9bfd50e6dc
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
70 lines
2.4 KiB
Diff
70 lines
2.4 KiB
Diff
From 968cc2c96390f06e56ed6a43f935bfebdefed28f Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fw@strlen.de>
|
|
Date: Sat, 16 May 2026 23:23:21 +0800
|
|
Subject: [PATCH] netfilter: disable payload mangling in userns
|
|
|
|
Several parts of network stack rely on iph->ihl validation
|
|
done by network stack before PRE_ROUTING.
|
|
|
|
Disable this feature for user namespaces for now.
|
|
|
|
tcp option handling is likely safe even for LOCAL_IN, so this
|
|
this leaves tcp option mangling via nft_exthdr.c as-is.
|
|
|
|
I don't think these are the only means to alter packets, but these
|
|
appear to be relatively prominent.
|
|
|
|
This could be relaxed later. Example:
|
|
- allow userns for ingress hook.
|
|
- allow userns if base is transport header.
|
|
|
|
Also, we should revalidate or restrict generally:
|
|
- Don't allow linklayer writes to spill into network header
|
|
- restrict ipv4 and ipv6 to 'known safe' writes, e.g.
|
|
saddr/daddr/check/tos
|
|
|
|
Reported-by: Qi Tang <tpluszz77@gmail.com>
|
|
Reported-by: Tong Liu <lyutoon@gmail.com>
|
|
Tested-by: Qi Tang <tpluszz77@gmail.com>
|
|
Link: https://lore.kernel.org/netfilter-devel/20260515100411.3141-1-fw@strlen.de/
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
|
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
|
|
index 64496e7..8d4fa10 100644
|
|
--- a/net/netfilter/nfnetlink_queue.c
|
|
+++ b/net/netfilter/nfnetlink_queue.c
|
|
@@ -1061,6 +1061,9 @@ nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int di
|
|
{
|
|
struct sk_buff *nskb;
|
|
|
|
+ if (e->state.net->user_ns != &init_user_ns)
|
|
+ return -EPERM;
|
|
+
|
|
if (diff < 0) {
|
|
unsigned int min_len = skb_transport_offset(e->skb);
|
|
|
|
@@ -1458,8 +1461,7 @@ static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
|
|
if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]),
|
|
payload_len, entry, diff) < 0)
|
|
verdict = NF_DROP;
|
|
-
|
|
- if (ct && diff)
|
|
+ else if (ct && diff)
|
|
nfnl_ct->seq_adjust(entry->skb, ct, ctinfo, diff);
|
|
}
|
|
|
|
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
|
|
index 7dfc534..0dba42e 100644
|
|
--- a/net/netfilter/nft_payload.c
|
|
+++ b/net/netfilter/nft_payload.c
|
|
@@ -944,6 +944,9 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
|
|
u32 csum_offset, csum_type = NFT_PAYLOAD_CSUM_NONE;
|
|
int err;
|
|
|
|
+ if (ctx->net->user_ns != &init_user_ns)
|
|
+ return -EPERM;
|
|
+
|
|
priv->base = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
|
|
priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
|
|
priv->len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
|