#
a54e7219 |
|
11-Jan-2024 |
Pavel Tikhomirov <ptikhomirov@virtuozzo.com> |
netfilter: propagate net to nf_bridge_get_physindev This is a preparation patch for replacing physindev with physinif on nf_bridge_info structure. We will use dev_get_by_index_rcu to resolve device, when needed, and it requires net to be available. Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
a13fbf5e |
|
28-Jan-2023 |
Xin Long <lucien.xin@gmail.com> |
netfilter: use skb_ip_totlen and iph_totlen There are also quite some places in netfilter that may process IPv4 TCP GSO packets, we need to replace them too. In length_mt(), we have to use u_int32_t/int to accept skb_ip_totlen() return value, otherwise it may overflow and mismatch. This change will also help us add selftest for IPv4 BIG TCP in the following patch. Note that we don't need to replace the one in tcpmss_tg4(), as it will return if there is data after tcphdr in tcpmss_mangle_packet(). The same in mangle_contents() in nf_nat_helper.c, it returns false when skb->len + extra > 65535 in enlarge_skb(). Signed-off-by: Xin Long <lucien.xin@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
#
7a847c00 |
|
05-Jul-2022 |
Pablo Neira Ayuso <pablo@netfilter.org> |
netfilter: nf_log: incorrect offset to network header NFPROTO_ARP is expecting to find the ARP header at the network offset. In the particular case of ARP, HTYPE= field shows the initial bytes of the ethernet header destination MAC address. netdev out: IN= OUT=bridge0 MACSRC=c2:76:e5:71:e1:de MACDST=36:b0:4a:e2:72:ea MACPROTO=0806 ARP HTYPE=14000 PTYPE=0x4ae2 OPCODE=49782 NFPROTO_NETDEV egress hook is also expecting to find the IP headers at the network offset. Fixes: 35b9395104d5 ("netfilter: add generic ARP packet logger") Reported-by: Tom Yan <tom.ty89@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
c3e34866 |
|
24-Mar-2022 |
Phil Sutter <phil@nwl.cc> |
netfilter: nf_log_syslog: Consolidate entry checks Every syslog logging callback has to perform the same check to cover for rogue containers, introduce a helper for clarity. Drop the FIXME as there is a viable solution since commit 2851940ffee31 ("netfilter: allow logging from non-init namespaces"). Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
0c878380 |
|
24-Mar-2022 |
Phil Sutter <phil@nwl.cc> |
netfilter: nf_log_syslog: Don't ignore unknown protocols With netdev and bridge nfprotos, loggers may see arbitrary ethernet frames. Print at least basic info like interfaces and MAC header data. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
39ab798f |
|
24-Mar-2022 |
Phil Sutter <phil@nwl.cc> |
netfilter: nf_log_syslog: Merge MAC header dumpers The functions for IPv4 and IPv6 were almost identical apart from extra SIT tunnel device handling in the latter. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
593268dd |
|
20-Apr-2021 |
Phil Sutter <phil@nwl.cc> |
netfilter: nf_log_syslog: Unset bridge logger in pernet exit Without this, a stale pointer remains in pernet loggers after module unload causing a kernel oops during dereference. Easily reproduced by: | # modprobe nf_log_syslog | # rmmod nf_log_syslog | # cat /proc/net/netfilter/nf_log Fixes: 77ccee96a6742 ("netfilter: nf_log_bridge: merge with nf_log_syslog") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
e465cccd |
|
25-Mar-2021 |
Florian Westphal <fw@strlen.de> |
netfilter: nf_log_common: merge with nf_log_syslog Remove nf_log_common. Now that all per-af modules have been merged there is no longer a need to provide a helper module. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
77ccee96 |
|
25-Mar-2021 |
Florian Westphal <fw@strlen.de> |
netfilter: nf_log_bridge: merge with nf_log_syslog Provide bridge log support from nf_log_syslog. After the merge there is no need to load the "real packet loggers", all of them now reside in the same module. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
1510618e |
|
25-Mar-2021 |
Florian Westphal <fw@strlen.de> |
netfilter: nf_log_netdev: merge with nf_log_syslog Provide netdev family support from the nf_log_syslog module. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
f5466caa |
|
25-Mar-2021 |
Florian Westphal <fw@strlen.de> |
netfilter: nf_log_ipv6: merge with nf_log_syslog This removes the nf_log_ipv6 module, the functionality is now provided by nf_log_syslog. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
f11d61e7 |
|
25-Mar-2021 |
Florian Westphal <fw@strlen.de> |
netfilter: nf_log_arp: merge with nf_log_syslog similar to previous change: nf_log_syslog now covers ARP logging as well, the old nf_log_arp module is removed. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
#
db3187ae |
|
25-Mar-2021 |
Florian Westphal <fw@strlen.de> |
netfilter: nf_log_ipv4: rename to nf_log_syslog Netfilter has multiple log modules: nf_log_arp nf_log_bridge nf_log_ipv4 nf_log_ipv6 nf_log_netdev nfnetlink_log nf_log_common With the exception of nfnetlink_log (packet is sent to userspace for dissection/logging), all of them log to the kernel ringbuffer. This is the first part of a series to merge all modules except nfnetlink_log into a single module: nf_log_syslog. This allows to reduce code. After the series, only two log modules remain: nfnetlink_log and nf_log_syslog. The latter provides the same functionality as the old per-af log modules. This renames nf_log_ipv4 to nf_log_syslog. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|