--- /dev/null
+From 47b7e7f82802dced3ac73658bf4b77584a63063f Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Thu, 15 Feb 2018 00:23:05 +0100
+Subject: netfilter: don't set F_IFACE on ipv6 fib lookups
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 47b7e7f82802dced3ac73658bf4b77584a63063f upstream.
+
+"fib" starts to behave strangely when an ipv6 default route is
+added - the FIB lookup returns a route using 'oif' in this case.
+
+This behaviour was inherited from ip6tables rpfilter so change
+this as well.
+
+Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1221
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/netfilter/ip6t_rpfilter.c | 4 ----
+ net/ipv6/netfilter/nft_fib_ipv6.c | 12 ++----------
+ 2 files changed, 2 insertions(+), 14 deletions(-)
+
+--- a/net/ipv6/netfilter/ip6t_rpfilter.c
++++ b/net/ipv6/netfilter/ip6t_rpfilter.c
+@@ -48,10 +48,6 @@ static bool rpfilter_lookup_reverse6(str
+ }
+
+ fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
+- if ((flags & XT_RPFILTER_LOOSE) == 0) {
+- fl6.flowi6_oif = dev->ifindex;
+- lookup_flags |= RT6_LOOKUP_F_IFACE;
+- }
+
+ rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags);
+ if (rt->dst.error)
+--- a/net/ipv6/netfilter/nft_fib_ipv6.c
++++ b/net/ipv6/netfilter/nft_fib_ipv6.c
+@@ -182,7 +182,6 @@ void nft_fib6_eval(const struct nft_expr
+ }
+
+ *dest = 0;
+- again:
+ rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, lookup_flags);
+ if (rt->dst.error)
+ goto put_rt_err;
+@@ -191,15 +190,8 @@ void nft_fib6_eval(const struct nft_expr
+ if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
+ goto put_rt_err;
+
+- if (oif && oif != rt->rt6i_idev->dev) {
+- /* multipath route? Try again with F_IFACE */
+- if ((lookup_flags & RT6_LOOKUP_F_IFACE) == 0) {
+- lookup_flags |= RT6_LOOKUP_F_IFACE;
+- fl6.flowi6_oif = oif->ifindex;
+- ip6_rt_put(rt);
+- goto again;
+- }
+- }
++ if (oif && oif != rt->rt6i_idev->dev)
++ goto put_rt_err;
+
+ switch (priv->result) {
+ case NFT_FIB_RESULT_OIF:
--- /dev/null
+From cede24d1b21d68d84ac5a36c44f7d37daadcc258 Mon Sep 17 00:00:00 2001
+From: Vincent Bernat <vincent@bernat.im>
+Date: Sun, 20 May 2018 13:03:38 +0200
+Subject: netfilter: ip6t_rpfilter: provide input interface for route lookup
+
+From: Vincent Bernat <vincent@bernat.im>
+
+commit cede24d1b21d68d84ac5a36c44f7d37daadcc258 upstream.
+
+In commit 47b7e7f82802, this bit was removed at the same time the
+RT6_LOOKUP_F_IFACE flag was removed. However, it is needed when
+link-local addresses are used, which is a very common case: when
+packets are routed, neighbor solicitations are done using link-local
+addresses. For example, the following neighbor solicitation is not
+matched by "-m rpfilter":
+
+ IP6 fe80::5254:33ff:fe00:1 > ff02::1:ff00:3: ICMP6, neighbor
+ solicitation, who has 2001:db8::5254:33ff:fe00:3, length 32
+
+Commit 47b7e7f82802 doesn't quite explain why we shouldn't use
+RT6_LOOKUP_F_IFACE in the rpfilter case. I suppose the interface check
+later in the function would make it redundant. However, the remaining
+of the routing code is using RT6_LOOKUP_F_IFACE when there is no
+source address (which matches rpfilter's case with a non-unicast
+destination, like with neighbor solicitation).
+
+Signed-off-by: Vincent Bernat <vincent@bernat.im>
+Fixes: 47b7e7f82802 ("netfilter: don't set F_IFACE on ipv6 fib lookups")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/netfilter/ip6t_rpfilter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv6/netfilter/ip6t_rpfilter.c
++++ b/net/ipv6/netfilter/ip6t_rpfilter.c
+@@ -48,6 +48,8 @@ static bool rpfilter_lookup_reverse6(str
+ }
+
+ fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
++ if ((flags & XT_RPFILTER_LOOSE) == 0)
++ fl6.flowi6_oif = dev->ifindex;
+
+ rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags);
+ if (rt->dst.error)
--- /dev/null
+From adc972c5b88829d38ede08b1069718661c7330ae Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Mon, 11 Jun 2018 22:16:33 +0900
+Subject: netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit adc972c5b88829d38ede08b1069718661c7330ae upstream.
+
+When depth of chain is bigger than NFT_JUMP_STACK_SIZE, the nft_do_chain
+crashes. But there is no need to crash hard here.
+
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/nf_tables_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_tables_core.c
++++ b/net/netfilter/nf_tables_core.c
+@@ -208,7 +208,8 @@ next_rule:
+
+ switch (regs.verdict.code) {
+ case NFT_JUMP:
+- BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);
++ if (WARN_ON_ONCE(stackptr >= NFT_JUMP_STACK_SIZE))
++ return NF_DROP;
+ jumpstack[stackptr].chain = chain;
+ jumpstack[stackptr].rule = rule;
+ jumpstack[stackptr].rulenum = rulenum;
md-use-mddev_suspend-resume-instead-of-quiesce.patch
md-allow-metadata-update-while-suspending.patch
md-remove-special-meaning-of-quiesce-..-2.patch
+netfilter-don-t-set-f_iface-on-ipv6-fib-lookups.patch
+netfilter-ip6t_rpfilter-provide-input-interface-for-route-lookup.patch
+netfilter-nf_tables-use-warn_on_once-instead-of-bug_on-in-nft_do_chain.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
