openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 

Pablo Neira Ayuso says:

====================
The following patchset contains three Netfilter fixes and update
for the MAINTAINER file for your net tree, they are:

* Fix crash if nf_log_packet is called from conntrack, in that case
  both interfaces are NULL, from Hans Schillstrom. This bug introduced
  with the logging netns support in the previous merge window.

* Fix compilation of nf_log and nf_queue without CONFIG_PROC_FS,
  from myself. This bug was introduced in the previous merge window
  with the new netns support for the netfilter logging infrastructure.

* Fix possible crash in xt_TCPOPTSTRIP due to missing sanity
  checkings to validate that the TCP header is well-formed, from
  myself. I can find this bug in 2.6.25, probably it's been there
  since the beginning. I'll pass this to -stable.

* Update MAINTAINER file to point to new nf trees at git.kernel.org,
  remove Harald and use M: instead of P: (now obsolete tag) to
  keep Jozsef in the list of people.

Please, consider pulling this. Thanks!
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2013-05-16 14:32:42 -07:00
parent 755ccb9d57 bc6bcb59dd
commit 5c4b274981
12 changed files with 67 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
MAINTAINERS
View File

@ -5509,18 +5509,18 @@ F: Documentation/networking/s2io.txt
F: Documentation/networking/vxge.txt F: Documentation/networking/vxge.txt
F: drivers/net/ethernet/neterion/ F: drivers/net/ethernet/neterion/
NETFILTER/IPTABLES/IPCHAINS NETFILTER/IPTABLES
P: Harald Welte
P: Jozsef Kadlecsik
M: Pablo Neira Ayuso <pablo@netfilter.org> M: Pablo Neira Ayuso <pablo@netfilter.org>
M: Patrick McHardy <kaber@trash.net> M: Patrick McHardy <kaber@trash.net>
M: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
L: netfilter-devel@vger.kernel.org L: netfilter-devel@vger.kernel.org
L: netfilter@vger.kernel.org L: netfilter@vger.kernel.org
L: coreteam@netfilter.org L: coreteam@netfilter.org
W: http://www.netfilter.org/ W: http://www.netfilter.org/
W: http://www.iptables.org/ W: http://www.iptables.org/
T: git git://1984.lsi.us.es/nf Q: http://patchwork.ozlabs.org/project/netfilter-devel/list/
T: git git://1984.lsi.us.es/nf-next T: git git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
T: git git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
S: Supported S: Supported
F: include/linux/netfilter* F: include/linux/netfilter*
F: include/linux/netfilter/ F: include/linux/netfilter/

3
include/net/netfilter/nf_log.h
View File

@ -30,7 +30,8 @@ struct nf_loginfo {
} u; } u;
}; };
typedef void nf_logfn(u_int8_t pf, typedef void nf_logfn(struct net *net,
u_int8_t pf,
unsigned int hooknum, unsigned int hooknum,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,

3
include/net/netfilter/nfnetlink_log.h
View File

@ -2,7 +2,8 @@
#define _KER_NFNETLINK_LOG_H #define _KER_NFNETLINK_LOG_H
void void
nfulnl_log_packet(u_int8_t pf, nfulnl_log_packet(struct net *net,
u_int8_t pf,
unsigned int hooknum, unsigned int hooknum,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,

11
net/bridge/netfilter/ebt_log.c
View File

@ -72,13 +72,12 @@ print_ports(const struct sk_buff *skb, uint8_t protocol, int offset)
} }
static void static void
ebt_log_packet(u_int8_t pf, unsigned int hooknum, ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
const struct sk_buff *skb, const struct net_device *in, const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct nf_loginfo *loginfo, const struct net_device *out, const struct nf_loginfo *loginfo,
const char *prefix) const char *prefix)
{ {
unsigned int bitmask; unsigned int bitmask;
struct net *net = dev_net(in ? in : out);
/* FIXME: Disabled from containers until syslog ns is supported */ /* FIXME: Disabled from containers until syslog ns is supported */
if (!net_eq(net, &init_net)) if (!net_eq(net, &init_net))
@ -191,7 +190,7 @@ ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par)
nf_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb, nf_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb,
par->in, par->out, &li, "%s", info->prefix); par->in, par->out, &li, "%s", info->prefix);
else else
ebt_log_packet(NFPROTO_BRIDGE, par->hooknum, skb, par->in, ebt_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb, par->in,
par->out, &li, info->prefix); par->out, &li, info->prefix);
return EBT_CONTINUE; return EBT_CONTINUE;
} }

18
net/bridge/netfilter/ebt_ulog.c
View File

@ -131,14 +131,16 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
return skb; return skb;
} }
static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb, static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
const struct net_device *in, const struct net_device *out, const struct sk_buff *skb,
const struct ebt_ulog_info *uloginfo, const char *prefix) const struct net_device *in,
const struct net_device *out,
const struct ebt_ulog_info *uloginfo,
const char *prefix)
{ {
ebt_ulog_packet_msg_t *pm; ebt_ulog_packet_msg_t *pm;
size_t size, copy_len; size_t size, copy_len;
struct nlmsghdr *nlh; struct nlmsghdr *nlh;
struct net *net = dev_net(in ? in : out);
struct ebt_ulog_net *ebt = ebt_ulog_pernet(net); struct ebt_ulog_net *ebt = ebt_ulog_pernet(net);
unsigned int group = uloginfo->nlgroup; unsigned int group = uloginfo->nlgroup;
ebt_ulog_buff_t *ub = &ebt->ulog_buffers[group]; ebt_ulog_buff_t *ub = &ebt->ulog_buffers[group];
@ -233,7 +235,7 @@ static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb,
} }
/* this function is registered with the netfilter core */ /* this function is registered with the netfilter core */
static void ebt_log_packet(u_int8_t pf, unsigned int hooknum, static void ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
const struct sk_buff *skb, const struct net_device *in, const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const struct nf_loginfo *li, const struct net_device *out, const struct nf_loginfo *li,
const char *prefix) const char *prefix)
@ -252,13 +254,15 @@ static void ebt_log_packet(u_int8_t pf, unsigned int hooknum,
strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix)); strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
} }
ebt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix); ebt_ulog_packet(net, hooknum, skb, in, out, &loginfo, prefix);
} }
static unsigned int static unsigned int
ebt_ulog_tg(struct sk_buff *skb, const struct xt_action_param *par) ebt_ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
{ {
ebt_ulog_packet(par->hooknum, skb, par->in, par->out, struct net *net = dev_net(par->in ? par->in : par->out);
ebt_ulog_packet(net, par->hooknum, skb, par->in, par->out,
par->targinfo, NULL); par->targinfo, NULL);
return EBT_CONTINUE; return EBT_CONTINUE;
} }

13
net/ipv4/netfilter/ipt_ULOG.c
View File

@ -162,7 +162,8 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
return skb; return skb;
} }
static void ipt_ulog_packet(unsigned int hooknum, static void ipt_ulog_packet(struct net *net,
unsigned int hooknum,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,
const struct net_device *out, const struct net_device *out,
@ -174,7 +175,6 @@ static void ipt_ulog_packet(unsigned int hooknum,
size_t size, copy_len; size_t size, copy_len;
struct nlmsghdr *nlh; struct nlmsghdr *nlh;
struct timeval tv; struct timeval tv;
struct net *net = dev_net(in ? in : out);
struct ulog_net *ulog = ulog_pernet(net); struct ulog_net *ulog = ulog_pernet(net);
/* ffs == find first bit set, necessary because userspace /* ffs == find first bit set, necessary because userspace
@ -291,12 +291,15 @@ static void ipt_ulog_packet(unsigned int hooknum,
static unsigned int static unsigned int
ulog_tg(struct sk_buff *skb, const struct xt_action_param *par) ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
{ {
ipt_ulog_packet(par->hooknum, skb, par->in, par->out, struct net *net = dev_net(par->in ? par->in : par->out);
ipt_ulog_packet(net, par->hooknum, skb, par->in, par->out,
par->targinfo, NULL); par->targinfo, NULL);
return XT_CONTINUE; return XT_CONTINUE;
} }
static void ipt_logfn(u_int8_t pf, static void ipt_logfn(struct net *net,
u_int8_t pf,
unsigned int hooknum, unsigned int hooknum,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,
@ -318,7 +321,7 @@ static void ipt_logfn(u_int8_t pf,
strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix)); strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
} }
ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix); ipt_ulog_packet(net, hooknum, skb, in, out, &loginfo, prefix);
} }
static int ulog_tg_check(const struct xt_tgchk_param *par) static int ulog_tg_check(const struct xt_tgchk_param *par)

7
net/netfilter/nf_log.c
View File

@ -148,7 +148,7 @@ void nf_log_packet(struct net *net,
va_start(args, fmt); va_start(args, fmt);
vsnprintf(prefix, sizeof(prefix), fmt, args); vsnprintf(prefix, sizeof(prefix), fmt, args);
va_end(args); va_end(args);
logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix); logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
} }
rcu_read_unlock(); rcu_read_unlock();
} }
@ -368,17 +368,20 @@ static int __net_init nf_log_net_init(struct net *net)
return 0; return 0;
out_sysctl: out_sysctl:
#ifdef CONFIG_PROC_FS
/* For init_net: errors will trigger panic, don't unroll on error. */ /* For init_net: errors will trigger panic, don't unroll on error. */
if (!net_eq(net, &init_net)) if (!net_eq(net, &init_net))
remove_proc_entry("nf_log", net->nf.proc_netfilter); remove_proc_entry("nf_log", net->nf.proc_netfilter);
#endif
return ret; return ret;
} }
static void __net_exit nf_log_net_exit(struct net *net) static void __net_exit nf_log_net_exit(struct net *net)
{ {
netfilter_log_sysctl_exit(net); netfilter_log_sysctl_exit(net);
#ifdef CONFIG_PROC_FS
remove_proc_entry("nf_log", net->nf.proc_netfilter); remove_proc_entry("nf_log", net->nf.proc_netfilter);
#endif
} }
static struct pernet_operations nf_log_net_ops = { static struct pernet_operations nf_log_net_ops = {

6
net/netfilter/nfnetlink_log.c
View File

@ -602,7 +602,8 @@ static struct nf_loginfo default_loginfo = {
/* log handler for internal netfilter logging api */ /* log handler for internal netfilter logging api */
void void
nfulnl_log_packet(u_int8_t pf, nfulnl_log_packet(struct net *net,
u_int8_t pf,
unsigned int hooknum, unsigned int hooknum,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,
@ -615,7 +616,6 @@ nfulnl_log_packet(u_int8_t pf,
const struct nf_loginfo *li; const struct nf_loginfo *li;
unsigned int qthreshold; unsigned int qthreshold;
unsigned int plen; unsigned int plen;
struct net *net = dev_net(in ? in : out);
struct nfnl_log_net *log = nfnl_log_pernet(net); struct nfnl_log_net *log = nfnl_log_pernet(net);
if (li_user && li_user->type == NF_LOG_TYPE_ULOG) if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
@ -1045,7 +1045,9 @@ static int __net_init nfnl_log_net_init(struct net *net)
static void __net_exit nfnl_log_net_exit(struct net *net) static void __net_exit nfnl_log_net_exit(struct net *net)
{ {
#ifdef CONFIG_PROC_FS
remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter); remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter);
#endif
} }
static struct pernet_operations nfnl_log_net_ops = { static struct pernet_operations nfnl_log_net_ops = {

2
net/netfilter/nfnetlink_queue_core.c
View File

@ -1285,7 +1285,9 @@ static int __net_init nfnl_queue_net_init(struct net *net)
static void __net_exit nfnl_queue_net_exit(struct net *net) static void __net_exit nfnl_queue_net_exit(struct net *net)
{ {
#ifdef CONFIG_PROC_FS
remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter); remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
#endif
} }
static struct pernet_operations nfnl_queue_net_ops = { static struct pernet_operations nfnl_queue_net_ops = {

13
net/netfilter/xt_LOG.c
View File

@ -466,7 +466,8 @@ log_packet_common(struct sbuff *m,
static void static void
ipt_log_packet(u_int8_t pf, ipt_log_packet(struct net *net,
u_int8_t pf,
unsigned int hooknum, unsigned int hooknum,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,
@ -475,7 +476,6 @@ ipt_log_packet(u_int8_t pf,
const char *prefix) const char *prefix)
{ {
struct sbuff *m; struct sbuff *m;
struct net *net = dev_net(in ? in : out);
/* FIXME: Disabled from containers until syslog ns is supported */ /* FIXME: Disabled from containers until syslog ns is supported */
if (!net_eq(net, &init_net)) if (!net_eq(net, &init_net))
@ -797,7 +797,8 @@ static void dump_ipv6_mac_header(struct sbuff *m,
} }
static void static void
ip6t_log_packet(u_int8_t pf, ip6t_log_packet(struct net *net,
u_int8_t pf,
unsigned int hooknum, unsigned int hooknum,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,
@ -806,7 +807,6 @@ ip6t_log_packet(u_int8_t pf,
const char *prefix) const char *prefix)
{ {
struct sbuff *m; struct sbuff *m;
struct net *net = dev_net(in ? in : out);
/* FIXME: Disabled from containers until syslog ns is supported */ /* FIXME: Disabled from containers until syslog ns is supported */
if (!net_eq(net, &init_net)) if (!net_eq(net, &init_net))
@ -833,17 +833,18 @@ log_tg(struct sk_buff *skb, const struct xt_action_param *par)
{ {
const struct xt_log_info *loginfo = par->targinfo; const struct xt_log_info *loginfo = par->targinfo;
struct nf_loginfo li; struct nf_loginfo li;
struct net *net = dev_net(par->in ? par->in : par->out);
li.type = NF_LOG_TYPE_LOG; li.type = NF_LOG_TYPE_LOG;
li.u.log.level = loginfo->level; li.u.log.level = loginfo->level;
li.u.log.logflags = loginfo->logflags; li.u.log.logflags = loginfo->logflags;
if (par->family == NFPROTO_IPV4) if (par->family == NFPROTO_IPV4)
ipt_log_packet(NFPROTO_IPV4, par->hooknum, skb, par->in, ipt_log_packet(net, NFPROTO_IPV4, par->hooknum, skb, par->in,
par->out, &li, loginfo->prefix); par->out, &li, loginfo->prefix);
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
else if (par->family == NFPROTO_IPV6) else if (par->family == NFPROTO_IPV6)
ip6t_log_packet(NFPROTO_IPV6, par->hooknum, skb, par->in, ip6t_log_packet(net, NFPROTO_IPV6, par->hooknum, skb, par->in,
par->out, &li, loginfo->prefix); par->out, &li, loginfo->prefix);
#endif #endif
else else

3
net/netfilter/xt_NFLOG.c
View File

@ -26,13 +26,14 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
{ {
const struct xt_nflog_info *info = par->targinfo; const struct xt_nflog_info *info = par->targinfo;
struct nf_loginfo li; struct nf_loginfo li;
struct net *net = dev_net(par->in ? par->in : par->out);
li.type = NF_LOG_TYPE_ULOG; li.type = NF_LOG_TYPE_ULOG;
li.u.ulog.copy_len = info->len; li.u.ulog.copy_len = info->len;
li.u.ulog.group = info->group; li.u.ulog.group = info->group;
li.u.ulog.qthreshold = info->threshold; li.u.ulog.qthreshold = info->threshold;
nfulnl_log_packet(par->family, par->hooknum, skb, par->in, nfulnl_log_packet(net, par->family, par->hooknum, skb, par->in,
par->out, &li, info->prefix); par->out, &li, info->prefix);
return XT_CONTINUE; return XT_CONTINUE;
} }

17
net/netfilter/xt_TCPOPTSTRIP.c
View File

@ -30,17 +30,28 @@ static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
static unsigned int static unsigned int
tcpoptstrip_mangle_packet(struct sk_buff *skb, tcpoptstrip_mangle_packet(struct sk_buff *skb,
const struct xt_tcpoptstrip_target_info *info, const struct xt_action_param *par,
unsigned int tcphoff, unsigned int minlen) unsigned int tcphoff, unsigned int minlen)
{ {
const struct xt_tcpoptstrip_target_info *info = par->targinfo;
unsigned int optl, i, j; unsigned int optl, i, j;
struct tcphdr *tcph; struct tcphdr *tcph;
u_int16_t n, o; u_int16_t n, o;
u_int8_t *opt; u_int8_t *opt;
int len;
/* This is a fragment, no TCP header is available */
if (par->fragoff != 0)
return XT_CONTINUE;
if (!skb_make_writable(skb, skb->len)) if (!skb_make_writable(skb, skb->len))
return NF_DROP; return NF_DROP;
len = skb->len - tcphoff;
if (len < (int)sizeof(struct tcphdr) ||
tcp_hdr(skb)->doff * 4 > len)
return NF_DROP;
tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
opt = (u_int8_t *)tcph; opt = (u_int8_t *)tcph;
@ -76,7 +87,7 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
static unsigned int static unsigned int
tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par) tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
{ {
return tcpoptstrip_mangle_packet(skb, par->targinfo, ip_hdrlen(skb), return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb),
sizeof(struct iphdr) + sizeof(struct tcphdr)); sizeof(struct iphdr) + sizeof(struct tcphdr));
} }
@ -94,7 +105,7 @@ tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
if (tcphoff < 0) if (tcphoff < 0)
return NF_DROP; return NF_DROP;
return tcpoptstrip_mangle_packet(skb, par->targinfo, tcphoff, return tcpoptstrip_mangle_packet(skb, par, tcphoff,
sizeof(*ipv6h) + sizeof(struct tcphdr)); sizeof(*ipv6h) + sizeof(struct tcphdr));
} }
#endif #endif