Hello,
This patchset contains netfilter related fixes for the net tree.
1. Fix IP address check in irc DCC conntrack helper, this should check
the opposite direction rather than the destination address of the
packets' direction, from David Leadbeater.
2. bridge netfilter needs to drop dst references, from Harsh Modi.
This was fine back in the day the code was originally written,
but nowadays various tunnels can pre-set metadata dsts on packets.
3. Remove nf_conntrack_helper sysctl and the modparam toggle, users
need to explicitily assign the helpers to use via nftables or
iptables. Conntrack helpers, by design, may be used to add dynamic
port redirections to internal machines, so its necessary to restrict
which hosts/peers are allowed to use them.
The auto-assign-for-everything mechanism has been in "please don't do this"
territory since 2012. From Pablo.
4. Fix a memory leak in the netdev hook error unwind path, also from Pablo.
----------------------------------------------------------------
The following changes since commit 13a9d08c296228d18289de60b83792c586e1d073:
net: lan966x: improve error handle in lan966x_fdma_rx_get_frame() (2022-08-30 23:18:17 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
for you to fetch changes up to 0efe125cfb99e6773a7434f3463f7c2fa28f3a43:
netfilter: nf_conntrack_irc: Fix forged IP logic (2022-09-01 02:01:56 +0200)
----------------------------------------------------------------
David Leadbeater (1):
netfilter: nf_conntrack_irc: Fix forged IP logic
Harsh Modi (1):
netfilter: br_netfilter: Drop dst references before setting.
Pablo Neira Ayuso (2):
netfilter: remove nf_conntrack_helper sysctl and modparam toggles
netfilter: nf_tables: clean up hook list when offload flags check fails
include/net/netfilter/nf_conntrack.h | 2 -
include/net/netns/conntrack.h | 1 -
net/bridge/br_netfilter_hooks.c | 2 +
net/bridge/br_netfilter_ipv6.c | 1 +
net/netfilter/nf_conntrack_core.c | 7 +-
net/netfilter/nf_conntrack_helper.c | 80 +++-------------------
net/netfilter/nf_conntrack_irc.c | 5 +-
net/netfilter/nf_conntrack_netlink.c | 5 --
net/netfilter/nf_conntrack_standalone.c | 10 ---
net/netfilter/nf_tables_api.c | 4 +-
net/netfilter/nft_ct.c | 3 -
.../selftests/netfilter/nft_conntrack_helper.sh | 36 +++++++---
12 files changed, 46 insertions(+), 110 deletions(-)
Hello, This patchset contains netfilter related fixes for the net tree. 1. Fix IP address check in irc DCC conntrack helper, this should check the opposite direction rather than the destination address of the packets' direction, from David Leadbeater. 2. bridge netfilter needs to drop dst references, from Harsh Modi. This was fine back in the day the code was originally written, but nowadays various tunnels can pre-set metadata dsts on packets. 3. Remove nf_conntrack_helper sysctl and the modparam toggle, users need to explicitily assign the helpers to use via nftables or iptables. Conntrack helpers, by design, may be used to add dynamic port redirections to internal machines, so its necessary to restrict which hosts/peers are allowed to use them. The auto-assign-for-everything mechanism has been in "please don't do this" territory since 2012. From Pablo. 4. Fix a memory leak in the netdev hook error unwind path, also from Pablo. ---------------------------------------------------------------- The following changes since commit 13a9d08c296228d18289de60b83792c586e1d073: net: lan966x: improve error handle in lan966x_fdma_rx_get_frame() (2022-08-30 23:18:17 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git for you to fetch changes up to 0efe125cfb99e6773a7434f3463f7c2fa28f3a43: netfilter: nf_conntrack_irc: Fix forged IP logic (2022-09-01 02:01:56 +0200) ---------------------------------------------------------------- David Leadbeater (1): netfilter: nf_conntrack_irc: Fix forged IP logic Harsh Modi (1): netfilter: br_netfilter: Drop dst references before setting. Pablo Neira Ayuso (2): netfilter: remove nf_conntrack_helper sysctl and modparam toggles netfilter: nf_tables: clean up hook list when offload flags check fails include/net/netfilter/nf_conntrack.h | 2 - include/net/netns/conntrack.h | 1 - net/bridge/br_netfilter_hooks.c | 2 + net/bridge/br_netfilter_ipv6.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_helper.c | 80 +++------------------- net/netfilter/nf_conntrack_irc.c | 5 +- net/netfilter/nf_conntrack_netlink.c | 5 -- net/netfilter/nf_conntrack_standalone.c | 10 --- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nft_ct.c | 3 - .../selftests/netfilter/nft_conntrack_helper.sh | 36 +++++++--- 12 files changed, 46 insertions(+), 110 deletions(-)