Commit f2e0b29a authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

1) UAF in chain binding support from previous batch, from Dan Carpenter.

2) Queue up delayed work to expire connections with no destination,
   from Andrew Sy Kim.

3) Use fallthrough pseudo-keyword, from Gustavo A. R. Silva.

4) Replace HTTP links with HTTPS, from Alexander A. Klimov.

5) Remove superfluous null header checks in ip6tables, from
   Gaurav Singh.

6) Add extended netlink error reporting for expression.

7) Report EEXIST on overlapping chain, set elements and flowtable
   devices.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents c23cf402 77a92189

include/net/ip_vs.h

+29 −0
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <linux/spinlock.h>             /* for struct rwlock_t */

#include <linux/atomic.h>               /* for struct atomic_t */

#include <linux/refcount.h>             /* for struct refcount_t */

#include <linux/workqueue.h>



#include <linux/compiler.h>

#include <linux/timer.h>
@@ -886,6 +887,8 @@ struct netns_ipvs { 
	atomic_t		conn_out_counter;



#ifdef CONFIG_SYSCTL

	/* delayed work for expiring no dest connections */

	struct delayed_work	expire_nodest_conn_work;

	/* 1/rate drop and drop-entry variables */

	struct delayed_work	defense_work;   /* Work handler */

	int			drop_rate;
@@ -1051,6 +1054,11 @@ static inline int sysctl_conn_reuse_mode(struct netns_ipvs *ipvs) 
	return ipvs->sysctl_conn_reuse_mode;

}



static inline int sysctl_expire_nodest_conn(struct netns_ipvs *ipvs)

{

	return ipvs->sysctl_expire_nodest_conn;

}



static inline int sysctl_schedule_icmp(struct netns_ipvs *ipvs)

{

	return ipvs->sysctl_schedule_icmp;
@@ -1138,6 +1146,11 @@ static inline int sysctl_conn_reuse_mode(struct netns_ipvs *ipvs) 
	return 1;

}



static inline int sysctl_expire_nodest_conn(struct netns_ipvs *ipvs)

{

	return 0;

}



static inline int sysctl_schedule_icmp(struct netns_ipvs *ipvs)

{

	return 0;
@@ -1507,6 +1520,22 @@ static inline int ip_vs_todrop(struct netns_ipvs *ipvs) 
static inline int ip_vs_todrop(struct netns_ipvs *ipvs) { return 0; }

#endif



#ifdef CONFIG_SYSCTL

/* Enqueue delayed work for expiring no dest connections

 * Only run when sysctl_expire_nodest=1

 */

static inline void ip_vs_enqueue_expire_nodest_conns(struct netns_ipvs *ipvs)

{

	if (sysctl_expire_nodest_conn(ipvs))

		queue_delayed_work(system_long_wq,

				   &ipvs->expire_nodest_conn_work, 1);

}



void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs);

#else

static inline void ip_vs_enqueue_expire_nodest_conns(struct netns_ipvs *ipvs) {}

#endif



#define IP_VS_DFWD_METHOD(dest) (atomic_read(&(dest)->conn_flags) & \

				 IP_VS_CONN_F_FWD_MASK)

include/uapi/linux/netfilter/xt_connmark.h

+1 −1
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ 


#include <linux/types.h>



/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>

/* Copyright (C) 2002,2004 MARA Systems AB <https://www.marasystems.com>

 * by Henrik Nordstrom <hno@marasystems.com>

 *

 * This program is free software; you can redistribute it and/or modify

net/bridge/netfilter/ebtables.c

+1 −1
Original line number Diff line number Diff line
@@ -1852,7 +1852,7 @@ static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt, 
			size_kern = match_size;

		module_put(match->me);

		break;

	case EBT_COMPAT_WATCHER: /* fallthrough */

	case EBT_COMPAT_WATCHER:

	case EBT_COMPAT_TARGET:

		wt = xt_request_find_target(NFPROTO_BRIDGE, name,

					    mwt->u.revision);

net/decnet/netfilter/dn_rtmsg.c

+1 −1
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 
 *

 *              DECnet Routing Message Grabulator

 *

 *              (C) 2000 ChyGwyn Limited  -  http://www.chygwyn.com/

 *              (C) 2000 ChyGwyn Limited  -  https://www.chygwyn.com/

 *

 * Author:      Steven Whitehouse <steve@chygwyn.com>

 */

net/ipv6/netfilter/ip6t_ah.c

+1 −2
Original line number Diff line number Diff line
@@ -74,8 +74,7 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par) 
		 ahinfo->hdrres, ah->reserved,

		 !(ahinfo->hdrres && ah->reserved));



	return (ah != NULL) &&

		spi_match(ahinfo->spis[0], ahinfo->spis[1],

	return spi_match(ahinfo->spis[0], ahinfo->spis[1],

			  ntohl(ah->spi),

			  !!(ahinfo->invflags & IP6T_AH_INV_SPI)) &&

		(!ahinfo->hdrlen ||

CRA Git | Maintained and supported by SUSTech CRA and CCSE