjDhyPJTraDjQbdyenW5TzZ3ZzoBpwlpRynbKwKgLqnFdCBtG/vdm0SMM
 ZOfITT0aU8/tyh/zUm3pOmhIQJpGrxQC7ox0Jya+wc6tNT9ixKAocfUm/ftSuZBD
 EmH+YlfdQivEcaiP9GlPyGKFp0xRlAtDjbPiA5ZZXJtCNS17KRHNmc/GRIBnhqJu
 sv8c5Qxj3xppoBbTENKy0WI81L200CEpBrm+7qUgQj+TRdXzCaLCL7KTyLlmKxQa
 mor1TPDbrs5FEMWVaPJLloKSlKCm0forFnuRIxD3VYLQxqeomHY4CaV+vNjdMJDC
 4oV64Z1XVDR5SjtA+/MmX07FdTBdlGDzBZQugwQyhbM+iHEHBmvxXkyMEBpVBN2x
 U9XICr1PBibENZAyS/IKYW8ilfPtkUiW6Jgyk5W7bIw=
 =eXsP
 -----END PGP SIGNATURE-----

Merge tag 'nf-26-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Florian Westphal says:

====================
netfilter: updates for net

The following patchset contains Netfilter fixes for *net*.
These are fixes for bugs except patches 6 and 9 which fix issues added in
last PR and 7.1-rc1.

1) Reject unsupported target families in xt_nat_checkentry().
From Wyatt Feng.

2) Fix inverted time_after() check in ecache_work_evict_list().
Causes pointless work rescheds and thus way longer time to
clear the pending event backlog. From Yizhou Zhao.

3) Fix a use-after-free in br_ip6_fragment() caused by a dangling prevhdr
pointer.  From Xiang Mei.

4) Fix incorrect conntrack zone comparison in nf_conncount tuple
deduplication. Pass IP_CT_DIR_ORIGINAL, not zone direction.
From Yizhou Zhao.

5) Add bridge tunnel flowtable regression test for a bug that
   got fixed in the previous PR.  From Zhengyang Chen.

6) Use the correct direction when setting up tunnel routes in the flowtable
xmit path.  From Pablo Neira Ayuso.  This fixes a bug added in the
previous PR.

7) Reload IP header after potential skb head reallocation in IPVS.

8) Fix incorrect IPv6 transport offsets in TCP application code. Correct the
ICMPv6 header offset to ensure proper checksumming with extension headers,
from Julian Anastasov.  this is a followup to the previous PR.

9) Remove null-termination requirement for xt_physdev masks, this broke
   device names with 15 characters.

netfilter pull request nf-26-07-10

* tag 'nf-26-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: xt_physdev: masks are not c-strings
  ipvs: fix more places with wrong ipv6 transport offsets
  ipvs: reload ip header after head reallocation
  netfilter: flowtable: use correct direction to set up tunnel route
  selftests: netfilter: add bridge tunnel flowtable regression
  netfilter: nf_conncount: fix zone comparison in tuple dedup
  netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
  netfilter: ecache: fix inverted time_after() check
  netfilter: xt_nat: reject unsupported target families
====================

Link: https://patch.msgid.link/20260710143733.29741-1-fw@strlen.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Paolo Abeni 2026-07-17 11:19:36 +02:00
commit bc7291793f
10 changed files with 81 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/ipv6/netfilter.c
View File

@ -120,7 +120,7 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
ktime_t tstamp = skb->tstamp;
struct ip6_frag_state state;
u8 *prevhdr, nexthdr = 0;
unsigned int mtu, hlen;
unsigned int mtu, hlen, nexthdr_offset;
int hroom, err = 0;
__be32 frag_id;
@ -129,6 +129,7 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
goto blackhole;
hlen = err;
nexthdr = *prevhdr;
nexthdr_offset = prevhdr - skb_network_header(skb);
mtu = skb->dev->mtu;
if (frag_max_size > mtu ||
@ -147,6 +148,7 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
(err = skb_checksum_help(skb)))
goto blackhole;
prevhdr = skb_network_header(skb) + nexthdr_offset;
hroom = LL_RESERVED_SPACE(skb->dev);
if (skb_has_frag_list(skb)) {
unsigned int first_len = skb_pagelen(skb);

10
net/netfilter/ipvs/ip_vs_app.c
View File

@ -361,14 +361,13 @@ static inline int app_tcp_pkt_out(struct ip_vs_conn *cp, struct sk_buff *skb,
struct ip_vs_iphdr *ipvsh)
{
int diff;
const unsigned int tcp_offset = ip_hdrlen(skb);
struct tcphdr *th;
__u32 seq;
if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
return 0;
th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
/*
* Remember seq number in case this pkt gets resized
@ -438,14 +437,13 @@ static inline int app_tcp_pkt_in(struct ip_vs_conn *cp, struct sk_buff *skb,
struct ip_vs_iphdr *ipvsh)
{
int diff;
const unsigned int tcp_offset = ip_hdrlen(skb);
struct tcphdr *th;
__u32 seq;
if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
return 0;
th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
/*
* Remember seq number in case this pkt gets resized

3
net/netfilter/ipvs/ip_vs_core.c
View File

@ -1219,8 +1219,7 @@ static int ip_vs_out_icmp_v6(struct netns_ipvs *ipvs, struct sk_buff *skb,
snet.in6 = ciph.saddr.in6;
offset = ciph.len;
return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp,
pp, offset, sizeof(struct ipv6hdr),
hooknum);
pp, offset, ipvsh->len, hooknum);
}
#endif

6
net/netfilter/ipvs/ip_vs_xmit.c
View File

@ -736,13 +736,11 @@ int
ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
struct ip_vs_protocol *pp, struct ip_vs_iphdr *ipvsh)
{
struct iphdr *iph = ip_hdr(skb);
if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, iph->daddr,
if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, ip_hdr(skb)->daddr,
IP_VS_RT_MODE_NON_LOCAL, NULL, ipvsh) < 0)
goto tx_error;
ip_send_check(iph);
ip_send_check(ip_hdr(skb));
/* Another hack: avoid icmp_send in ip_fragment */
skb->ignore_df = 1;

6
net/netfilter/nf_conncount.c
View File

@ -211,8 +211,8 @@ static int __nf_conncount_add(struct net *net,
/* Not found, but might be about to be confirmed */
if (PTR_ERR(found) == -EAGAIN) {
if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
nf_ct_zone_id(zone, zone->dir))
nf_ct_zone_id(&conn->zone, IP_CT_DIR_ORIGINAL) ==
nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL))
goto out_put; /* already exists */
} else {
collect++;
@ -223,7 +223,7 @@ static int __nf_conncount_add(struct net *net,
found_ct = nf_ct_tuplehash_to_ctrack(found);
if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
nf_ct_zone_equal(found_ct, zone, zone->dir)) {
nf_ct_zone_equal(found_ct, zone, IP_CT_DIR_ORIGINAL)) {
/*
* We should not see tuples twice unless someone hooks
* this into a table without "-p tcp --syn".

2
net/netfilter/nf_conntrack_ecache.c
View File

@ -77,7 +77,7 @@ static enum retry_state ecache_work_evict_list(struct nf_conntrack_net *cnet)
hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode, &evicted_list);
if (time_after(stop, jiffies)) {
if (time_after(jiffies, stop)) {
ret = STATE_RESTART;
break;
}

6
net/netfilter/nf_flow_table_core.c
View File

@ -127,18 +127,18 @@ static int flow_offload_fill_route(struct flow_offload *flow,
switch (route->tuple[dir].xmit_type) {
case FLOW_OFFLOAD_XMIT_DIRECT:
if (flow_tuple->tun_num) {
if (route->tuple[!dir].in.num_tuns) {
flow_tuple->dst_cache = dst;
flow_tuple->dst_cookie =
flow_offload_dst_cookie(flow_tuple);
} else {
dst_release(dst);
}
memcpy(flow_tuple->out.h_dest, route->tuple[dir].out.h_dest,
ETH_ALEN);
memcpy(flow_tuple->out.h_source, route->tuple[dir].out.h_source,
ETH_ALEN);
flow_tuple->out.ifidx = route->tuple[dir].out.ifindex;
if (!flow_tuple->tun_num)
dst_release(dst);
break;
case FLOW_OFFLOAD_XMIT_XFRM:
case FLOW_OFFLOAD_XMIT_NEIGH:

9
net/netfilter/xt_nat.c
View File

@ -26,6 +26,15 @@ static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
static int xt_nat_checkentry(const struct xt_tgchk_param *par)
{
switch (par->family) {
case NFPROTO_IPV4:
case NFPROTO_IPV6:
case NFPROTO_INET:
break;
default:
return -EINVAL;
}
return nf_ct_netns_get(par->net, par->family);
}

5
net/netfilter/xt_physdev.c
View File

@ -130,11 +130,6 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
if (X(physoutdev))
return -ENAMETOOLONG;
}
if (X(in_mask))
return -ENAMETOOLONG;
if (X(out_mask))
return -ENAMETOOLONG;
#undef X
if (!brnf_probed) {

55
tools/testing/selftests/net/netfilter/nft_flowtable.sh
View File

@ -736,6 +736,61 @@ if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 "on bridge"; then
ret=1
fi
if ip -net "$nsr1" link show tun0 > /dev/null 2>&1 &&
ip -net "$nsr2" link show tun0 > /dev/null 2>&1; then
ip -net "$nsr1" route change default via 192.168.100.2
ip -net "$nsr2" route change default via 192.168.100.1
ip -6 -net "$nsr1" route delete default
ip -6 -net "$nsr1" route add default via fee1:3::2
ip -6 -net "$nsr2" route delete default
ip -6 -net "$nsr2" route add default via fee1:3::1
ip -net "$ns2" route add default via 10.0.2.1
ip -6 -net "$ns2" route add default via dead:2::1
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "tun0" tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "tun6" tcp dport 12345 ct mark set 1 flow add @f1 counter name routed_orig accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "veth0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "br0" tcp sport 12345 ct mark set 1 flow add @f1 counter name routed_repl accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "tun0" accept'
ip netns exec "$nsr1" nft -a insert rule inet filter forward \
'meta oif "tun6" accept'
ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null
if test_tcp_forwarding "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
check_counters "bridge + IPIP tunnel"
else
echo "FAIL: flow offload for ns1/ns2 with bridge + IPIP tunnel" 1>&2
ip netns exec "$nsr1" nft list ruleset
ret=1
fi
if test_tcp_forwarding "$ns1" "$ns2" 1 6 "[dead:2::99]" 12345; then
check_counters "bridge + IP6IP6 tunnel"
else
echo "FAIL: flow offload for ns1/ns2 with bridge + IP6IP6 tunnel" 1>&2
ip netns exec "$nsr1" nft list ruleset
ret=1
fi
ip -net "$nsr1" route change default via 192.168.10.2
ip -net "$nsr2" route change default via 192.168.10.1
ip -net "$ns2" route del default via 10.0.2.1
ip -6 -net "$nsr1" route delete default
ip -6 -net "$nsr1" route add default via fee1:2::2
ip -6 -net "$nsr2" route delete default
ip -6 -net "$nsr2" route add default via fee1:2::1
ip -6 -net "$ns2" route del default via dead:2::1
else
echo "SKIP: bridge + tunnel flowtable regression (tun0 missing)"
[ "$ret" -eq 0 ] && ret=$ksft_skip
fi
# Another test:
# Add bridge interface br0 to Router1, with NAT and VLAN.