| Message ID | 20201121111151.15960-1-jengelh@inai.de |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | netfilter: use actual socket sk for REJECT action | expand |
Hi Jan, On Sat, Nov 21, 2020 at 12:11:51PM +0100, Jan Engelhardt wrote: > True to the message of commit v5.10-rc1-105-g46d6c5ae953c, _do_ > actually make use of state->sk when possible, such as in the REJECT > modules. Could you rebase and resend a v2? I think this patch is clashing with recent updates to add REJECT support for ingress. Thanks.
On Tuesday 2020-12-01 09:49, Pablo Neira Ayuso wrote: >Hi Jan, > >On Sat, Nov 21, 2020 at 12:11:51PM +0100, Jan Engelhardt wrote: >> True to the message of commit v5.10-rc1-105-g46d6c5ae953c, _do_ >> actually make use of state->sk when possible, such as in the REJECT >> modules. > >Could you rebase and resend a v2? I think this patch is clashing with >recent updates to add REJECT support for ingress. I observed no conflict when attempting the rebase command, either onto cb7fb043e69a (/pub/scm/linux/kernel/git/netdev/net-next.git #master) or f7583f02a538 (/pub/scm/linux/kernel/git/pablo/nf-next #master)
On Tue, Dec 01, 2020 at 01:49:21PM +0100, Jan Engelhardt wrote: > On Tuesday 2020-12-01 09:49, Pablo Neira Ayuso wrote: > > >Hi Jan, > > > >On Sat, Nov 21, 2020 at 12:11:51PM +0100, Jan Engelhardt wrote: > >> True to the message of commit v5.10-rc1-105-g46d6c5ae953c, _do_ > >> actually make use of state->sk when possible, such as in the REJECT > >> modules. > > > >Could you rebase and resend a v2? I think this patch is clashing with > >recent updates to add REJECT support for ingress. > > I observed no conflict when attempting the rebase command, either onto > cb7fb043e69a (/pub/scm/linux/kernel/git/netdev/net-next.git #master) or > f7583f02a538 (/pub/scm/linux/kernel/git/pablo/nf-next #master) I see, it does not apply via: git am netfilter-use-actual-socket-sk-for-REJECT-action.patch because patch shows: diff --git include/net/netfilter/ipv4/nf_reject.h include/net/netfilter/ipv4/nf_reject.h index 40e0e0623f46..d8207a82d761 100644 --- include/net/netfilter/ipv4/nf_reject.h +++ include/net/netfilter/ipv4/nf_reject.h instead of: diff --git a/include/net/netfilter/ipv4/nf_reject.h b/include/net/netfilter/ipv4/nf_reject.h index 40e0e0623f46..d8207a82d761 100644 --- a/include/net/netfilter/ipv4/nf_reject.h +++ b/include/net/netfilter/ipv4/nf_reject.h I just manually updated the patch so now it works. Is there a similar way to make patch -p0 for git-am BTW? Thanks.
On 2020-12-01, at 14:36:39 +0100, Pablo Neira Ayuso wrote: > On Tue, Dec 01, 2020 at 01:49:21PM +0100, Jan Engelhardt wrote: > > On Tuesday 2020-12-01 09:49, Pablo Neira Ayuso wrote: > > >On Sat, Nov 21, 2020 at 12:11:51PM +0100, Jan Engelhardt wrote: > > >> True to the message of commit v5.10-rc1-105-g46d6c5ae953c, _do_ > > >> actually make use of state->sk when possible, such as in the REJECT > > >> modules. > > > > > >Could you rebase and resend a v2? I think this patch is clashing with > > >recent updates to add REJECT support for ingress. > > > > I observed no conflict when attempting the rebase command, either onto > > cb7fb043e69a (/pub/scm/linux/kernel/git/netdev/net-next.git #master) or > > f7583f02a538 (/pub/scm/linux/kernel/git/pablo/nf-next #master) > > I see, it does not apply via: > > git am netfilter-use-actual-socket-sk-for-REJECT-action.patch > > because patch shows: > > diff --git include/net/netfilter/ipv4/nf_reject.h include/net/netfilter/ipv4/nf_reject.h > index 40e0e0623f46..d8207a82d761 100644 > --- include/net/netfilter/ipv4/nf_reject.h > +++ include/net/netfilter/ipv4/nf_reject.h > > instead of: > > diff --git a/include/net/netfilter/ipv4/nf_reject.h b/include/net/netfilter/ipv4/nf_reject.h > index 40e0e0623f46..d8207a82d761 100644 > --- a/include/net/netfilter/ipv4/nf_reject.h > +++ b/include/net/netfilter/ipv4/nf_reject.h > > I just manually updated the patch so now it works. > > Is there a similar way to make patch -p0 for git-am BTW? git am -p0. J.
On Tuesday 2020-12-01 14:36, Pablo Neira Ayuso wrote: >I see, it does not apply via: > > git am netfilter-use-actual-socket-sk-for-REJECT-action.patch > >because patch shows: > >--- include/net/netfilter/ipv4/nf_reject.h > >instead of: > >--- a/include/net/netfilter/ipv4/nf_reject.h Ooxh! ~/.gitconfig: [diff] algorithm = histogram noprefix = true diff.noprefix has an effect on `git diff`, but not `git add -p`, but then again does on `git send-email`. That's real intuitive. Not. :-/
diff --git include/net/netfilter/ipv4/nf_reject.h include/net/netfilter/ipv4/nf_reject.h index 40e0e0623f46..d8207a82d761 100644 --- include/net/netfilter/ipv4/nf_reject.h +++ include/net/netfilter/ipv4/nf_reject.h @@ -8,8 +8,8 @@ #include <net/netfilter/nf_reject.h> void nf_send_unreach(struct sk_buff *skb_in, int code, int hook); -void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook); - +void nf_send_reset(struct net *net, struct sock *, struct sk_buff *oldskb, + int hook); const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb, struct tcphdr *_oth, int hook); struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb, diff --git include/net/netfilter/ipv6/nf_reject.h include/net/netfilter/ipv6/nf_reject.h index 4a3ef9ebdf6f..86e87bc2c516 100644 --- include/net/netfilter/ipv6/nf_reject.h +++ include/net/netfilter/ipv6/nf_reject.h @@ -7,9 +7,8 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in, unsigned char code, unsigned int hooknum); - -void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook); - +void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, + int hook); const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb, struct tcphdr *otcph, unsigned int *otcplen, int hook); diff --git net/ipv4/netfilter/ipt_REJECT.c net/ipv4/netfilter/ipt_REJECT.c index e16b98ee6266..4b8840734762 100644 --- net/ipv4/netfilter/ipt_REJECT.c +++ net/ipv4/netfilter/ipt_REJECT.c @@ -56,7 +56,8 @@ reject_tg(struct sk_buff *skb, const struct xt_action_param *par) nf_send_unreach(skb, ICMP_PKT_FILTERED, hook); break; case IPT_TCP_RESET: - nf_send_reset(xt_net(par), skb, hook); + nf_send_reset(xt_net(par), par->state->sk, skb, hook); + break; case IPT_ICMP_ECHOREPLY: /* Doesn't happen. */ break; diff --git net/ipv4/netfilter/nf_reject_ipv4.c net/ipv4/netfilter/nf_reject_ipv4.c index 93b07739807b..efe14a6a5d9b 100644 --- net/ipv4/netfilter/nf_reject_ipv4.c +++ net/ipv4/netfilter/nf_reject_ipv4.c @@ -112,7 +112,8 @@ static int nf_reject_fill_skb_dst(struct sk_buff *skb_in) } /* Send RST reply */ -void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) +void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, + int hook) { struct net_device *br_indev __maybe_unused; struct sk_buff *nskb; @@ -144,8 +145,7 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP, ip4_dst_hoplimit(skb_dst(nskb))); nf_reject_ip_tcphdr_put(nskb, oldskb, oth); - - if (ip_route_me_harder(net, nskb->sk, nskb, RTN_UNSPEC)) + if (ip_route_me_harder(net, sk, nskb, RTN_UNSPEC)) goto free_nskb; niph = ip_hdr(nskb); diff --git net/ipv4/netfilter/nft_reject_ipv4.c net/ipv4/netfilter/nft_reject_ipv4.c index e408f813f5d8..ff437e4ed6db 100644 --- net/ipv4/netfilter/nft_reject_ipv4.c +++ net/ipv4/netfilter/nft_reject_ipv4.c @@ -27,7 +27,8 @@ static void nft_reject_ipv4_eval(const struct nft_expr *expr, nf_send_unreach(pkt->skb, priv->icmp_code, nft_hook(pkt)); break; case NFT_REJECT_TCP_RST: - nf_send_reset(nft_net(pkt), pkt->skb, nft_hook(pkt)); + nf_send_reset(nft_net(pkt), pkt->xt.state->sk, pkt->skb, + nft_hook(pkt)); break; default: break; diff --git net/ipv6/netfilter/ip6t_REJECT.c net/ipv6/netfilter/ip6t_REJECT.c index 3ac5485049f0..a35019d2e480 100644 --- net/ipv6/netfilter/ip6t_REJECT.c +++ net/ipv6/netfilter/ip6t_REJECT.c @@ -61,7 +61,7 @@ reject_tg6(struct sk_buff *skb, const struct xt_action_param *par) /* Do nothing */ break; case IP6T_TCP_RESET: - nf_send_reset6(net, skb, xt_hooknum(par)); + nf_send_reset6(net, par->state->sk, skb, xt_hooknum(par)); break; case IP6T_ICMP6_POLICY_FAIL: nf_send_unreach6(net, skb, ICMPV6_POLICY_FAIL, xt_hooknum(par)); diff --git net/ipv6/netfilter/nf_reject_ipv6.c net/ipv6/netfilter/nf_reject_ipv6.c index 4aef6baaa55e..8b145f2a2841 100644 --- net/ipv6/netfilter/nf_reject_ipv6.c +++ net/ipv6/netfilter/nf_reject_ipv6.c @@ -141,7 +141,8 @@ static int nf_reject6_fill_skb_dst(struct sk_buff *skb_in) return 0; } -void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook) +void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, + int hook) { struct net_device *br_indev __maybe_unused; struct sk_buff *nskb; @@ -233,7 +234,7 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook) dev_queue_xmit(nskb); } else #endif - ip6_local_out(net, nskb->sk, nskb); + ip6_local_out(net, sk, nskb); } EXPORT_SYMBOL_GPL(nf_send_reset6); diff --git net/ipv6/netfilter/nft_reject_ipv6.c net/ipv6/netfilter/nft_reject_ipv6.c index c1098a1968e1..7969d1f3018d 100644 --- net/ipv6/netfilter/nft_reject_ipv6.c +++ net/ipv6/netfilter/nft_reject_ipv6.c @@ -28,7 +28,8 @@ static void nft_reject_ipv6_eval(const struct nft_expr *expr, nft_hook(pkt)); break; case NFT_REJECT_TCP_RST: - nf_send_reset6(nft_net(pkt), pkt->skb, nft_hook(pkt)); + nf_send_reset6(nft_net(pkt), pkt->xt.state->sk, pkt->skb, + nft_hook(pkt)); break; default: break; diff --git net/netfilter/nft_reject_inet.c net/netfilter/nft_reject_inet.c index cf8f2646e93c..36b219e2e896 100644 --- net/netfilter/nft_reject_inet.c +++ net/netfilter/nft_reject_inet.c @@ -28,7 +28,8 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, nft_hook(pkt)); break; case NFT_REJECT_TCP_RST: - nf_send_reset(nft_net(pkt), pkt->skb, nft_hook(pkt)); + nf_send_reset(nft_net(pkt), pkt->xt.state->sk, + pkt->skb, nft_hook(pkt)); break; case NFT_REJECT_ICMPX_UNREACH: nf_send_unreach(pkt->skb, @@ -44,7 +45,8 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, priv->icmp_code, nft_hook(pkt)); break; case NFT_REJECT_TCP_RST: - nf_send_reset6(nft_net(pkt), pkt->skb, nft_hook(pkt)); + nf_send_reset6(nft_net(pkt), pkt->xt.state->sk, + pkt->skb, nft_hook(pkt)); break; case NFT_REJECT_ICMPX_UNREACH: nf_send_unreach6(nft_net(pkt), pkt->skb,
True to the message of commit v5.10-rc1-105-g46d6c5ae953c, _do_ actually make use of state->sk when possible, such as in the REJECT modules. Reported-by: Minqiang Chen <ptpt52@gmail.com> Cc: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Jan Engelhardt <jengelh@inai.de> --- Compile-tested only. As 46d6c5ae9 has made its way into stable, maybe this one shall too. include/net/netfilter/ipv4/nf_reject.h | 4 ++-- include/net/netfilter/ipv6/nf_reject.h | 5 ++--- net/ipv4/netfilter/ipt_REJECT.c | 3 ++- net/ipv4/netfilter/nf_reject_ipv4.c | 6 +++--- net/ipv4/netfilter/nft_reject_ipv4.c | 3 ++- net/ipv6/netfilter/ip6t_REJECT.c | 2 +- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +++-- net/ipv6/netfilter/nft_reject_ipv6.c | 3 ++- net/netfilter/nft_reject_inet.c | 6 ++++-- 9 files changed, 21 insertions(+), 16 deletions(-)