Commit 73ce00d4 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
The following patchset contains Netfilter/IPVS fixes for 3.10-rc3,
they are:

* fix xt_addrtype with IPv6, from Florian Westphal. This required
  a new hook for IPv6 functions in the netfilter core to avoid
  hard dependencies with the ipv6 subsystem when this match is
  only used for IPv4.

* fix connection reuse case in IPVS. Currently, if an reused
  connection are directed to the same server. If that server is
  down, those connection would fail. Therefore, clear the
  connection and choose a new server among the available ones.

* fix possible non-nul terminated string sent to user-space if
  ipt_ULOG is used as the default netfilter logging stub, from
  Chen Gang.

* fix mark logging of IPv6 packets in xt_LOG, from Michal Kubecek.
  This bug has been there since 2.6.26.

* Fix breakage ip_vs_sh due to incorrect structure layout for
  RCU, from Jan Beulich.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 8e6d91ae a70b9641

include/linux/netfilter_ipv6.h

+16 −0
Original line number Diff line number Diff line
@@ -17,6 +17,22 @@ extern __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook, 


extern int ipv6_netfilter_init(void);

extern void ipv6_netfilter_fini(void);



/*

 * Hook functions for ipv6 to allow xt_* modules to be built-in even

 * if IPv6 is a module.

 */

struct nf_ipv6_ops {

	int (*chk_addr)(struct net *net, const struct in6_addr *addr,

			const struct net_device *dev, int strict);

};



extern const struct nf_ipv6_ops __rcu *nf_ipv6_ops;

static inline const struct nf_ipv6_ops *nf_get_ipv6_ops(void)

{

	return rcu_dereference(nf_ipv6_ops);

}



#else /* CONFIG_NETFILTER */

static inline int ipv6_netfilter_init(void) { return 0; }

static inline void ipv6_netfilter_fini(void) { return; }

include/net/addrconf.h

+1 −1
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ extern int addrconf_set_dstaddr(struct net *net, 


extern int			ipv6_chk_addr(struct net *net,

					      const struct in6_addr *addr,

					      struct net_device *dev,

					      const struct net_device *dev,

					      int strict);



#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)

net/ipv4/netfilter/ipt_ULOG.c

+4 −2
Original line number Diff line number Diff line
@@ -231,8 +231,10 @@ static void ipt_ulog_packet(struct net *net, 
	put_unaligned(tv.tv_usec, &pm->timestamp_usec);

	put_unaligned(skb->mark, &pm->mark);

	pm->hook = hooknum;

	if (prefix != NULL)

		strncpy(pm->prefix, prefix, sizeof(pm->prefix));

	if (prefix != NULL) {

		strncpy(pm->prefix, prefix, sizeof(pm->prefix) - 1);

		pm->prefix[sizeof(pm->prefix) - 1] = '\0';

	}

	else if (loginfo->prefix[0] != '\0')

		strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));

	else

net/ipv6/addrconf.c

+1 −1
Original line number Diff line number Diff line
@@ -1487,7 +1487,7 @@ static int ipv6_count_addresses(struct inet6_dev *idev) 
}



int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,

		  struct net_device *dev, int strict)

		  const struct net_device *dev, int strict)

{

	struct inet6_ifaddr *ifp;

	unsigned int hash = inet6_addr_hash(addr);

net/ipv6/netfilter.c

+7 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/netfilter.h>

#include <linux/netfilter_ipv6.h>

#include <linux/export.h>

#include <net/addrconf.h>

#include <net/dst.h>

#include <net/ipv6.h>

#include <net/ip6_route.h>
@@ -186,6 +187,10 @@ static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook, 
	return csum;

};



static const struct nf_ipv6_ops ipv6ops = {

	.chk_addr	= ipv6_chk_addr,

};



static const struct nf_afinfo nf_ip6_afinfo = {

	.family			= AF_INET6,

	.checksum		= nf_ip6_checksum,
@@ -198,6 +203,7 @@ static const struct nf_afinfo nf_ip6_afinfo = { 


int __init ipv6_netfilter_init(void)

{

	RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops);

	return nf_register_afinfo(&nf_ip6_afinfo);

}
@@ -206,5 +212,6 @@ int __init ipv6_netfilter_init(void) 
 */

void ipv6_netfilter_fini(void)

{

	RCU_INIT_POINTER(nf_ipv6_ops, NULL);

	nf_unregister_afinfo(&nf_ip6_afinfo);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE