linux-toradex.git/net/netfilter, branch v3.14.3

core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors

2014-03-27T19:29:38+00:00

skb_zerocopy can copy elements of the frags array between skbs, but it doesn't
orphan them. Also, it doesn't handle errors, so this patch takes care of that
as well, and modify the callers accordingly. skb_tx_error() is also added to
the callers so they will signal the failed delivery towards the creator of the
skb.

Signed-off-by: Zoltan Kiss 
Signed-off-by: David S. Miller

netfilter: ctnetlink: force null nat binding on insert

2014-02-17T23:13:51+00:00

Quoting Andrey Vagin:
  When a conntrack is created  by kernel, it is initialized (sets
  IPS_{DST,SRC}_NAT_DONE_BIT bits in nf_nat_setup_info) and only then it
  is added in hashes (__nf_conntrack_hash_insert), so one conntract
  can't be initialized from a few threads concurrently.

  ctnetlink can add an uninitialized conntrack (w/o
  IPS_{DST,SRC}_NAT_DONE_BIT) in hashes, then a few threads can look up
  this conntrack and start initialize it concurrently. It's dangerous,
  because BUG can be triggered from nf_nat_setup_info.

Fix this race by always setting up nat, even if no CTA_NAT_ attribute
was requested before inserting the ct into the hash table. In absence
of CTA_NAT_ attribute, a null binding is created.

This alters current behaviour: Before this patch, the first packet
matching the newly injected conntrack would be run through the nat
table since nf_nat_initialized() returns false.  IOW, this forces
ctnetlink users to specify the desired nat transformation on ct
creation time.

Thanks for Florian Westphal, this patch is based on his original
patch to address this problem, including this patch description.

Reported-By: Andrey Vagin 
Signed-off-by: Pablo Neira Ayuso 
Acked-by: Florian Westphal

netfilter: nf_tables: check if payload length is a power of 2

2014-02-17T10:21:17+00:00

Add a check if payload's length is a power of 2 when selecting ops.
The fast ops were meant for well aligned loads, also this fixes a
small bug when using a length of 3 with some offsets which causes
only 1 byte to be loaded because the fast ops are chosen.

Signed-off-by: Nikolay Aleksandrov 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_meta: fix typo "CONFIG_NET_CLS_ROUTE"

2014-02-14T10:37:34+00:00

There are two checks for CONFIG_NET_CLS_ROUTE, but the corresponding
Kconfig symbol was dropped in v2.6.39. Since the code guards access to
dst_entry.tclassid it seems CONFIG_IP_ROUTE_CLASSID should be used
instead.

Signed-off-by: Paul Bolle 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_reject_inet: fix unintended fall-through in switch-statatement

2014-02-14T10:37:33+00:00

For IPv4 packets, we call both IPv4 and IPv6 reject.

Reported-by: Dave Jones 
Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

net: Include appropriate header file in netfilter/nft_lookup.c

2014-02-10T01:32:50+00:00

Include appropriate header file net/netfilter/nf_tables_core.h in
net/netfilter/nft_lookup.c because it has prototype declaration of
functions defined in net/netfilter/nft_lookup.c.

This eliminates the following warning in net/netfilter/nft_lookup.c:
net/netfilter/nft_lookup.c:133:12: warning: no previous prototype for ‘nft_lookup_module_init’ [-Wmissing-prototypes]
net/netfilter/nft_lookup.c:138:6: warning: no previous prototype for ‘nft_lookup_module_exit’ [-Wmissing-prototypes]

Signed-off-by: Rashika Kheria 
Reviewed-by: Josh Triplett 
Signed-off-by: David S. Miller

netfilter: nf_tables: unininline nft_trace_packet()

2014-02-07T16:50:27+00:00

It makes no sense to inline a rarely used function meant for debugging
only that is called a total of five times in the main evaluation loop.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix loop checking with end interval elements

2014-02-07T16:21:45+00:00

Fix access to uninitialized data for end interval elements. The
element data part is uninitialized in interval end elements.

Signed-off-by: Pablo Neira Ayuso

netfilter: nft_rbtree: fix data handling of end interval elements

2014-02-07T13:22:06+00:00

This patch fixes several things which related to the handling of
end interval elements:

* Chain use underflow with intervals and map: If you add a rule
  using intervals+map that introduces a loop, the error path of the
  rbtree set decrements the chain refcount for each side of the
  interval, leading to a chain use counter underflow.

* Don't copy the data part of the end interval element since, this
  area is uninitialized and this confuses the loop detection code.

* Don't allocate room for the data part of end interval elements
  since this is unused.

So, after this patch the idea is that end interval elements don't
have a data part.

Signed-off-by: Pablo Neira Ayuso 
Acked-by: Patrick McHardy

netfilter: nf_tables: do not allow NFT_SET_ELEM_INTERVAL_END flag and data

2014-02-07T13:21:49+00:00

This combination is not allowed since end interval elements cannot
contain data.

Signed-off-by: Pablo Neira Ayuso 
Acked-by: Patrick McHardy