aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* prima: Wi-Fi direct is not working when SAP is turned onHEADp9.0Dundi Raviteja2018-11-291-30/+0
| | | | | | | | | | | | Currently while changing interface, if interface type is AP and p2p adapter present, driver removes p2p interface which cause Wi-Fi direct to disable. To address this issue, don't remove p2p interface while changing interface. Change-Id: I13c7d5230a65d2fb66099de52b79f19ec4072135 CRs-Fixed: 2314145
* prima: Reset Maximum allowable size of a beacon frameAbhinav Kumar2018-11-291-0/+4
| | | | | | | | | | | | | | | While updating probe response template, driver uses probeRespTemplateLen as the maximum allowable size of beacon frame. In case if the content of probeRespTemplateLen is greater than SCH_MAX_PROBE_RESP_SIZE (700) results in Buffer Overflow while copying probeRespTemplate buffer to local buffer. Fix is to validate probeRespTemplateLen against maximum allowable size (SCH_MAX_PROBE_RESP_SIZE) and if probeRespTemplateLen is greater than maximum then reset to SCH_MAX_PROBE_RESP_SIZE. Change-Id: Iccc8e63c78b104d0c2ba5a6995e72c47ac8f8e25 CRs-Fixed: 2303693
* wlan: Increase size of MAX_WPA_RSN_IE_LEN in wlan_hdd_cfg80211_set_iegaurank kathpalia2018-11-291-1/+1
| | | | | | | | | | | | | In function wlan_hdd_cfg80211_set_ie, RSN IE is parsed and copied into the buffer pWextState->WPARSNIE for length eLen + 2. However, the buffer WPARSNIE is allocated only for MAX_WPA_RSN_IE_LEN size. If eLen + 2 is greater than MAX_WPA_RSN_IE_LEN, a buffer overflow would occur. Increase the size of MAX_WPA_RSN_IE_LEN to 255 as per the spec Change-Id: Ibf44e8dc1010e6e32b2262357d3aa180926d5c99 CRs-Fixed: 2299183
* wlan: Use proper length to send the beacon/probe to kernelHanumanth Reddy Pothula2018-11-291-2/+3
| | | | | | | | | | | | | | | | | propagation from qcacld-3.0 to prima. Currently sizeof(struct ieee80211_mgmt) + IE len is used to calculate the total frame length to send the beacon/probe to kernel. struct ieee80211_mgmt contains union to define different frames and thus the sizeof(struct ieee80211_mgmt) may give extra length for beacon/probe if any of the union size is greater than the probe/beacon union size. This result in trail of zeroes at the end of the frame. To fix this use sizeof(mgmt_mac_header) + SIR_MAC_B_PR_SSID_OFFSET + ie len to determine the exact size of the frame. Change-Id: I71e94b111f36fcd4060befcae282f1fcce5e17f1 CRs-Fixed: 2251716
* wlan: Can't scan the hidden external SSID when the 1st SSID is emptyHanumanth Reddy Pothula2018-11-291-2/+2
| | | | | | | | | | | | Propagation from qcacld-2.0 to prima Because of previous issue with supplicant setting n_ssids to 1 when there is no SSID provided, wlan_hdd_cfg80211.c simply ignores the case when the first SSID is empty. However, this fails when the 1st SSID is empty but the one after is not. Change-Id: I8b25cab6335b59db587fb90d04a31682afa48d06 CRs-Fixed: 2148403
* defconfig: Enable connection tracking helper supportArne Coucheron2018-11-298-8/+40
| | | | Change-Id: I02ec2743de16d3d25618b16636e66ce07edb4a98
* netfilter: xt_rpfilter: depend on raw or mangle tableFlorian Westphal2018-11-292-2/+2
| | | | | | | | rpfilter is only valid in raw/mangle PREROUTING, i.e. RPFILTER=y|m is useless without raw or mangle table support. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: use IS_ENABLE to replace if defined in TRACE targetGao feng2018-11-292-6/+3
| | | | | Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: fix missing dependencies for NETFILTER_XT_MATCH_CONNLABELFlorian Westphal2018-11-291-0/+1
| | | | | | | | | | | | | It was possible to set NF_CONNTRACK=n and NF_CONNTRACK_LABELS=y via NETFILTER_XT_MATCH_CONNLABEL=y. warning: (NETFILTER_XT_MATCH_CONNLABEL) selects NF_CONNTRACK_LABELS which has unmet direct dependencies (NET && INET && NETFILTER && NF_CONNTRACK) Reported-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: add missing xt_connlabel.h header in installationPablo Neira Ayuso2018-11-291-0/+1
| | | | | | | | | | In (c539f01 netfilter: add connlabel conntrack extension), it was missing the change to the Kbuild file to install the header in the system. Change-Id: I3d20d2ad16f53ef40d83633957a4c91c9d2f80ec Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: add connlabel conntrack extensionFlorian Westphal2018-11-2910-0/+278
| | | | | | | | | | | | | | | | | | similar to connmarks, except labels are bit-based; i.e. all labels may be attached to a flow at the same time. Up to 128 labels are supported. Supporting more labels is possible, but requires increasing the ct offset delta from u8 to u16 type due to increased extension sizes. Mapping of bit-identifier to label name is done in userspace. The extension is enabled at run-time once "-m connlabel" netfilter rules are added. Change-Id: I98cfb16533e7e4bde1d73f2aa30e1be425f0b67e Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: x_tables: print correct hook names for ARPJan Engelhardt2018-11-291-8/+20
| | | | | | | | | | | | | | | | | | | | | | | arptables 0.0.4 (released on 10th Jan 2013) supports calling the CLASSIFY target, but on adding a rule to the wrong chain, the diagnostic is as follows: # arptables -A INPUT -j CLASSIFY --set-class 0:0 arptables: Invalid argument # dmesg | tail -n1 x_tables: arp_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from INPUT/FORWARD This is incorrect, since xt_CLASSIFY.c does specify (1 << NF_ARP_OUT) | (1 << NF_ARP_FORWARD). This patch corrects the x_tables diagnostic message to print the proper hook names for the NFPROTO_ARP case. Affects all kernels down to and including v2.6.31. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nfnetlink_queue: add NFQA_CAP_LEN attributePablo Neira Ayuso2018-11-292-2/+8
| | | | | | | | | | | | | | | | | This patch adds the NFQA_CAP_LEN attribute that allows us to know what is the real packet size from user-space (even if we decided to retrieve just a few bytes from the packet instead of all of it). Security software that inspects packets should always check for this new attribute to make sure that it is inspecting the entire packet. This also helps to provide a workaround for the problem described in: http://marc.info/?l=netfilter-devel&m=134519473212536&w=2 Original idea from Florian Westphal. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nfnetlink_queue: fix maximum packet length to userspacePablo Neira Ayuso2018-11-291-3/+7
| | | | | | | | | | | | | | | | | | | | | | The packets that we send via NFQUEUE are encapsulated in the NFQA_PAYLOAD attribute. The length of the packet in userspace is obtained via attr->nla_len field. This field contains the size of the Netlink attribute header plus the packet length. If the maximum packet length is specified, ie. 65535 bytes, and packets in the range of (65531,65535] are sent to userspace, the attr->nla_len overflows and it reports bogus lengths to the application. To fix this, this patch limits the maximum packet length to 65531 bytes. If larger packet length is specified, the packet that we send to user-space is truncated to 65531 bytes. To support 65535 bytes packets, we have to revisit the idea of the 32-bits Netlink attribute length. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* net: Allow userns root to control ipv4Eric W. Biederman2018-11-2912-24/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow an unpriviled user who has created a user namespace, and then created a network namespace to effectively use the new network namespace, by reducing capable(CAP_NET_ADMIN) and capable(CAP_NET_RAW) calls to be ns_capable(net->user_ns, CAP_NET_ADMIN), or capable(net->user_ns, CAP_NET_RAW) calls. Settings that merely control a single network device are allowed. Either the network device is a logical network device where restrictions make no difference or the network device is hardware NIC that has been explicity moved from the initial network namespace. In general policy and network stack state changes are allowed while resource control is left unchanged. Allow creating raw sockets. Allow the SIOCSARP ioctl to control the arp cache. Allow the SIOCSIFFLAG ioctl to allow setting network device flags. Allow the SIOCSIFADDR ioctl to allow setting a netdevice ipv4 address. Allow the SIOCSIFBRDADDR ioctl to allow setting a netdevice ipv4 broadcast address. Allow the SIOCSIFDSTADDR ioctl to allow setting a netdevice ipv4 destination address. Allow the SIOCSIFNETMASK ioctl to allow setting a netdevice ipv4 netmask. Allow the SIOCADDRT and SIOCDELRT ioctls to allow adding and deleting ipv4 routes. Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for adding, changing and deleting gre tunnels. Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for adding, changing and deleting ipip tunnels. Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for adding, changing and deleting ipsec virtual tunnel interfaces. Allow setting the MRT_INIT, MRT_DONE, MRT_ADD_VIF, MRT_DEL_VIF, MRT_ADD_MFC, MRT_DEL_MFC, MRT_ASSERT, MRT_PIM, MRT_TABLE socket options on multicast routing sockets. Allow setting and receiving IPOPT_CIPSO, IP_OPT_SEC, IP_OPT_SID and arbitrary ip options. Allow setting IP_SEC_POLICY/IP_XFRM_POLICY ipv4 socket option. Allow setting the IP_TRANSPARENT ipv4 socket option. Allow setting the TCP_REPAIR socket option. Allow setting the TCP_CONGESTION socket option. Change-Id: I3b6ce2465e354cd2865e1a7fe67d6e812f88b16a Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* netfilter: fix missing dependencies for the NOTRACK targetPablo Neira Ayuso2018-11-291-0/+3
| | | | | | | | | | | warning: (NETFILTER_XT_TARGET_NOTRACK) selects NETFILTER_XT_TARGET_CT which has unmet direct +dependencies (NET && INET && NETFILTER && NETFILTER_XTABLES && NF_CONNTRACK && (IP_NF_RAW || +IP6_NF_RAW) && NETFILTER_ADVANCED) Reported-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: kbuild test robot <fengguang.wu@intel.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: xt_CT: recover NOTRACK target supportPablo Neira Ayuso2018-11-293-1/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Florian Westphal reported that the removal of the NOTRACK target (9655050 netfilter: remove xt_NOTRACK) is breaking some existing setups. That removal was scheduled for removal since long time ago as described in Documentation/feature-removal-schedule.txt What: xt_NOTRACK Files: net/netfilter/xt_NOTRACK.c When: April 2011 Why: Superseded by xt_CT Still, people may have not notice / may have decided to stick to an old iptables version. I agree with him in that some more conservative approach by spotting some printk to warn users for some time is less agressive. Current iptables 1.4.16.3 already contains the aliasing support that makes it point to the CT target, so upgrading would fix it. Still, the policy so far has been to avoid pushing our users to upgrade. As a solution, this patch recovers the NOTRACK target inside the CT target and it now spots a warning. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: remove xt_NOTRACKCong Wang2018-11-2931-102/+0
| | | | | | | | | | | It was scheduled to be removed for a long time. Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Patrick McHardy <kaber@trash.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: netfilter@vger.kernel.org Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nf_conntrack_ipv6: fix comment for packets without dataFlorent Fourcot2018-11-291-2/+2
| | | | | | | | Remove ambiguity of double negation. Signed-off-by: Florent Fourcot <florent.fourcot@enst-bretagne.fr> Acked-by: Rick Jones <rick.jones2@hp.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nf_nat: Also handle non-ESTABLISHED routing changes in MASQUERADEAndrew Collins2018-11-292-10/+20
| | | | | | | | | | | | | | | Since (a0ecb85 netfilter: nf_nat: Handle routing changes in MASQUERADE target), the MASQUERADE target handles routing changes which affect the output interface of a connection, but only for ESTABLISHED connections. It is also possible for NEW connections which already have a conntrack entry to be affected by routing changes. This adds a check to drop entries in the NEW+conntrack state when the oif has changed. Signed-off-by: Andrew Collins <bsderandrew@gmail.com> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: ip[6]t_REJECT: fix wrong transport header pointer in TCP resetMukund Jampala2018-11-292-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The problem occurs when iptables constructs the tcp reset packet. It doesn't initialize the pointer to the tcp header within the skb. When the skb is passed to the ixgbe driver for transmit, the ixgbe driver attempts to access the tcp header and crashes. Currently, other drivers (such as our 1G e1000e or igb drivers) don't access the tcp header on transmit unless the TSO option is turned on. <1>BUG: unable to handle kernel NULL pointer dereference at 0000000d <1>IP: [<d081621c>] ixgbe_xmit_frame_ring+0x8cc/0x2260 [ixgbe] <4>*pdpt = 0000000085e5d001 *pde = 0000000000000000 <0>Oops: 0000 [#1] SMP [...] <4>Pid: 0, comm: swapper Tainted: P 2.6.35.12 #1 Greencity/Thurley <4>EIP: 0060:[<d081621c>] EFLAGS: 00010246 CPU: 16 <4>EIP is at ixgbe_xmit_frame_ring+0x8cc/0x2260 [ixgbe] <4>EAX: c7628820 EBX: 00000007 ECX: 00000000 EDX: 00000000 <4>ESI: 00000008 EDI: c6882180 EBP: dfc6b000 ESP: ced95c48 <4> DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 <0>Process swapper (pid: 0, ti=ced94000 task=ced73bd0 task.ti=ced94000) <0>Stack: <4> cbec7418 c779e0d8 c77cc888 c77cc8a8 0903010a 00000000 c77c0008 00000002 <4><0> cd4997c0 00000010 dfc6b000 00000000 d0d176c9 c77cc8d8 c6882180 cbec7318 <4><0> 00000004 00000004 cbec7230 cbec7110 00000000 cbec70c0 c779e000 00000002 <0>Call Trace: <4> [<d0d176c9>] ? 0xd0d176c9 <4> [<d0d18a4d>] ? 0xd0d18a4d <4> [<411e243e>] ? dev_hard_start_xmit+0x218/0x2d7 <4> [<411f03d7>] ? sch_direct_xmit+0x4b/0x114 <4> [<411f056a>] ? __qdisc_run+0xca/0xe0 <4> [<411e28b0>] ? dev_queue_xmit+0x2d1/0x3d0 <4> [<411e8120>] ? neigh_resolve_output+0x1c5/0x20f <4> [<411e94a1>] ? neigh_update+0x29c/0x330 <4> [<4121cf29>] ? arp_process+0x49c/0x4cd <4> [<411f80c9>] ? nf_hook_slow+0x3f/0xac <4> [<4121ca8d>] ? arp_process+0x0/0x4cd <4> [<4121ca8d>] ? arp_process+0x0/0x4cd <4> [<4121c6d5>] ? T.901+0x38/0x3b <4> [<4121c918>] ? arp_rcv+0xa3/0xb4 <4> [<4121ca8d>] ? arp_process+0x0/0x4cd <4> [<411e1173>] ? __netif_receive_skb+0x32b/0x346 <4> [<411e19e1>] ? netif_receive_skb+0x5a/0x5f <4> [<411e1ea9>] ? napi_skb_finish+0x1b/0x30 <4> [<d0816eb4>] ? ixgbe_xmit_frame_ring+0x1564/0x2260 [ixgbe] <4> [<41013468>] ? lapic_next_event+0x13/0x16 <4> [<410429b2>] ? clockevents_program_event+0xd2/0xe4 <4> [<411e1b03>] ? net_rx_action+0x55/0x127 <4> [<4102da1a>] ? __do_softirq+0x77/0xeb <4> [<4102dab1>] ? do_softirq+0x23/0x27 <4> [<41003a67>] ? do_IRQ+0x7d/0x8e <4> [<41002a69>] ? common_interrupt+0x29/0x30 <4> [<41007bcf>] ? mwait_idle+0x48/0x4d <4> [<4100193b>] ? cpu_idle+0x37/0x4c <0>Code: df 09 d7 0f 94 c2 0f b6 d2 e9 e7 fb ff ff 31 db 31 c0 e9 38 ff ff ff 80 78 06 06 0f 85 3e fb ff ff 8b 7c 24 38 8b 8f b8 00 00 00 <0f> b6 51 0d f6 c2 01 0f 85 27 fb ff ff 80 e2 02 75 0d 8b 6c 24 <0>EIP: [<d081621c>] ixgbe_xmit_frame_ring+0x8cc/0x2260 [ixgbe] SS:ESP Signed-off-by: Mukund Jampala <jbmukund@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nf_nat: Handle routing changes in MASQUERADE targetJozsef Kadlecsik2018-11-293-0/+23
| | | | | | | | | | | | | | When the route changes (backup default route, VPNs) which affect a masqueraded target, the packets were sent out with the outdated source address. The patch addresses the issue by comparing the outgoing interface directly with the masqueraded interface in the nat table. Events are inefficient in this case, because it'd require adding route events to the network core and then scanning the whole conntrack table and re-checking the route for all entry. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: ip6tables: add stateless IPv6-to-IPv6 Network Prefix Translation ↵Patrick McHardy2018-11-295-0/+192
| | | | | | target Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ip6tables: add NETMAP targetPatrick McHardy2018-11-293-0/+105
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ip6tables: add REDIRECT targetPatrick McHardy2018-11-293-0/+110
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ip6tables: add MASQUERADE targetPatrick McHardy2018-11-297-4/+155
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ipv6: add IPv6 NAT supportPatrick McHardy2018-11-2913-2/+764
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* net: core: add function for incremental IPv6 pseudo header checksum updatesPatrick McHardy2018-11-292-0/+23
| | | | | | | | Add inet_proto_csum_replace16 for incrementally updating IPv6 pseudo header checksums for IPv6 NAT. Signed-off-by: Patrick McHardy <kaber@trash.net> Acked-by: David S. Miller <davem@davemloft.net>
* netfilter: nf_conntrack_ipv6: fix tracking of ICMPv6 error messages ↵Patrick McHardy2018-11-291-57/+6
| | | | | | | | | | | | | | | | | containing fragments ICMPv6 error messages are tracked by extracting the conntrack tuple of the inner packet and looking up the corresponding conntrack entry. Tuple extraction uses the ->get_l4proto() callback, which in case of fragments returns NEXTHDR_FRAGMENT instead of the upper protocol, even for the first fragment when the entire next header is present, resulting in a failure to find the correct connection tracking entry. This patch changes ipv6_get_l4proto() to use ipv6_skip_exthdr() instead of nf_ct_ipv6_skip_exthdr() in order to skip fragment headers when the fragment offset is zero. Signed-off-by: Patrick McHardy <kaber@trash.net>
* ipv4: fix path MTU discovery with connection trackingPatrick McHardy2018-11-294-2/+14
| | | | | | | | | | | | | | | | | IPv4 conntrack defragments incoming packet at the PRE_ROUTING hook and (in case of forwarded packets) refragments them at POST_ROUTING independent of the IP_DF flag. Refragmentation uses the dst_mtu() of the local route without caring about the original fragment sizes, thereby breaking PMTUD. This patch fixes this by keeping track of the largest received fragment with IP_DF set and generates an ICMP fragmentation required error during refragmentation if that size exceeds the MTU. Change-Id: Ibac77b728baba05841286ea5a8a2089d56e6ad65 Signed-off-by: Patrick McHardy <kaber@trash.net> Acked-by: Eric Dumazet <edumazet@google.com> Acked-by: David S. Miller <davem@davemloft.net>
* netfilter: nf_conntrack_ipv6: improve fragmentation handlingPatrick McHardy2018-11-295-17/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The IPv6 conntrack fragmentation currently has a couple of shortcomings. Fragmentes are collected in PREROUTING/OUTPUT, are defragmented, the defragmented packet is then passed to conntrack, the resulting conntrack information is attached to each original fragment and the fragments then continue their way through the stack. Helper invocation occurs in the POSTROUTING hook, at which point only the original fragments are available. The result of this is that fragmented packets are never passed to helpers. This patch improves the situation in the following way: - If a reassembled packet belongs to a connection that has a helper assigned, the reassembled packet is passed through the stack instead of the original fragments. - During defragmentation, the largest received fragment size is stored. On output, the packet is refragmented if required. If the largest received fragment size exceeds the outgoing MTU, a "packet too big" message is generated, thus behaving as if the original fragments were passed through the stack from an outside point of view. - The ipv6_helper() hook function can't receive fragments anymore for connections using a helper, so it is switched to use ipv6_skip_exthdr() instead of the netfilter specific nf_ct_ipv6_skip_exthdr() and the reassembled packets are passed to connection tracking helpers. The result of this is that we can properly track fragmented packets, but still generate ICMPv6 Packet too big messages if we would have before. This patch is also required as a precondition for IPv6 NAT, where NAT helpers might enlarge packets up to a point that they require fragmentation. In that case we can't generate Packet too big messages since the proper MTU can't be calculated in all cases (f.i. when changing textual representation of a variable amount of addresses), so the packet is transparently fragmented iff the original packet or fragments would have fit the outgoing MTU. IPVS parts by Jesper Dangaard Brouer <brouer@redhat.com>. Change-Id: I75d83668e7de723fb271232f475f46f4037a4a4f Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: nf_ct_ftp: add sequence tracking pickup facility for injected entriesPablo Neira Ayuso2018-11-294-3/+31
| | | | | | | | | | | | | | This patch allows the FTP helper to pickup the sequence tracking from the first packet seen. This is useful to fix the breakage of the first FTP command after the failover while using conntrackd to synchronize states. The seq_aft_nl_num field in struct nf_ct_ftp_info has been shrinked to 16-bits (enough for what it does), so we can use the remaining 16-bits to store the flags while using the same size for the private FTP helper data. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nf_nat: support IPv6 in TFTP NAT helperPablo Neira Ayuso2018-11-296-8/+7
| | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: nf_nat: support IPv6 in IRC NAT helperPablo Neira Ayuso2018-11-296-14/+7
| | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: nf_nat: support IPv6 in SIP NAT helperPatrick McHardy2018-11-297-121/+146
| | | | | | | | Add IPv6 support to the SIP NAT helper. There are no functional differences to IPv4 NAT, just different formats for addresses. Change-Id: I151f527731d4724606203ca82244b5aad4b9e026 Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: nf_nat: support IPv6 in amanda NAT helperPatrick McHardy2018-11-296-8/+7
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: nf_nat: support IPv6 in FTP NAT helperPatrick McHardy2018-11-296-20/+27
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xt_nat: fix incorrect hooks for SNAT and DNAT targetsElison Niven2018-11-291-4/+4
| | | | | | | | | | | | In (c7232c9 netfilter: add protocol independent NAT core), the hooks were accidentally modified: SNAT hooks are POST_ROUTING and LOCAL_IN (before it was LOCAL_OUT). DNAT hooks are PRE_ROUTING and LOCAL_OUT (before it was LOCAL_IN). Signed-off-by: Elison Niven <elison.niven@cyberoam.com> Signed-off-by: Sanket Shah <sanket.shah@cyberoam.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nf_nat: remove obsolete rcu_read_unlock callUlrich Weber2018-11-291-3/+1
| | | | | | | | | | hlist walk in find_appropriate_src() is not protected anymore by rcu_read_lock(), so rcu_read_unlock() is unnecessary if in_range() matches. This bug was added in (c7232c9 netfilter: add protocol independent NAT core). Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: ctnetlink: fix module auto-load in ctnetlink_parse_natPablo Neira Ayuso2018-11-291-3/+0
| | | | | | | | | | (c7232c9 netfilter: add protocol independent NAT core) added incorrect locking for the module auto-load case in ctnetlink_parse_nat. That function is always called from ctnetlink_create_conntrack which requires no locking. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: fix crash during boot if NAT has been compiled built-inPablo Neira Ayuso2018-11-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | (c7232c9 netfilter: add protocol independent NAT core) introduced a problem that leads to crashing during boot due to NULL pointer dereference. It seems that xt_nat calls xt_register_target() before xt_init(): net/netfilter/x_tables.c:static struct xt_af *xt; is NULL and we crash on xt_register_target(struct xt_target *target) { u_int8_t af = target->family; int ret; ret = mutex_lock_interruptible(&xt[af].mutex); ... Fix this by changing the linking order, to make sure that x_tables comes before xt_nat. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: add protocol independent NAT corePatrick McHardy2018-11-2949-1142/+1495
| | | | | | | | Convert the IPv4 NAT implementation to a protocol independent core and address family specific modules. Change-Id: I926b42af53b37c96fb654021e7f568450e8c63c0 Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: nf_nat: add protoff argument to packet mangling functionsPatrick McHardy2018-11-2922-205/+328
| | | | | | | | | For mangling IPv6 packets the protocol header offset needs to be known by the NAT packet mangling functions. Add a so far unused protoff argument and convert the conntrack and NAT helpers to use it in preparation of IPv6 NAT. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: nf_conntrack: restrict NAT helper invocation to IPv4Patrick McHardy2018-11-296-22/+49
| | | | | | | The NAT helpers currently only handle IPv4 packets correctly. Restrict invocation of the helpers to IPv4 in preparation of IPv6 NAT. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: nf_ct_sip: fix IPv6 address parsingPatrick McHardy2018-11-293-20/+73
| | | | | | | | | | | | | | | | | | | | | | Within SIP messages IPv6 addresses are enclosed in square brackets in most cases, with the exception of the "received=" header parameter. Currently the helper fails to parse enclosed addresses. This patch: - changes the SIP address parsing function to enforce square brackets when required, and accept them when not required but present, as recommended by RFC 5118. - adds a new SDP address parsing function that never accepts square brackets since SDP doesn't use them. With these changes, the SIP helper correctly parses all test messages from RFC 5118 (Session Initiation Protocol (SIP) Torture Test Messages for Internet Protocol Version 6 (IPv6)). Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nf_ct_sip: fix helper namePatrick McHardy2018-11-291-3/+2
| | | | | | | | | | | Commit 3a8fc53a (netfilter: nf_ct_helper: allocate 16 bytes for the helper and policy names) introduced a bug in the SIP helper, the helper name is sprinted to the sip_names array instead of instead of into the helper structure. This breaks the helper match and the /proc/net/nf_conntrack_expect output. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: ctnetlink: fix compilation with NF_CONNTRACK_EVENTS=nPablo Neira Ayuso2018-11-291-1/+1
| | | | | | | | | | | | This patch fixes compilation with NF_CONNTRACK_EVENTS=n and NETFILTER_NETLINK_QUEUE_CT=y. I'm leaving all those static inline functions that calculate the size of the event message out of the ifdef area of NF_CONNTRACK_EVENTS since they will not be included by gcc in case they are unused. Reported-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nfnetlink_queue: fix sparse warning due to missing includePablo Neira Ayuso2018-11-291-0/+1
| | | | | | This patch fixes a sparse warning due to missing include header file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nfnetlink_queue: fix compilation with CONFIG_NF_NAT=m and ↵Pablo Neira Ayuso2018-11-295-8/+18
| | | | | | | | | | | | | | CONFIG_NF_CT_NETLINK=y LD init/built-in.o net/built-in.o:(.data+0x4408): undefined reference to `nf_nat_tcp_seq_adjust' make: *** [vmlinux] Error 1 This patch adds a new pointer hook (nfq_ct_nat_hook) similar to other existing in Netfilter to solve our complicated configuration dependencies. Reported-by: Valdis Kletnieks <valdis.kletnieks@vt.edu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nfq_ct_hook needs __rcu and __read_mostlyPablo Neira Ayuso2018-11-292-2/+2
| | | | | | | This removes some sparse warnings. Reported-by: Fengguang Wu <wfg@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-20 00:37:56 +0000