1. 17 Feb, 2014 3 commits
    • Pablo Neira Ayuso's avatar
      netfilter: ctnetlink: force null nat binding on insert · 0eba801b
      Pablo Neira Ayuso authored
      Quoting Andrey Vagin:
        When a conntrack is created  by kernel, it is initialized (sets
        IPS_{DST,SRC}_NAT_DONE_BIT bits in nf_nat_setup_info) and only then it
        is added in hashes (__nf_conntrack_hash_insert), so one conntract
        can't be initialized from a few threads concurrently.
      
        ctnetlink can add an uninitialized conntrack (w/o
        IPS_{DST,SRC}_NAT_DONE_BIT) in hashes, then a few threads can look up
        this conntrack and start initialize it concurrently. It's dangerous,
        because BUG can be triggered from nf_nat_setup_info.
      
      Fix this race by always setting up nat, even if no CTA_NAT_ attribute
      was requested before inserting the ct into the hash table. In absence
      of CTA_NAT_ attribute, a null binding is created.
      
      This alters current behaviour: Before this patch, the first packet
      matching the newly injected conntrack would be run through the nat
      table since nf_nat_initialized() returns false.  IOW, this forces
      ctnetlink users to specify the desired nat transformation on ct
      creation time.
      
      Thanks for Florian Westphal, this patch is based on his original
      patch to address this problem, including this patch description.
      Reported-By: default avatarAndrey Vagin <avagin@gmail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Acked-by: default avatarFlorian Westphal <fw@strlen.de>
      0eba801b
    • Nikolay Aleksandrov's avatar
      netfilter: nf_tables: check if payload length is a power of 2 · f627ed91
      Nikolay Aleksandrov authored
      Add a check if payload's length is a power of 2 when selecting ops.
      The fast ops were meant for well aligned loads, also this fixes a
      small bug when using a length of 3 with some offsets which causes
      only 1 byte to be loaded because the fast ops are chosen.
      Signed-off-by: default avatarNikolay Aleksandrov <nikolay@redhat.com>
      Acked-by: default avatarPatrick McHardy <kaber@trash.net>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      f627ed91
    • Florian Westphal's avatar
      netfilter: nf_tables: fix nf_trace always-on with XT_TRACE=n · 478b360a
      Florian Westphal authored
      When using nftables with CONFIG_NETFILTER_XT_TARGET_TRACE=n, we get
      lots of "TRACE: filter:output:policy:1 IN=..." warnings as several
      places will leave skb->nf_trace uninitialised.
      
      Unlike iptables tracing functionality is not conditional in nftables,
      so always copy/zero nf_trace setting when nftables is enabled.
      
      Move this into __nf_copy() helper.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      478b360a
  2. 14 Feb, 2014 3 commits
  3. 11 Feb, 2014 5 commits
  4. 10 Feb, 2014 29 commits