Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Thadeu Lima de Souza Cascardo 870dcc31c0 netfilter: nf_tables: prevent OOB access in nft_byteorder_eval ... commit caf3ef7468 upstream. When evaluating byteorder expressions with size 2, a union with 32-bit and 16-bit members is used. Since the 16-bit members are aligned to 32-bit, the array accesses will be out-of-bounds. It may lead to a stack-out-of-bounds access like the one below: [ 23.095215] ================================================================== [ 23.095625] BUG: KASAN: stack-out-of-bounds in nft_byteorder_eval+0x13c/0x320 [ 23.096020] Read of size 2 at addr ffffc90000007948 by task ping/115 [ 23.096358] [ 23.096456] CPU: 0 PID: 115 Comm: ping Not tainted 6.4.0+ #413 [ 23.096770] Call Trace: [ 23.096910] <IRQ> [ 23.097030] dump_stack_lvl+0x60/0xc0 [ 23.097218] print_report+0xcf/0x630 [ 23.097388] ? nft_byteorder_eval+0x13c/0x320 [ 23.097577] ? kasan_addr_to_slab+0xd/0xc0 [ 23.097760] ? nft_byteorder_eval+0x13c/0x320 [ 23.097949] kasan_report+0xc9/0x110 [ 23.098106] ? nft_byteorder_eval+0x13c/0x320 [ 23.098298] __asan_load2+0x83/0xd0 [ 23.098453] nft_byteorder_eval+0x13c/0x320 [ 23.098659] nft_do_chain+0x1c8/0xc50 [ 23.098852] ? __pfx_nft_do_chain+0x10/0x10 [ 23.099078] ? __kasan_check_read+0x11/0x20 [ 23.099295] ? __pfx___lock_acquire+0x10/0x10 [ 23.099535] ? __pfx___lock_acquire+0x10/0x10 [ 23.099745] ? __kasan_check_read+0x11/0x20 [ 23.099929] nft_do_chain_ipv4+0xfe/0x140 [ 23.100105] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 23.100327] ? lock_release+0x204/0x400 [ 23.100515] ? nf_hook.constprop.0+0x340/0x550 [ 23.100779] nf_hook_slow+0x6c/0x100 [ 23.100977] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 23.101223] nf_hook.constprop.0+0x334/0x550 [ 23.101443] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 23.101677] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 23.101882] ? __pfx_ip_rcv_finish+0x10/0x10 [ 23.102071] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 23.102291] ? rcu_read_lock_held+0x4b/0x70 [ 23.102481] ip_local_deliver+0xbb/0x110 [ 23.102665] ? __pfx_ip_rcv+0x10/0x10 [ 23.102839] ip_rcv+0x199/0x2a0 [ 23.102980] ? __pfx_ip_rcv+0x10/0x10 [ 23.103140] __netif_receive_skb_one_core+0x13e/0x150 [ 23.103362] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 23.103647] ? mark_held_locks+0x48/0xa0 [ 23.103819] ? process_backlog+0x36c/0x380 [ 23.103999] __netif_receive_skb+0x23/0xc0 [ 23.104179] process_backlog+0x91/0x380 [ 23.104350] __napi_poll.constprop.0+0x66/0x360 [ 23.104589] ? net_rx_action+0x1cb/0x610 [ 23.104811] net_rx_action+0x33e/0x610 [ 23.105024] ? _raw_spin_unlock+0x23/0x50 [ 23.105257] ? __pfx_net_rx_action+0x10/0x10 [ 23.105485] ? mark_held_locks+0x48/0xa0 [ 23.105741] __do_softirq+0xfa/0x5ab [ 23.105956] ? __dev_queue_xmit+0x765/0x1c00 [ 23.106193] do_softirq.part.0+0x49/0xc0 [ 23.106423] </IRQ> [ 23.106547] <TASK> [ 23.106670] __local_bh_enable_ip+0xf5/0x120 [ 23.106903] __dev_queue_xmit+0x789/0x1c00 [ 23.107131] ? __pfx___dev_queue_xmit+0x10/0x10 [ 23.107381] ? find_held_lock+0x8e/0xb0 [ 23.107585] ? lock_release+0x204/0x400 [ 23.107798] ? neigh_resolve_output+0x185/0x350 [ 23.108049] ? mark_held_locks+0x48/0xa0 [ 23.108265] ? neigh_resolve_output+0x185/0x350 [ 23.108514] neigh_resolve_output+0x246/0x350 [ 23.108753] ? neigh_resolve_output+0x246/0x350 [ 23.109003] ip_finish_output2+0x3c3/0x10b0 [ 23.109250] ? __pfx_ip_finish_output2+0x10/0x10 [ 23.109510] ? __pfx_nf_hook+0x10/0x10 [ 23.109732] __ip_finish_output+0x217/0x390 [ 23.109978] ip_finish_output+0x2f/0x130 [ 23.110207] ip_output+0xc9/0x170 [ 23.110404] ip_push_pending_frames+0x1a0/0x240 [ 23.110652] raw_sendmsg+0x102e/0x19e0 [ 23.110871] ? __pfx_raw_sendmsg+0x10/0x10 [ 23.111093] ? lock_release+0x204/0x400 [ 23.111304] ? __mod_lruvec_page_state+0x148/0x330 [ 23.111567] ? find_held_lock+0x8e/0xb0 [ 23.111777] ? find_held_lock+0x8e/0xb0 [ 23.111993] ? __rcu_read_unlock+0x7c/0x2f0 [ 23.112225] ? aa_sk_perm+0x18a/0x550 [ 23.112431] ? filemap_map_pages+0x4f1/0x900 [ 23.112665] ? __pfx_aa_sk_perm+0x10/0x10 [ 23.112880] ? find_held_lock+0x8e/0xb0 [ 23.113098] inet_sendmsg+0xa0/0xb0 [ 23.113297] ? inet_sendmsg+0xa0/0xb0 [ 23.113500] ? __pfx_inet_sendmsg+0x10/0x10 [ 23.113727] sock_sendmsg+0xf4/0x100 [ 23.113924] ? move_addr_to_kernel.part.0+0x4f/0xa0 [ 23.114190] __sys_sendto+0x1d4/0x290 [ 23.114391] ? __pfx___sys_sendto+0x10/0x10 [ 23.114621] ? __pfx_mark_lock.part.0+0x10/0x10 [ 23.114869] ? lock_release+0x204/0x400 [ 23.115076] ? find_held_lock+0x8e/0xb0 [ 23.115287] ? rcu_is_watching+0x23/0x60 [ 23.115503] ? __rseq_handle_notify_resume+0x6e2/0x860 [ 23.115778] ? __kasan_check_write+0x14/0x30 [ 23.116008] ? blkcg_maybe_throttle_current+0x8d/0x770 [ 23.116285] ? mark_held_locks+0x28/0xa0 [ 23.116503] ? do_syscall_64+0x37/0x90 [ 23.116713] __x64_sys_sendto+0x7f/0xb0 [ 23.116924] do_syscall_64+0x59/0x90 [ 23.117123] ? irqentry_exit_to_user_mode+0x25/0x30 [ 23.117387] ? irqentry_exit+0x77/0xb0 [ 23.117593] ? exc_page_fault+0x92/0x140 [ 23.117806] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 23.118081] RIP: 0033:0x7f744aee2bba [ 23.118282] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 23.119237] RSP: 002b:00007ffd04a7c9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 23.119644] RAX: ffffffffffffffda RBX: 00007ffd04a7e0a0 RCX: 00007f744aee2bba [ 23.120023] RDX: 0000000000000040 RSI: 000056488e9e6300 RDI: 0000000000000003 [ 23.120413] RBP: 000056488e9e6300 R08: 00007ffd04a80320 R09: 0000000000000010 [ 23.120809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 23.121219] R13: 00007ffd04a7dc38 R14: 00007ffd04a7ca00 R15: 00007ffd04a7e0a0 [ 23.121617] </TASK> [ 23.121749] [ 23.121845] The buggy address belongs to the virtual mapping at [ 23.121845] [ffffc90000000000, ffffc90000009000) created by: [ 23.121845] irq_init_percpu_irqstack+0x1cf/0x270 [ 23.122707] [ 23.122803] The buggy address belongs to the physical page: [ 23.123104] page:0000000072ac19f0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a09 [ 23.123609] flags: 0xfffffc0001000(reserved|node=0|zone=1|lastcpupid=0x1fffff) [ 23.123998] page_type: 0xffffffff() [ 23.124194] raw: 000fffffc0001000 ffffea0000928248 ffffea0000928248 0000000000000000 [ 23.124610] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 23.125023] page dumped because: kasan: bad access detected [ 23.125326] [ 23.125421] Memory state around the buggy address: [ 23.125682] ffffc90000007800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.126072] ffffc90000007880: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00 [ 23.126455] >ffffc90000007900: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 [ 23.126840] ^ [ 23.127138] ffffc90000007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 [ 23.127522] ffffc90000007a00: f3 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 [ 23.127906] ================================================================== [ 23.128324] Disabling lock debugging due to kernel taint Using simple s16 pointers for the 16-bit accesses fixes the problem. For the 32-bit accesses, src and dst can be used directly. Fixes: 96518518cc ("netfilter: add nftables") Cc: stable@vger.kernel.org Reported-by: Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with ZDI Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2023-07-23 13:47:37 +02:00
..
ipset	netfilter: ipset: Add schedule point in call_ad().	2023-06-14 11:13:02 +02:00
ipvs	ipvs: increase ip_vs_conn_tab_bits range for 64BIT	2023-07-23 13:47:34 +02:00
core.c	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
Kconfig	netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y	2022-09-05 10:30:11 +02:00
Makefile	netfilter: add netfilter hooks to SRv6 data plane	2021-08-30 01:51:36 +02:00
nf_conncount.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
nf_conntrack_acct.c	netfilter: nf_conntrack_acct.c: A typo fix	2021-03-28 17:31:14 -07:00
nf_conntrack_amanda.c	netfilter: nf_conntrack_sip: fix expectation clash	2019-07-16 13:16:59 +02:00
nf_conntrack_broadcast.c	netfilter: nf_conntrack_sip: fix expectation clash	2019-07-16 13:16:59 +02:00
nf_conntrack_core.c	netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper	2023-06-14 11:13:02 +02:00
nf_conntrack_ecache.c	netfilter: ecache: remove nf_exp_event_notifier structure	2021-08-25 12:50:38 +02:00
nf_conntrack_expect.c	netfilter: conntrack: convert to refcount_t api	2022-04-27 14:39:01 +02:00
nf_conntrack_extend.c	netfilter: conntrack: remove two export symbols	2019-12-17 22:59:31 +01:00
nf_conntrack_ftp.c	netfilter: remove BUG_ON() after skb_header_pointer()	2021-05-05 23:45:48 +02:00
nf_conntrack_h323_asn1.c	netfilter: Use fallthrough pseudo-keyword	2020-07-22 01:18:05 +02:00
nf_conntrack_h323_main.c	netfilter: fix clang-12 fmt string warnings	2021-06-01 23:53:51 +02:00
nf_conntrack_h323_types.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 484	2019-06-19 17:09:52 +02:00
nf_conntrack_helper.c	netfilter: conntrack: Avoid nf_ct_helper_hash uses after free	2023-07-23 13:47:37 +02:00
nf_conntrack_irc.c	netfilter: nf_conntrack_irc: Tighten matching on DCC message	2022-09-28 11:11:46 +02:00
nf_conntrack_labels.c	netfilter: not mark a spinlock as __read_mostly	2019-08-27 18:07:03 +02:00
nf_conntrack_netbios_ns.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
nf_conntrack_netlink.c	netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT	2023-06-09 10:32:26 +02:00
nf_conntrack_pptp.c	netfilter: remove BUG_ON() after skb_header_pointer()	2021-05-05 23:45:48 +02:00
nf_conntrack_proto.c	netfilter: conntrack: nf_ct_gre_keymap_flush() removal	2021-07-02 02:07:01 +02:00
nf_conntrack_proto_dccp.c	netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one	2023-07-23 13:46:56 +02:00
nf_conntrack_proto_generic.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
nf_conntrack_proto_gre.c	netfilter: conntrack: nf_ct_gre_keymap_flush() removal	2021-07-02 02:07:01 +02:00
nf_conntrack_proto_icmp.c	netfilter: conntrack: pass hook state to log functions	2021-06-18 14:47:43 +02:00
nf_conntrack_proto_icmpv6.c	netfilter: conntrack: set icmpv6 redirects as RELATED	2022-12-31 13:14:14 +01:00
nf_conntrack_proto_sctp.c	netfilter: conntrack: unify established states for SCTP paths	2023-02-01 08:27:30 +01:00
nf_conntrack_proto_tcp.c	netfilter: conntrack: work around exceeded receive window	2022-09-15 11:30:01 +02:00
nf_conntrack_proto_udp.c	netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state	2021-11-18 19:16:21 +01:00
nf_conntrack_sane.c	netfilter: remove BUG_ON() after skb_header_pointer()	2021-05-05 23:45:48 +02:00
nf_conntrack_seqadj.c	netfilter: conntrack, nat: prefer skb_ensure_writable	2019-05-31 18:02:45 +02:00
nf_conntrack_sip.c	netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.	2023-07-23 13:46:56 +02:00
nf_conntrack_snmp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
nf_conntrack_standalone.c	netfilter: conntrack: fix possible bug_on with enable_hooks=1	2023-05-24 17:36:41 +01:00
nf_conntrack_tftp.c	netfilter: nf_conntrack_sip: fix expectation clash	2019-07-16 13:16:59 +02:00
nf_conntrack_timeout.c	netfilter: update include directives.	2019-09-13 12:33:06 +02:00
nf_conntrack_timestamp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 77	2019-05-24 17:37:51 +02:00
nf_dup_netdev.c	netfilter: nf_fwd_netdev: clear timestamp in forwarding path	2020-10-22 14:49:36 +02:00
nf_flow_table_core.c	netfilter: flowtable: fix stuck flows on cleanup due to pending work	2022-08-31 17:16:42 +02:00
nf_flow_table_inet.c	netfilter: flowtable: Fix QinQ and pppoe support for inet table	2022-04-08 14:23:40 +02:00
nf_flow_table_ip.c	netfilter: flowtable: move dst_check to packet path	2022-05-25 09:57:33 +02:00
nf_flow_table_offload.c	netfilter: flowtable: really fix NAT IPv6 offload	2022-12-31 13:14:36 +01:00
nf_hooks_lwtunnel.c	netfilter: add netfilter hooks to SRv6 data plane	2021-08-30 01:51:36 +02:00
nf_internals.h	netfilter: ctnetlink: add kernel side filtering for dump	2020-05-27 22:20:34 +02:00
nf_log.c	netfilter: nft_log: perform module load from nf_tables	2021-03-31 22:34:11 +02:00
nf_log_syslog.c	netfilter: nf_log: incorrect offset to network header	2022-07-21 21:24:23 +02:00
nf_nat_amanda.c	netfilter: nf_conntrack_sip: fix expectation clash	2019-07-16 13:16:59 +02:00
nf_nat_core.c	netfilter: nat: include zone id in nat table hash again	2021-09-21 03:46:55 +02:00
nf_nat_ftp.c	netfilter: nf_conntrack_sip: fix expectation clash	2019-07-16 13:16:59 +02:00
nf_nat_helper.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-22 08:59:24 -04:00
nf_nat_irc.c	netfilter: nf_conntrack_sip: fix expectation clash	2019-07-16 13:16:59 +02:00
nf_nat_masquerade.c	netfilter: nf_nat_masquerade: defer conntrack walk to work queue	2021-09-21 03:46:56 +02:00
nf_nat_proto.c	netfilter: nat: move nf_xfrm_me_harder to where it is used	2021-04-26 03:20:07 +02:00
nf_nat_redirect.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-22 08:59:24 -04:00
nf_nat_sip.c	netfilter: nf_conntrack_sip: fix expectation clash	2019-07-16 13:16:59 +02:00
nf_nat_tftp.c	netfilter: nf_conntrack_sip: fix expectation clash	2019-07-16 13:16:59 +02:00
nf_queue.c	netfilter: nf_queue: handle socket prefetch	2022-03-08 19:12:45 +01:00
nf_sockopt.c	netfilter: switch nf_setsockopt to sockptr_t	2020-07-24 15:41:54 -07:00
nf_synproxy_core.c	ip: Fix data-races around sysctl_ip_default_ttl.	2022-07-29 17:25:09 +02:00
nf_tables_api.c	netfilter: nf_tables: do not ignore genmask when looking up chain by id	2023-07-23 13:47:37 +02:00
nf_tables_core.c	netfilter: nft_cmp: optimize comparison for 16-bytes	2022-08-31 17:16:41 +02:00
nf_tables_offload.c	netfilter: nf_tables: bail out early if hardware offload is not supported	2022-06-14 18:36:17 +02:00
nf_tables_trace.c	netfilter: nf_tables: convert pktinfo->tprot_set to flags field	2022-07-12 16:34:55 +02:00
nfnetlink.c	netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM	2023-06-21 15:59:16 +02:00
nfnetlink_acct.c	netfilter: use nfnetlink_unicast()	2021-05-29 01:04:53 +02:00
nfnetlink_cthelper.c	Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net	2021-06-07 13:01:52 -07:00
nfnetlink_cttimeout.c	netfilter: use nfnetlink_unicast()	2021-05-29 01:04:53 +02:00
nfnetlink_hook.c	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
nfnetlink_log.c	netfilter: fix regression in looped (broad|multi)cast's MAC handling	2021-12-29 12:28:40 +01:00
nfnetlink_osf.c	netfilter: nfnetlink_osf: fix module autoload	2023-06-28 10:29:49 +02:00
nfnetlink_queue.c	netfilter: nf_queue: do not allow packet truncation below transport header offset	2022-08-03 12:03:53 +02:00
nft_bitwise.c	netfilter: nf_tables: upfront validation of data via nft_data_init()	2022-08-31 17:16:41 +02:00
nft_byteorder.c	netfilter: nf_tables: prevent OOB access in nft_byteorder_eval	2023-07-23 13:47:37 +02:00
nft_chain_filter.c	netfilter: nf_tables: always release netdev hooks from notifier	2023-05-24 17:36:41 +01:00
nft_chain_nat.c	netfilter: nf_tables: remove unused arg in nft_set_pktinfo_unspec()	2021-05-29 01:04:54 +02:00
nft_chain_route.c	netfilter: nf_tables: remove unused arg in nft_set_pktinfo_unspec()	2021-05-29 01:04:54 +02:00
nft_cmp.c	netfilter: nf_tables: upfront validation of data via nft_data_init()	2022-08-31 17:16:41 +02:00
nft_compat.c	netfilter: log: work around missing softdep backend module	2021-09-21 03:46:56 +02:00
nft_connlimit.c	netfilter: Add MODULE_DESCRIPTION entries to kernel modules	2020-06-25 00:50:31 +02:00
nft_counter.c	netfilter: nftables: counter hardware offload support	2021-04-18 22:04:49 +02:00
nft_ct.c	netfilter: conntrack: Fix data-races around ct mark	2022-12-02 17:41:04 +01:00
nft_dup_netdev.c	netfilter: nf_tables_offload: incorrect flow offload action array size	2022-03-02 11:47:51 +01:00
nft_dynset.c	netfilter: nf_tables: deactivate anonymous set from preparation phase	2023-05-11 23:00:40 +09:00
nft_exthdr.c	netfilter: nft_payload: don't allow th access for fragments	2022-07-12 16:34:56 +02:00
nft_fib.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_fib_inet.c	netfilter: Add MODULE_DESCRIPTION entries to kernel modules	2020-06-25 00:50:31 +02:00
nft_fib_netdev.c	netfilter: Add MODULE_DESCRIPTION entries to kernel modules	2020-06-25 00:50:31 +02:00
nft_flow_offload.c	netfilter: flowtable: fix TCP flow teardown	2022-05-25 09:57:33 +02:00
nft_fwd_netdev.c	netfilter: nf_tables_offload: incorrect flow offload action array size	2022-03-02 11:47:51 +01:00
nft_hash.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_immediate.c	netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain	2023-06-28 10:29:48 +02:00
nft_last.c	netfilter: nft_last: avoid possible false sharing	2021-07-23 14:18:02 +02:00
nft_limit.c	netfilter: nft_limit: avoid possible divide error in nft_limit_init	2021-04-10 21:15:35 +02:00
nft_log.c	netfilter: nft_log: perform module load from nf_tables	2021-03-31 22:34:11 +02:00
nft_lookup.c	netfilter: nf_tables: deactivate anonymous set from preparation phase	2023-05-11 23:00:40 +09:00
nft_masq.c	netfilter: nft_masq: correct length for loading protocol registers	2023-03-22 13:31:23 +01:00
nft_meta.c	netfilter: nf_tables: convert pktinfo->tprot_set to flags field	2022-07-12 16:34:55 +02:00
nft_nat.c	netfilter: nft_nat: correct length for loading protocol registers	2023-03-22 13:31:23 +01:00
nft_numgen.c	netfilter: use get_random_u32 instead of prandom	2022-06-29 09:03:21 +02:00
nft_objref.c	netfilter: nf_tables: deactivate anonymous set from preparation phase	2023-05-11 23:00:40 +09:00
nft_osf.c	netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families	2022-08-31 17:16:41 +02:00
nft_payload.c	netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits	2023-01-18 11:48:46 +01:00
nft_queue.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_quota.c	netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event notification	2021-10-02 12:00:17 +02:00
nft_range.c	netfilter: nf_tables: upfront validation of data via nft_data_init()	2022-08-31 17:16:41 +02:00
nft_redir.c	netfilter: nft_redir: correct value of inet type .maxattrs	2023-03-22 13:31:23 +01:00
nft_reject.c	netfilter: nft_reject: unify reject init and dump into nft_reject	2020-10-31 10:40:42 +01:00
nft_reject_inet.c	netfilter: nf_tables: add and use nft_sk helper	2021-05-29 01:04:53 +02:00
nft_reject_netdev.c	netfilter: nft_reject: add reject verdict support for netdev	2020-10-31 10:41:00 +01:00
nft_rt.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_set_bitmap.c	netfilter: nf_tables: drop map element references from preparation phase	2023-07-23 13:46:44 +02:00
nft_set_hash.c	netfilter: nf_tables: drop map element references from preparation phase	2023-07-23 13:46:44 +02:00
nft_set_pipapo.c	netfilter: nf_tables: drop map element references from preparation phase	2023-07-23 13:46:44 +02:00
nft_set_pipapo.h	netfilter: nf_tables: prefer direct calls for set lookups	2021-05-29 01:04:27 +02:00
nft_set_pipapo_avx2.c	nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups	2021-12-14 10:57:06 +01:00
nft_set_pipapo_avx2.h	netfilter: nf_tables: prefer direct calls for set lookups	2021-05-29 01:04:27 +02:00
nft_set_rbtree.c	netfilter: nf_tables: drop map element references from preparation phase	2023-07-23 13:46:44 +02:00
nft_socket.c	netfilter: nft_socket: only do sk lookups when indev is available	2022-05-09 09:14:43 +02:00
nft_synproxy.c	netfilter: nft_synproxy: unregister hooks on init error path	2022-02-23 12:03:10 +01:00
nft_tproxy.c	netfilter: nft_tproxy: restrict to prerouting hook	2023-02-22 12:57:05 +01:00
nft_tunnel.c	netfilter: nft_tunnel: restrict it to netdev family	2022-08-31 17:16:41 +02:00
nft_xfrm.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
utils.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
x_tables.c	netfilter: x_tables: never register tables by default	2021-08-09 10:22:01 +02:00
xt_addrtype.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_AUDIT.c	netfilter: fix clang-12 fmt string warnings	2021-06-01 23:53:51 +02:00
xt_bpf.c	bpf: Refactor BPF_PROG_RUN into a function	2021-08-17 00:45:07 +02:00
xt_cgroup.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_CHECKSUM.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_CLASSIFY.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_cluster.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_comment.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
xt_connbytes.c	netfilter: x_tables: use pr ratelimiting in all remaining spots	2018-02-14 21:05:38 +01:00
xt_connlabel.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_connlimit.c	netfilter: update include directives.	2019-09-13 12:33:06 +02:00
xt_connmark.c	netfilter: conntrack: Fix data-races around ct mark	2022-12-02 17:41:04 +01:00
xt_CONNSECMARK.c	netfilter: Replace HTTP links with HTTPS ones	2020-07-29 20:09:18 +02:00
xt_conntrack.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_cpu.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_CT.c	netfilter: conntrack: convert to refcount_t api	2022-04-27 14:39:01 +02:00
xt_dccp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_devgroup.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_DSCP.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-22 08:59:24 -04:00
xt_dscp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_ecn.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_esp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_hashlimit.c	netfilter: Replace zero-length array with flexible-array member	2020-03-15 15:20:16 +01:00
xt_helper.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_HL.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-22 08:59:24 -04:00
xt_hl.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_HMARK.c	netfilter: xt_HMARK: Use ip_is_fragment() helper	2020-08-28 19:55:51 +02:00
xt_IDLETIMER.c	netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value	2021-10-07 19:35:57 +02:00
xt_ipcomp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
xt_iprange.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2019-06-25 01:32:59 +02:00
xt_ipvs.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
xt_l2tp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_LED.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 164	2019-05-30 11:26:38 -07:00
xt_length.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_limit.c	netfilter: x_tables: improve limit_mt scalability	2021-05-29 01:04:52 +02:00
xt_LOG.c	netfilter: log: work around missing softdep backend module	2021-09-21 03:46:56 +02:00
xt_mac.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_mark.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_MASQUERADE.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_multiport.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_nat.c	netfilter: Add MODULE_DESCRIPTION entries to kernel modules	2020-06-25 00:50:31 +02:00
xt_NETMAP.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_nfacct.c	netfilter: Remove unnecessary conversion to bool	2020-12-01 09:45:29 +01:00
xt_NFLOG.c	netfilter: log: work around missing softdep backend module	2021-09-21 03:46:56 +02:00
xt_NFQUEUE.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_osf.c	netfilter: nfnetlink_osf: fix module autoload	2023-06-28 10:29:49 +02:00
xt_owner.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2019-06-25 01:32:59 +02:00
xt_physdev.c	netfilter: inline xt_hashlimit, ebt_802_3 and xt_physdev headers	2019-09-13 12:32:48 +02:00
xt_pkttype.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_policy.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_quota.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
xt_RATEEST.c	netfilter: xt_RATEEST: reject non-null terminated string from userspace	2020-12-27 11:52:26 +01:00
xt_rateest.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_realm.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_recent.c	netfilter: xt_recent: Fix attempt to update deleted entry	2021-02-04 00:33:08 +01:00
xt_REDIRECT.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_repldata.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xt_sctp.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
xt_SECMARK.c	netfilter: xt_SECMARK: add new revision to fix structure layout	2021-05-03 23:02:44 +02:00
xt_set.c	netfilter: inline four headers files into another one.	2019-08-13 12:14:26 +02:00
xt_socket.c	netfilter: xt_socket: missing ifdef CONFIG_IP6_NF_IPTABLES dependency	2022-03-02 11:47:51 +01:00
xt_state.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_statistic.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_string.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_TCPMSS.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-22 08:59:24 -04:00
xt_tcpmss.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
xt_TCPOPTSTRIP.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-22 08:59:24 -04:00
xt_tcpudp.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
xt_TEE.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 3	2019-05-21 11:28:40 +02:00
xt_time.c	netfilter: Replace HTTP links with HTTPS ones	2020-07-29 20:09:18 +02:00
xt_TPROXY.c	netfilter: disable defrag once its no longer needed	2021-04-26 03:20:07 +02:00
xt_TRACE.c	netfilter: nf_log: add module softdeps	2021-03-31 22:34:10 +02:00
xt_u32.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00