: Netfilter fixes

PATCH In review Patrick McHardy 2 participants 12 messages Mar 4, 2007 – Mar 5, 2007

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Patrick McHardy

author

2007-03-04 20:19 UTC #0 lore raw

cover : Netfilter fixes

Hi Dave,

following are a number of netfilter fixes for 2.6.21, fixing an endless loop during module unload with conntrack events enabled, multiple problems with nfnetlink_log, incorrect ctnetlink config ifdefs in nf_conntrack and nf_nat and missing mark initialization in ip6_route_me_harder. Most of them should also go in -stable, I'll send backports soon.

Please apply, thanks.

 include/linux/netfilter_ipv4/ip_conntrack_core.h |    2 -
 include/net/netfilter/nf_conntrack_core.h        |    2 -
 net/ipv4/netfilter/ip_conntrack_core.c           |    2 -
 net/ipv4/netfilter/ip_conntrack_proto_tcp.c      |    4 ++-
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c   |    6 +----
 net/ipv4/netfilter/nf_conntrack_proto_icmp.c     |    6 +----
 net/ipv4/netfilter/nf_nat_core.c                 |    3 --
 net/ipv4/netfilter/nf_nat_proto_gre.c            |    3 --
 net/ipv4/netfilter/nf_nat_proto_icmp.c           |    3 --
 net/ipv4/netfilter/nf_nat_proto_tcp.c            |    3 --
 net/ipv4/netfilter/nf_nat_proto_udp.c            |    3 --
 net/ipv6/netfilter.c                             |    1 
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c   |    6 +----
 net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c   |    6 +----
 net/netfilter/nf_conntrack_core.c                |    5 +---
 net/netfilter/nf_conntrack_proto_gre.c           |    3 --
 net/netfilter/nf_conntrack_proto_tcp.c           |   13 +++++------
 net/netfilter/nf_conntrack_proto_udp.c           |    6 +----
 net/netfilter/nfnetlink_log.c                    |   26 +++++++++++++++--------
 19 files changed, 48 insertions(+), 55 deletions(-)

Michal Miroslaw:
[NETFILTER]: nfnetlink_log: fix reference leak [NETFILTER]: nfnetlink_log: fix use after free [NETFILTER]: nfnetlink_log: fix NULL pointer dereference [NETFILTER]: nfnetlink_log: fix possible NULL pointer dereference [NETFILTER]: nfnetlink_log: fix reference counting

Patrick McHardy:
[NETFILTER]: conntrack: fix {nf,ip}_ct_iterate_cleanup endless loops [NETFILTER]: nf_conntrack/nf_nat: fix incorrect config ifdefs [NETFILTER]: tcp conntrack: accept SYN|URG as valid [NETFILTER]: nfnetlink_log: fix module reference counting

Yasuyuki Kozakai:
[NETFILTER]: ip6_route_me_harder should take into account mark

Patrick McHardy

author

2007-03-04 20:19 UTC #1 lore raw

PATCH 1/10 : conntrack: fix {nf, ip}_ct_iterate_cleanup endless loops

[NETFILTER]: conntrack: fix {nf,ip}_ct_iterate_cleanup endless loops

Fix {nf,ip}_ct_iterate_cleanup unconfirmed list handling:

- unconfirmed entries can not be killed manually, they are removed on confirmation or final destruction of the conntrack entry, which means we might iterate forever without making forward progress.

This can happen in combination with the conntrack event cache, which holds a reference to the conntrack entry, which is only released when the packet makes it all the way through the stack or a different packet is handled.

- taking references to an unconfirmed entry and using it outside the locked section doesn't work, the list entries are not refcounted and another CPU might already be waiting to destroy the entry

What the code really wants to do is make sure the references of the hash table to the selected conntrack entries are released, so they will be destroyed once all references from skbs and the event cache are dropped.

Since unconfirmed entries haven't even entered the hash yet, simply mark them as dying and skip confirmation based on that.

Reported and tested by Chuck Ebbert <[email protected]>

Signed-off-by Patrick McHardy <[email protected]>

---
commit 3b0f1308568d67be761a89c95354cce8617e6715
tree ab83a08e8daa26e2bb1051314e36da6a76cb0219
parent 2ff7354fe888f46f6629b57e463b0a1eb956c02b
author Patrick McHardy <[email protected]> Thu, 01 Mar 2007 15:15:49 +0100 committer Patrick McHardy <[email protected]> Thu, 01 Mar 2007 15:15:49 +0100

 include/linux/netfilter_ipv4/ip_conntrack_core.h |    2 +-
 include/net/netfilter/nf_conntrack_core.h        |    2 +-
 net/ipv4/netfilter/ip_conntrack_core.c           |    2 +-
 net/netfilter/nf_conntrack_core.c                |    2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

include/linux/netfilter_ipv4/ip_conntrack_core.h +1 -1

index 907d4f5..e3a6df0 100644
@@ -45,7 +45,7 @@ static inline int ip_conntrack_confirm(s
 	int ret = NF_ACCEPT;
 
 	if (ct) {
-		if (!is_confirmed(ct))
+		if (!is_confirmed(ct) && !is_dying(ct))
 			ret = __ip_conntrack_confirm(pskb);
 		ip_ct_deliver_cached_events(ct);
 	}

include/net/netfilter/nf_conntrack_core.h +1 -1

index 7fdc72c..85634e1 100644
@@ -64,7 +64,7 @@ static inline int nf_conntrack_confirm(s
 	int ret = NF_ACCEPT;
 
 	if (ct) {
-		if (!nf_ct_is_confirmed(ct))
+		if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
 			ret = __nf_conntrack_confirm(pskb);
 		nf_ct_deliver_cached_events(ct);
 	}

net/ipv4/netfilter/ip_conntrack_core.c +1 -1

index 07ba1dd..23b99ae 100644
@@ -1254,7 +1254,7 @@ get_next_corpse(int (*iter)(struct ip_co
 	list_for_each_entry(h, &unconfirmed, list) {
 		ct = tuplehash_to_ctrack(h);
 		if (iter(ct, data))
-			goto found;
+			set_bit(IPS_DYING_BIT, &ct->status);
 	}
 	write_unlock_bh(&ip_conntrack_lock);
 	return NULL;

net/netfilter/nf_conntrack_core.c +1 -1

index 32891eb..4fdf484 100644
@@ -1070,7 +1070,7 @@ get_next_corpse(int (*iter)(struct nf_co
 	list_for_each_entry(h, &unconfirmed, list) {
 		ct = nf_ct_tuplehash_to_ctrack(h);
 		if (iter(ct, data))
-			goto found;
+			set_bit(IPS_DYING_BIT, &ct->status);
 	}
 	write_unlock_bh(&nf_conntrack_lock);
 	return NULL;

Patrick McHardy

author

2007-03-04 20:20 UTC #2 lore raw

PATCH 2/10 : nf_conntrack/nf_nat: fix incorrect config ifdefs

In reply to Patrick McHardy

[NETFILTER]: nf_conntrack/nf_nat: fix incorrect config ifdefs

The nf_conntrack_netlink config option is named CONFIG_NF_CT_NETLINK, but multiple files use CONFIG_IP_NF_CONNTRACK_NETLINK or CONFIG_NF_CONNTRACK_NETLINK for ifdefs.

Fix this and reformat all CONFIG_NF_CT_NETLINK ifdefs to only use a line.

Signed-off-by Patrick McHardy <[email protected]>

---
commit e6ebc414bb13540bba508e404af7aa6b3e65e6f3
tree fc0e57dd55029b62245132beb180f081e4c84990
parent 3b0f1308568d67be761a89c95354cce8617e6715
author Patrick McHardy <[email protected]> Thu, 01 Mar 2007 15:21:03 +0100 committer Patrick McHardy <[email protected]> Thu, 01 Mar 2007 15:21:03 +0100

 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |    6 ++----
 net/ipv4/netfilter/nf_conntrack_proto_icmp.c   |    6 ++----
 net/ipv4/netfilter/nf_nat_core.c               |    3 +--
 net/ipv4/netfilter/nf_nat_proto_gre.c          |    3 +--
 net/ipv4/netfilter/nf_nat_proto_icmp.c         |    3 +--
 net/ipv4/netfilter/nf_nat_proto_tcp.c          |    3 +--
 net/ipv4/netfilter/nf_nat_proto_udp.c          |    3 +--
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |    6 ++----
 net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c |    6 ++----
 net/netfilter/nf_conntrack_core.c              |    3 +--
 net/netfilter/nf_conntrack_proto_gre.c         |    3 +--
 net/netfilter/nf_conntrack_proto_tcp.c         |    9 +++------
 net/netfilter/nf_conntrack_proto_udp.c         |    6 ++----
 13 files changed, 20 insertions(+), 40 deletions(-)

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +2 -4

index b984db7..8f3e92d 100644
@@ -379,8 +379,7 @@ getorigdst(struct sock *sk, int optval, 
 	return -ENOENT;
 }
 
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>

@@ -435,8 +434,7 @@ struct nf_conntrack_l3proto nf_conntrack
 	.print_conntrack = ipv4_print_conntrack,
 	.prepare	 = ipv4_prepare,
 	.get_features	 = ipv4_get_features,
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.tuple_to_nfattr = ipv4_tuple_to_nfattr,
 	.nfattr_to_tuple = ipv4_nfattr_to_tuple,
 #endif

net/ipv4/netfilter/nf_conntrack_proto_icmp.c +2 -4

index 88cfa6a..5fd1e53 100644
@@ -268,8 +268,7 @@ icmp_error(struct sk_buff *skb, unsigned
 	return icmp_error_message(skb, ctinfo, hooknum);
 }
 
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>

@@ -368,8 +367,7 @@ struct nf_conntrack_l4proto nf_conntrack
 	.error			= icmp_error,
 	.destroy		= NULL,
 	.me			= NULL,
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.tuple_to_nfattr	= icmp_tuple_to_nfattr,
 	.nfattr_to_tuple	= icmp_nfattr_to_tuple,
 #endif

net/ipv4/netfilter/nf_nat_core.c +1 -2

index 2c01378..452e9d3 100644
@@ -546,8 +546,7 @@ void nf_nat_protocol_unregister(struct n
 }
 EXPORT_SYMBOL(nf_nat_protocol_unregister);
 
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 int
 nf_nat_port_range_to_nfattr(struct sk_buff *skb,
 			    const struct nf_nat_range *range)

net/ipv4/netfilter/nf_nat_proto_gre.c +1 -2

index d3de579..e5a34c1 100644
@@ -152,8 +152,7 @@ static struct nf_nat_protocol gre __read
 	.manip_pkt		= gre_manip_pkt,
 	.in_range		= gre_in_range,
 	.unique_tuple		= gre_unique_tuple,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.range_to_nfattr	= nf_nat_port_range_to_nfattr,
 	.nfattr_to_range	= nf_nat_port_nfattr_to_range,
 #endif

net/ipv4/netfilter/nf_nat_proto_icmp.c +1 -2

index 6bc2f06..f71ef9b 100644
@@ -78,8 +78,7 @@ struct nf_nat_protocol nf_nat_protocol_i
 	.manip_pkt		= icmp_manip_pkt,
 	.in_range		= icmp_in_range,
 	.unique_tuple		= icmp_unique_tuple,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.range_to_nfattr	= nf_nat_port_range_to_nfattr,
 	.nfattr_to_range	= nf_nat_port_nfattr_to_range,
 #endif

net/ipv4/netfilter/nf_nat_proto_tcp.c +1 -2

index 439164c..123c959 100644
@@ -144,8 +144,7 @@ struct nf_nat_protocol nf_nat_protocol_t
 	.manip_pkt		= tcp_manip_pkt,
 	.in_range		= tcp_in_range,
 	.unique_tuple		= tcp_unique_tuple,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.range_to_nfattr	= nf_nat_port_range_to_nfattr,
 	.nfattr_to_range	= nf_nat_port_nfattr_to_range,
 #endif

net/ipv4/netfilter/nf_nat_proto_udp.c +1 -2

index 8cae6e0..1c4c70e 100644
@@ -134,8 +134,7 @@ struct nf_nat_protocol nf_nat_protocol_u
 	.manip_pkt		= udp_manip_pkt,
 	.in_range		= udp_in_range,
 	.unique_tuple		= udp_unique_tuple,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.range_to_nfattr	= nf_nat_port_range_to_nfattr,
 	.nfattr_to_range	= nf_nat_port_nfattr_to_range,
 #endif

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +2 -4

index 4b7be4b..6f19c4a 100644
@@ -353,8 +353,7 @@ static ctl_table nf_ct_ipv6_sysctl_table
 };
 #endif
 
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>

@@ -403,8 +402,7 @@ struct nf_conntrack_l3proto nf_conntrack
 	.print_tuple		= ipv6_print_tuple,
 	.print_conntrack	= ipv6_print_conntrack,
 	.prepare		= ipv6_prepare,
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.tuple_to_nfattr	= ipv6_tuple_to_nfattr,
 	.nfattr_to_tuple	= ipv6_nfattr_to_tuple,
 #endif

net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +2 -4

index 21f19cc..075da4f 100644
@@ -244,8 +244,7 @@ icmpv6_error(struct sk_buff *skb, unsign
 	return icmpv6_error_message(skb, dataoff, ctinfo, hooknum);
 }
 
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>

@@ -327,8 +326,7 @@ struct nf_conntrack_l4proto nf_conntrack
 	.packet			= icmpv6_packet,
 	.new			= icmpv6_new,
 	.error			= icmpv6_error,
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.tuple_to_nfattr	= icmpv6_tuple_to_nfattr,
 	.nfattr_to_tuple	= icmpv6_nfattr_to_tuple,
 #endif

net/netfilter/nf_conntrack_core.c +1 -2

index 4fdf484..b3a70eb 100644
@@ -976,8 +976,7 @@ #endif
 }
 EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
 
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>

net/netfilter/nf_conntrack_proto_gre.c +1 -2

index ac193ce..5434472 100644
@@ -281,8 +281,7 @@ static struct nf_conntrack_l4proto nf_co
 	.new		 = gre_new,
 	.destroy	 = gre_destroy,
 	.me 		 = THIS_MODULE,
-#if defined(CONFIG_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_NF_CONNTRACK_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.tuple_to_nfattr = nf_ct_port_tuple_to_nfattr,
 	.nfattr_to_tuple = nf_ct_port_nfattr_to_tuple,
 #endif

net/netfilter/nf_conntrack_proto_tcp.c +3 -6

index 069b85c..3b9ad7f 100644
@@ -1099,8 +1099,7 @@ #endif
 	return 1;
 }
 
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>

@@ -1378,8 +1377,7 @@ struct nf_conntrack_l4proto nf_conntrack
 	.packet 		= tcp_packet,
 	.new 			= tcp_new,
 	.error			= tcp_error,
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.to_nfattr		= tcp_to_nfattr,
 	.from_nfattr		= nfattr_to_tcp,
 	.tuple_to_nfattr	= nf_ct_port_tuple_to_nfattr,

@@ -1408,8 +1406,7 @@ struct nf_conntrack_l4proto nf_conntrack
 	.packet 		= tcp_packet,
 	.new 			= tcp_new,
 	.error			= tcp_error,
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.to_nfattr		= tcp_to_nfattr,
 	.from_nfattr		= nfattr_to_tcp,
 	.tuple_to_nfattr	= nf_ct_port_tuple_to_nfattr,

net/netfilter/nf_conntrack_proto_udp.c +2 -4

index d0a1cee..a5e5726 100644
@@ -208,8 +208,7 @@ struct nf_conntrack_l4proto nf_conntrack
 	.packet			= udp_packet,
 	.new			= udp_new,
 	.error			= udp_error,
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.tuple_to_nfattr	= nf_ct_port_tuple_to_nfattr,
 	.nfattr_to_tuple	= nf_ct_port_nfattr_to_tuple,
 #endif

@@ -236,8 +235,7 @@ struct nf_conntrack_l4proto nf_conntrack
 	.packet			= udp_packet,
 	.new			= udp_new,
 	.error			= udp_error,
-#if defined(CONFIG_NF_CT_NETLINK) || \
-    defined(CONFIG_NF_CT_NETLINK_MODULE)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.tuple_to_nfattr	= nf_ct_port_tuple_to_nfattr,
 	.nfattr_to_tuple	= nf_ct_port_nfattr_to_tuple,
 #endif

Patrick McHardy

author

2007-03-04 20:20 UTC #3 lore raw

PATCH 3/10 : tcp conntrack: accept SYN|URG as valid

In reply to Patrick McHardy

[NETFILTER]: tcp conntrack: accept SYN|URG as valid

Some stacks apparently send packets with SYN|URG set. Linux accepts these packets, so TCP conntrack should to.

Pointed out by Martijn Posthuma <[email protected]>.

Signed-off-by Patrick McHardy <[email protected]>

---
commit efe99d89bb32f8ea7f76fdf9867d0df52e8ca0aa
tree 2fdf2aa01da7595f763432b3b03822a020239592
parent e6ebc414bb13540bba508e404af7aa6b3e65e6f3
author Patrick McHardy <[email protected]> Thu, 01 Mar 2007 15:21:44 +0100 committer Patrick McHardy <[email protected]> Thu, 01 Mar 2007 15:21:44 +0100

 net/ipv4/netfilter/ip_conntrack_proto_tcp.c |    4 +++-
 net/netfilter/nf_conntrack_proto_tcp.c      |    4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

net/ipv4/netfilter/ip_conntrack_proto_tcp.c +3 -1

index 170d625..0a72eab 100644
@@ -812,8 +812,10 @@ #define	TH_CWR	0x80
 static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
 {
 	[TH_SYN]			= 1,
-	[TH_SYN|TH_ACK]			= 1,
 	[TH_SYN|TH_PUSH]		= 1,
+	[TH_SYN|TH_URG]			= 1,
+	[TH_SYN|TH_PUSH|TH_URG]		= 1,
+	[TH_SYN|TH_ACK]			= 1,
 	[TH_SYN|TH_ACK|TH_PUSH]		= 1,
 	[TH_RST]			= 1,
 	[TH_RST|TH_ACK]			= 1,

net/netfilter/nf_conntrack_proto_tcp.c +3 -1

index 3b9ad7f..153d661 100644
@@ -769,8 +769,10 @@ #define	TH_CWR	0x80
 static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
 {
 	[TH_SYN]			= 1,
-	[TH_SYN|TH_ACK]			= 1,
 	[TH_SYN|TH_PUSH]		= 1,
+	[TH_SYN|TH_URG]			= 1,
+	[TH_SYN|TH_PUSH|TH_URG]		= 1,
+	[TH_SYN|TH_ACK]			= 1,
 	[TH_SYN|TH_ACK|TH_PUSH]		= 1,
 	[TH_RST]			= 1,
 	[TH_RST|TH_ACK]			= 1,

Patrick McHardy

author

2007-03-04 20:20 UTC #4 lore raw

PATCH 4/10 : nfnetlink_log: fix reference leak

In reply to Patrick McHardy

[NETFILTER]: nfnetlink_log: fix reference leak

Stop reference leaking in nfulnl_log_packet(). If we start a timer we are already taking another reference.

Signed-off-by Michal Miroslaw <[email protected]>

Signed-off-by Patrick McHardy <[email protected]>

---
commit d8b913269b678945a6af2e5432b6c2aa8a6ff3ef
tree 626a8ad2f8a035b327fe7f1c779a3146283eb72b
parent efe99d89bb32f8ea7f76fdf9867d0df52e8ca0aa
author Michal Miroslaw <[email protected]> Thu, 01 Mar 2007 16:18:44 +0100 committer Patrick McHardy <[email protected]> Thu, 01 Mar 2007 16:18:44 +0100

 net/netfilter/nfnetlink_log.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

net/netfilter/nfnetlink_log.c +4 -3

index b8eab0d..62c3f31 100644
@@ -711,15 +711,16 @@ #endif
 		inst->timer.expires = jiffies + (inst->flushtimeout*HZ/100);
 		add_timer(&inst->timer);
 	}
-	spin_unlock_bh(&inst->lock);
 
+unlock_and_release:
+	spin_unlock_bh(&inst->lock);
+	instance_put(inst);
 	return;
 
 alloc_failure:
-	spin_unlock_bh(&inst->lock);
-	instance_put(inst);
 	UDEBUG("error allocating skb\n");
 	/* FIXME: statistics */
+	goto unlock_and_release;
 }
 
 static int

Patrick McHardy

author

2007-03-04 20:20 UTC #5 lore raw

PATCH 5/10 : nfnetlink_log: fix use after free

In reply to Patrick McHardy

[NETFILTER]: nfnetlink_log: fix use after free

Paranoia: instance_put() might have freed the inst pointer when we spin_unlock_bh().

Signed-off-by Michal Miroslaw <[email protected]>

Signed-off-by Patrick McHardy <[email protected]>

---
commit aa1cfb5305723e815830307a398c17134a19d4d2
tree 63649ce0eb88954ba6f8a8cb0b06a2a1b265c9d3
parent d8b913269b678945a6af2e5432b6c2aa8a6ff3ef
author Michal Miroslaw <[email protected]> Thu, 01 Mar 2007 16:20:49 +0100 committer Patrick McHardy <[email protected]> Thu, 01 Mar 2007 16:20:49 +0100

 net/netfilter/nfnetlink_log.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

net/netfilter/nfnetlink_log.c +1 -1

index 62c3f31..27b844a 100644
@@ -393,8 +393,8 @@ static void nfulnl_timer(unsigned long d
 
 	spin_lock_bh(&inst->lock);
 	__nfulnl_send(inst);
-	instance_put(inst);
 	spin_unlock_bh(&inst->lock);
+	instance_put(inst);
 }
 
 /* This is an inline function, we don't really care about a long

Patrick McHardy

author

2007-03-04 20:20 UTC #6 lore raw

PATCH 6/10 : nfnetlink_log: fix NULL pointer dereference

In reply to Patrick McHardy

[NETFILTER]: nfnetlink_log: fix NULL pointer dereference

Fix the nasty NULL dereference on multiple packets per netlink message.

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000004
 printing eip:
f8a4b3bf
*pde = 00000000
Oops: 0002 [#1]
SMP 
Modules linked in: nfnetlink_log ipt_ttl ipt_REDIRECT xt_tcpudp iptable_nat nf_nat nf_conntrack_ipv4 xt_state ipt_ipp2p xt_NFLOG xt_hashlimit ip6_tables iptable_filter xt_multiport xt_mark ipt_set iptable_raw xt_MARK iptable_mangle ip_tables cls_fw cls_u32 sch_esfq sch_htb ip_set_ipmap ip_set ipt_ULOG x_tables dm_snapshot dm_mirror loop e1000 parport_pc parport e100 floppy ide_cd cdrom
CPU:    0
EIP:    0060:[<f8a4b3bf>]    Not tainted VLI
EFLAGS: 00010206   (2.6.20 #5)

EIP is at __nfulnl_send+0x24/0x51 [nfnetlink_log]
eax: 00000000 ebx: f2b5cbc0 ecx: c03f5f54 edx: c03f4000
esi: f2b5cbc8 edi: c03f5f54 ebp: f8a4b3ec esp: c03f5f30
ds: 007b es: 007b ss: 0068
Process swapper (pid: 0, ti=c03f4000 task=c03bece0 task.ti=c03f4000)

Stack: f2b5cbc0 f8a4b401 00000100 c0444080 c012af49 00000000 f6f19100 f6f19000 
       c1707800 c03f5f54 c03f5f54 00000123 00000021 c03e8d08 c0426380 00000009 
       c0126932 00000000 00000046 c03e9980 c03e6000 0047b007 c01269bd 00000000 
Call Trace:
 [<f8a4b401>] nfulnl_timer+0x15/0x25 [nfnetlink_log]
 [<c012af49>] run_timer_softirq+0x10a/0x164
 [<c0126932>] __do_softirq+0x60/0xba
 [<c01269bd>] do_softirq+0x31/0x35
 [<c0104f6e>] do_IRQ+0x62/0x74
 [<c01036cb>] common_interrupt+0x23/0x28
 [<c0101018>] default_idle+0x0/0x3f
 [<c0101045>] default_idle+0x2d/0x3f
 [<c01010fa>] cpu_idle+0xa0/0xb9
 [<c03fb7f5>] start_kernel+0x1a8/0x1ac
 [<c03fb293>] unknown_bootoption+0x0/0x181
 =======================
Code: 5e 5f 5b 5e 5f 5d c3 53 89 c3 8d 40 1c 83 7b 1c 00 74 05 e8 2c ee 6d c7 83 7b 14 00 75 04 31 c0 eb 34 83 7b 10 01 76 09 8b 43 18 <66> c7 40 04 03 00 8b 53 34 8b 43 14 b9 40 00 00 00 e8 08 9a 84 
EIP: [<f8a4b3bf>] __nfulnl_send+0x24/0x51 [nfnetlink_log] SS:ESP 0068:c03f5f30
 <0>Kernel panic - not syncing: Fatal exception in interrupt
 <0>Rebooting in 5 seconds..

Panic no more!

Signed-off-by Micha Mirosaw <[email protected]>

Signed-off-by Patrick McHardy <[email protected]>

---
commit eff0bb8715bfc8b8c2cbd58504433d3fd48b36c8
tree 9290bdb2b0c490336cd3665de3f7962b7403b95a
parent aa1cfb5305723e815830307a398c17134a19d4d2
author Michal Miroslaw <[email protected]> Thu, 01 Mar 2007 16:21:54 +0100 committer Patrick McHardy <[email protected]> Thu, 01 Mar 2007 16:21:54 +0100

 net/netfilter/nfnetlink_log.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

net/netfilter/nfnetlink_log.c +1 -0

index 27b844a..1b94051 100644
@@ -560,6 +560,7 @@ #endif
 	}
 
 	nlh->nlmsg_len = inst->skb->tail - old_tail;
+	inst->lastnlh = nlh;
 	return 0;
 
 nlmsg_failure:

Patrick McHardy

author

2007-03-04 20:20 UTC #7 lore raw

PATCH 7/10 : nfnetlink_log: fix possible NULL pointer dereference

In reply to Patrick McHardy

[NETFILTER]: nfnetlink_log: fix possible NULL pointer dereference

Eliminate possible NULL pointer dereference in nfulnl_recv_config().

Signed-off-by Michal Miroslaw <[email protected]>

Signed-off-by Patrick McHardy <[email protected]>

---
commit 79fb63ea8565212c9e8fde1e18a5598b438ced08
tree 5e0e1dd8d4b2bc6af902fbd508c05bde37df98a4
parent eff0bb8715bfc8b8c2cbd58504433d3fd48b36c8
author Michal Miroslaw <[email protected]> Fri, 02 Mar 2007 13:11:38 +0100 committer Patrick McHardy <[email protected]> Fri, 02 Mar 2007 13:11:38 +0100

 net/netfilter/nfnetlink_log.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

net/netfilter/nfnetlink_log.c +4 -0

index 1b94051..b669db5 100644
@@ -858,6 +858,9 @@ nfulnl_recv_config(struct sock *ctnl, st
 			ret = -EINVAL;
 			break;
 		}
+
+		if (!inst)
+			goto out;
 	} else {
 		if (!inst) {
 			UDEBUG("no config command, and no instance for "

@@ -911,6 +914,7 @@ nfulnl_recv_config(struct sock *ctnl, st
 
 out_put:
 	instance_put(inst);
+out:
 	return ret;
 }

Patrick McHardy

author

2007-03-04 20:20 UTC #8 lore raw

PATCH 8/10 : nfnetlink_log: fix module reference counting

In reply to Patrick McHardy

[NETFILTER]: nfnetlink_log: fix module reference counting

Count module references correctly: after instance_destroy() there might be timer pending and holding a reference for this netlink instance.

Based on patch by Michal Miroslaw <[email protected]>

Signed-off-by Patrick McHardy <[email protected]>

---
commit 3aed666579e96dfe23eb1988faf4af09c33358bc
tree ebfeba440d7599dea20c6a35a4a6d840dfe06ff3
parent 79fb63ea8565212c9e8fde1e18a5598b438ced08
author Patrick McHardy <[email protected]> Fri, 02 Mar 2007 13:21:31 +0100 committer Patrick McHardy <[email protected]> Fri, 02 Mar 2007 13:21:31 +0100

 net/netfilter/nfnetlink_log.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

net/netfilter/nfnetlink_log.c +1 -2

index b669db5..d0af8bc 100644
@@ -133,6 +133,7 @@ instance_put(struct nfulnl_instance *ins
 	if (inst && atomic_dec_and_test(&inst->use)) {
 		UDEBUG("kfree(inst=%p)\n", inst);
 		kfree(inst);
+		module_put(THIS_MODULE);
 	}
 }

@@ -228,8 +229,6 @@ _instance_destroy2(struct nfulnl_instanc
 
 	/* and finally put the refcount */
 	instance_put(inst);
-
-	module_put(THIS_MODULE);
 }
 
 static inline void

Patrick McHardy

author

2007-03-04 20:20 UTC #9 lore raw

PATCH 9/10 : nfnetlink_log: fix reference counting

In reply to Patrick McHardy

[NETFILTER]: nfnetlink_log: fix reference counting

Fix reference counting (memory leak) problem in __nfulnl_send() and callers related to packet queueing.

Signed-off-by Michal Miroslaw <[email protected]>

Signed-off-by Patrick McHardy <[email protected]>

---
commit 346efa9c7dd81bff762a436d0259424e7c74fa69
tree 70f56ee7946691f7326b9e8bb2d8bbb502c757e2
parent 3aed666579e96dfe23eb1988faf4af09c33358bc
author Michal Miroslaw <[email protected]> Fri, 02 Mar 2007 13:24:08 +0100 committer Patrick McHardy <[email protected]> Fri, 02 Mar 2007 13:24:08 +0100

 net/netfilter/nfnetlink_log.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

net/netfilter/nfnetlink_log.c +6 -3

index d0af8bc..91a0972 100644
@@ -218,6 +218,9 @@ _instance_destroy2(struct nfulnl_instanc
 
 	spin_lock_bh(&inst->lock);
 	if (inst->skb) {
+		/* timer "holds" one reference (we have one more) */
+		if (del_timer(&inst->timer))
+			instance_put(inst);
 		if (inst->qlen)
 			__nfulnl_send(inst);
 		if (inst->skb) {

@@ -362,9 +365,6 @@ __nfulnl_send(struct nfulnl_instance *in
 {
 	int status;
 
-	if (timer_pending(&inst->timer))
-		del_timer(&inst->timer);
-
 	if (!inst->skb)
 		return 0;

@@ -689,6 +689,9 @@ #endif
 		 * enough room in the skb left. flush to userspace. */
 		UDEBUG("flushing old skb\n");
 
+		/* timer "holds" one reference (we have another one) */
+		if (del_timer(&inst->timer))
+			instance_put(inst);
 		__nfulnl_send(inst);
 
 		if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) {

Patrick McHardy

author

2007-03-04 20:20 UTC #10 lore raw

PATCH 10/10 : ip6_route_me_harder should take into account mark

In reply to Patrick McHardy

[NETFILTER]: ip6_route_me_harder should take into account mark

Signed-off-by Yasuyuki Kozakai <[email protected]>

Signed-off-by Patrick McHardy <[email protected]>

---
commit 906b5340def3527974c307c89460bc82c34535f7
tree 9142f0e4f515cccab225e8ab89e4a530f4dafecb
parent 346efa9c7dd81bff762a436d0259424e7c74fa69
author Yasuyuki Kozakai <[email protected]> Fri, 02 Mar 2007 13:24:43 +0100 committer Patrick McHardy <[email protected]> Fri, 02 Mar 2007 13:24:43 +0100

 net/ipv6/netfilter.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

net/ipv6/netfilter.c +1 -0

index 0b2d265..1c405dd 100644
@@ -15,6 +15,7 @@ int ip6_route_me_harder(struct sk_buff *
 	struct dst_entry *dst;
 	struct flowi fl = {
 		.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
+		.mark = skb->mark,
 		.nl_u =
 		{ .ip6_u =
 		  { .daddr = iph->daddr,

David Miller

maintainer

2007-03-05 00:00 UTC #11 lore raw

In reply to Patrick McHardy

From: Patrick McHardy <[email protected]>
Date: Sun, 4 Mar 2007 21:19:58 +0100 (MET)

Quoted 8 lines

following are a number of netfilter fixes for 2.6.21, fixing an endless loop during module unload with conntrack events enabled, multiple problems with nfnetlink_log, incorrect ctnetlink config ifdefs in nf_conntrack and nf_nat and missing mark initialization in ip6_route_me_harder. Most of them should also go in -stable, I'll send backports soon.
Please apply, thanks.

All applied, thanks a lot Patrick.