Commit 90b2621f authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://1984.lsi.us.es/nf 



Pablo Neira Ayuso says:

====================
The following patchset contains 7 Netfilter/IPVS fixes for 3.9-rc, they are:

* Restrict IPv6 stateless NPT targets to the mangle table. Many users are
  complaining that this target does not work in the nat table, which is the
  wrong table for it, from Florian Westphal.

* Fix possible use before initialization in the netns init path of several
  conntrack protocol trackers (introduced recently while improving conntrack
  netns support), from Gao Feng.

* Fix incorrect initialization of copy_range in nfnetlink_queue, spotted
  by Eric Dumazet during the NFWS2013, patch from myself.

* Fix wrong calculation of next SCTP chunk in IPVS, from Julian Anastasov.

* Remove rcu_read_lock section in IPVS while calling ipv4_update_pmtu
  not required anymore after change introduced in 3.7, again from Julian.

* Fix SYN looping in IPVS state sync if the backup is used a real server
  in DR/TUN modes, this required a new /proc entry to disable the director
  function when acting as backup, also from Julian.

* Remove leftover IP_NF_QUEUE Kconfig after ip_queue removal, noted by
  Paul Bolle.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 10b38669 3dd6664f

Documentation/networking/ipvs-sysctl.txt

+7 −0
Original line number Diff line number Diff line
@@ -15,6 +15,13 @@ amemthresh - INTEGER 
        enabled and the variable is automatically set to 2, otherwise

        the strategy is disabled and the variable is  set  to 1.



backup_only - BOOLEAN

	0 - disabled (default)

	not 0 - enabled



	If set, disable the director function while the server is

	in backup mode to avoid packet loops for DR/TUN methods.



conntrack - BOOLEAN

	0 - disabled (default)

	not 0 - enabled

include/net/ip_vs.h

+12 −0
Original line number Diff line number Diff line
@@ -976,6 +976,7 @@ struct netns_ipvs { 
	int			sysctl_sync_retries;

	int			sysctl_nat_icmp_send;

	int			sysctl_pmtu_disc;

	int			sysctl_backup_only;



	/* ip_vs_lblc */

	int			sysctl_lblc_expiration;
@@ -1067,6 +1068,12 @@ static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs) 
	return ipvs->sysctl_pmtu_disc;

}



static inline int sysctl_backup_only(struct netns_ipvs *ipvs)

{

	return ipvs->sync_state & IP_VS_STATE_BACKUP &&

	       ipvs->sysctl_backup_only;

}



#else



static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs)
@@ -1114,6 +1121,11 @@ static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs) 
	return 1;

}



static inline int sysctl_backup_only(struct netns_ipvs *ipvs)

{

	return 0;

}



#endif



/*

net/ipv4/netfilter/Kconfig

+0 −13
Original line number Diff line number Diff line
@@ -36,19 +36,6 @@ config NF_CONNTRACK_PROC_COMPAT 


	  If unsure, say Y.



config IP_NF_QUEUE

	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"

	depends on NETFILTER_ADVANCED

	help

	  Netfilter has the ability to queue packets to user space: the

	  netlink device can be used to access them using this driver.



	  This option enables the old IPv4-only "ip_queue" implementation

	  which has been obsoleted by the new "nfnetlink_queue" code (see

	  CONFIG_NETFILTER_NETLINK_QUEUE).



	  To compile it as a module, choose M here.  If unsure, say N.



config IP_NF_IPTABLES

	tristate "IP tables support (required for filtering/masq/NAT)"

	default m if NETFILTER_ADVANCED=n

net/ipv6/netfilter/ip6t_NPT.c

+2 −0
Original line number Diff line number Diff line
@@ -114,6 +114,7 @@ ip6t_dnpt_tg(struct sk_buff *skb, const struct xt_action_param *par) 
static struct xt_target ip6t_npt_target_reg[] __read_mostly = {

	{

		.name		= "SNPT",

		.table		= "mangle",

		.target		= ip6t_snpt_tg,

		.targetsize	= sizeof(struct ip6t_npt_tginfo),

		.checkentry	= ip6t_npt_checkentry,
@@ -124,6 +125,7 @@ static struct xt_target ip6t_npt_target_reg[] __read_mostly = { 
	},

	{

		.name		= "DNPT",

		.table		= "mangle",

		.target		= ip6t_dnpt_tg,

		.targetsize	= sizeof(struct ip6t_npt_tginfo),

		.checkentry	= ip6t_npt_checkentry,

net/netfilter/ipvs/ip_vs_core.c

+8 −6
Original line number Diff line number Diff line
@@ -1394,10 +1394,8 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) 
			skb_reset_network_header(skb);

			IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",

				&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, mtu);

			rcu_read_lock();

			ipv4_update_pmtu(skb, dev_net(skb->dev),

					 mtu, 0, 0, 0, 0);

			rcu_read_unlock();

			/* Client uses PMTUD? */

			if (!(cih->frag_off & htons(IP_DF)))

				goto ignore_ipip;
@@ -1577,7 +1575,8 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) 
	}

	/* ipvs enabled in this netns ? */

	net = skb_net(skb);

	if (!net_ipvs(net)->enable)

	ipvs = net_ipvs(net);

	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))

		return NF_ACCEPT;



	ip_vs_fill_iph_skb(af, skb, &iph);
@@ -1654,7 +1653,6 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) 
	}



	IP_VS_DBG_PKT(11, af, pp, skb, 0, "Incoming packet");

	ipvs = net_ipvs(net);

	/* Check the server status */

	if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {

		/* the destination server is not available */
@@ -1815,13 +1813,15 @@ ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb, 
{

	int r;

	struct net *net;

	struct netns_ipvs *ipvs;



	if (ip_hdr(skb)->protocol != IPPROTO_ICMP)

		return NF_ACCEPT;



	/* ipvs enabled in this netns ? */

	net = skb_net(skb);

	if (!net_ipvs(net)->enable)

	ipvs = net_ipvs(net);

	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))

		return NF_ACCEPT;



	return ip_vs_in_icmp(skb, &r, hooknum);
@@ -1835,6 +1835,7 @@ ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb, 
{

	int r;

	struct net *net;

	struct netns_ipvs *ipvs;

	struct ip_vs_iphdr iphdr;



	ip_vs_fill_iph_skb(AF_INET6, skb, &iphdr);
@@ -1843,7 +1844,8 @@ ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb, 


	/* ipvs enabled in this netns ? */

	net = skb_net(skb);

	if (!net_ipvs(net)->enable)

	ipvs = net_ipvs(net);

	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))

		return NF_ACCEPT;



	return ip_vs_in_icmp_v6(skb, &r, hooknum, &iphdr);

CRA Git | Maintained and supported by SUSTech CRA and CCSE