1. 21 9月, 2012 5 次提交
    • U
      netfilter: nf_nat: remove obsolete rcu_read_unlock call · 136251d0
      Ulrich Weber 提交于
      hlist walk in find_appropriate_src() is not protected anymore by rcu_read_lock(),
      so rcu_read_unlock() is unnecessary if in_range() matches.
      
      This bug was added in (c7232c99 netfilter: add protocol independent NAT core).
      Signed-off-by: NUlrich Weber <ulrich.weber@sophos.com>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      136251d0
    • P
      netfilter: nf_nat: fix oops when unloading protocol modules · b0cdb1d9
      Patrick McHardy 提交于
      When unloading a protocol module nf_ct_iterate_cleanup() is used to
      remove all conntracks using the protocol from the bysource hash and
      clean their NAT sections. Since the conntrack isn't actually killed,
      the NAT callback is invoked twice, once for each direction, which
      causes an oops when trying to delete it from the bysource hash for
      the second time.
      
      The same oops can also happen when removing both an L3 and L4 protocol
      since the cleanup function doesn't check whether the conntrack has
      already been cleaned up.
      
      Pid: 4052, comm: modprobe Not tainted 3.6.0-rc3-test-nat-unload-fix+ #32 Red Hat KVM
      RIP: 0010:[<ffffffffa002c303>]  [<ffffffffa002c303>] nf_nat_proto_clean+0x73/0xd0 [nf_nat]
      RSP: 0018:ffff88007808fe18  EFLAGS: 00010246
      RAX: 0000000000000000 RBX: ffff8800728550c0 RCX: ffff8800756288b0
      RDX: dead000000200200 RSI: ffff88007808fe88 RDI: ffffffffa002f208
      RBP: ffff88007808fe28 R08: ffff88007808e000 R09: 0000000000000000
      R10: dead000000200200 R11: dead000000100100 R12: ffffffff81c6dc00
      R13: ffff8800787582b8 R14: ffff880078758278 R15: ffff88007808fe88
      FS:  00007f515985d700(0000) GS:ffff88007cd00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: 00007f515986a000 CR3: 000000007867a000 CR4: 00000000000006e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process modprobe (pid: 4052, threadinfo ffff88007808e000, task ffff8800756288b0)
      Stack:
       ffff88007808fe68 ffffffffa002c290 ffff88007808fe78 ffffffff815614e3
       ffffffff00000000 00000aeb00000246 ffff88007808fe68 ffffffff81c6dc00
       ffff88007808fe88 ffffffffa00358a0 0000000000000000 000000000040f5b0
      Call Trace:
       [<ffffffffa002c290>] ? nf_nat_net_exit+0x50/0x50 [nf_nat]
       [<ffffffff815614e3>] nf_ct_iterate_cleanup+0xc3/0x170
       [<ffffffffa002c55a>] nf_nat_l3proto_unregister+0x8a/0x100 [nf_nat]
       [<ffffffff812a0303>] ? compat_prepare_timeout+0x13/0xb0
       [<ffffffffa0035848>] nf_nat_l3proto_ipv4_exit+0x10/0x23 [nf_nat_ipv4]
       ...
      
      To fix this,
      
      - check whether the conntrack has already been cleaned up in
        nf_nat_proto_clean
      
      - change nf_ct_iterate_cleanup() to only invoke the callback function
        once for each conntrack (IP_CT_DIR_ORIGINAL).
      
      The second change doesn't affect other callers since when conntracks are
      actually killed, both directions are removed from the hash immediately
      and the callback is already only invoked once. If it is not killed, the
      second callback invocation will always return the same decision not to
      kill it.
      Reported-by: NJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      Acked-by: NJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      b0cdb1d9
    • P
      netfilter: fix IPv6 NAT dependencies in Kconfig · b0041d1b
      Pablo Neira Ayuso 提交于
      * NF_NAT_IPV6 requires IP6_NF_IPTABLES
      
      * IP6_NF_TARGET_MASQUERADE, IP6_NF_TARGET_NETMAP, IP6_NF_TARGET_REDIRECT
        and IP6_NF_TARGET_NPT require NF_NAT_IPV6.
      
      This change just mirrors what IPv4 does in Kconfig, for consistency.
      Reported-by: NRandy Dunlap <rdunlap@xenotime.net>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      b0041d1b
    • A
      tcp: Document use of undefined variable. · 4308fc58
      Alan Cox 提交于
      Both tcp_timewait_state_process and tcp_check_req use the same basic
      construct of
      
      	struct tcp_options received tmp_opt;
      	tmp_opt.saw_tstamp = 0;
      
      then call
      
      	tcp_parse_options
      
      However if they are fed a frame containing a TCP_SACK then tbe code
      behaviour is undefined because opt_rx->sack_ok is undefined data.
      
      This ought to be documented if it is intentional.
      Signed-off-by: NAlan Cox <alan@linux.intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4308fc58
    • C
  2. 20 9月, 2012 11 次提交
  3. 19 9月, 2012 3 次提交
  4. 18 9月, 2012 8 次提交
  5. 14 9月, 2012 11 次提交
  6. 12 9月, 2012 2 次提交
    • P
      netfilter: ctnetlink: fix module auto-load in ctnetlink_parse_nat · c7cbb917
      Pablo Neira Ayuso 提交于
      (c7232c99 netfilter: add protocol independent NAT core) added
      incorrect locking for the module auto-load case in ctnetlink_parse_nat.
      
      That function is always called from ctnetlink_create_conntrack which
      requires no locking.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      c7cbb917
    • J
      netfilter: log: Fix log-level processing · 16af511a
      Joe Perches 提交于
      auto75914331@hushmail.com reports that iptables does not correctly
      output the KERN_<level>.
      
      $IPTABLES -A RULE_0_in  -j LOG  --log-level notice --log-prefix "DENY  in: "
      
      result with linux 3.6-rc5
      Sep 12 06:37:29 xxxxx kernel: <5>DENY  in: IN=eth0 OUT= MAC=.......
      
      result with linux 3.5.3 and older:
      Sep  9 10:43:01 xxxxx kernel: DENY  in: IN=eth0 OUT= MAC......
      
      commit 04d2c8c8
      ("printk: convert the format for KERN_<LEVEL> to a 2 byte pattern")
      updated the syslog header style but did not update netfilter uses.
      
      Do so.
      
      Use KERN_SOH and string concatenation instead of "%c" KERN_SOH_ASCII
      as suggested by Eric Dumazet.
      Signed-off-by: NJoe Perches <joe@perches.com>
      cc: auto75914331@hushmail.com
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      16af511a