iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nat: fix src map lookup

Browse Source 
commit 97772bcd56 upstream.

When doing initial conversion to rhashtable I replaced the bucket
walk with a single rhashtable_lookup_fast().

When moving to rhlist I failed to properly walk the list of identical
tuples, but that is what is needed for this to work correctly.
The table contains the original tuples, so the reply tuples are all
distinct.

We currently decide that mapping is (not) in range only based on the
first entry, but in case its not we need to try the reply tuple of the
next entry until we either find an in-range mapping or we checked
all the entries.

This bug makes nat core attempt collision resolution while it might be
able to use the mapping as-is.

Fixes: 870190a9ec ("netfilter: nat: convert nat bysrc hash to rhashtable")
Reported-by: Jaco Kroon <jaco@uls.co.za>
Tested-by: Jaco Kroon <jaco@uls.co.za>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Florian Westphal
2017-07-07 13:07:17 +02:00
committed by Greg Kroah-Hartman
parent 090911a22c
commit 5f81b1f51b
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
net/netfilter/nf_nat_core.c
View File

@ -225,20 +225,21 @@ find_appropriate_src(struct net *net,
.tuple = tuple, .tuple = tuple,
.zone = zone .zone = zone
}; };
struct rhlist_head *hl; struct rhlist_head *hl, *h;
hl = rhltable_lookup(&nf_nat_bysource_table, &key, hl = rhltable_lookup(&nf_nat_bysource_table, &key,
nf_nat_bysource_params); nf_nat_bysource_params);
if (!hl)
return 0;
ct = container_of(hl, typeof(*ct), nat_bysource); rhl_for_each_entry_rcu(ct, h, hl, nat_bysource) {
nf_ct_invert_tuplepr(result,
&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
result->dst = tuple->dst;
nf_ct_invert_tuplepr(result, if (in_range(l3proto, l4proto, result, range))
&ct->tuplehash[IP_CT_DIR_REPLY].tuple); return 1;
result->dst = tuple->dst; }
return in_range(l3proto, l4proto, result, range); return 0;
} }
/* For [FUTURE] fragmentation handling, we want the least-used /* For [FUTURE] fragmentation handling, we want the least-used