Commit 63e4b9d6 authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'nf-24-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Narrow down target/match revision to u8 in nft_compat.

2) Bail out with unused flags in nft_compat.

3) Restrict layer 4 protocol to u16 in nft_compat.

4) Remove static in pipapo get command that slipped through when
   reducing set memory footprint.

5) Follow up incremental fix for the ipset performance regression,
   this includes the missing gc cancellation, from Jozsef Kadlecsik.

6) Allow to filter by zone 0 in ctnetlink, do not interpret zone 0
   as no filtering, from Felix Huettner.

7) Reject direction for NFT_CT_ID.

8) Use timestamp to check for set element expiration while transaction
   is handled to prevent garbage collection from removing set elements
   that were just added by this transaction. Packet path and netlink
   dump/get path still use current time to check for expiration.

9) Restore NF_REPEAT in nfnetlink_queue, from Florian Westphal.

10) map_index needs to be percpu and per-set, not just percpu.
    At this time its possible for a pipapo set to fill the all-zero part
    with ones and take the 'might have bits set' as 'start-from-zero' area.
    From Florian Westphal. This includes three patches:

    - Change scratchpad area to a structure that provides space for a
      per-set-and-cpu toggle and uses it of the percpu one.

    - Add a new free helper to prepare for the next patch.

    - Remove the scratch_aligned pointer and makes AVX2 implementation
      use the exact same memory addresses for read/store of the matching
      state.

netfilter pull request 24-02-08

* tag 'nf-24-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nft_set_pipapo: remove scratch_aligned pointer
  netfilter: nft_set_pipapo: add helper to release pcpu scratch area
  netfilter: nft_set_pipapo: store index in scratch maps
  netfilter: nft_set_rbtree: skip end interval element from gc
  netfilter: nfnetlink_queue: un-break NF_REPEAT
  netfilter: nf_tables: use timestamp to check for set element timeout
  netfilter: nft_ct: reject direction for ct id
  netfilter: ctnetlink: fix filtering for zone 0
  netfilter: ipset: Missing gc cancellations fixed
  netfilter: nft_set_pipapo: remove static in nft_pipapo_get()
  netfilter: nft_compat: restrict match/target protocol to u16
  netfilter: nft_compat: reject unused compat flag
  netfilter: nft_compat: narrow down revision to unsigned 8-bits
====================

Link: https://lore.kernel.org/r/20240208112834.1433-1-pablo@netfilter.org


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents 2fe8a236 5a8cdf6f

include/net/netfilter/nf_tables.h

+14 −2
Original line number Diff line number Diff line
@@ -808,10 +808,16 @@ static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ex 
	return nft_set_ext(ext, NFT_SET_EXT_EXPRESSIONS);

}



static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)

static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext,

					  u64 tstamp)

{

	return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) &&

	       time_is_before_eq_jiffies64(*nft_set_ext_expiration(ext));

	       time_after_eq64(tstamp, *nft_set_ext_expiration(ext));

}



static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)

{

	return __nft_set_elem_expired(ext, get_jiffies_64());

}



static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set,
@@ -1779,6 +1785,7 @@ struct nftables_pernet { 
	struct list_head	notify_list;

	struct mutex		commit_mutex;

	u64			table_handle;

	u64			tstamp;

	unsigned int		base_seq;

	unsigned int		gc_seq;

	u8			validate_state;
@@ -1791,6 +1798,11 @@ static inline struct nftables_pernet *nft_pernet(const struct net *net) 
	return net_generic(net, nf_tables_net_id);

}



static inline u64 nft_net_tstamp(const struct net *net)

{

	return nft_pernet(net)->tstamp;

}



#define __NFT_REDUCE_READONLY	1UL

#define NFT_REDUCE_READONLY	(void *)__NFT_REDUCE_READONLY

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -285,9 +285,11 @@ enum nft_rule_attributes { 
/**

 * enum nft_rule_compat_flags - nf_tables rule compat flags

 *

 * @NFT_RULE_COMPAT_F_UNUSED: unused

 * @NFT_RULE_COMPAT_F_INV: invert the check result

 */

enum nft_rule_compat_flags {

	NFT_RULE_COMPAT_F_UNUSED = (1 << 0),

	NFT_RULE_COMPAT_F_INV	= (1 << 1),

	NFT_RULE_COMPAT_F_MASK	= NFT_RULE_COMPAT_F_INV,

};

net/netfilter/ipset/ip_set_core.c

+2 −0
Original line number Diff line number Diff line
@@ -1154,6 +1154,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info, 
	return ret;



cleanup:

	set->variant->cancel_gc(set);

	set->variant->destroy(set);

put_out:

	module_put(set->type->me);
@@ -2378,6 +2379,7 @@ ip_set_net_exit(struct net *net) 
		set = ip_set(inst, i);

		if (set) {

			ip_set(inst, i) = NULL;

			set->variant->cancel_gc(set);

			ip_set_destroy_set(set);

		}

	}

net/netfilter/ipset/ip_set_hash_gen.h

+2 −2
Original line number Diff line number Diff line
@@ -432,7 +432,7 @@ mtype_ahash_destroy(struct ip_set *set, struct htable *t, bool ext_destroy) 
	u32 i;



	for (i = 0; i < jhash_size(t->htable_bits); i++) {

		n = __ipset_dereference(hbucket(t, i));

		n = (__force struct hbucket *)hbucket(t, i);

		if (!n)

			continue;

		if (set->extensions & IPSET_EXT_DESTROY && ext_destroy)
@@ -452,7 +452,7 @@ mtype_destroy(struct ip_set *set) 
	struct htype *h = set->data;

	struct list_head *l, *lt;



	mtype_ahash_destroy(set, ipset_dereference_nfnl(h->table), true);

	mtype_ahash_destroy(set, (__force struct htable *)h->table, true);

	list_for_each_safe(l, lt, &h->ad) {

		list_del(l);

		kfree(l);

net/netfilter/nf_conntrack_netlink.c

+8 −4
Original line number Diff line number Diff line
@@ -876,6 +876,7 @@ struct ctnetlink_filter_u32 { 


struct ctnetlink_filter {

	u8 family;

	bool zone_filter;



	u_int32_t orig_flags;

	u_int32_t reply_flags;
@@ -992,9 +993,12 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) 
	if (err)

		goto err_filter;



	if (cda[CTA_ZONE]) {

		err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone);

		if (err < 0)

			goto err_filter;

		filter->zone_filter = true;

	}



	if (!cda[CTA_FILTER])

		return filter;
@@ -1148,7 +1152,7 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data) 
	if (filter->family && nf_ct_l3num(ct) != filter->family)

		goto ignore_entry;



	if (filter->zone.id != NF_CT_DEFAULT_ZONE_ID &&

	if (filter->zone_filter &&

	    !nf_ct_zone_equal_any(ct, &filter->zone))

		goto ignore_entry;