Commit b0e61d98 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://1984.lsi.us.es/nf-next 



Pablo Neira Ayuso says:

====================
The following patchset contains four Netfilter updates, mostly targeting
to fix issues added with IPv6 NAT, and one little IPVS update for net-next:

* Remove unneeded conditional free of skb in nfnetlink_queue, from
  Wei Yongjun.

* One semantic path from coccinelle detected the use of list_del +
  INIT_LIST_HEAD, instead of list_del_init, again from Wei Yongjun.

* Fix out-of-bound memory access in the NAT address selection, from
  Florian Westphal. This was introduced with the IPv6 NAT patches.

* Two fixes for crashes that were introduced in the recently merged
  IPv6 NAT support, from myself.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 280050cc c7cbb917

net/netfilter/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -47,7 +47,6 @@ nf_nat-y := nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \ 
		   nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o



obj-$(CONFIG_NF_NAT) += nf_nat.o

obj-$(CONFIG_NF_NAT) += xt_nat.o



# NAT protocols (nf_nat)

obj-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
@@ -71,6 +70,7 @@ obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o 
obj-$(CONFIG_NETFILTER_XT_MARK) += xt_mark.o

obj-$(CONFIG_NETFILTER_XT_CONNMARK) += xt_connmark.o

obj-$(CONFIG_NETFILTER_XT_SET) += xt_set.o

obj-$(CONFIG_NF_NAT) += xt_nat.o



# targets

obj-$(CONFIG_NETFILTER_XT_TARGET_AUDIT) += xt_AUDIT.o

net/netfilter/ipvs/ip_vs_ctl.c

+1 −2
Original line number Diff line number Diff line
@@ -539,8 +539,7 @@ static int ip_vs_rs_unhash(struct ip_vs_dest *dest) 
	 * Remove it from the rs_table table.

	 */

	if (!list_empty(&dest->d_list)) {

		list_del(&dest->d_list);

		INIT_LIST_HEAD(&dest->d_list);

		list_del_init(&dest->d_list);

	}



	return 1;

net/netfilter/nf_conntrack_netlink.c

+0 −3
Original line number Diff line number Diff line
@@ -1120,16 +1120,13 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct, 
	if (err == -EAGAIN) {

#ifdef CONFIG_MODULES

		rcu_read_unlock();

		spin_unlock_bh(&nf_conntrack_lock);

		nfnl_unlock();

		if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) {

			nfnl_lock();

			spin_lock_bh(&nf_conntrack_lock);

			rcu_read_lock();

			return -EOPNOTSUPP;

		}

		nfnl_lock();

		spin_lock_bh(&nf_conntrack_lock);

		rcu_read_lock();

#else

		err = -EOPNOTSUPP;

net/netfilter/nf_nat_core.c

+1 −1
Original line number Diff line number Diff line
@@ -255,7 +255,7 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple, 
	 * client coming from the same IP (some Internet Banking sites

	 * like this), even across reboots.

	 */

	j = jhash2((u32 *)&tuple->src.u3, sizeof(tuple->src.u3),

	j = jhash2((u32 *)&tuple->src.u3, sizeof(tuple->src.u3) / sizeof(u32),

		   range->flags & NF_NAT_RANGE_PERSISTENT ?

			0 : (__force u32)tuple->dst.u3.all[max] ^ zone);

net/netfilter/nfnetlink_queue_core.c

+1 −2
Original line number Diff line number Diff line
@@ -406,7 +406,6 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue, 
	return skb;



nla_put_failure:

	if (skb)

	kfree_skb(skb);

	net_err_ratelimited("nf_queue: error creating packet message\n");

	return NULL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE