Skip to content

Commit e9d572d

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Do not delete clash entries on reply, let them expire instead, from Florian Westphal. 2) Do not report EAGAIN to nfnetlink, otherwise this enters a busy loop. Update nfnetlink_unicast() to translate EAGAIN to ENOBUFS. 3) Remove repeated words in code comments, from Randy Dunlap. 4) Several patches for the flowtable selftests, from Fabian Frederick. ==================== Signed-off-by: David S. Miller <[email protected]>
2 parents bb8872a + c461721 commit e9d572d

File tree

12 files changed

+92
-91
lines changed

12 files changed

+92
-91
lines changed

‎include/linux/netfilter/nfnetlink.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,7 @@ int nfnetlink_has_listeners(struct net *net, unsigned int group);
4343
int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid,
4444
unsigned int group, int echo, gfp_t flags);
4545
int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error);
46-
int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
47-
int flags);
46+
int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid);
4847

4948
static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
5049
{

‎net/ipv4/netfilter/nf_nat_pptp.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* nf_nat_pptp.c
44
*
55
* NAT support for PPTP (Point to Point Tunneling Protocol).
6-
* PPTP is a a protocol for creating virtual private networks.
6+
* PPTP is a protocol for creating virtual private networks.
77
* It is a specification defined by Microsoft and some vendors
88
* working with Microsoft. PPTP is built on top of a modified
99
* version of the Internet Generic Routing Encapsulation Protocol.

‎net/netfilter/nf_conntrack_pptp.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// SPDX-License-Identifier: GPL-2.0-only
22
/*
33
* Connection tracking support for PPTP (Point to Point Tunneling Protocol).
4-
* PPTP is a a protocol for creating virtual private networks.
4+
* PPTP is a protocol for creating virtual private networks.
55
* It is a specification defined by Microsoft and some vendors
66
* working with Microsoft. PPTP is built on top of a modified
77
* version of the Internet Generic Routing Encapsulation Protocol.

‎net/netfilter/nf_conntrack_proto_tcp.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1152,7 +1152,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
11521152
&& (old_state == TCP_CONNTRACK_SYN_RECV
11531153
|| old_state == TCP_CONNTRACK_ESTABLISHED)
11541154
&& new_state == TCP_CONNTRACK_ESTABLISHED) {
1155-
/* Set ASSURED if we see see valid ack in ESTABLISHED
1155+
/* Set ASSURED if we see valid ack in ESTABLISHED
11561156
after SYN_RECV or a valid answer for a picked up
11571157
connection. */
11581158
set_bit(IPS_ASSURED_BIT, &ct->status);

‎net/netfilter/nf_conntrack_proto_udp.c

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -81,18 +81,6 @@ static bool udp_error(struct sk_buff *skb,
8181
return false;
8282
}
8383

84-
static void nf_conntrack_udp_refresh_unreplied(struct nf_conn *ct,
85-
struct sk_buff *skb,
86-
enum ip_conntrack_info ctinfo,
87-
u32 extra_jiffies)
88-
{
89-
if (unlikely(ctinfo == IP_CT_ESTABLISHED_REPLY &&
90-
ct->status & IPS_NAT_CLASH))
91-
nf_ct_kill(ct);
92-
else
93-
nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies);
94-
}
95-
9684
/* Returns verdict for packet, and may modify conntracktype */
9785
int nf_conntrack_udp_packet(struct nf_conn *ct,
9886
struct sk_buff *skb,
@@ -124,12 +112,15 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
124112

125113
nf_ct_refresh_acct(ct, ctinfo, skb, extra);
126114

115+
/* never set ASSURED for IPS_NAT_CLASH, they time out soon */
116+
if (unlikely((ct->status & IPS_NAT_CLASH)))
117+
return NF_ACCEPT;
118+
127119
/* Also, more likely to be important, and not a probe */
128120
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
129121
nf_conntrack_event_cache(IPCT_ASSURED, ct);
130122
} else {
131-
nf_conntrack_udp_refresh_unreplied(ct, skb, ctinfo,
132-
timeouts[UDP_CT_UNREPLIED]);
123+
nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]);
133124
}
134125
return NF_ACCEPT;
135126
}
@@ -206,12 +197,15 @@ int nf_conntrack_udplite_packet(struct nf_conn *ct,
206197
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
207198
nf_ct_refresh_acct(ct, ctinfo, skb,
208199
timeouts[UDP_CT_REPLIED]);
200+
201+
if (unlikely((ct->status & IPS_NAT_CLASH)))
202+
return NF_ACCEPT;
203+
209204
/* Also, more likely to be important, and not a probe */
210205
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
211206
nf_conntrack_event_cache(IPCT_ASSURED, ct);
212207
} else {
213-
nf_conntrack_udp_refresh_unreplied(ct, skb, ctinfo,
214-
timeouts[UDP_CT_UNREPLIED]);
208+
nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]);
215209
}
216210
return NF_ACCEPT;
217211
}

‎net/netfilter/nf_tables_api.c

Lines changed: 29 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -815,11 +815,11 @@ static int nf_tables_gettable(struct net *net, struct sock *nlsk,
815815
nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
816816
family, table);
817817
if (err < 0)
818-
goto err;
818+
goto err_fill_table_info;
819819

820-
return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
820+
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
821821

822-
err:
822+
err_fill_table_info:
823823
kfree_skb(skb2);
824824
return err;
825825
}
@@ -1563,11 +1563,11 @@ static int nf_tables_getchain(struct net *net, struct sock *nlsk,
15631563
nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
15641564
family, table, chain);
15651565
if (err < 0)
1566-
goto err;
1566+
goto err_fill_chain_info;
15671567

1568-
return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1568+
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
15691569

1570-
err:
1570+
err_fill_chain_info:
15711571
kfree_skb(skb2);
15721572
return err;
15731573
}
@@ -3008,11 +3008,11 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk,
30083008
nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
30093009
family, table, chain, rule, NULL);
30103010
if (err < 0)
3011-
goto err;
3011+
goto err_fill_rule_info;
30123012

3013-
return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3013+
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
30143014

3015-
err:
3015+
err_fill_rule_info:
30163016
kfree_skb(skb2);
30173017
return err;
30183018
}
@@ -3968,11 +3968,11 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk,
39683968

39693969
err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
39703970
if (err < 0)
3971-
goto err;
3971+
goto err_fill_set_info;
39723972

3973-
return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3973+
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
39743974

3975-
err:
3975+
err_fill_set_info:
39763976
kfree_skb(skb2);
39773977
return err;
39783978
}
@@ -4860,24 +4860,18 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
48604860
err = -ENOMEM;
48614861
skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
48624862
if (skb == NULL)
4863-
goto err1;
4863+
return err;
48644864

48654865
err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
48664866
NFT_MSG_NEWSETELEM, 0, set, &elem);
48674867
if (err < 0)
4868-
goto err2;
4868+
goto err_fill_setelem;
48694869

4870-
err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4871-
/* This avoids a loop in nfnetlink. */
4872-
if (err < 0)
4873-
goto err1;
4870+
return nfnetlink_unicast(skb, ctx->net, ctx->portid);
48744871

4875-
return 0;
4876-
err2:
4872+
err_fill_setelem:
48774873
kfree_skb(skb);
4878-
err1:
4879-
/* this avoids a loop in nfnetlink. */
4880-
return err == -EAGAIN ? -ENOBUFS : err;
4874+
return err;
48814875
}
48824876

48834877
/* called with rcu_read_lock held */
@@ -6182,10 +6176,11 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk,
61826176
nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
61836177
family, table, obj, reset);
61846178
if (err < 0)
6185-
goto err;
6179+
goto err_fill_obj_info;
61866180

6187-
return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6188-
err:
6181+
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
6182+
6183+
err_fill_obj_info:
61896184
kfree_skb(skb2);
61906185
return err;
61916186
}
@@ -7045,10 +7040,11 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
70457040
NFT_MSG_NEWFLOWTABLE, 0, family,
70467041
flowtable, &flowtable->hook_list);
70477042
if (err < 0)
7048-
goto err;
7043+
goto err_fill_flowtable_info;
70497044

7050-
return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
7051-
err:
7045+
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7046+
7047+
err_fill_flowtable_info:
70527048
kfree_skb(skb2);
70537049
return err;
70547050
}
@@ -7234,10 +7230,11 @@ static int nf_tables_getgen(struct net *net, struct sock *nlsk,
72347230
err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
72357231
nlh->nlmsg_seq);
72367232
if (err < 0)
7237-
goto err;
7233+
goto err_fill_gen_info;
72387234

7239-
return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
7240-
err:
7235+
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7236+
7237+
err_fill_gen_info:
72417238
kfree_skb(skb2);
72427239
return err;
72437240
}

‎net/netfilter/nfnetlink.c

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -149,10 +149,15 @@ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error)
149149
}
150150
EXPORT_SYMBOL_GPL(nfnetlink_set_err);
151151

152-
int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
153-
int flags)
152+
int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid)
154153
{
155-
return netlink_unicast(net->nfnl, skb, portid, flags);
154+
int err;
155+
156+
err = nlmsg_unicast(net->nfnl, skb, portid);
157+
if (err == -EAGAIN)
158+
err = -ENOBUFS;
159+
160+
return err;
156161
}
157162
EXPORT_SYMBOL_GPL(nfnetlink_unicast);
158163

‎net/netfilter/nfnetlink_log.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -356,8 +356,7 @@ __nfulnl_send(struct nfulnl_instance *inst)
356356
goto out;
357357
}
358358
}
359-
nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid,
360-
MSG_DONTWAIT);
359+
nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid);
361360
out:
362361
inst->qlen = 0;
363362
inst->skb = NULL;

‎net/netfilter/nfnetlink_queue.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -681,7 +681,7 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue,
681681
*packet_id_ptr = htonl(entry->id);
682682

683683
/* nfnetlink_unicast will either free the nskb or add it to a socket */
684-
err = nfnetlink_unicast(nskb, net, queue->peer_portid, MSG_DONTWAIT);
684+
err = nfnetlink_unicast(nskb, net, queue->peer_portid);
685685
if (err < 0) {
686686
if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
687687
failopen = 1;

‎net/netfilter/nft_flow_offload.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
102102
}
103103

104104
if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||
105-
ct->status & IPS_SEQ_ADJUST)
105+
ct->status & (IPS_SEQ_ADJUST | IPS_NAT_CLASH))
106106
goto out;
107107

108108
if (!nf_ct_is_confirmed(ct))

‎net/netfilter/xt_recent.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -640,7 +640,7 @@ static void __net_exit recent_proc_net_exit(struct net *net)
640640
struct recent_table *t;
641641

642642
/* recent_net_exit() is called before recent_mt_destroy(). Make sure
643-
* that the parent xt_recent proc entry is is empty before trying to
643+
* that the parent xt_recent proc entry is empty before trying to
644644
* remove it.
645645
*/
646646
spin_lock_bh(&recent_lock);

0 commit comments

Comments
 (0)