Commit cd2cc01b authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
netfilter fixes for net

The following patchset contains fixes for your net tree, they are:

* Remove extra quote from connlimit configuration in Kconfig, from
  Randy Dunlap.

* Fix missing mss option in syn packets sent to the backend in our
  new synproxy target, from Martin Topholm.

* Use window scale announced by client when sending the forged
  syn to the backend, from Martin Topholm.

* Fix IPv6 address comparison in ebtables, from Luís Fernando
  Cornachioni Estrozi.

* Fix wrong endianess in sequence adjustment which breaks helpers
  in NAT configurations, from Phil Oester.

* Fix the error path handling of nft_compat, from me.

* Make sure the global conntrack counter is decremented after the
  object has been released, also from me.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 3fb69bca acab78b9

net/bridge/netfilter/ebt_ip6.c

+5 −3
Original line number Original line Diff line number Diff line
@@ -48,10 +48,12 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par) 
	if (info->bitmask & EBT_IP6_TCLASS &&

	if (info->bitmask & EBT_IP6_TCLASS &&

	   FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))

	   FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))

		return false;

		return false;

	if (FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,

	if ((info->bitmask & EBT_IP6_SOURCE &&

				       &info->saddr), EBT_IP6_SOURCE) ||

	    FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,

				       &info->saddr), EBT_IP6_SOURCE)) ||

	    (info->bitmask & EBT_IP6_DEST &&

	    FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,

	    FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,

				       &info->daddr), EBT_IP6_DEST))

				       &info->daddr), EBT_IP6_DEST)))

		return false;

		return false;

	if (info->bitmask & EBT_IP6_PROTO) {

	if (info->bitmask & EBT_IP6_PROTO) {

		uint8_t nexthdr = ih6->nexthdr;

		uint8_t nexthdr = ih6->nexthdr;

net/ipv4/netfilter/ipt_SYNPROXY.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -244,6 +244,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet, 




	this_cpu_inc(snet->stats->cookie_valid);

	this_cpu_inc(snet->stats->cookie_valid);

	opts->mss = mss;

	opts->mss = mss;

	opts->options |= XT_SYNPROXY_OPT_MSS;





	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)

	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)

		synproxy_check_timestamp_cookie(opts);

		synproxy_check_timestamp_cookie(opts);

net/ipv6/netfilter/ip6t_SYNPROXY.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -259,6 +259,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet, 




	this_cpu_inc(snet->stats->cookie_valid);

	this_cpu_inc(snet->stats->cookie_valid);

	opts->mss = mss;

	opts->mss = mss;

	opts->options |= XT_SYNPROXY_OPT_MSS;





	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)

	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)

		synproxy_check_timestamp_cookie(opts);

		synproxy_check_timestamp_cookie(opts);

net/netfilter/Kconfig

+1 −1
Original line number Original line Diff line number Diff line
@@ -909,7 +909,7 @@ config NETFILTER_XT_MATCH_CONNLABEL 
	  connection simultaneously.

	  connection simultaneously.





config NETFILTER_XT_MATCH_CONNLIMIT

config NETFILTER_XT_MATCH_CONNLIMIT

	tristate '"connlimit" match support"'

	tristate '"connlimit" match support'

	depends on NF_CONNTRACK

	depends on NF_CONNTRACK

	depends on NETFILTER_ADVANCED

	depends on NETFILTER_ADVANCED

	---help---

	---help---

net/netfilter/nf_conntrack_core.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -764,9 +764,10 @@ void nf_conntrack_free(struct nf_conn *ct) 
	struct net *net = nf_ct_net(ct);

	struct net *net = nf_ct_net(ct);





	nf_ct_ext_destroy(ct);

	nf_ct_ext_destroy(ct);

	atomic_dec(&net->ct.count);

	nf_ct_ext_free(ct);

	nf_ct_ext_free(ct);

	kmem_cache_free(net->ct.nf_conntrack_cachep, ct);

	kmem_cache_free(net->ct.nf_conntrack_cachep, ct);

	smp_mb__before_atomic_dec();

	atomic_dec(&net->ct.count);

}

}

EXPORT_SYMBOL_GPL(nf_conntrack_free);

EXPORT_SYMBOL_GPL(nf_conntrack_free);

CRA Git | Maintained and supported by SUSTech CRA and CCSE