Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Sasha Levin <Alexander.Levin@microsoft.com>
To:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>
CC:     Florian Westphal <fw@strlen.de>,
        Pablo Neira Ayuso <pablo@netfilter.org>,
        Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL for 4.15 070/124] netfilter: core: only allow one nat
 hook per hook point
Thread-Topic: [PATCH AUTOSEL for 4.15 070/124] netfilter: core: only allow one
 nat hook per hook point
Thread-Index: AQHTv5myu58aptvIyEaP7WYFhKi18w==
Date:   Mon, 19 Mar 2018 15:48:16 +0000
Message-ID: <20180319154645.11350-70-alexander.levin@microsoft.com>
References: <20180319154645.11350-1-alexander.levin@microsoft.com>
In-Reply-To: <20180319154645.11350-1-alexander.levin@microsoft.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: microsoft.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: ab4f33d0-c517-4c5e-d411-08d58db0eb49
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Mar 2018 15:48:16.7815
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0919
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Florian Westphal <fw@strlen.de>

[ Upstream commit f92b40a8b2645af38bd6814651c59c1e690db53d ]

The netfilter NAT core cannot deal with more than one NAT hook per hook
location (prerouting, input ...), because the NAT hooks install a NAT null
binding in case the iptables nat table (iptable_nat hooks) or the
corresponding nftables chain (nft nat hooks) doesn't specify a nat
transformation.

Null bindings are needed to detect port collsisions between NAT-ed and
non-NAT-ed connections.

This causes nftables NAT rules to not work when iptable_nat module is
loaded, and vice versa because nat binding has already been attached
when the second nat hook is consulted.

The netfilter core is not really the correct location to handle this
(hooks are just hooks, the core has no notion of what kinds of side
 effects a hook implements), but its the only place where we can check
for conflicts between both iptables hooks and nftables hooks without
adding dependencies.

So add nat annotation to hook_ops to describe those hooks that will
add NAT bindings and then make core reject if such a hook already exists.
The annotation fills a padding hole, in case further restrictions appar
we might change this to a 'u8 type' instead of bool.

iptables error if nft nat hook active:
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables v1.4.21: can't initialize iptables table `nat': File exists
Perhaps iptables or your kernel needs to be upgraded.

nftables error if iptables nat table present:
nft -f /etc/nftables/ipv4-nat
/usr/etc/nftables/ipv4-nat:3:1-2: Error: Could not process rule: File exist=
s
table nat {
^^

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 include/linux/netfilter.h         | 1 +
 net/ipv4/netfilter/iptable_nat.c  | 4 ++++
 net/ipv6/netfilter/ip6table_nat.c | 4 ++++
 net/netfilter/core.c              | 6 ++++++
 net/netfilter/nf_tables_api.c     | 2 ++
 5 files changed, 17 insertions(+)

diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index b24e9b101651..267954bca56f 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -67,6 +67,7 @@ struct nf_hook_ops {
 	struct net_device	*dev;
 	void			*priv;
 	u_int8_t		pf;
+	bool			nat_hook;
 	unsigned int		hooknum;
 	/* Hooks are ordered in ascending priority. */
 	int			priority;
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_=
nat.c
index a1a07b338ccf..0f7255cc65ee 100644
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -72,6 +72,7 @@ static const struct nf_hook_ops nf_nat_ipv4_ops[] =3D {
 	{
 		.hook		=3D iptable_nat_ipv4_in,
 		.pf		=3D NFPROTO_IPV4,
+		.nat_hook	=3D true,
 		.hooknum	=3D NF_INET_PRE_ROUTING,
 		.priority	=3D NF_IP_PRI_NAT_DST,
 	},
@@ -79,6 +80,7 @@ static const struct nf_hook_ops nf_nat_ipv4_ops[] =3D {
 	{
 		.hook		=3D iptable_nat_ipv4_out,
 		.pf		=3D NFPROTO_IPV4,
+		.nat_hook	=3D true,
 		.hooknum	=3D NF_INET_POST_ROUTING,
 		.priority	=3D NF_IP_PRI_NAT_SRC,
 	},
@@ -86,6 +88,7 @@ static const struct nf_hook_ops nf_nat_ipv4_ops[] =3D {
 	{
 		.hook		=3D iptable_nat_ipv4_local_fn,
 		.pf		=3D NFPROTO_IPV4,
+		.nat_hook	=3D true,
 		.hooknum	=3D NF_INET_LOCAL_OUT,
 		.priority	=3D NF_IP_PRI_NAT_DST,
 	},
@@ -93,6 +96,7 @@ static const struct nf_hook_ops nf_nat_ipv4_ops[] =3D {
 	{
 		.hook		=3D iptable_nat_ipv4_fn,
 		.pf		=3D NFPROTO_IPV4,
+		.nat_hook	=3D true,
 		.hooknum	=3D NF_INET_LOCAL_IN,
 		.priority	=3D NF_IP_PRI_NAT_SRC,
 	},
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6tabl=
e_nat.c
index 991512576c8c..47306e45a80a 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -74,6 +74,7 @@ static const struct nf_hook_ops nf_nat_ipv6_ops[] =3D {
 	{
 		.hook		=3D ip6table_nat_in,
 		.pf		=3D NFPROTO_IPV6,
+		.nat_hook	=3D true,
 		.hooknum	=3D NF_INET_PRE_ROUTING,
 		.priority	=3D NF_IP6_PRI_NAT_DST,
 	},
@@ -81,6 +82,7 @@ static const struct nf_hook_ops nf_nat_ipv6_ops[] =3D {
 	{
 		.hook		=3D ip6table_nat_out,
 		.pf		=3D NFPROTO_IPV6,
+		.nat_hook	=3D true,
 		.hooknum	=3D NF_INET_POST_ROUTING,
 		.priority	=3D NF_IP6_PRI_NAT_SRC,
 	},
@@ -88,12 +90,14 @@ static const struct nf_hook_ops nf_nat_ipv6_ops[] =3D {
 	{
 		.hook		=3D ip6table_nat_local_fn,
 		.pf		=3D NFPROTO_IPV6,
+		.nat_hook	=3D true,
 		.hooknum	=3D NF_INET_LOCAL_OUT,
 		.priority	=3D NF_IP6_PRI_NAT_DST,
 	},
 	/* After packet filtering, change source */
 	{
 		.hook		=3D ip6table_nat_fn,
+		.nat_hook	=3D true,
 		.pf		=3D NFPROTO_IPV6,
 		.hooknum	=3D NF_INET_LOCAL_IN,
 		.priority	=3D NF_IP6_PRI_NAT_SRC,
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 52cd2901a097..11e39cb19441 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -135,6 +135,12 @@ nf_hook_entries_grow(const struct nf_hook_entries *old=
,
 			++i;
 			continue;
 		}
+
+		if (reg->nat_hook && orig_ops[i]->nat_hook) {
+			kvfree(new);
+			return ERR_PTR(-EEXIST);
+		}
+
 		if (inserted || reg->priority > orig_ops[i]->priority) {
 			new_ops[nhooks] =3D (void *)orig_ops[i];
 			new->hooks[nhooks] =3D old->hooks[i];
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 07bd4138c84e..5d6e3193723a 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1400,6 +1400,8 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8=
 family, u8 genmask,
 				ops->hook =3D hookfn;
 			if (afi->hook_ops_init)
 				afi->hook_ops_init(ops, i);
+			if (basechain->type->type =3D=3D NFT_CHAIN_T_NAT)
+				ops->nat_hook =3D true;
 		}
=20
 		chain->flags |=3D NFT_BASE_CHAIN;
--=20
2.14.1