Commit 0f74d0cd authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'nf-24-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

Patch #1 fixes the suspicious RCU usage warning that resulted from the
	 recent fix for the race between namespace cleanup and gc in
	 ipset left out checking the pernet exit phase when calling
	 rcu_dereference_protected(), from Jozsef Kadlecsik.

Patch #2 fixes incorrect input and output netdevice in SRv6 prerouting
	 hooks, from Jianguo Wu.

Patch #3 moves nf_hooks_lwtunnel sysctl toggle to the netfilter core.
	 The connection tracking system is loaded on-demand, this
	 ensures availability of this knob regardless.

Patch #4-#5 adds selftests for SRv6 netfilter hooks also from Jianguo Wu.

netfilter pull request 24-06-19

* tag 'nf-24-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  selftests: add selftest for the SRv6 End.DX6 behavior with netfilter
  selftests: add selftest for the SRv6 End.DX4 behavior with netfilter
  netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core
  seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
  netfilter: ipset: Fix suspicious rcu_dereference_protected()
====================

Link: https://lore.kernel.org/r/20240619170537.2846-1-pablo@netfilter.org


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents 6cd4a78d 221200ff

include/net/netns/netfilter.h

+3 −0
Original line number Diff line number Diff line
@@ -15,6 +15,9 @@ struct netns_nf { 
	const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO];

#ifdef CONFIG_SYSCTL

	struct ctl_table_header *nf_log_dir_header;

#ifdef CONFIG_LWTUNNEL

	struct ctl_table_header *nf_lwtnl_dir_header;

#endif

#endif

	struct nf_hook_entries __rcu *hooks_ipv4[NF_INET_NUMHOOKS];

	struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS];

net/ipv6/seg6_local.c

+4 −4
Original line number Diff line number Diff line
@@ -941,8 +941,8 @@ static int input_action_end_dx6(struct sk_buff *skb, 


	if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled))

		return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,

			       dev_net(skb->dev), NULL, skb, NULL,

			       skb_dst(skb)->dev, input_action_end_dx6_finish);

			       dev_net(skb->dev), NULL, skb, skb->dev,

			       NULL, input_action_end_dx6_finish);



	return input_action_end_dx6_finish(dev_net(skb->dev), NULL, skb);

drop:
@@ -991,8 +991,8 @@ static int input_action_end_dx4(struct sk_buff *skb, 


	if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled))

		return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,

			       dev_net(skb->dev), NULL, skb, NULL,

			       skb_dst(skb)->dev, input_action_end_dx4_finish);

			       dev_net(skb->dev), NULL, skb, skb->dev,

			       NULL, input_action_end_dx4_finish);



	return input_action_end_dx4_finish(dev_net(skb->dev), NULL, skb);

drop:

net/netfilter/core.c

+11 −2
Original line number Diff line number Diff line
@@ -815,12 +815,21 @@ int __init netfilter_init(void) 
	if (ret < 0)

		goto err;



#ifdef CONFIG_LWTUNNEL

	ret = netfilter_lwtunnel_init();

	if (ret < 0)

		goto err_lwtunnel_pernet;

#endif

	ret = netfilter_log_init();

	if (ret < 0)

		goto err_pernet;

		goto err_log_pernet;



	return 0;

err_pernet:

err_log_pernet:

#ifdef CONFIG_LWTUNNEL

	netfilter_lwtunnel_fini();

err_lwtunnel_pernet:

#endif

	unregister_pernet_subsys(&netfilter_net_ops);

err:

	return ret;

net/netfilter/ipset/ip_set_core.c

+6 −5
Original line number Diff line number Diff line
@@ -53,12 +53,13 @@ MODULE_DESCRIPTION("core IP set support"); 
MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);



/* When the nfnl mutex or ip_set_ref_lock is held: */

#define ip_set_dereference(p)		\

	rcu_dereference_protected(p,	\

#define ip_set_dereference(inst)	\

	rcu_dereference_protected((inst)->ip_set_list,	\

		lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \

		lockdep_is_held(&ip_set_ref_lock))

		lockdep_is_held(&ip_set_ref_lock) || \

		(inst)->is_deleted)

#define ip_set(inst, id)		\

	ip_set_dereference((inst)->ip_set_list)[id]

	ip_set_dereference(inst)[id]

#define ip_set_ref_netlink(inst,id)	\

	rcu_dereference_raw((inst)->ip_set_list)[id]

#define ip_set_dereference_nfnl(p)	\
@@ -1133,7 +1134,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info, 
		if (!list)

			goto cleanup;

		/* nfnl mutex is held, both lists are valid */

		tmp = ip_set_dereference(inst->ip_set_list);

		tmp = ip_set_dereference(inst);

		memcpy(list, tmp, sizeof(struct ip_set *) * inst->ip_set_max);

		rcu_assign_pointer(inst->ip_set_list, list);

		/* Make sure all current packets have passed through */

net/netfilter/nf_conntrack_standalone.c

+0 −15
Original line number Diff line number Diff line
@@ -22,9 +22,6 @@ 
#include <net/netfilter/nf_conntrack_acct.h>

#include <net/netfilter/nf_conntrack_zones.h>

#include <net/netfilter/nf_conntrack_timestamp.h>

#ifdef CONFIG_LWTUNNEL

#include <net/netfilter/nf_hooks_lwtunnel.h>

#endif

#include <linux/rculist_nulls.h>



static bool enable_hooks __read_mostly;
@@ -612,9 +609,6 @@ enum nf_ct_sysctl_index { 
	NF_SYSCTL_CT_PROTO_TIMEOUT_GRE,

	NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM,

#endif

#ifdef CONFIG_LWTUNNEL

	NF_SYSCTL_CT_LWTUNNEL,

#endif



	NF_SYSCTL_CT_LAST_SYSCTL,

};
@@ -946,15 +940,6 @@ static struct ctl_table nf_ct_sysctl_table[] = { 
		.proc_handler   = proc_dointvec_jiffies,

	},

#endif

#ifdef CONFIG_LWTUNNEL

	[NF_SYSCTL_CT_LWTUNNEL] = {

		.procname	= "nf_hooks_lwtunnel",

		.data		= NULL,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= nf_hooks_lwtunnel_sysctl_handler,

	},

#endif

};



static struct ctl_table nf_ct_netfilter_table[] = {