Commit 6dae8222 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://1984.lsi.us.es/nf 



Pablo Neira Ayuso Says:

====================
The following patchset contains Netfilter/IPVS updates for your
net tree, they are:

* Fix incorrect hooks for SNAT and DNAT (bug introduced in recent IPv6
  NAT changes), from Elison Niven.

* Fix xt_TEE (got broken with recent rt_gateway semantic change),
  from Eric Dumazet.

* Fix custom conntrack timeout policy attachment for IPv6, from myself.

* Always initialize ip_vs_timeout_user in case that TCP or UDP protocols
  is disabled, from Arnd Bergmann.

Note that I had to pull from your tree to obtain:

(c92b9655 ipv4: Add FLOWI_FLAG_KNOWN_NH)

which was required for the xt_TEE fix.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 43c422ed 2ad5b9e4

net/netfilter/ipvs/ip_vs_ctl.c

+2 −1
Original line number Diff line number Diff line
@@ -2589,6 +2589,8 @@ __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u) 
	struct ip_vs_proto_data *pd;

#endif



	memset(u, 0, sizeof (*u));



#ifdef CONFIG_IP_VS_PROTO_TCP

	pd = ip_vs_proto_data_get(net, IPPROTO_TCP);

	u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
@@ -2766,7 +2768,6 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 
	{

		struct ip_vs_timeout_user t;



		memset(&t, 0, sizeof(t));

		__ip_vs_get_timeouts(net, &t);

		if (copy_to_user(user, &t, sizeof(t)) != 0)

			ret = -EFAULT;

net/netfilter/xt_CT.c

+6 −4
Original line number Diff line number Diff line
@@ -180,9 +180,9 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par, 
	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;

	struct ctnl_timeout *timeout;

	struct nf_conn_timeout *timeout_ext;

	const struct ipt_entry *e = par->entryinfo;

	struct nf_conntrack_l4proto *l4proto;

	int ret = 0;

	u8 proto;



	rcu_read_lock();

	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
@@ -192,9 +192,11 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par, 
		goto out;

	}



	if (e->ip.invflags & IPT_INV_PROTO) {

	proto = xt_ct_find_proto(par);

	if (!proto) {

		ret = -EINVAL;

		pr_info("You cannot use inversion on L4 protocol\n");

		pr_info("You must specify a L4 protocol, and not use "

			"inversions on it.\n");

		goto out;

	}
@@ -214,7 +216,7 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par, 
	/* Make sure the timeout policy matches any existing protocol tracker,

	 * otherwise default to generic.

	 */

	l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);

	l4proto = __nf_ct_l4proto_find(par->family, proto);

	if (timeout->l4proto->l4proto != l4proto->l4proto) {

		ret = -EINVAL;

		pr_info("Timeout policy `%s' can only be used by L4 protocol "

net/netfilter/xt_TEE.c

+1 −0
Original line number Diff line number Diff line
@@ -70,6 +70,7 @@ tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info) 
	fl4.daddr = info->gw.ip;

	fl4.flowi4_tos = RT_TOS(iph->tos);

	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;

	fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;

	rt = ip_route_output_key(net, &fl4);

	if (IS_ERR(rt))

		return false;

net/netfilter/xt_nat.c

+4 −4
Original line number Diff line number Diff line
@@ -111,7 +111,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = { 
		.family		= NFPROTO_IPV4,

		.table		= "nat",

		.hooks		= (1 << NF_INET_POST_ROUTING) |

				  (1 << NF_INET_LOCAL_OUT),

				  (1 << NF_INET_LOCAL_IN),

		.me		= THIS_MODULE,

	},

	{
@@ -123,7 +123,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = { 
		.family		= NFPROTO_IPV4,

		.table		= "nat",

		.hooks		= (1 << NF_INET_PRE_ROUTING) |

				  (1 << NF_INET_LOCAL_IN),

				  (1 << NF_INET_LOCAL_OUT),

		.me		= THIS_MODULE,

	},

	{
@@ -133,7 +133,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = { 
		.targetsize	= sizeof(struct nf_nat_range),

		.table		= "nat",

		.hooks		= (1 << NF_INET_POST_ROUTING) |

				  (1 << NF_INET_LOCAL_OUT),

				  (1 << NF_INET_LOCAL_IN),

		.me		= THIS_MODULE,

	},

	{
@@ -143,7 +143,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = { 
		.targetsize	= sizeof(struct nf_nat_range),

		.table		= "nat",

		.hooks		= (1 << NF_INET_PRE_ROUTING) |

				  (1 << NF_INET_LOCAL_IN),

				  (1 << NF_INET_LOCAL_OUT),

		.me		= THIS_MODULE,

	},

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE