Commit 695ef16c authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for your net tree,
they are rather small patches but fixing several outstanding bugs in
nf_conntrack and nf_tables, as well as minor problems with missing
SYNPROXY header uapi installation:

1) Oneliner not to leak conntrack kmemcache on module removal, this
   problem was introduced in the previous merge window, patch from
   Florian Westphal.

2) Two fixes for insufficient ruleset loop validation, one due to
   incorrect flag check in nf_tables_bind_set() and another related to
   silly wrong generation mask logic from the walk path, from Liping
   Zhang.

3) Fix double-free of anonymous sets on error, this fix simplifies the
   code to let the abort path take care of releasing the set object,
   also from Liping Zhang.

4) The introduction of helper function for transactions broke the skip
   inactive rules logic from the nft_do_chain(), again from Liping
   Zhang.

5) Two patches to install uapi xt_SYNPROXY.h header and calm down
   kbuild robot due to missing #include <linux/types.h>.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents ce449ba7 1463847e

include/net/netfilter/nf_tables.h

+1 −0
Original line number Diff line number Diff line
@@ -167,6 +167,7 @@ struct nft_set_elem { 


struct nft_set;

struct nft_set_iter {

	u8		genmask;

	unsigned int	count;

	unsigned int	skip;

	int		err;

include/uapi/linux/netfilter/Kbuild

+1 −0
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ header-y += xt_NFLOG.h 
header-y += xt_NFQUEUE.h

header-y += xt_RATEEST.h

header-y += xt_SECMARK.h

header-y += xt_SYNPROXY.h

header-y += xt_TCPMSS.h

header-y += xt_TCPOPTSTRIP.h

header-y += xt_TEE.h

include/uapi/linux/netfilter/xt_SYNPROXY.h

+2 −0
Original line number Diff line number Diff line 
#ifndef _XT_SYNPROXY_H

#define _XT_SYNPROXY_H



#include <linux/types.h>



#define XT_SYNPROXY_OPT_MSS		0x01

#define XT_SYNPROXY_OPT_WSCALE		0x02

#define XT_SYNPROXY_OPT_SACK_PERM	0x04

net/netfilter/nf_conntrack_core.c

+2 −0
Original line number Diff line number Diff line
@@ -1544,6 +1544,8 @@ void nf_conntrack_cleanup_end(void) 
	nf_conntrack_tstamp_fini();

	nf_conntrack_acct_fini();

	nf_conntrack_expect_fini();



	kmem_cache_destroy(nf_conntrack_cachep);

}



/*

net/netfilter/nf_tables_api.c

+11 −13
Original line number Diff line number Diff line
@@ -2946,25 +2946,21 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 
		 * jumps are already validated for that chain.

		 */

		list_for_each_entry(i, &set->bindings, list) {

			if (binding->flags & NFT_SET_MAP &&

			if (i->flags & NFT_SET_MAP &&

			    i->chain == binding->chain)

				goto bind;

		}



		iter.genmask	= nft_genmask_next(ctx->net);

		iter.skip 	= 0;

		iter.count	= 0;

		iter.err	= 0;

		iter.fn		= nf_tables_bind_check_setelem;



		set->ops->walk(ctx, set, &iter);

		if (iter.err < 0) {

			/* Destroy anonymous sets if binding fails */

			if (set->flags & NFT_SET_ANONYMOUS)

				nf_tables_set_destroy(ctx, set);



		if (iter.err < 0)

			return iter.err;

	}

	}

bind:

	binding->chain = ctx->chain;

	list_add_tail_rcu(&binding->list, &set->bindings);
@@ -3194,6 +3190,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 


	args.cb			= cb;

	args.skb		= skb;

	args.iter.genmask	= nft_genmask_cur(ctx.net);

	args.iter.skip		= cb->args[0];

	args.iter.count		= 0;

	args.iter.err		= 0;
@@ -4284,6 +4281,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx, 
			    binding->chain != chain)

				continue;



			iter.genmask	= nft_genmask_next(ctx->net);

			iter.skip 	= 0;

			iter.count	= 0;

			iter.err	= 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE