Skip to content

Commit 5c4b274

Browse files
davem330davem330
committed
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says: ==================== The following patchset contains three Netfilter fixes and update for the MAINTAINER file for your net tree, they are: * Fix crash if nf_log_packet is called from conntrack, in that case both interfaces are NULL, from Hans Schillstrom. This bug introduced with the logging netns support in the previous merge window. * Fix compilation of nf_log and nf_queue without CONFIG_PROC_FS, from myself. This bug was introduced in the previous merge window with the new netns support for the netfilter logging infrastructure. * Fix possible crash in xt_TCPOPTSTRIP due to missing sanity checkings to validate that the TCP header is well-formed, from myself. I can find this bug in 2.6.25, probably it's been there since the beginning. I'll pass this to -stable. * Update MAINTAINER file to point to new nf trees at git.kernel.org, remove Harald and use M: instead of P: (now obsolete tag) to keep Jozsef in the list of people. Please, consider pulling this. Thanks! ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents 755ccb9 + bc6bcb5 commit 5c4b274

File tree

12 files changed

+67
-39
lines changed

12 files changed

+67
-39
lines changed

‎MAINTAINERS

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5509,18 +5509,18 @@ F: Documentation/networking/s2io.txt
55095509
F: Documentation/networking/vxge.txt
55105510
F: drivers/net/ethernet/neterion/
55115511

5512-
NETFILTER/IPTABLES/IPCHAINS
5513-
P: Harald Welte
5514-
P: Jozsef Kadlecsik
5512+
NETFILTER/IPTABLES
55155513
M: Pablo Neira Ayuso <pablo@netfilter.org>
55165514
M: Patrick McHardy <kaber@trash.net>
5515+
M: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
55175516
L: netfilter-devel@vger.kernel.org
55185517
L: netfilter@vger.kernel.org
55195518
L: coreteam@netfilter.org
55205519
W: http://www.netfilter.org/
55215520
W: http://www.iptables.org/
5522-
T: git git://1984.lsi.us.es/nf
5523-
T: git git://1984.lsi.us.es/nf-next
5521+
Q: http://patchwork.ozlabs.org/project/netfilter-devel/list/
5522+
T: git git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
5523+
T: git git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
55245524
S: Supported
55255525
F: include/linux/netfilter*
55265526
F: include/linux/netfilter/

‎include/net/netfilter/nf_log.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ struct nf_loginfo {
3030
} u;
3131
};
3232

33-
typedef void nf_logfn(u_int8_t pf,
33+
typedef void nf_logfn(struct net *net,
34+
u_int8_t pf,
3435
unsigned int hooknum,
3536
const struct sk_buff *skb,
3637
const struct net_device *in,

‎include/net/netfilter/nfnetlink_log.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
#define _KER_NFNETLINK_LOG_H
33

44
void
5-
nfulnl_log_packet(u_int8_t pf,
5+
nfulnl_log_packet(struct net *net,
6+
u_int8_t pf,
67
unsigned int hooknum,
78
const struct sk_buff *skb,
89
const struct net_device *in,

‎net/bridge/netfilter/ebt_log.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -72,13 +72,12 @@ print_ports(const struct sk_buff *skb, uint8_t protocol, int offset)
7272
}
7373

7474
static void
75-
ebt_log_packet(u_int8_t pf, unsigned int hooknum,
76-
const struct sk_buff *skb, const struct net_device *in,
77-
const struct net_device *out, const struct nf_loginfo *loginfo,
78-
const char *prefix)
75+
ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
76+
const struct sk_buff *skb, const struct net_device *in,
77+
const struct net_device *out, const struct nf_loginfo *loginfo,
78+
const char *prefix)
7979
{
8080
unsigned int bitmask;
81-
struct net *net = dev_net(in ? in : out);
8281

8382
/* FIXME: Disabled from containers until syslog ns is supported */
8483
if (!net_eq(net, &init_net))
@@ -191,7 +190,7 @@ ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par)
191190
nf_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb,
192191
par->in, par->out, &li, "%s", info->prefix);
193192
else
194-
ebt_log_packet(NFPROTO_BRIDGE, par->hooknum, skb, par->in,
193+
ebt_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb, par->in,
195194
par->out, &li, info->prefix);
196195
return EBT_CONTINUE;
197196
}

‎net/bridge/netfilter/ebt_ulog.c

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -131,14 +131,16 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
131131
return skb;
132132
}
133133

134-
static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb,
135-
const struct net_device *in, const struct net_device *out,
136-
const struct ebt_ulog_info *uloginfo, const char *prefix)
134+
static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
135+
const struct sk_buff *skb,
136+
const struct net_device *in,
137+
const struct net_device *out,
138+
const struct ebt_ulog_info *uloginfo,
139+
const char *prefix)
137140
{
138141
ebt_ulog_packet_msg_t *pm;
139142
size_t size, copy_len;
140143
struct nlmsghdr *nlh;
141-
struct net *net = dev_net(in ? in : out);
142144
struct ebt_ulog_net *ebt = ebt_ulog_pernet(net);
143145
unsigned int group = uloginfo->nlgroup;
144146
ebt_ulog_buff_t *ub = &ebt->ulog_buffers[group];
@@ -233,7 +235,7 @@ static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb,
233235
}
234236

235237
/* this function is registered with the netfilter core */
236-
static void ebt_log_packet(u_int8_t pf, unsigned int hooknum,
238+
static void ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
237239
const struct sk_buff *skb, const struct net_device *in,
238240
const struct net_device *out, const struct nf_loginfo *li,
239241
const char *prefix)
@@ -252,13 +254,15 @@ static void ebt_log_packet(u_int8_t pf, unsigned int hooknum,
252254
strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
253255
}
254256

255-
ebt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
257+
ebt_ulog_packet(net, hooknum, skb, in, out, &loginfo, prefix);
256258
}
257259

258260
static unsigned int
259261
ebt_ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
260262
{
261-
ebt_ulog_packet(par->hooknum, skb, par->in, par->out,
263+
struct net *net = dev_net(par->in ? par->in : par->out);
264+
265+
ebt_ulog_packet(net, par->hooknum, skb, par->in, par->out,
262266
par->targinfo, NULL);
263267
return EBT_CONTINUE;
264268
}

‎net/ipv4/netfilter/ipt_ULOG.c

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,8 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
162162
return skb;
163163
}
164164

165-
static void ipt_ulog_packet(unsigned int hooknum,
165+
static void ipt_ulog_packet(struct net *net,
166+
unsigned int hooknum,
166167
const struct sk_buff *skb,
167168
const struct net_device *in,
168169
const struct net_device *out,
@@ -174,7 +175,6 @@ static void ipt_ulog_packet(unsigned int hooknum,
174175
size_t size, copy_len;
175176
struct nlmsghdr *nlh;
176177
struct timeval tv;
177-
struct net *net = dev_net(in ? in : out);
178178
struct ulog_net *ulog = ulog_pernet(net);
179179

180180
/* ffs == find first bit set, necessary because userspace
@@ -291,12 +291,15 @@ static void ipt_ulog_packet(unsigned int hooknum,
291291
static unsigned int
292292
ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
293293
{
294-
ipt_ulog_packet(par->hooknum, skb, par->in, par->out,
294+
struct net *net = dev_net(par->in ? par->in : par->out);
295+
296+
ipt_ulog_packet(net, par->hooknum, skb, par->in, par->out,
295297
par->targinfo, NULL);
296298
return XT_CONTINUE;
297299
}
298300

299-
static void ipt_logfn(u_int8_t pf,
301+
static void ipt_logfn(struct net *net,
302+
u_int8_t pf,
300303
unsigned int hooknum,
301304
const struct sk_buff *skb,
302305
const struct net_device *in,
@@ -318,7 +321,7 @@ static void ipt_logfn(u_int8_t pf,
318321
strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
319322
}
320323

321-
ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
324+
ipt_ulog_packet(net, hooknum, skb, in, out, &loginfo, prefix);
322325
}
323326

324327
static int ulog_tg_check(const struct xt_tgchk_param *par)

‎net/netfilter/nf_log.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ void nf_log_packet(struct net *net,
148148
va_start(args, fmt);
149149
vsnprintf(prefix, sizeof(prefix), fmt, args);
150150
va_end(args);
151-
logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
151+
logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
152152
}
153153
rcu_read_unlock();
154154
}
@@ -368,17 +368,20 @@ static int __net_init nf_log_net_init(struct net *net)
368368
return 0;
369369

370370
out_sysctl:
371+
#ifdef CONFIG_PROC_FS
371372
/* For init_net: errors will trigger panic, don't unroll on error. */
372373
if (!net_eq(net, &init_net))
373374
remove_proc_entry("nf_log", net->nf.proc_netfilter);
374-
375+
#endif
375376
return ret;
376377
}
377378

378379
static void __net_exit nf_log_net_exit(struct net *net)
379380
{
380381
netfilter_log_sysctl_exit(net);
382+
#ifdef CONFIG_PROC_FS
381383
remove_proc_entry("nf_log", net->nf.proc_netfilter);
384+
#endif
382385
}
383386

384387
static struct pernet_operations nf_log_net_ops = {

‎net/netfilter/nfnetlink_log.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -602,7 +602,8 @@ static struct nf_loginfo default_loginfo = {
602602

603603
/* log handler for internal netfilter logging api */
604604
void
605-
nfulnl_log_packet(u_int8_t pf,
605+
nfulnl_log_packet(struct net *net,
606+
u_int8_t pf,
606607
unsigned int hooknum,
607608
const struct sk_buff *skb,
608609
const struct net_device *in,
@@ -615,7 +616,6 @@ nfulnl_log_packet(u_int8_t pf,
615616
const struct nf_loginfo *li;
616617
unsigned int qthreshold;
617618
unsigned int plen;
618-
struct net *net = dev_net(in ? in : out);
619619
struct nfnl_log_net *log = nfnl_log_pernet(net);
620620

621621
if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
@@ -1045,7 +1045,9 @@ static int __net_init nfnl_log_net_init(struct net *net)
10451045

10461046
static void __net_exit nfnl_log_net_exit(struct net *net)
10471047
{
1048+
#ifdef CONFIG_PROC_FS
10481049
remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter);
1050+
#endif
10491051
}
10501052

10511053
static struct pernet_operations nfnl_log_net_ops = {

‎net/netfilter/nfnetlink_queue_core.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1285,7 +1285,9 @@ static int __net_init nfnl_queue_net_init(struct net *net)
12851285

12861286
static void __net_exit nfnl_queue_net_exit(struct net *net)
12871287
{
1288+
#ifdef CONFIG_PROC_FS
12881289
remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
1290+
#endif
12891291
}
12901292

12911293
static struct pernet_operations nfnl_queue_net_ops = {

‎net/netfilter/xt_LOG.c

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -466,7 +466,8 @@ log_packet_common(struct sbuff *m,
466466

467467

468468
static void
469-
ipt_log_packet(u_int8_t pf,
469+
ipt_log_packet(struct net *net,
470+
u_int8_t pf,
470471
unsigned int hooknum,
471472
const struct sk_buff *skb,
472473
const struct net_device *in,
@@ -475,7 +476,6 @@ ipt_log_packet(u_int8_t pf,
475476
const char *prefix)
476477
{
477478
struct sbuff *m;
478-
struct net *net = dev_net(in ? in : out);
479479

480480
/* FIXME: Disabled from containers until syslog ns is supported */
481481
if (!net_eq(net, &init_net))
@@ -797,7 +797,8 @@ static void dump_ipv6_mac_header(struct sbuff *m,
797797
}
798798

799799
static void
800-
ip6t_log_packet(u_int8_t pf,
800+
ip6t_log_packet(struct net *net,
801+
u_int8_t pf,
801802
unsigned int hooknum,
802803
const struct sk_buff *skb,
803804
const struct net_device *in,
@@ -806,7 +807,6 @@ ip6t_log_packet(u_int8_t pf,
806807
const char *prefix)
807808
{
808809
struct sbuff *m;
809-
struct net *net = dev_net(in ? in : out);
810810

811811
/* FIXME: Disabled from containers until syslog ns is supported */
812812
if (!net_eq(net, &init_net))
@@ -833,17 +833,18 @@ log_tg(struct sk_buff *skb, const struct xt_action_param *par)
833833
{
834834
const struct xt_log_info *loginfo = par->targinfo;
835835
struct nf_loginfo li;
836+
struct net *net = dev_net(par->in ? par->in : par->out);
836837

837838
li.type = NF_LOG_TYPE_LOG;
838839
li.u.log.level = loginfo->level;
839840
li.u.log.logflags = loginfo->logflags;
840841

841842
if (par->family == NFPROTO_IPV4)
842-
ipt_log_packet(NFPROTO_IPV4, par->hooknum, skb, par->in,
843+
ipt_log_packet(net, NFPROTO_IPV4, par->hooknum, skb, par->in,
843844
par->out, &li, loginfo->prefix);
844845
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
845846
else if (par->family == NFPROTO_IPV6)
846-
ip6t_log_packet(NFPROTO_IPV6, par->hooknum, skb, par->in,
847+
ip6t_log_packet(net, NFPROTO_IPV6, par->hooknum, skb, par->in,
847848
par->out, &li, loginfo->prefix);
848849
#endif
849850
else

‎net/netfilter/xt_NFLOG.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,14 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
2626
{
2727
const struct xt_nflog_info *info = par->targinfo;
2828
struct nf_loginfo li;
29+
struct net *net = dev_net(par->in ? par->in : par->out);
2930

3031
li.type = NF_LOG_TYPE_ULOG;
3132
li.u.ulog.copy_len = info->len;
3233
li.u.ulog.group = info->group;
3334
li.u.ulog.qthreshold = info->threshold;
3435

35-
nfulnl_log_packet(par->family, par->hooknum, skb, par->in,
36+
nfulnl_log_packet(net, par->family, par->hooknum, skb, par->in,
3637
par->out, &li, info->prefix);
3738
return XT_CONTINUE;
3839
}

‎net/netfilter/xt_TCPOPTSTRIP.c

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,17 +30,28 @@ static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
3030

3131
static unsigned int
3232
tcpoptstrip_mangle_packet(struct sk_buff *skb,
33-
const struct xt_tcpoptstrip_target_info *info,
33+
const struct xt_action_param *par,
3434
unsigned int tcphoff, unsigned int minlen)
3535
{
36+
const struct xt_tcpoptstrip_target_info *info = par->targinfo;
3637
unsigned int optl, i, j;
3738
struct tcphdr *tcph;
3839
u_int16_t n, o;
3940
u_int8_t *opt;
41+
int len;
42+
43+
/* This is a fragment, no TCP header is available */
44+
if (par->fragoff != 0)
45+
return XT_CONTINUE;
4046

4147
if (!skb_make_writable(skb, skb->len))
4248
return NF_DROP;
4349

50+
len = skb->len - tcphoff;
51+
if (len < (int)sizeof(struct tcphdr) ||
52+
tcp_hdr(skb)->doff * 4 > len)
53+
return NF_DROP;
54+
4455
tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
4556
opt = (u_int8_t *)tcph;
4657

@@ -76,7 +87,7 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
7687
static unsigned int
7788
tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
7889
{
79-
return tcpoptstrip_mangle_packet(skb, par->targinfo, ip_hdrlen(skb),
90+
return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb),
8091
sizeof(struct iphdr) + sizeof(struct tcphdr));
8192
}
8293

@@ -94,7 +105,7 @@ tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
94105
if (tcphoff < 0)
95106
return NF_DROP;
96107

97-
return tcpoptstrip_mangle_packet(skb, par->targinfo, tcphoff,
108+
return tcpoptstrip_mangle_packet(skb, par, tcphoff,
98109
sizeof(*ipv6h) + sizeof(struct tcphdr));
99110
}
100111
#endif

0 commit comments

Comments
 (0)