Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for your net tree, they are: 1) Fix missing initialization of tuple structure in nfnetlink_cthelper to avoid mismatches when looking up to attach userspace helpers to flows, from Ian Wilson. 2) Fix potential crash in nft_hash when we hit -EAGAIN in nft_hash_walk(), from Herbert Xu. 3) We don't need to indicate the hook information to update the basechain default policy in nf_tables. 4) Restore tracing over nfnetlink_log due to recent rework to accomodate logging infrastructure into nf_tables. 5) Fix wrong IP6T_INV_PROTO check in xt_TPROXY. 6) Set IP6T_F_PROTO flag in nft_compat so we can use SYNPROXY6 and REJECT6 from xt over nftables. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Коммит
c0e41fa76c
|
@ -79,6 +79,16 @@ void nf_log_packet(struct net *net,
|
||||||
const struct nf_loginfo *li,
|
const struct nf_loginfo *li,
|
||||||
const char *fmt, ...);
|
const char *fmt, ...);
|
||||||
|
|
||||||
|
__printf(8, 9)
|
||||||
|
void nf_log_trace(struct net *net,
|
||||||
|
u_int8_t pf,
|
||||||
|
unsigned int hooknum,
|
||||||
|
const struct sk_buff *skb,
|
||||||
|
const struct net_device *in,
|
||||||
|
const struct net_device *out,
|
||||||
|
const struct nf_loginfo *li,
|
||||||
|
const char *fmt, ...);
|
||||||
|
|
||||||
struct nf_log_buf;
|
struct nf_log_buf;
|
||||||
|
|
||||||
struct nf_log_buf *nf_log_buf_open(void);
|
struct nf_log_buf *nf_log_buf_open(void);
|
||||||
|
|
|
@ -272,9 +272,9 @@ static void trace_packet(const struct sk_buff *skb,
|
||||||
&chainname, &comment, &rulenum) != 0)
|
&chainname, &comment, &rulenum) != 0)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
nf_log_packet(net, AF_INET, hook, skb, in, out, &trace_loginfo,
|
nf_log_trace(net, AF_INET, hook, skb, in, out, &trace_loginfo,
|
||||||
"TRACE: %s:%s:%s:%u ",
|
"TRACE: %s:%s:%s:%u ",
|
||||||
tablename, chainname, comment, rulenum);
|
tablename, chainname, comment, rulenum);
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
|
|
@ -298,9 +298,9 @@ static void trace_packet(const struct sk_buff *skb,
|
||||||
&chainname, &comment, &rulenum) != 0)
|
&chainname, &comment, &rulenum) != 0)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
nf_log_packet(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
|
nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
|
||||||
"TRACE: %s:%s:%s:%u ",
|
"TRACE: %s:%s:%s:%u ",
|
||||||
tablename, chainname, comment, rulenum);
|
tablename, chainname, comment, rulenum);
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
|
|
@ -212,6 +212,30 @@ void nf_log_packet(struct net *net,
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(nf_log_packet);
|
EXPORT_SYMBOL(nf_log_packet);
|
||||||
|
|
||||||
|
void nf_log_trace(struct net *net,
|
||||||
|
u_int8_t pf,
|
||||||
|
unsigned int hooknum,
|
||||||
|
const struct sk_buff *skb,
|
||||||
|
const struct net_device *in,
|
||||||
|
const struct net_device *out,
|
||||||
|
const struct nf_loginfo *loginfo, const char *fmt, ...)
|
||||||
|
{
|
||||||
|
va_list args;
|
||||||
|
char prefix[NF_LOG_PREFIXLEN];
|
||||||
|
const struct nf_logger *logger;
|
||||||
|
|
||||||
|
rcu_read_lock();
|
||||||
|
logger = rcu_dereference(net->nf.nf_loggers[pf]);
|
||||||
|
if (logger) {
|
||||||
|
va_start(args, fmt);
|
||||||
|
vsnprintf(prefix, sizeof(prefix), fmt, args);
|
||||||
|
va_end(args);
|
||||||
|
logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
|
||||||
|
}
|
||||||
|
rcu_read_unlock();
|
||||||
|
}
|
||||||
|
EXPORT_SYMBOL(nf_log_trace);
|
||||||
|
|
||||||
#define S_SIZE (1024 - (sizeof(unsigned int) + 1))
|
#define S_SIZE (1024 - (sizeof(unsigned int) + 1))
|
||||||
|
|
||||||
struct nf_log_buf {
|
struct nf_log_buf {
|
||||||
|
|
|
@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
|
||||||
|
|
||||||
if (nla[NFTA_CHAIN_POLICY]) {
|
if (nla[NFTA_CHAIN_POLICY]) {
|
||||||
if ((chain != NULL &&
|
if ((chain != NULL &&
|
||||||
!(chain->flags & NFT_BASE_CHAIN)) ||
|
!(chain->flags & NFT_BASE_CHAIN)))
|
||||||
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
|
if (chain == NULL &&
|
||||||
nla[NFTA_CHAIN_HOOK] == NULL)
|
nla[NFTA_CHAIN_HOOK] == NULL)
|
||||||
return -EOPNOTSUPP;
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
|
|
|
@ -94,10 +94,10 @@ static void nft_trace_packet(const struct nft_pktinfo *pkt,
|
||||||
{
|
{
|
||||||
struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
|
struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
|
||||||
|
|
||||||
nf_log_packet(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
|
nf_log_trace(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
|
||||||
pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
|
pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
|
||||||
chain->table->name, chain->name, comments[type],
|
chain->table->name, chain->name, comments[type],
|
||||||
rulenum);
|
rulenum);
|
||||||
}
|
}
|
||||||
|
|
||||||
unsigned int
|
unsigned int
|
||||||
|
|
|
@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
|
||||||
if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
|
if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
|
||||||
|
/* Not all fields are initialized so first zero the tuple */
|
||||||
|
memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
|
||||||
|
|
||||||
tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
|
tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
|
||||||
tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
|
tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
|
||||||
|
|
||||||
|
|
|
@ -133,6 +133,9 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
|
||||||
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
|
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
|
||||||
break;
|
break;
|
||||||
case AF_INET6:
|
case AF_INET6:
|
||||||
|
if (proto)
|
||||||
|
entry->e6.ipv6.flags |= IP6T_F_PROTO;
|
||||||
|
|
||||||
entry->e6.ipv6.proto = proto;
|
entry->e6.ipv6.proto = proto;
|
||||||
entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
|
entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
|
||||||
break;
|
break;
|
||||||
|
@ -344,6 +347,9 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
|
||||||
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
|
entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
|
||||||
break;
|
break;
|
||||||
case AF_INET6:
|
case AF_INET6:
|
||||||
|
if (proto)
|
||||||
|
entry->e6.ipv6.flags |= IP6T_F_PROTO;
|
||||||
|
|
||||||
entry->e6.ipv6.proto = proto;
|
entry->e6.ipv6.proto = proto;
|
||||||
entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
|
entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
|
||||||
break;
|
break;
|
||||||
|
|
|
@ -153,6 +153,8 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
|
||||||
iter->err = err;
|
iter->err = err;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (iter->count < iter->skip)
|
if (iter->count < iter->skip)
|
||||||
|
|
|
@ -513,8 +513,8 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
|
||||||
{
|
{
|
||||||
const struct ip6t_ip6 *i = par->entryinfo;
|
const struct ip6t_ip6 *i = par->entryinfo;
|
||||||
|
|
||||||
if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
|
if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
|
||||||
&& !(i->flags & IP6T_INV_PROTO))
|
!(i->invflags & IP6T_INV_PROTO))
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
pr_info("Can be used only in combination with "
|
pr_info("Can be used only in combination with "
|
||||||
|
|
Загрузка…
Ссылка в новой задаче