kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/ipv6
History
Maxim Mikityanskiy 1ec43100f7 netfilter: socket: Lookup orig tuple for IPv6 SNAT 
commit 932b32ffd7 upstream.

nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to
restore the original 5-tuple in case of SNAT, to be able to find the
right socket (if any). Then socket_match() can correctly check whether
the socket was transparent.

However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this
conntrack lookup, making xt_socket fail to match on the socket when the
packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6.

IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as
pods' addresses are in the fd00::/8 ULA subnet and need to be replaced
with the node's external address. Cilium leverages Envoy to enforce L7
policies, and Envoy uses transparent sockets. Cilium inserts an iptables
prerouting rule that matches on `-m socket --transparent` and redirects
the packets to localhost, but it fails to match SNATed IPv6 packets due
to that missing conntrack lookup.

Closes: https://github.com/cilium/cilium/issues/37932
Fixes: eb31628e37 ("netfilter: nf_tables: Add support for IPv6 NAT")
Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-04-07 10:05:45 +02:00
..
ila net: ipv6: fix missing dst ref drop in ila lwtunnel 2025-03-13 12:53:19 +01:00
netfilter netfilter: socket: Lookup orig tuple for IPv6 SNAT 2025-04-07 10:05:45 +02:00
addrconf.c Revert "gre: Fix IPv6 link-local address generation." 2025-03-28 21:59:00 +01:00
addrconf_core.c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses 2024-02-05 20:13:01 +00:00
addrlabel.c ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network 2022-11-07 12:26:15 +00:00
af_inet6.c net: inet6: do not leave a dangling sk pointer in inet6_create() 2024-12-14 19:54:41 +01:00
ah6.c xfrm: ah: add extack to ah_init_state, ah6_init_state 2022-09-29 07:17:59 +02:00
anycast.c ipv6: fix memory leaks on IPV6_ADDRFORM path 2020-07-30 16:30:55 -07:00
calipso.c cipso,calipso: resolve a number of problems with the DOI refcounts 2021-03-04 15:26:57 -08:00
datagram.c ipv6: Fix datagram socket connection with DSCP. 2023-02-22 12:59:54 +01:00
esp6.c net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP 2024-08-03 08:49:03 +02:00
esp6_offload.c xfrm: Linearize the skb after offloading if needed. 2023-06-28 11:12:29 +02:00
exthdrs.c Fix write to cloned skb in ipv6_hop_ioam() 2024-03-01 13:26:38 +01:00
exthdrs_core.c ipv6: Fix out-of-bounds access in ipv6_find_tlv() 2023-05-30 14:03:21 +01:00
exthdrs_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
fib6_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib6_rules.c ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() 2024-05-17 11:56:12 +02:00
fou6.c net: Add MODULE_DESCRIPTION entries to network modules 2020-06-20 21:33:57 -07:00
icmp.c inetpeer: do not get a refcount in inet_getpeer() 2025-02-21 13:49:01 +01:00
inet6_connection_sock.c lsm,selinux: pass flowi_common instead of flowi to the LSM hooks 2020-11-23 18:36:21 -05:00
inet6_hashtables.c net: remove duplicate reuseport_lookup functions 2024-06-12 11:03:12 +02:00
ioam6.c genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
ioam6_iptunnel.c ipv6: ioam: block BH from ioam6_output() 2024-06-21 14:35:33 +02:00
ip6_checksum.c net: udp: fix handling of CHECKSUM_COMPLETE packets 2018-10-24 14:18:16 -07:00
ip6_fib.c ipv6: Fix soft lockups in fib6_select_path under high next hop churn 2025-02-01 18:30:06 +01:00
ip6_flowlabel.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
ip6_gre.c erspan: make sure erspan_base_hdr is present in skb->head 2024-04-10 16:28:27 +02:00
ip6_icmp.c net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-02-23 11:29:52 -08:00
ip6_input.c ipv6: annotate data-races around cnf.disable_ipv6 2024-05-17 11:56:13 +02:00
ip6_offload.c net-next: skbuff: refactor pskb_pull 2022-09-30 12:31:46 +01:00
ip6_offload.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ip6_output.c inetpeer: do not get a refcount in inet_getpeer() 2025-02-21 13:49:01 +01:00
ip6_tunnel.c ipv4: Convert ip_route_input() to dscp_t. 2025-03-07 16:56:44 +01:00
ip6_udp_tunnel.c net: Make locking in sock_bindtoindex optional 2020-06-01 14:57:14 -07:00
ip6_vti.c ip6_vti: fix slab-use-after-free in decode_session6 2023-08-23 17:52:32 +02:00
ip6mr.c ip6mr: fix tables suspicious RCU usage 2024-12-14 19:53:52 +01:00
ipcomp6.c xfrm: ipcomp: add extack to ipcomp{4,6}_init_state 2022-09-29 07:18:00 +02:00
ipv6_sockglue.c net: use unrcu_pointer() helper 2024-12-14 19:53:33 +01:00
Kconfig net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL 2024-10-17 15:21:13 +02:00
Makefile net: ipv6: use ipv6-y directly instead of ipv6-objs 2021-09-28 13:13:40 +01:00
mcast.c ipv6: mcast: add RCU protection to mld_newpack() 2025-02-21 13:50:09 +01:00
mcast_snoop.c net: bridge: mcast: fix broken length + header check for MRDv6 Adv. 2021-04-27 14:02:06 -07:00
mip6.c xfrm: mip6: add extack to mip6_destopt_init_state, mip6_rthdr_init_state 2022-09-29 07:18:01 +02:00
ndisc.c ndisc: extend RCU protection in ndisc_send_skb() 2025-02-21 13:50:08 +01:00
netfilter.c netfilter: Use l3mdev flow key when re-routing mangled packets 2022-05-16 13:03:29 +02:00
output_core.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
ping.c net: annotate data-races around sk->sk_tsflags 2024-01-10 17:10:23 +01:00
proc.c icmp: Add counters for rate limits 2024-10-17 15:21:27 +02:00
protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
raw.c net: annotate data-races around sk->sk_tsflags 2024-01-10 17:10:23 +01:00
reassembly.c net: ipv6: fix wrong start position when receive hop-by-hop fragment 2024-06-12 11:03:18 +02:00
route.c ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). 2025-03-28 21:59:00 +01:00
rpl.c net: rpl: fix rpl header size calculation 2023-04-26 14:28:34 +02:00
rpl_iptunnel.c net: ipv6: fix dst ref loop on input in rpl lwt 2025-03-07 16:56:46 +01:00
seg6.c ipv6: sr: fix invalid unregister error path 2024-06-12 11:03:19 +02:00
seg6_hmac.c ipv6: sr: fix memleak in seg6_hmac_init_algo 2024-06-12 11:03:51 +02:00
seg6_iptunnel.c net: ipv6: fix dst ref loop on input in seg6 lwt 2025-03-07 16:56:46 +01:00
seg6_local.c seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors 2024-06-27 13:46:20 +02:00
sit.c ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip devices 2025-01-09 13:30:00 +01:00
syncookies.c dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 11:52:16 +01:00
sysctl_net_ipv6.c net: sysctl: introduce sysctl SYSCTL_THREE 2022-05-03 10:15:06 +02:00
tcp_ipv6.c net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:17:17 +01:00
tcpv6_offload.c net: move gro definitions to include/net/gro.h 2021-11-16 13:16:54 +00:00
tunnel6.c tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels 2020-07-09 12:52:37 +02:00
udp.c udp: gso: do not drop small packets when PMTU reduces 2025-02-21 13:49:36 +01:00
udp_impl.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2022-10-12 17:50:37 -07:00
udp_offload.c gso: fix dodgy bit handling for GSO_UDP_L4 2024-08-29 17:30:54 +02:00
udplite.c udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). 2023-05-30 14:03:20 +01:00
xfrm6_input.c xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:56:10 +02:00
xfrm6_output.c xfrm: fix tunnel model fragmentation behavior 2022-03-01 12:08:40 +01:00
xfrm6_policy.c xfrm: respect ip protocols rules criteria when performing dst lookups 2024-11-01 01:56:03 +01:00
xfrm6_protocol.c xfrm: add support for UDPv6 encapsulation of ESP 2020-04-28 11:28:36 +02:00
xfrm6_state.c xfrm: remove output_finish indirection from xfrm_state_afinfo 2020-05-06 09:40:08 +02:00
xfrm6_tunnel.c xfrm: tunnel: add extack to ipip_init_state, xfrm6_tunnel_init_state 2022-09-29 07:18:00 +02:00