From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:47
Hi David,
The following patchset contains Netfilter/IPVS fixes for your net tree:
1) Reject non-null terminated helper names from xt_CT, from Gao Feng.
2) Fix KASAN splat due to out-of-bound access from commit phase, from
Alexey Kodanev.
3) Missing conntrack hook registration on IPVS FTP helper, from Julian
Anastasov.
4) Incorrect skbuff allocation size in bridge nft_reject, from Taehee Yoo.
5) Fix inverted check on packet xmit to non-local addresses, also from
Julian.
6) Fix ebtables alignment compat problems, from Alin Nastac.
7) Hook mask checks are not correct in xt_set, from Serhey Popovych.
8) Fix timeout listing of element in ipsets, from Jozsef.
9) Cap maximum timeout value in ipset, also from Jozsef.
10) Don't allow family option for hash:mac sets, from Florent Fourcot.
11) Restrict ebtables to work with NFPROTO_BRIDGE targets only, this
Florian.
12) Another bug reported by KASAN in the rbtree set backend, from
Taehee Yoo.
13) Missing __IPS_MAX_BIT update doesn't include IPS_OFFLOAD_BIT.
From Gao Feng.
14) Missing initialization of match/target in ebtables, from Florian
Westphal.
15) Remove useless nft_dup.h file in include path, from C. Labbe.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 664088f8d68178809b848ca450f2797efb34e8e7:
net-sysfs: Fix memory leak in XPS configuration (2018-05-31 23:02:42 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to d8e87fc6d11c31525430a388317b52f4a98a5328:
netfilter: remove include/net/netfilter/nft_dup.h (2018-06-08 12:42:24 +0200)
----------------------------------------------------------------
Alexey Kodanev (1):
netfilter: nf_tables: check msg_type before nft_trans_set(trans)
Alin Nastac (1):
netfilter: ebtables: fix compat entry padding
Corentin Labbe (1):
netfilter: remove include/net/netfilter/nft_dup.h
Florent Fourcot (1):
netfilter: ipset: forbid family for hash:mac sets
Florian Westphal (2):
netfilter: ebtables: reject non-bridge targets
netfilter: x_tables: initialise match/target check parameter struct
Gao Feng (2):
netfilter: xt_CT: Reject the non-null terminated string from user space
netfilter: nf_conntrack: Increase __IPS_MAX_BIT with new bit IPS_OFFLOAD_BIT
Jozsef Kadlecsik (2):
netfilter: ipset: List timing out entries with "timeout 1" instead of zero
netfilter: ipset: Limit max timeout value
Julian Anastasov (2):
ipvs: register conntrack hooks for ftp
ipvs: fix check on xmit to non-local addresses
Pablo Neira Ayuso (1):
Merge git://blackhole.kfki.hu/nf
Serhey Popovych (1):
netfilter: xt_set: Check hook mask correctly
Taehee Yoo (2):
netfilter: nft_reject_bridge: fix skb allocation size in nft_reject_br_send_v6_unreach
netfilter: nft_set_rbtree: fix parameter of __nft_rbtree_lookup()
include/linux/netfilter/ipset/ip_set_timeout.h | 20 ++++++++++-----
include/net/ip_vs.h | 30 ++++++++++++++++++++++
include/net/netfilter/nft_dup.h | 10 --------
include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +-
net/bridge/netfilter/ebtables.c | 25 ++++++++++++++----
net/bridge/netfilter/nft_reject_bridge.c | 2 +-
net/ipv4/netfilter/ip_tables.c | 1 +
net/ipv6/netfilter/ip6_tables.c | 1 +
net/netfilter/ipset/ip_set_hash_gen.h | 5 +++-
net/netfilter/ipvs/ip_vs_ctl.c | 4 +++
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
net/netfilter/nf_tables_api.c | 11 ++++----
net/netfilter/nft_set_rbtree.c | 2 +-
net/netfilter/xt_CT.c | 10 ++++++++
net/netfilter/xt_set.c | 10 ++++----
15 files changed, 99 insertions(+), 36 deletions(-)
delete mode 100644 include/net/netfilter/nft_dup.h
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:47
From: Jozsef Kadlecsik <redacted>
When listing sets with timeout support, there's a probability that
just timing out entries with "0" timeout value is listed/saved.
However when restoring the saved list, the zero timeout value means
permanent elelements.
The new behaviour is that timing out entries are listed with "timeout 1"
instead of zero.
Fixes netfilter bugzilla #1258.
Signed-off-by: Jozsef Kadlecsik <redacted>
---
include/linux/netfilter/ipset/ip_set_timeout.h | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
@@ -65,8 +65,14 @@ ip_set_timeout_set(unsigned long *timeout, u32 value)staticinlineu32ip_set_timeout_get(constunsignedlong*timeout){-return*timeout==IPSET_ELEM_PERMANENT?0:-jiffies_to_msecs(*timeout-jiffies)/MSEC_PER_SEC;+u32t;++if(*timeout==IPSET_ELEM_PERMANENT)+return0;++t=jiffies_to_msecs(*timeout-jiffies)/MSEC_PER_SEC;+/* Zero value in userspace means no timeout */+returnt==0?1:t;}#endif /* __KERNEL__ */
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:47
From: Gao Feng <redacted>
The helper and timeout strings are from user-space, we need to make
sure they are null terminated. If not, evil user could make kernel
read the unexpected memory, even print it when fail to find by the
following codes.
pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
Signed-off-by: Gao Feng <redacted>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_CT.c | 10 ++++++++++
1 file changed, 10 insertions(+)
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:48
From: Florent Fourcot <redacted>
Userspace `ipset` command forbids family option for hash:mac type:
ipset create test hash:mac family inet4
ipset v6.30: Unknown argument: `family'
However, this check is not done in kernel itself. When someone use
external netlink applications (pyroute2 python library for example), one
can create hash:mac with invalid family and inconsistant results from
userspace (`ipset` command cannot read set content anymore).
This patch enforce the logic in kernel, and forbids insertion of
hash:mac with a family set.
Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no
impact on other hash:* sets
Signed-off-by: Florent Fourcot <redacted>
Signed-off-by: Victorien Molle <redacted>
Signed-off-by: Jozsef Kadlecsik <redacted>
---
net/netfilter/ipset/ip_set_hash_gen.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
@@ -1234,7 +1234,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,pr_debug("Create set %s with family %s\n",set->name,set->family==NFPROTO_IPV4?"inet":"inet6");-#ifndef IP_SET_PROTO_UNDEF+#ifdef IP_SET_PROTO_UNDEF+if(set->family!=NFPROTO_UNSPEC)+return-IPSET_ERR_INVALID_FAMILY;+#elseif(!(set->family==NFPROTO_IPV4||set->family==NFPROTO_IPV6))return-IPSET_ERR_INVALID_FAMILY;#endif
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:48
From: Alin Nastac <redacted>
On arm64, ebt_entry_{match,watcher,target} structs are 40 bytes long
while on 32-bit arm these structs have a size of 36 bytes.
COMPAT_XT_ALIGN() macro cannot be used here to determine the necessary
padding for the CONFIG_COMPAT because it imposes an 8-byte boundary
alignment, condition that is not found in 32-bit ebtables application.
Signed-off-by: Alin Nastac <redacted>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/ebtables.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
@@ -1610,16 +1610,16 @@ struct compat_ebt_entry_mwt {compat_uptr_tptr;}u;compat_uint_tmatch_size;-compat_uint_tdata[0];+compat_uint_tdata[0]__attribute__((aligned(__alignof__(structcompat_ebt_replace))));};/* account for possible padding between match_size and ->data */staticintebt_compat_entry_padsize(void){-BUILD_BUG_ON(XT_ALIGN(sizeof(structebt_entry_match))<-COMPAT_XT_ALIGN(sizeof(structcompat_ebt_entry_mwt)));-return(int)XT_ALIGN(sizeof(structebt_entry_match))--COMPAT_XT_ALIGN(sizeof(structcompat_ebt_entry_mwt));+BUILD_BUG_ON(sizeof(structebt_entry_match)<+sizeof(structcompat_ebt_entry_mwt));+return(int)sizeof(structebt_entry_match)-+sizeof(structcompat_ebt_entry_mwt);}staticintebt_compat_match_offset(conststructxt_match*match,
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:48
From: Serhey Popovych <redacted>
Inserting rule before one with SET target we get error with warning in
dmesg(1) output:
# iptables -A FORWARD -t mangle -j SET --map-set test src --map-prio
# iptables -I FORWARD 1 -t mangle -j ACCEPT
iptables: Invalid argument. Run `dmesg' for more information.
# dmesg |tail -n1
[268578.026643] mapping of prio or/and queue is allowed only from \
OUTPUT/FORWARD/POSTROUTING chains
Rather than checking for supported hook bits for SET target check for
unsupported one as done in all rest of matches and targets.
Signed-off-by: Serhey Popovych <redacted>
Signed-off-by: Jozsef Kadlecsik <redacted>
---
net/netfilter/xt_set.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
@@ -470,7 +470,7 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)}if(((info->flags&IPSET_FLAG_MAP_SKBPRIO)|(info->flags&IPSET_FLAG_MAP_SKBQUEUE))&&-!(par->hook_mask&(1<<NF_INET_FORWARD|+(par->hook_mask&~(1<<NF_INET_FORWARD|1<<NF_INET_LOCAL_OUT|1<<NF_INET_POST_ROUTING))){pr_info_ratelimited("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:49
From: Florian Westphal <fw@strlen.de>
the ebtables evaluation loop expects targets to return
positive values (jumps), or negative values (absolute verdicts).
This is completely different from what xtables does.
In xtables, targets are expected to return the standard netfilter
verdicts, i.e. NF_DROP, NF_ACCEPT, etc.
ebtables will consider these as jumps.
Therefore reject any target found due to unspec fallback.
v2: also reject watchers. ebtables ignores their return value, so
a target that assumes skb ownership (and returns NF_STOLEN) causes
use-after-free.
The only watchers in the 'ebtables' front-end are log and nflog;
both have AF_BRIDGE specific wrappers on kernel side.
Reported-by: syzbot+2b43f681169a2a0d306a@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/ebtables.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:49
From: Jozsef Kadlecsik <redacted>
Due to the negative value condition in msecs_to_jiffies(), the real
max possible timeout value must be set to (UINT_MAX >> 1)/MSEC_PER_SEC.
Neutron Soutmun proposed the proper fix, but an insufficient one was
applied, see https://patchwork.ozlabs.org/patch/400405/.
Signed-off-by: Jozsef Kadlecsik <redacted>
---
include/linux/netfilter/ipset/ip_set_timeout.h | 10 ++++++----
net/netfilter/xt_set.c | 8 ++++----
2 files changed, 10 insertions(+), 8 deletions(-)
@@ -23,6 +23,9 @@/* Set is defined with timeout support: timeout value may be 0 */#define IPSET_NO_TIMEOUT UINT_MAX+/* Max timeout value, see msecs_to_jiffies() in jiffies.h */+#define IPSET_MAX_TIMEOUT (UINT_MAX >> 1)/MSEC_PER_SEC+#define ip_set_adt_opt_timeout(opt, set) \((opt)->ext.timeout!=IPSET_NO_TIMEOUT?(opt)->ext.timeout:(set)->timeout)
@@ -32,11 +35,10 @@ ip_set_timeout_uget(struct nlattr *tb)unsignedinttimeout=ip_set_get_h32(tb);/* Normalize to fit into jiffies */-if(timeout>UINT_MAX/MSEC_PER_SEC)-timeout=UINT_MAX/MSEC_PER_SEC;+if(timeout>IPSET_MAX_TIMEOUT)+timeout=IPSET_MAX_TIMEOUT;-/* Userspace supplied TIMEOUT parameter: adjust crazy size */-returntimeout==IPSET_NO_TIMEOUT?IPSET_NO_TIMEOUT-1:timeout;+returntimeout;}staticinlinebool
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:49
From: Julian Anastasov <ja@ssi.bg>
There is mistake in the rt_mode_allow_non_local assignment.
It should be used to check if sending to non-local addresses is
allowed, now it checks if local addresses are allowed.
As local addresses are allowed for most of the cases, the only
places that are affected are for traffic to transparent cache
servers:
- bypass connections when cache server is not available
- related ICMP in FORWARD hook when sent to cache server
Fixes: 4a4739d56b00 ("ipvs: Pull out crosses_local_route_boundary logic")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:50
From: Gao Feng <redacted>
The __IPS_MAX_BIT is used in __ctnetlink_change_status as the max bit
value. When add new bit IPS_OFFLOAD_BIT whose value is 14, we should
increase the __IPS_MAX_BIT too, from 14 to 15.
There is no any bug in current codes, although it lost one loop in
__ctnetlink_change_status. Because the new bit IPS_OFFLOAD_BIT belongs
the IPS_UNCHANGEABLE_MASK.
Signed-off-by: Gao Feng <redacted>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:50
From: Florian Westphal <fw@strlen.de>
syzbot reports following splat:
BUG: KMSAN: uninit-value in ebt_stp_mt_check+0x24b/0x450
net/bridge/netfilter/ebt_stp.c:162
ebt_stp_mt_check+0x24b/0x450 net/bridge/netfilter/ebt_stp.c:162
xt_check_match+0x1438/0x1650 net/netfilter/x_tables.c:506
ebt_check_match net/bridge/netfilter/ebtables.c:372 [inline]
ebt_check_entry net/bridge/netfilter/ebtables.c:702 [inline]
The uninitialised access is
xt_mtchk_param->nft_compat
... which should be set to 0.
Fix it by zeroing the struct beforehand, same for tgchk.
ip(6)tables targetinfo uses c99-style initialiser, so no change
needed there.
Reported-by: syzbot+da4494182233c23a5fcf@syzkaller.appspotmail.com
Fixes: 55917a21d0cc0 ("netfilter: x_tables: add context to know if extension runs from nft_compat")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/ebtables.c | 2 ++
net/ipv4/netfilter/ip_tables.c | 1 +
net/ipv6/netfilter/ip6_tables.c | 1 +
3 files changed, 4 insertions(+)
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:51
From: Corentin Labbe <clabbe@baylibre.com>
include/net/netfilter/nft_dup.h was introduced in d877f07112f1 ("netfilter: nf_tables: add nft_dup expression")
but was never user since this date.
Furthermore, the only struct in this file is unused elsewhere.
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nft_dup.h | 10 ----------
1 file changed, 10 deletions(-)
delete mode 100644 include/net/netfilter/nft_dup.h
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: 2018-06-11 09:22:54
From: Julian Anastasov <ja@ssi.bg>
ip_vs_ftp requires conntrack modules for mangling
of FTP command responses in passive mode.
Make sure the conntrack hooks are registered when
real servers use NAT method in FTP virtual service.
The hooks will be registered while the service is
present.
Fixes: 0c66dc1ea3f0 ("netfilter: conntrack: register hooks in netns when needed by ruleset")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <redacted>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/ip_vs.h | 30 ++++++++++++++++++++++++++++++
net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++
2 files changed, 34 insertions(+)