Commit 702151da authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Refetch IP header pointer after pskb_may_pull() in flowtable,
   from Haishuang Yan.

2) Fix memleak in flowtable offload in nf_flow_table_free(),
   from Paul Blakey.

3) Set control.addr_type mask in flowtable offload, from Edward Cree.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents b738a185 15ff1972

net/netfilter/nf_flow_table_core.c

+3 −0
Original line number Diff line number Diff line
@@ -554,6 +554,9 @@ void nf_flow_table_free(struct nf_flowtable *flow_table) 
	nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL);

	nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, flow_table);

	nf_flow_table_offload_flush(flow_table);

	if (nf_flowtable_hw_offload(flow_table))

		nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step,

				      flow_table);

	rhashtable_destroy(&flow_table->rhashtable);

}

EXPORT_SYMBOL_GPL(nf_flow_table_free);

net/netfilter/nf_flow_table_ip.c

+10 −4
Original line number Diff line number Diff line
@@ -146,11 +146,13 @@ static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb, 


	if (test_bit(NF_FLOW_SNAT, &flow->flags) &&

	    (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||

	     nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))

	     nf_flow_snat_ip(flow, skb, ip_hdr(skb), thoff, dir) < 0))

		return -1;



	iph = ip_hdr(skb);

	if (test_bit(NF_FLOW_DNAT, &flow->flags) &&

	    (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||

	     nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))

	     nf_flow_dnat_ip(flow, skb, ip_hdr(skb), thoff, dir) < 0))

		return -1;



	return 0;
@@ -189,6 +191,7 @@ static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev, 
	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))

		return -1;



	iph = ip_hdr(skb);

	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);



	tuple->src_v4.s_addr	= iph->saddr;
@@ -426,11 +429,13 @@ static int nf_flow_nat_ipv6(const struct flow_offload *flow, 


	if (test_bit(NF_FLOW_SNAT, &flow->flags) &&

	    (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||

	     nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))

	     nf_flow_snat_ipv6(flow, skb, ipv6_hdr(skb), thoff, dir) < 0))

		return -1;



	ip6h = ipv6_hdr(skb);

	if (test_bit(NF_FLOW_DNAT, &flow->flags) &&

	    (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||

	     nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))

	     nf_flow_dnat_ipv6(flow, skb, ipv6_hdr(skb), thoff, dir) < 0))

		return -1;



	return 0;
@@ -459,6 +464,7 @@ static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev, 
	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))

		return -1;



	ip6h = ipv6_hdr(skb);

	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);



	tuple->src_v6		= ip6h->saddr;

net/netfilter/nf_flow_table_offload.c

+1 −0
Original line number Diff line number Diff line
@@ -87,6 +87,7 @@ static int nf_flow_rule_match(struct nf_flow_match *match, 
	default:

		return -EOPNOTSUPP;

	}

	mask->control.addr_type = 0xffff;

	match->dissector.used_keys |= BIT(key->control.addr_type);

	mask->basic.n_proto = 0xffff;

CRA Git | Maintained and supported by SUSTech CRA and CCSE