Commit 00a25cca authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'nf-next-25-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next 

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following batch contains Netfilter updates for net-next:

1) Use kvmalloc in xt_hashlimit, from Denis Kirjanov.

2) Tighten nf_conntrack sysctl accepted values for nf_conntrack_max
   and nf_ct_expect_max, from Nicolas Bouchinet.

3) Avoid lookup in nft_fib if socket is available, from Florian Westphal.

4) Initialize struct lsm_context in nfnetlink_queue to avoid
   hypothetical ENOMEM errors, Chenyuan Yang.

5) Use strscpy() instead of _pad when initializing xtables table name,
   kzalloc is already used to initialized the table memory area.
   From Thorsten Blum.

6) Missing socket lookup by conntrack information for IPv6 traffic
   in nft_socket, there is a similar chunk in IPv4, this was never
   added when IPv6 NAT was introduced. From Maxim Mikityanskiy.

7) Fix clang issues with nf_tables CONFIG_MITIGATION_RETPOLINE,
   from WangYuli.

* tag 'nf-next-25-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: nf_tables: Only use nf_skip_indirect_calls() when MITIGATION_RETPOLINE
  netfilter: socket: Lookup orig tuple for IPv6 SNAT
  netfilter: xtables: Use strscpy() instead of strscpy_pad()
  netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error
  netfilter: fib: avoid lookup if socket is available
  netfilter: conntrack: Bound nf_conntrack sysctl writes
  netfilter: xt_hashlimit: replace vmalloc calls with kvmalloc
====================

Link: https://patch.msgid.link/20250323100922.59983-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 5e8df794 e3a4182e

include/net/netfilter/nft_fib.h

+21 −0
Original line number Diff line number Diff line
@@ -18,6 +18,27 @@ nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in) 
	return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK;

}



static inline bool nft_fib_can_skip(const struct nft_pktinfo *pkt)

{

	const struct net_device *indev = nft_in(pkt);

	const struct sock *sk;



	switch (nft_hook(pkt)) {

	case NF_INET_PRE_ROUTING:

	case NF_INET_INGRESS:

	case NF_INET_LOCAL_IN:

		break;

	default:

		return false;

	}



	sk = pkt->skb->sk;

	if (sk && sk_fullsock(sk))

	       return sk->sk_rx_dst_ifindex == indev->ifindex;



	return nft_fib_is_loopback(pkt->skb, indev);

}



int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr, bool reset);

int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,

		 const struct nlattr * const tb[]);

net/ipv4/netfilter/nft_fib_ipv4.c

+5 −6
Original line number Diff line number Diff line
@@ -71,6 +71,11 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	const struct net_device *oif;

	const struct net_device *found;



	if (nft_fib_can_skip(pkt)) {

		nft_fib_store_result(dest, priv, nft_in(pkt));

		return;

	}



	/*

	 * Do not set flowi4_oif, it restricts results (for example, asking

	 * for oif 3 will get RTN_UNICAST result even if the daddr exits
@@ -85,12 +90,6 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	else

		oif = NULL;



	if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&

	    nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {

		nft_fib_store_result(dest, priv, nft_in(pkt));

		return;

	}



	iph = skb_header_pointer(pkt->skb, noff, sizeof(_iph), &_iph);

	if (!iph) {

		regs->verdict.code = NFT_BREAK;

net/ipv6/netfilter/nf_socket_ipv6.c

+23 −0
Original line number Diff line number Diff line
@@ -103,6 +103,10 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, 
	struct sk_buff *data_skb = NULL;

	int doff = 0;

	int thoff = 0, tproto;

#if IS_ENABLED(CONFIG_NF_CONNTRACK)

	enum ip_conntrack_info ctinfo;

	struct nf_conn const *ct;

#endif



	tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);

	if (tproto < 0) {
@@ -136,6 +140,25 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, 
		return NULL;

	}



#if IS_ENABLED(CONFIG_NF_CONNTRACK)

	/* Do the lookup with the original socket address in

	 * case this is a reply packet of an established

	 * SNAT-ted connection.

	 */

	ct = nf_ct_get(skb, &ctinfo);

	if (ct &&

	    ((tproto != IPPROTO_ICMPV6 &&

	      ctinfo == IP_CT_ESTABLISHED_REPLY) ||

	     (tproto == IPPROTO_ICMPV6 &&

	      ctinfo == IP_CT_RELATED_REPLY)) &&

	    (ct->status & IPS_SRC_NAT_DONE)) {

		daddr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in6;

		dport = (tproto == IPPROTO_TCP) ?

			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port :

			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;

	}

#endif



	return nf_socket_get_sock_v6(net, data_skb, doff, tproto, saddr, daddr,

				     sport, dport, indev);

}

net/ipv6/netfilter/nft_fib_ipv6.c

+10 −9
Original line number Diff line number Diff line
@@ -170,6 +170,11 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	struct rt6_info *rt;

	int lookup_flags;



	if (nft_fib_can_skip(pkt)) {

		nft_fib_store_result(dest, priv, nft_in(pkt));

		return;

	}



	if (priv->flags & NFTA_FIB_F_IIF)

		oif = nft_in(pkt);

	else if (priv->flags & NFTA_FIB_F_OIF)
@@ -181,16 +186,12 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, 
		return;

	}



	lookup_flags = nft_fib6_flowi_init(&fl6, priv, pkt, oif, iph);



	if (nft_hook(pkt) == NF_INET_PRE_ROUTING ||

	    nft_hook(pkt) == NF_INET_INGRESS) {

		if (nft_fib_is_loopback(pkt->skb, nft_in(pkt)) ||

		    nft_fib_v6_skip_icmpv6(pkt->skb, pkt->tprot, iph)) {

	if (nft_fib_v6_skip_icmpv6(pkt->skb, pkt->tprot, iph)) {

		nft_fib_store_result(dest, priv, nft_in(pkt));

		return;

	}

	}



	lookup_flags = nft_fib6_flowi_init(&fl6, priv, pkt, oif, iph);



	*dest = 0;

	rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, pkt->skb,

net/netfilter/nf_conntrack_standalone.c

+9 −3
Original line number Diff line number Diff line
@@ -618,7 +618,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { 
		.data		= &nf_conntrack_max,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra2		= SYSCTL_INT_MAX,

	},

	[NF_SYSCTL_CT_COUNT] = {

		.procname	= "nf_conntrack_count",
@@ -654,7 +656,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { 
		.data		= &nf_ct_expect_max,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ONE,

		.extra2		= SYSCTL_INT_MAX,

	},

	[NF_SYSCTL_CT_ACCT] = {

		.procname	= "nf_conntrack_acct",
@@ -947,7 +951,9 @@ static struct ctl_table nf_ct_netfilter_table[] = { 
		.data		= &nf_conntrack_max,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra2		= SYSCTL_INT_MAX,

	},

};