From: Greg Kroah-Hartman Date: Thu, 5 Jul 2018 17:10:37 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.14.54~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6d4c32ad0389ec20bf643f888111e30f6757edee;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: netfilter-don-t-set-f_iface-on-ipv6-fib-lookups.patch netfilter-ip6t_rpfilter-provide-input-interface-for-route-lookup.patch netfilter-nf_tables-use-warn_on_once-instead-of-bug_on-in-nft_do_chain.patch --- diff --git a/queue-4.14/netfilter-don-t-set-f_iface-on-ipv6-fib-lookups.patch b/queue-4.14/netfilter-don-t-set-f_iface-on-ipv6-fib-lookups.patch new file mode 100644 index 00000000000..3391781cbf5 --- /dev/null +++ b/queue-4.14/netfilter-don-t-set-f_iface-on-ipv6-fib-lookups.patch @@ -0,0 +1,66 @@ +From 47b7e7f82802dced3ac73658bf4b77584a63063f Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 15 Feb 2018 00:23:05 +0100 +Subject: netfilter: don't set F_IFACE on ipv6 fib lookups + +From: Florian Westphal + +commit 47b7e7f82802dced3ac73658bf4b77584a63063f upstream. + +"fib" starts to behave strangely when an ipv6 default route is +added - the FIB lookup returns a route using 'oif' in this case. + +This behaviour was inherited from ip6tables rpfilter so change +this as well. + +Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1221 +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/netfilter/ip6t_rpfilter.c | 4 ---- + net/ipv6/netfilter/nft_fib_ipv6.c | 12 ++---------- + 2 files changed, 2 insertions(+), 14 deletions(-) + +--- a/net/ipv6/netfilter/ip6t_rpfilter.c ++++ b/net/ipv6/netfilter/ip6t_rpfilter.c +@@ -48,10 +48,6 @@ static bool rpfilter_lookup_reverse6(str + } + + fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; +- if ((flags & XT_RPFILTER_LOOSE) == 0) { +- fl6.flowi6_oif = dev->ifindex; +- lookup_flags |= RT6_LOOKUP_F_IFACE; +- } + + rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags); + if (rt->dst.error) +--- a/net/ipv6/netfilter/nft_fib_ipv6.c ++++ b/net/ipv6/netfilter/nft_fib_ipv6.c +@@ -182,7 +182,6 @@ void nft_fib6_eval(const struct nft_expr + } + + *dest = 0; +- again: + rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, lookup_flags); + if (rt->dst.error) + goto put_rt_err; +@@ -191,15 +190,8 @@ void nft_fib6_eval(const struct nft_expr + if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL)) + goto put_rt_err; + +- if (oif && oif != rt->rt6i_idev->dev) { +- /* multipath route? Try again with F_IFACE */ +- if ((lookup_flags & RT6_LOOKUP_F_IFACE) == 0) { +- lookup_flags |= RT6_LOOKUP_F_IFACE; +- fl6.flowi6_oif = oif->ifindex; +- ip6_rt_put(rt); +- goto again; +- } +- } ++ if (oif && oif != rt->rt6i_idev->dev) ++ goto put_rt_err; + + switch (priv->result) { + case NFT_FIB_RESULT_OIF: diff --git a/queue-4.14/netfilter-ip6t_rpfilter-provide-input-interface-for-route-lookup.patch b/queue-4.14/netfilter-ip6t_rpfilter-provide-input-interface-for-route-lookup.patch new file mode 100644 index 00000000000..71c1df70d19 --- /dev/null +++ b/queue-4.14/netfilter-ip6t_rpfilter-provide-input-interface-for-route-lookup.patch @@ -0,0 +1,46 @@ +From cede24d1b21d68d84ac5a36c44f7d37daadcc258 Mon Sep 17 00:00:00 2001 +From: Vincent Bernat +Date: Sun, 20 May 2018 13:03:38 +0200 +Subject: netfilter: ip6t_rpfilter: provide input interface for route lookup + +From: Vincent Bernat + +commit cede24d1b21d68d84ac5a36c44f7d37daadcc258 upstream. + +In commit 47b7e7f82802, this bit was removed at the same time the +RT6_LOOKUP_F_IFACE flag was removed. However, it is needed when +link-local addresses are used, which is a very common case: when +packets are routed, neighbor solicitations are done using link-local +addresses. For example, the following neighbor solicitation is not +matched by "-m rpfilter": + + IP6 fe80::5254:33ff:fe00:1 > ff02::1:ff00:3: ICMP6, neighbor + solicitation, who has 2001:db8::5254:33ff:fe00:3, length 32 + +Commit 47b7e7f82802 doesn't quite explain why we shouldn't use +RT6_LOOKUP_F_IFACE in the rpfilter case. I suppose the interface check +later in the function would make it redundant. However, the remaining +of the routing code is using RT6_LOOKUP_F_IFACE when there is no +source address (which matches rpfilter's case with a non-unicast +destination, like with neighbor solicitation). + +Signed-off-by: Vincent Bernat +Fixes: 47b7e7f82802 ("netfilter: don't set F_IFACE on ipv6 fib lookups") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/netfilter/ip6t_rpfilter.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv6/netfilter/ip6t_rpfilter.c ++++ b/net/ipv6/netfilter/ip6t_rpfilter.c +@@ -48,6 +48,8 @@ static bool rpfilter_lookup_reverse6(str + } + + fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; ++ if ((flags & XT_RPFILTER_LOOSE) == 0) ++ fl6.flowi6_oif = dev->ifindex; + + rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags); + if (rt->dst.error) diff --git a/queue-4.14/netfilter-nf_tables-use-warn_on_once-instead-of-bug_on-in-nft_do_chain.patch b/queue-4.14/netfilter-nf_tables-use-warn_on_once-instead-of-bug_on-in-nft_do_chain.patch new file mode 100644 index 00000000000..e807aa078c3 --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-use-warn_on_once-instead-of-bug_on-in-nft_do_chain.patch @@ -0,0 +1,34 @@ +From adc972c5b88829d38ede08b1069718661c7330ae Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Mon, 11 Jun 2018 22:16:33 +0900 +Subject: netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain() + +From: Taehee Yoo + +commit adc972c5b88829d38ede08b1069718661c7330ae upstream. + +When depth of chain is bigger than NFT_JUMP_STACK_SIZE, the nft_do_chain +crashes. But there is no need to crash hard here. + +Suggested-by: Florian Westphal +Signed-off-by: Taehee Yoo +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_tables_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nf_tables_core.c ++++ b/net/netfilter/nf_tables_core.c +@@ -208,7 +208,8 @@ next_rule: + + switch (regs.verdict.code) { + case NFT_JUMP: +- BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE); ++ if (WARN_ON_ONCE(stackptr >= NFT_JUMP_STACK_SIZE)) ++ return NF_DROP; + jumpstack[stackptr].chain = chain; + jumpstack[stackptr].rule = rule; + jumpstack[stackptr].rulenum = rulenum; diff --git a/queue-4.14/series b/queue-4.14/series index 437485c87f6..13d300c0c6b 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -37,3 +37,6 @@ md-move-suspend_hi-lo-handling-into-core-md-code.patch md-use-mddev_suspend-resume-instead-of-quiesce.patch md-allow-metadata-update-while-suspending.patch md-remove-special-meaning-of-quiesce-..-2.patch +netfilter-don-t-set-f_iface-on-ipv6-fib-lookups.patch +netfilter-ip6t_rpfilter-provide-input-interface-for-route-lookup.patch +netfilter-nf_tables-use-warn_on_once-instead-of-bug_on-in-nft_do_chain.patch