Skip to content

Commit fc0c68c

Browse files
emmilemmil
committed
Merge: netfilter: xtables: avoid NFPROTO_UNSPEC where needed
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/5575 ``` CVE: CVE-2024-50038 JIRA: https://issues.redhat.com/browse/RHEL-63905 ``` Signed-off-by: Phil Sutter <psutter@redhat.com> Approved-by: Florian Westphal <fwestpha@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Rado Vrbovsky <rvrbovsk@redhat.com>
2 parents 9a2a408 + 01de117 commit fc0c68c

File tree

16 files changed

+435
-176
lines changed

16 files changed

+435
-176
lines changed

‎net/netfilter/xt_CHECKSUM.c‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -63,24 +63,37 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)
6363
return 0;
6464
}
6565

66-
static struct xt_target checksum_tg_reg __read_mostly = {
67-
.name = "CHECKSUM",
68-
.family = NFPROTO_UNSPEC,
69-
.target = checksum_tg,
70-
.targetsize = sizeof(struct xt_CHECKSUM_info),
71-
.table = "mangle",
72-
.checkentry = checksum_tg_check,
73-
.me = THIS_MODULE,
66+
static struct xt_target checksum_tg_reg[] __read_mostly = {
67+
{
68+
.name = "CHECKSUM",
69+
.family = NFPROTO_IPV4,
70+
.target = checksum_tg,
71+
.targetsize = sizeof(struct xt_CHECKSUM_info),
72+
.table = "mangle",
73+
.checkentry = checksum_tg_check,
74+
.me = THIS_MODULE,
75+
},
76+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
77+
{
78+
.name = "CHECKSUM",
79+
.family = NFPROTO_IPV6,
80+
.target = checksum_tg,
81+
.targetsize = sizeof(struct xt_CHECKSUM_info),
82+
.table = "mangle",
83+
.checkentry = checksum_tg_check,
84+
.me = THIS_MODULE,
85+
},
86+
#endif
7487
};
7588

7689
static int __init checksum_tg_init(void)
7790
{
78-
return xt_register_target(&checksum_tg_reg);
91+
return xt_register_targets(checksum_tg_reg, ARRAY_SIZE(checksum_tg_reg));
7992
}
8093

8194
static void __exit checksum_tg_exit(void)
8295
{
83-
xt_unregister_target(&checksum_tg_reg);
96+
xt_unregister_targets(checksum_tg_reg, ARRAY_SIZE(checksum_tg_reg));
8497
}
8598

8699
module_init(checksum_tg_init);

‎net/netfilter/xt_CLASSIFY.c‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,9 @@ static struct xt_target classify_tg_reg[] __read_mostly = {
3838
{
3939
.name = "CLASSIFY",
4040
.revision = 0,
41-
.family = NFPROTO_UNSPEC,
41+
.family = NFPROTO_IPV4,
4242
.hooks = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
43-
(1 << NF_INET_POST_ROUTING),
43+
(1 << NF_INET_POST_ROUTING),
4444
.target = classify_tg,
4545
.targetsize = sizeof(struct xt_classify_target_info),
4646
.me = THIS_MODULE,
@@ -54,6 +54,18 @@ static struct xt_target classify_tg_reg[] __read_mostly = {
5454
.targetsize = sizeof(struct xt_classify_target_info),
5555
.me = THIS_MODULE,
5656
},
57+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
58+
{
59+
.name = "CLASSIFY",
60+
.revision = 0,
61+
.family = NFPROTO_IPV6,
62+
.hooks = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) |
63+
(1 << NF_INET_POST_ROUTING),
64+
.target = classify_tg,
65+
.targetsize = sizeof(struct xt_classify_target_info),
66+
.me = THIS_MODULE,
67+
},
68+
#endif
5769
};
5870

5971
static int __init classify_tg_init(void)

‎net/netfilter/xt_CONNSECMARK.c‎

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -114,25 +114,39 @@ static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par)
114114
nf_ct_netns_put(par->net, par->family);
115115
}
116116

117-
static struct xt_target connsecmark_tg_reg __read_mostly = {
118-
.name = "CONNSECMARK",
119-
.revision = 0,
120-
.family = NFPROTO_UNSPEC,
121-
.checkentry = connsecmark_tg_check,
122-
.destroy = connsecmark_tg_destroy,
123-
.target = connsecmark_tg,
124-
.targetsize = sizeof(struct xt_connsecmark_target_info),
125-
.me = THIS_MODULE,
117+
static struct xt_target connsecmark_tg_reg[] __read_mostly = {
118+
{
119+
.name = "CONNSECMARK",
120+
.revision = 0,
121+
.family = NFPROTO_IPV4,
122+
.checkentry = connsecmark_tg_check,
123+
.destroy = connsecmark_tg_destroy,
124+
.target = connsecmark_tg,
125+
.targetsize = sizeof(struct xt_connsecmark_target_info),
126+
.me = THIS_MODULE,
127+
},
128+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
129+
{
130+
.name = "CONNSECMARK",
131+
.revision = 0,
132+
.family = NFPROTO_IPV6,
133+
.checkentry = connsecmark_tg_check,
134+
.destroy = connsecmark_tg_destroy,
135+
.target = connsecmark_tg,
136+
.targetsize = sizeof(struct xt_connsecmark_target_info),
137+
.me = THIS_MODULE,
138+
},
139+
#endif
126140
};
127141

128142
static int __init connsecmark_tg_init(void)
129143
{
130-
return xt_register_target(&connsecmark_tg_reg);
144+
return xt_register_targets(connsecmark_tg_reg, ARRAY_SIZE(connsecmark_tg_reg));
131145
}
132146

133147
static void __exit connsecmark_tg_exit(void)
134148
{
135-
xt_unregister_target(&connsecmark_tg_reg);
149+
xt_unregister_targets(connsecmark_tg_reg, ARRAY_SIZE(connsecmark_tg_reg));
136150
}
137151

138152
module_init(connsecmark_tg_init);

‎net/netfilter/xt_CT.c‎

Lines changed: 81 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -313,10 +313,41 @@ static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
313313
xt_ct_tg_destroy(par, par->targinfo);
314314
}
315315

316+
static unsigned int
317+
notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
318+
{
319+
/* Previously seen (loopback)? Ignore. */
320+
if (skb->_nfct != 0)
321+
return XT_CONTINUE;
322+
323+
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
324+
325+
return XT_CONTINUE;
326+
}
327+
328+
static int notrack_chk(const struct xt_tgchk_param *par)
329+
{
330+
if (!par->net->xt.notrack_deprecated_warning) {
331+
pr_info("netfilter: NOTRACK target is deprecated, "
332+
"use CT instead or upgrade iptables\n");
333+
par->net->xt.notrack_deprecated_warning = true;
334+
}
335+
return 0;
336+
}
337+
316338
static struct xt_target xt_ct_tg_reg[] __read_mostly = {
339+
{
340+
.name = "NOTRACK",
341+
.revision = 0,
342+
.family = NFPROTO_IPV4,
343+
.checkentry = notrack_chk,
344+
.target = notrack_tg,
345+
.table = "raw",
346+
.me = THIS_MODULE,
347+
},
317348
{
318349
.name = "CT",
319-
.family = NFPROTO_UNSPEC,
350+
.family = NFPROTO_IPV4,
320351
.targetsize = sizeof(struct xt_ct_target_info),
321352
.usersize = offsetof(struct xt_ct_target_info, ct),
322353
.checkentry = xt_ct_tg_check_v0,
@@ -327,7 +358,7 @@ static struct xt_target xt_ct_tg_reg[] __read_mostly = {
327358
},
328359
{
329360
.name = "CT",
330-
.family = NFPROTO_UNSPEC,
361+
.family = NFPROTO_IPV4,
331362
.revision = 1,
332363
.targetsize = sizeof(struct xt_ct_target_info_v1),
333364
.usersize = offsetof(struct xt_ct_target_info, ct),
@@ -339,7 +370,7 @@ static struct xt_target xt_ct_tg_reg[] __read_mostly = {
339370
},
340371
{
341372
.name = "CT",
342-
.family = NFPROTO_UNSPEC,
373+
.family = NFPROTO_IPV4,
343374
.revision = 2,
344375
.targetsize = sizeof(struct xt_ct_target_info_v1),
345376
.usersize = offsetof(struct xt_ct_target_info, ct),
@@ -349,60 +380,62 @@ static struct xt_target xt_ct_tg_reg[] __read_mostly = {
349380
.table = "raw",
350381
.me = THIS_MODULE,
351382
},
352-
};
353-
354-
static unsigned int
355-
notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
356-
{
357-
/* Previously seen (loopback)? Ignore. */
358-
if (skb->_nfct != 0)
359-
return XT_CONTINUE;
360-
361-
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
362-
363-
return XT_CONTINUE;
364-
}
365-
366-
static int notrack_chk(const struct xt_tgchk_param *par)
367-
{
368-
if (!par->net->xt.notrack_deprecated_warning) {
369-
pr_info("netfilter: NOTRACK target is deprecated, "
370-
"use CT instead or upgrade iptables\n");
371-
par->net->xt.notrack_deprecated_warning = true;
372-
}
373-
return 0;
374-
}
375-
376-
static struct xt_target notrack_tg_reg __read_mostly = {
377-
.name = "NOTRACK",
378-
.revision = 0,
379-
.family = NFPROTO_UNSPEC,
380-
.checkentry = notrack_chk,
381-
.target = notrack_tg,
382-
.table = "raw",
383-
.me = THIS_MODULE,
383+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
384+
{
385+
.name = "NOTRACK",
386+
.revision = 0,
387+
.family = NFPROTO_IPV6,
388+
.checkentry = notrack_chk,
389+
.target = notrack_tg,
390+
.table = "raw",
391+
.me = THIS_MODULE,
392+
},
393+
{
394+
.name = "CT",
395+
.family = NFPROTO_IPV6,
396+
.targetsize = sizeof(struct xt_ct_target_info),
397+
.usersize = offsetof(struct xt_ct_target_info, ct),
398+
.checkentry = xt_ct_tg_check_v0,
399+
.destroy = xt_ct_tg_destroy_v0,
400+
.target = xt_ct_target_v0,
401+
.table = "raw",
402+
.me = THIS_MODULE,
403+
},
404+
{
405+
.name = "CT",
406+
.family = NFPROTO_IPV6,
407+
.revision = 1,
408+
.targetsize = sizeof(struct xt_ct_target_info_v1),
409+
.usersize = offsetof(struct xt_ct_target_info, ct),
410+
.checkentry = xt_ct_tg_check_v1,
411+
.destroy = xt_ct_tg_destroy_v1,
412+
.target = xt_ct_target_v1,
413+
.table = "raw",
414+
.me = THIS_MODULE,
415+
},
416+
{
417+
.name = "CT",
418+
.family = NFPROTO_IPV6,
419+
.revision = 2,
420+
.targetsize = sizeof(struct xt_ct_target_info_v1),
421+
.usersize = offsetof(struct xt_ct_target_info, ct),
422+
.checkentry = xt_ct_tg_check_v2,
423+
.destroy = xt_ct_tg_destroy_v1,
424+
.target = xt_ct_target_v1,
425+
.table = "raw",
426+
.me = THIS_MODULE,
427+
},
428+
#endif
384429
};
385430

386431
static int __init xt_ct_tg_init(void)
387432
{
388-
int ret;
389-
390-
ret = xt_register_target(&notrack_tg_reg);
391-
if (ret < 0)
392-
return ret;
393-
394-
ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
395-
if (ret < 0) {
396-
xt_unregister_target(&notrack_tg_reg);
397-
return ret;
398-
}
399-
return 0;
433+
return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
400434
}
401435

402436
static void __exit xt_ct_tg_exit(void)
403437
{
404438
xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
405-
xt_unregister_target(&notrack_tg_reg);
406439
}
407440

408441
module_init(xt_ct_tg_init);

‎net/netfilter/xt_IDLETIMER.c‎

Lines changed: 40 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -458,28 +458,49 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
458458

459459
static struct xt_target idletimer_tg[] __read_mostly = {
460460
{
461-
.name = "IDLETIMER",
462-
.family = NFPROTO_UNSPEC,
463-
.target = idletimer_tg_target,
464-
.targetsize = sizeof(struct idletimer_tg_info),
465-
.usersize = offsetof(struct idletimer_tg_info, timer),
466-
.checkentry = idletimer_tg_checkentry,
467-
.destroy = idletimer_tg_destroy,
468-
.me = THIS_MODULE,
461+
.name = "IDLETIMER",
462+
.family = NFPROTO_IPV4,
463+
.target = idletimer_tg_target,
464+
.targetsize = sizeof(struct idletimer_tg_info),
465+
.usersize = offsetof(struct idletimer_tg_info, timer),
466+
.checkentry = idletimer_tg_checkentry,
467+
.destroy = idletimer_tg_destroy,
468+
.me = THIS_MODULE,
469469
},
470470
{
471-
.name = "IDLETIMER",
472-
.family = NFPROTO_UNSPEC,
473-
.revision = 1,
474-
.target = idletimer_tg_target_v1,
475-
.targetsize = sizeof(struct idletimer_tg_info_v1),
476-
.usersize = offsetof(struct idletimer_tg_info_v1, timer),
477-
.checkentry = idletimer_tg_checkentry_v1,
478-
.destroy = idletimer_tg_destroy_v1,
479-
.me = THIS_MODULE,
471+
.name = "IDLETIMER",
472+
.family = NFPROTO_IPV4,
473+
.revision = 1,
474+
.target = idletimer_tg_target_v1,
475+
.targetsize = sizeof(struct idletimer_tg_info_v1),
476+
.usersize = offsetof(struct idletimer_tg_info_v1, timer),
477+
.checkentry = idletimer_tg_checkentry_v1,
478+
.destroy = idletimer_tg_destroy_v1,
479+
.me = THIS_MODULE,
480480
},
481-
482-
481+
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
482+
{
483+
.name = "IDLETIMER",
484+
.family = NFPROTO_IPV6,
485+
.target = idletimer_tg_target,
486+
.targetsize = sizeof(struct idletimer_tg_info),
487+
.usersize = offsetof(struct idletimer_tg_info, timer),
488+
.checkentry = idletimer_tg_checkentry,
489+
.destroy = idletimer_tg_destroy,
490+
.me = THIS_MODULE,
491+
},
492+
{
493+
.name = "IDLETIMER",
494+
.family = NFPROTO_IPV6,
495+
.revision = 1,
496+
.target = idletimer_tg_target_v1,
497+
.targetsize = sizeof(struct idletimer_tg_info_v1),
498+
.usersize = offsetof(struct idletimer_tg_info_v1, timer),
499+
.checkentry = idletimer_tg_checkentry_v1,
500+
.destroy = idletimer_tg_destroy_v1,
501+
.me = THIS_MODULE,
502+
},
503+
#endif
483504
};
484505

485506
static struct class *idletimer_tg_class;

0 commit comments

Comments
 (0)