kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net
History
Maxim Mikityanskiy 1ca2169cc1 netfilter: socket: Lookup orig tuple for IPv6 SNAT 
commit 932b32ffd7 upstream.

nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to
restore the original 5-tuple in case of SNAT, to be able to find the
right socket (if any). Then socket_match() can correctly check whether
the socket was transparent.

However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this
conntrack lookup, making xt_socket fail to match on the socket when the
packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6.

IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as
pods' addresses are in the fd00::/8 ULA subnet and need to be replaced
with the node's external address. Cilium leverages Envoy to enforce L7
policies, and Envoy uses transparent sockets. Cilium inserts an iptables
prerouting rule that matches on `-m socket --transparent` and redirects
the packets to localhost, but it fails to match SNATed IPv6 packets due
to that missing conntrack lookup.

Closes: https://github.com/cilium/cilium/issues/37932
Fixes: eb31628e37 ("netfilter: nf_tables: Add support for IPv6 NAT")
Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-04-10 14:31:56 +02:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p 9p/xen: fix release of IRQ 2024-12-14 19:51:21 +01:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-23 17:15:49 +01:00
8021q vlan: fix memory leak in vlan_newlink() 2025-04-10 14:31:48 +02:00
appletalk appletalk: Fix Use-After-Free in atalk_ioctl 2023-12-20 15:17:37 +01:00
atm atm: Fix NULL pointer dereference 2025-04-10 14:31:55 +02:00
ax25 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg 2022-06-22 14:22:01 +02:00
batman-adv batman-adv: Ignore own maximum aggregation size during RX 2025-04-10 14:31:55 +02:00
bluetooth Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE 2025-04-10 14:31:55 +02:00
bpf bpf: Set run context for rawtp test_run callback 2024-07-05 09:14:06 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge net: bridge: xmit: make sure we have at least eth header len bytes 2024-11-14 13:13:40 +01:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:48:54 +01:00
can can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero 2025-03-13 12:50:40 +01:00
ceph libceph: fix race between delayed_work() and ceph_monc_stop() 2024-07-18 13:07:42 +02:00
core bpf, sockmap: Fix race between element replace and close() 2025-04-10 14:31:55 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: improve shutdown sequence 2025-01-09 13:28:42 +01:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool net: avoid race between device unregistration and ethnl ops 2025-03-13 12:49:59 +01:00
hsr net: hsr: fix fill_frame_info() regression vs VLAN packets 2025-03-13 12:50:13 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:51:37 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 tcp: fix races in tcp_abort() 2025-04-10 14:31:52 +02:00
ipv6 netfilter: socket: Lookup orig tuple for IPv6 SNAT 2025-04-10 14:31:56 +02:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-09-04 13:23:27 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key net: af_key: fix sadb_x_filter validation 2023-08-26 14:23:32 +02:00
l2tp genetlink: hold RCU in genlmsg_mcast() 2024-11-01 01:52:34 +01:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: do not use skb_get() before dev_queue_xmit() 2025-03-13 12:51:05 +01:00
mac80211 wifi: mac80211: wake the queues in case of failure in resume 2025-01-09 13:28:48 +01:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp mctp: Handle error of rtnl_register_module(). 2024-10-17 15:11:57 +02:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:57:09 +01:00
mptcp mptcp: Fix data stream corruption in the address announcement 2025-04-10 14:31:55 +02:00
ncsi net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling 2025-03-13 12:50:33 +01:00
netfilter netfilter: nft_exthdr: fix offset with ipv4_find_option() 2025-04-10 14:31:49 +02:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2024-01-25 14:52:33 -08:00
netlink netlink: terminate outstanding dump on socket close 2024-12-14 19:50:34 +01:00
netrom netrom: check buffer length before accessing it 2025-01-09 13:28:46 +01:00
nfc NFC: nci: Add bounds checking in nci_hci_create_pipe() 2025-03-13 12:50:32 +01:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: remove misbehaving actions length check 2025-04-10 14:31:49 +02:00
packet af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK 2025-01-09 13:28:47 +01:00
phonet phonet: fix rtm_phonet_notify() skb allocation 2024-05-17 11:50:58 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:11:08 +02:00
rds net:rds: Fix possible deadlock in rds_message_put 2024-09-04 13:23:39 +02:00
rfkill net: rfkill: gpio: Add check for clk_enable() 2024-12-14 19:50:58 +01:00
rose net: rose: lock the socket in rose_bind() 2025-03-13 12:50:22 +01:00
rxrpc rxrpc: Fix response to PING RESPONSE ACKs to a dead call 2024-02-23 08:54:58 +01:00
sched net_sched: Prevent creation of classes with TC_H_ROOT 2025-04-10 14:31:49 +02:00
sctp sctp: Fix undefined behavior in left shift operation 2025-04-10 14:31:51 +02:00
smc net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-03-13 12:49:57 +01:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 19:17:11 +01:00
sunrpc sunrpc: suppress warnings for unused procfs functions 2025-03-13 12:50:56 +01:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: re-order conditions in tipc_crypto_key_rcv() 2025-03-13 12:50:19 +01:00
tls tls: Fix tls_sw_sendmsg error handling 2025-01-23 17:15:50 +01:00
unix af_unix: Remove put_pid()/put_cred() in copy_peercred(). 2024-09-12 11:07:45 +02:00
vmw_vsock vsock: Orphan socket after transport release 2025-03-13 12:51:12 +01:00
wireless wifi: nl80211: reject cooked mode if it is set along with other flags 2025-03-13 12:51:03 +01:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:21:23 -04:00
xdp xsk: fix OOB map writes when deleting elements 2024-12-14 19:51:33 +01:00
xfrm xfrm_output: Force software GSO only in tunnel mode 2025-04-10 14:31:53 +02:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: explicitly clear the sk pointer, when pf->create fails 2024-10-17 15:12:00 +02:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00