Commit 515fb5c3 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net-next

The following batch contains a couple of fixes to address some fallout
from the previous pull request, they are:

1) Address link problems in the bridge code after e5de75bf. Fix it by
   using rcu hook to address to avoid ifdef pollution and hard
   dependency between bridge and br_netfilter.

2) Address sparse warnings in the netfilter reject code, patch from
   Florian Westphal.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 59e33c2b 1a4ba64d

include/net/netfilter/ipv4/nf_reject.h

+1 −1
Original line number Diff line number Diff line
@@ -12,7 +12,7 @@ const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb, 
					     struct tcphdr *_oth, int hook);

struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb,

				  const struct sk_buff *oldskb,

				  __be16 protocol, int ttl);

				  __u8 protocol, int ttl);

void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb,

			     const struct tcphdr *oth);

include/net/netfilter/ipv6/nf_reject.h

+1 −1
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb, 
					      unsigned int *otcplen, int hook);

struct ipv6hdr *nf_reject_ip6hdr_put(struct sk_buff *nskb,

				     const struct sk_buff *oldskb,

				     __be16 protocol, int hoplimit);

				     __u8 protocol, int hoplimit);

void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb,

			      const struct sk_buff *oldskb,

			      const struct tcphdr *oth, unsigned int otcplen);

net/bridge/br_device.c

+6 −1
Original line number Diff line number Diff line
@@ -25,6 +25,9 @@ 
#define COMMON_FEATURES (NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA | \

			 NETIF_F_GSO_MASK | NETIF_F_HW_CSUM)



const struct nf_br_ops __rcu *nf_br_ops __read_mostly;

EXPORT_SYMBOL_GPL(nf_br_ops);



/* net device transmit always called with BH disabled */

netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)

{
@@ -33,10 +36,12 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) 
	struct net_bridge_fdb_entry *dst;

	struct net_bridge_mdb_entry *mdst;

	struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);

	const struct nf_br_ops *nf_ops;

	u16 vid = 0;



	rcu_read_lock();

	if (br_nf_prerouting_finish_bridge(skb)) {

	nf_ops = rcu_dereference(nf_br_ops);

	if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {

		rcu_read_unlock();

		return NETDEV_TX_OK;

	}

net/bridge/br_netfilter.c

+7 −2
Original line number Diff line number Diff line
@@ -914,7 +914,7 @@ static void br_nf_pre_routing_finish_bridge_slow(struct sk_buff *skb) 
	br_handle_frame_finish(skb);

}



int br_nf_prerouting_finish_bridge(struct sk_buff *skb)

static int br_nf_dev_xmit(struct sk_buff *skb)

{

	if (skb->nf_bridge && (skb->nf_bridge->mask & BRNF_BRIDGED_DNAT)) {

		br_nf_pre_routing_finish_bridge_slow(skb);
@@ -922,7 +922,10 @@ int br_nf_prerouting_finish_bridge(struct sk_buff *skb) 
	}

	return 0;

}

EXPORT_SYMBOL_GPL(br_nf_prerouting_finish_bridge);



static const struct nf_br_ops br_ops = {

	.br_dev_xmit_hook =	br_nf_dev_xmit,

};



void br_netfilter_enable(void)

{
@@ -1061,12 +1064,14 @@ static int __init br_netfilter_init(void) 
		return -ENOMEM;

	}

#endif

	RCU_INIT_POINTER(nf_br_ops, &br_ops);

	printk(KERN_NOTICE "Bridge firewalling registered\n");

	return 0;

}



static void __exit br_netfilter_fini(void)

{

	RCU_INIT_POINTER(nf_br_ops, NULL);

	nf_unregister_hooks(br_nf_ops, ARRAY_SIZE(br_nf_ops));

#ifdef CONFIG_SYSCTL

	unregister_net_sysctl_table(brnf_sysctl_header);

net/bridge/br_private.h

+5 −5
Original line number Diff line number Diff line
@@ -763,17 +763,17 @@ static inline int br_vlan_enabled(struct net_bridge *br) 
}

#endif



struct nf_br_ops {

	int (*br_dev_xmit_hook)(struct sk_buff *skb);

};

extern const struct nf_br_ops __rcu *nf_br_ops;



/* br_netfilter.c */

#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)

int br_nf_prerouting_finish_bridge(struct sk_buff *skb);

int br_nf_core_init(void);

void br_nf_core_fini(void);

void br_netfilter_rtable_init(struct net_bridge *);

#else

static inline int br_nf_prerouting_finish_bridge(struct sk_buff *skb)

{

        return 0;

}

static inline int br_nf_core_init(void) { return 0; }

static inline void br_nf_core_fini(void) {}

#define br_netfilter_rtable_init(x)

CRA Git | Maintained and supported by SUSTech CRA and CCSE