Maxim Mikityanskiy
6488b96a79
netfilter: socket: Lookup orig tuple for IPv6 SNAT ...
commit 932b32ffd7604fb00b5c57e239a3cc4d901ccf6e upstream.
nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to
restore the original 5-tuple in case of SNAT, to be able to find the
right socket (if any). Then socket_match() can correctly check whether
the socket was transparent.
However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this
conntrack lookup, making xt_socket fail to match on the socket when the
packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6.
IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as
pods' addresses are in the fd00::/8 ULA subnet and need to be replaced
with the node's external address. Cilium leverages Envoy to enforce L7
policies, and Envoy uses transparent sockets. Cilium inserts an iptables
prerouting rule that matches on `-m socket --transparent` and redirects
the packets to localhost, but it fails to match SNATed IPv6 packets due
to that missing conntrack lookup.
Closes: https://github.com/cilium/cilium/issues/37932
Fixes: eb31628e37
2025-04-10 14:29:39 +02:00
9p/xen: fix release of IRQ
2024-12-14 19:44:41 +01:00
net: 802: LLC+SNAP OID:PID lookup on start of skb data
2025-02-01 18:18:45 +01:00
vlan: fix memory leak in vlan_newlink()
2025-04-10 14:29:34 +02:00
atm: Fix NULL pointer dereference
2025-04-10 14:29:38 +02:00
batman-adv: Ignore own maximum aggregation size during RX
2025-04-10 14:29:38 +02:00
Bluetooth: Fix error code in chan_alloc_skb_cb()
2025-04-10 14:29:38 +02:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
2025-03-13 12:43:16 +01:00
libceph: fix race between delayed_work() and ceph_monc_stop()
2024-07-18 11:40:55 +02:00
net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
2025-04-10 14:29:38 +02:00
net: fix data-races around sk->sk_forward_alloc
2025-02-01 18:18:52 +01:00
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
2024-12-14 19:44:51 +01:00
net-timestamp: support TCP GSO case for a few missing flags
2025-03-13 12:43:30 +01:00
netfilter: socket: Lookup orig tuple for IPv6 SNAT
2025-04-10 14:29:39 +02:00
s390/iucv: fix receive buffer virtual vs physical address confusion
2024-09-04 13:14:57 +02:00
kcm: Serialise kcm_sendmsg() for the same socket.
2024-09-04 13:14:59 +02:00
genetlink: hold RCU in genlmsg_mcast()
2024-11-08 16:20:50 +01:00
llc: do not use skb_get() before dev_queue_xmit()
2025-03-13 12:43:29 +01:00
wifi: mac80211: wake the queues in case of failure in resume
2025-01-09 13:23:35 +01:00
mac802154: check local interfaces before deleting sdata list
2025-02-01 18:18:50 +01:00
net/ncsi: wait for the last response to Deselect Package before configuring channel
2025-03-13 12:43:11 +01:00
netfilter: nft_exthdr: fix offset with ipv4_find_option()
2025-04-10 14:29:35 +02:00
netlink: terminate outstanding dump on socket close
2024-12-14 19:44:18 +01:00
netrom: check buffer length before accessing it
2025-01-09 13:23:35 +01:00
NFC: nci: Add bounds checking in nci_hci_create_pipe()
2025-03-13 12:43:11 +01:00
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
2025-03-13 12:43:18 +01:00
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
2025-01-09 13:23:35 +01:00
phonet: fix rtm_phonet_notify() skb allocation
2024-05-17 11:43:54 +02:00
net: qrtr: Update packets cloning when broadcasting
2024-11-08 16:20:33 +01:00
net:rds: Fix possible deadlock in rds_message_put
2024-09-04 13:15:03 +02:00
net: rfkill: gpio: Add check for clk_enable()
2024-12-14 19:44:27 +01:00
net: rose: lock the socket in rose_bind()
2025-03-13 12:43:06 +01:00
net_sched: Prevent creation of classes with TC_H_ROOT
2025-04-10 14:29:35 +02:00
sctp: Fix undefined behavior in left shift operation
2025-04-10 14:29:36 +02:00
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
2025-01-09 13:23:27 +01:00
sunrpc: suppress warnings for unused procfs functions
2025-03-13 12:43:24 +01:00
tipc: fix NULL deref in cleanup_bearer()
2024-12-19 18:05:03 +01:00
tls: Fix tls_sw_sendmsg error handling
2025-02-01 18:18:45 +01:00
af_unix: Remove put_pid()/put_cred() in copy_peercred().
2024-09-12 11:03:52 +02:00
vsock: Allow retrying on connect() failure
2025-03-13 12:43:00 +01:00
wifi: nl80211: reject cooked mode if it is set along with other flags
2025-03-13 12:43:28 +01:00
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
2024-06-16 13:28:52 +02:00
xfrm_output: Force software GSO only in tunnel mode
2025-04-10 14:29:37 +02:00
6488b96a79