Commit c26d0d98 authored by Jakub Kicinski's avatar Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

1) Fix incorrect TCP connection tracking window reset for non-syn
   packets, from Florian Westphal.

2) Incorrect dependency on CONFIG_NFT_FLOW_OFFLOAD, from Volodymyr Mytnyk.

3) Fix nft_socket from the output path, from Florian Westphal.

* git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nft_socket: only do sk lookups when indev is available
  netfilter: conntrack: fix udp offload timeout sysctl
  netfilter: nf_conntrack_tcp: re-init for syn packets only
====================

Link: https://lore.kernel.org/r/20220428142109.38726-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents aeaf59b7 743b83f1
...@@ -556,24 +556,14 @@ static bool tcp_in_window(struct nf_conn *ct, ...@@ -556,24 +556,14 @@ static bool tcp_in_window(struct nf_conn *ct,
} }
} }
} else if (((state->state == TCP_CONNTRACK_SYN_SENT } else if (tcph->syn &&
&& dir == IP_CT_DIR_ORIGINAL) after(end, sender->td_end) &&
|| (state->state == TCP_CONNTRACK_SYN_RECV (state->state == TCP_CONNTRACK_SYN_SENT ||
&& dir == IP_CT_DIR_REPLY)) state->state == TCP_CONNTRACK_SYN_RECV)) {
&& after(end, sender->td_end)) {
/* /*
* RFC 793: "if a TCP is reinitialized ... then it need * RFC 793: "if a TCP is reinitialized ... then it need
* not wait at all; it must only be sure to use sequence * not wait at all; it must only be sure to use sequence
* numbers larger than those recently used." * numbers larger than those recently used."
*/
sender->td_end =
sender->td_maxend = end;
sender->td_maxwin = (win == 0 ? 1 : win);
tcp_options(skb, dataoff, tcph, sender);
} else if (tcph->syn && dir == IP_CT_DIR_REPLY &&
state->state == TCP_CONNTRACK_SYN_SENT) {
/* Retransmitted syn-ack, or syn (simultaneous open).
* *
* Re-init state for this direction, just like for the first * Re-init state for this direction, just like for the first
* syn(-ack) reply, it might differ in seq, ack or tcp options. * syn(-ack) reply, it might differ in seq, ack or tcp options.
...@@ -581,7 +571,8 @@ static bool tcp_in_window(struct nf_conn *ct, ...@@ -581,7 +571,8 @@ static bool tcp_in_window(struct nf_conn *ct,
tcp_init_sender(sender, receiver, tcp_init_sender(sender, receiver,
skb, dataoff, tcph, skb, dataoff, tcph,
end, win); end, win);
if (!tcph->ack)
if (dir == IP_CT_DIR_REPLY && !tcph->ack)
return true; return true;
} }
......
...@@ -823,7 +823,7 @@ static struct ctl_table nf_ct_sysctl_table[] = { ...@@ -823,7 +823,7 @@ static struct ctl_table nf_ct_sysctl_table[] = {
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_jiffies, .proc_handler = proc_dointvec_jiffies,
}, },
#if IS_ENABLED(CONFIG_NFT_FLOW_OFFLOAD) #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD] = { [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD] = {
.procname = "nf_flowtable_udp_timeout", .procname = "nf_flowtable_udp_timeout",
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
......
...@@ -54,6 +54,32 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo ...@@ -54,6 +54,32 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo
} }
#endif #endif
static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt)
{
const struct net_device *indev = nft_in(pkt);
const struct sk_buff *skb = pkt->skb;
struct sock *sk = NULL;
if (!indev)
return NULL;
switch (nft_pf(pkt)) {
case NFPROTO_IPV4:
sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, indev);
break;
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
case NFPROTO_IPV6:
sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, indev);
break;
#endif
default:
WARN_ON_ONCE(1);
break;
}
return sk;
}
static void nft_socket_eval(const struct nft_expr *expr, static void nft_socket_eval(const struct nft_expr *expr,
struct nft_regs *regs, struct nft_regs *regs,
const struct nft_pktinfo *pkt) const struct nft_pktinfo *pkt)
...@@ -67,20 +93,7 @@ static void nft_socket_eval(const struct nft_expr *expr, ...@@ -67,20 +93,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
sk = NULL; sk = NULL;
if (!sk) if (!sk)
switch(nft_pf(pkt)) { sk = nft_socket_do_lookup(pkt);
case NFPROTO_IPV4:
sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, nft_in(pkt));
break;
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
case NFPROTO_IPV6:
sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, nft_in(pkt));
break;
#endif
default:
WARN_ON_ONCE(1);
regs->verdict.code = NFT_BREAK;
return;
}
if (!sk) { if (!sk) {
regs->verdict.code = NFT_BREAK; regs->verdict.code = NFT_BREAK;
...@@ -224,6 +237,16 @@ static bool nft_socket_reduce(struct nft_regs_track *track, ...@@ -224,6 +237,16 @@ static bool nft_socket_reduce(struct nft_regs_track *track,
return nft_expr_reduce_bitwise(track, expr); return nft_expr_reduce_bitwise(track, expr);
} }
static int nft_socket_validate(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nft_data **data)
{
return nft_chain_validate_hooks(ctx->chain,
(1 << NF_INET_PRE_ROUTING) |
(1 << NF_INET_LOCAL_IN) |
(1 << NF_INET_LOCAL_OUT));
}
static struct nft_expr_type nft_socket_type; static struct nft_expr_type nft_socket_type;
static const struct nft_expr_ops nft_socket_ops = { static const struct nft_expr_ops nft_socket_ops = {
.type = &nft_socket_type, .type = &nft_socket_type,
...@@ -231,6 +254,7 @@ static const struct nft_expr_ops nft_socket_ops = { ...@@ -231,6 +254,7 @@ static const struct nft_expr_ops nft_socket_ops = {
.eval = nft_socket_eval, .eval = nft_socket_eval,
.init = nft_socket_init, .init = nft_socket_init,
.dump = nft_socket_dump, .dump = nft_socket_dump,
.validate = nft_socket_validate,
.reduce = nft_socket_reduce, .reduce = nft_socket_reduce,
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment