mirror of
https://github.com/torvalds/linux.git
synced 2024-09-21 23:43:02 +00:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says: ==================== netfilter fixes for net The following patchset contains fixes for your net tree, they are: * Remove extra quote from connlimit configuration in Kconfig, from Randy Dunlap. * Fix missing mss option in syn packets sent to the backend in our new synproxy target, from Martin Topholm. * Use window scale announced by client when sending the forged syn to the backend, from Martin Topholm. * Fix IPv6 address comparison in ebtables, from Luís Fernando Cornachioni Estrozi. * Fix wrong endianess in sequence adjustment which breaks helpers in NAT configurations, from Phil Oester. * Fix the error path handling of nft_compat, from me. * Make sure the global conntrack counter is decremented after the object has been released, also from me. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
commit
cd2cc01b67
|
@ -48,10 +48,12 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
||||||
if (info->bitmask & EBT_IP6_TCLASS &&
|
if (info->bitmask & EBT_IP6_TCLASS &&
|
||||||
FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
|
FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
|
||||||
return false;
|
return false;
|
||||||
if (FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
|
if ((info->bitmask & EBT_IP6_SOURCE &&
|
||||||
&info->saddr), EBT_IP6_SOURCE) ||
|
FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
|
||||||
|
&info->saddr), EBT_IP6_SOURCE)) ||
|
||||||
|
(info->bitmask & EBT_IP6_DEST &&
|
||||||
FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
|
FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
|
||||||
&info->daddr), EBT_IP6_DEST))
|
&info->daddr), EBT_IP6_DEST)))
|
||||||
return false;
|
return false;
|
||||||
if (info->bitmask & EBT_IP6_PROTO) {
|
if (info->bitmask & EBT_IP6_PROTO) {
|
||||||
uint8_t nexthdr = ih6->nexthdr;
|
uint8_t nexthdr = ih6->nexthdr;
|
||||||
|
|
|
@ -244,6 +244,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
|
||||||
|
|
||||||
this_cpu_inc(snet->stats->cookie_valid);
|
this_cpu_inc(snet->stats->cookie_valid);
|
||||||
opts->mss = mss;
|
opts->mss = mss;
|
||||||
|
opts->options |= XT_SYNPROXY_OPT_MSS;
|
||||||
|
|
||||||
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
|
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
|
||||||
synproxy_check_timestamp_cookie(opts);
|
synproxy_check_timestamp_cookie(opts);
|
||||||
|
|
|
@ -259,6 +259,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
|
||||||
|
|
||||||
this_cpu_inc(snet->stats->cookie_valid);
|
this_cpu_inc(snet->stats->cookie_valid);
|
||||||
opts->mss = mss;
|
opts->mss = mss;
|
||||||
|
opts->options |= XT_SYNPROXY_OPT_MSS;
|
||||||
|
|
||||||
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
|
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
|
||||||
synproxy_check_timestamp_cookie(opts);
|
synproxy_check_timestamp_cookie(opts);
|
||||||
|
|
|
@ -909,7 +909,7 @@ config NETFILTER_XT_MATCH_CONNLABEL
|
||||||
connection simultaneously.
|
connection simultaneously.
|
||||||
|
|
||||||
config NETFILTER_XT_MATCH_CONNLIMIT
|
config NETFILTER_XT_MATCH_CONNLIMIT
|
||||||
tristate '"connlimit" match support"'
|
tristate '"connlimit" match support'
|
||||||
depends on NF_CONNTRACK
|
depends on NF_CONNTRACK
|
||||||
depends on NETFILTER_ADVANCED
|
depends on NETFILTER_ADVANCED
|
||||||
---help---
|
---help---
|
||||||
|
|
|
@ -764,9 +764,10 @@ void nf_conntrack_free(struct nf_conn *ct)
|
||||||
struct net *net = nf_ct_net(ct);
|
struct net *net = nf_ct_net(ct);
|
||||||
|
|
||||||
nf_ct_ext_destroy(ct);
|
nf_ct_ext_destroy(ct);
|
||||||
atomic_dec(&net->ct.count);
|
|
||||||
nf_ct_ext_free(ct);
|
nf_ct_ext_free(ct);
|
||||||
kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
|
kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
|
||||||
|
smp_mb__before_atomic_dec();
|
||||||
|
atomic_dec(&net->ct.count);
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(nf_conntrack_free);
|
EXPORT_SYMBOL_GPL(nf_conntrack_free);
|
||||||
|
|
||||||
|
|
|
@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
|
||||||
spin_lock_bh(&ct->lock);
|
spin_lock_bh(&ct->lock);
|
||||||
this_way = &seqadj->seq[dir];
|
this_way = &seqadj->seq[dir];
|
||||||
if (this_way->offset_before == this_way->offset_after ||
|
if (this_way->offset_before == this_way->offset_after ||
|
||||||
before(this_way->correction_pos, seq)) {
|
before(this_way->correction_pos, ntohl(seq))) {
|
||||||
this_way->correction_pos = seq;
|
this_way->correction_pos = ntohl(seq);
|
||||||
this_way->offset_before = this_way->offset_after;
|
this_way->offset_before = this_way->offset_after;
|
||||||
this_way->offset_after += off;
|
this_way->offset_after += off;
|
||||||
}
|
}
|
||||||
|
|
|
@ -151,9 +151,10 @@ void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
|
||||||
opts->tsecr = opts->tsval;
|
opts->tsecr = opts->tsval;
|
||||||
opts->tsval = tcp_time_stamp & ~0x3f;
|
opts->tsval = tcp_time_stamp & ~0x3f;
|
||||||
|
|
||||||
if (opts->options & XT_SYNPROXY_OPT_WSCALE)
|
if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
|
||||||
opts->tsval |= info->wscale;
|
opts->tsval |= opts->wscale;
|
||||||
else
|
opts->wscale = info->wscale;
|
||||||
|
} else
|
||||||
opts->tsval |= 0xf;
|
opts->tsval |= 0xf;
|
||||||
|
|
||||||
if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
|
if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
|
||||||
|
|
|
@ -128,7 +128,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
|
||||||
[NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 },
|
[NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 },
|
||||||
};
|
};
|
||||||
|
|
||||||
static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
|
static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
|
||||||
{
|
{
|
||||||
struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
|
struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
|
||||||
u32 flags;
|
u32 flags;
|
||||||
|
@ -148,7 +148,8 @@ static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
|
||||||
if (flags & NFT_RULE_COMPAT_F_INV)
|
if (flags & NFT_RULE_COMPAT_F_INV)
|
||||||
*inv = true;
|
*inv = true;
|
||||||
|
|
||||||
return ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
|
*proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
|
||||||
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
|
@ -166,8 +167,11 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
|
||||||
|
|
||||||
target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
|
target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
|
||||||
|
|
||||||
if (ctx->nla[NFTA_RULE_COMPAT])
|
if (ctx->nla[NFTA_RULE_COMPAT]) {
|
||||||
proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
|
ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
|
||||||
|
if (ret < 0)
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
|
||||||
nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
|
nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
|
||||||
|
|
||||||
|
@ -356,8 +360,11 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
|
||||||
|
|
||||||
match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
|
match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
|
||||||
|
|
||||||
if (ctx->nla[NFTA_RULE_COMPAT])
|
if (ctx->nla[NFTA_RULE_COMPAT]) {
|
||||||
proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
|
ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
|
||||||
|
if (ret < 0)
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
|
||||||
nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
|
nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user