kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/bridge
History
Florian Westphal 6dcc8ba8a6 netfilter: nf_queue: drop packets with cloned unconfirmed conntracks 
[ Upstream commit 7d8dc1c7be ]

Conntrack assumes an unconfirmed entry (not yet committed to global hash
table) has a refcount of 1 and is not visible to other cores.

With multicast forwarding this assumption breaks down because such
skbs get cloned after being picked up, i.e.  ct->use refcount is > 1.

Likewise, bridge netfilter will clone broad/mutlicast frames and
all frames in case they need to be flood-forwarded during learning
phase.

For ip multicast forwarding or plain bridge flood-forward this will
"work" because packets don't leave softirq and are implicitly
serialized.

With nfqueue this no longer holds true, the packets get queued
and can be reinjected in arbitrary ways.

Disable this feature, I see no other solution.

After this patch, nfqueue cannot queue packets except the last
multicast/broadcast packet.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-08-29 17:30:25 +02:00
..
netfilter netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:07:07 +02:00
br.c net: bridge: mst: Multiple Spanning Tree (MST) mode 2022-03-17 16:49:57 -07:00
br_arp_nd_proxy.c neighbour: annotate lockless accesses to n->nud_state 2023-10-10 22:00:42 +02:00
br_cfm.c bridge: cfm: remove redundant return 2021-06-22 10:35:15 -07:00
br_cfm_netlink.c bridge: cfm: fix enum typo in br_cc_ccm_tx_parse 2024-02-05 20:12:54 +00:00
br_device.c net: bridge: xmit: make sure we have at least eth header len bytes 2024-06-12 11:03:32 +02:00
br_fdb.c rtnetlink: add extack support in fdb del handlers 2022-05-09 11:58:20 +01:00
br_forward.c net: bridge: mst: Check vlan state for egress decision 2024-08-03 08:49:09 +02:00
br_if.c net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode 2023-07-19 16:22:04 +02:00
br_input.c netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:07:07 +02:00
br_ioctl.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2021-12-31 14:35:40 +00:00
br_mdb.c net: bridge: allow add/remove permanent mdb entries on disabled ports 2022-06-15 09:35:21 +01:00
br_mrp.c net: bridge: mrp: Update the Test frames for MRA 2021-06-28 15:46:10 -07:00
br_mrp_netlink.c bridge: mrp: Use hlist_head instead of list_head for mrp 2020-11-09 16:42:12 -08:00
br_mrp_switchdev.c bridge: mrp: Extend br_mrp_switchdev to detect better the errors 2021-02-16 14:47:46 -08:00
br_mst.c net: bridge: mst: fix suspicious rcu usage in br_mst_set_state 2024-06-21 14:35:52 +02:00
br_multicast.c net: bridge: mcast: wait for previous gc cycles when removing port 2024-08-14 13:52:43 +02:00
br_multicast_eht.c net: bridge: multicast: use multicast contexts instead of bridge or port 2021-07-20 05:41:19 -07:00
br_netfilter_hooks.c netfilter: nf_queue: drop packets with cloned unconfirmed conntracks 2024-08-29 17:30:25 +02:00
br_netfilter_ipv6.c netfilter: bridge: replace physindev with physinif in nf_bridge_info 2024-01-25 15:27:51 -08:00
br_netlink.c net-sysfs: convert dev->operstate reads to lockless ones 2024-05-17 11:56:13 +02:00
br_netlink_tunnel.c net: bridge: notify on vlan tunnel changes done via the old api 2020-07-12 15:18:24 -07:00
br_nf_core.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2019-12-24 22:28:54 -08:00
br_private.h netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:07:07 +02:00
br_private_cfm.h bridge: cfm: Kernel space implementation of CFM. CCM frame RX added. 2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h net: bridge: multicast: use multicast contexts instead of bridge or port 2021-07-20 05:41:19 -07:00
br_private_mrp.h net: bridge: mrp: Update the Test frames for MRA 2021-06-28 15:46:10 -07:00
br_private_stp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
br_private_tunnel.h bridge: always declare tunnel functions 2023-05-24 17:32:48 +01:00
br_stp.c net: bridge: mst: Multiple Spanning Tree (MST) mode 2022-03-17 16:49:57 -07:00
br_stp_bpdu.c net: bridge: add STP xstats 2019-12-14 20:02:36 -08:00
br_stp_if.c Revert "bridge: Add extack warning when enabling STP in netns." 2023-09-13 09:42:20 +02:00
br_stp_timer.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
br_switchdev.c net: bridge: switchdev: Ensure deferred event delivery on unoffload 2024-03-01 13:26:36 +01:00
br_sysfs_br.c bridge: Fix flushing of dynamic FDB entries 2022-11-02 20:47:09 -07:00
br_sysfs_if.c bridge: move from strlcpy with unused retval to strscpy 2022-08-22 17:57:30 -07:00
br_vlan.c bridge: switchdev: Fix memory leaks when changing VLAN protocol 2022-11-15 13:38:11 +01:00
br_vlan_options.c net: bridge: mst: Allow changing a VLAN's MSTI 2022-03-17 16:49:57 -07:00
br_vlan_tunnel.c net: bridge: change return type of br_handle_ingress_vlan_tunnel 2021-08-24 16:51:09 -07:00
Kconfig bridge: cfm: Add BRIDGE_CFM to Kconfig. 2020-10-29 18:39:43 -07:00
Makefile net: bridge: mst: Multiple Spanning Tree (MST) mode 2022-03-17 16:49:57 -07:00