Commit cd2cc01b authored by David S. Miller's avatar David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says:

====================
netfilter fixes for net

The following patchset contains fixes for your net tree, they are:

* Remove extra quote from connlimit configuration in Kconfig, from
  Randy Dunlap.

* Fix missing mss option in syn packets sent to the backend in our
  new synproxy target, from Martin Topholm.

* Use window scale announced by client when sending the forged
  syn to the backend, from Martin Topholm.

* Fix IPv6 address comparison in ebtables, from Luís Fernando
  Cornachioni Estrozi.

* Fix wrong endianess in sequence adjustment which breaks helpers
  in NAT configurations, from Phil Oester.

* Fix the error path handling of nft_compat, from me.

* Make sure the global conntrack counter is decremented after the
  object has been released, also from me.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 3fb69bca acab78b9
...@@ -48,10 +48,12 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par) ...@@ -48,10 +48,12 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
if (info->bitmask & EBT_IP6_TCLASS && if (info->bitmask & EBT_IP6_TCLASS &&
FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS)) FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
return false; return false;
if (FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk, if ((info->bitmask & EBT_IP6_SOURCE &&
&info->saddr), EBT_IP6_SOURCE) || FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
&info->saddr), EBT_IP6_SOURCE)) ||
(info->bitmask & EBT_IP6_DEST &&
FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk, FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
&info->daddr), EBT_IP6_DEST)) &info->daddr), EBT_IP6_DEST)))
return false; return false;
if (info->bitmask & EBT_IP6_PROTO) { if (info->bitmask & EBT_IP6_PROTO) {
uint8_t nexthdr = ih6->nexthdr; uint8_t nexthdr = ih6->nexthdr;
......
...@@ -244,6 +244,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet, ...@@ -244,6 +244,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
this_cpu_inc(snet->stats->cookie_valid); this_cpu_inc(snet->stats->cookie_valid);
opts->mss = mss; opts->mss = mss;
opts->options |= XT_SYNPROXY_OPT_MSS;
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP) if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
synproxy_check_timestamp_cookie(opts); synproxy_check_timestamp_cookie(opts);
......
...@@ -259,6 +259,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet, ...@@ -259,6 +259,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
this_cpu_inc(snet->stats->cookie_valid); this_cpu_inc(snet->stats->cookie_valid);
opts->mss = mss; opts->mss = mss;
opts->options |= XT_SYNPROXY_OPT_MSS;
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP) if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
synproxy_check_timestamp_cookie(opts); synproxy_check_timestamp_cookie(opts);
......
...@@ -909,7 +909,7 @@ config NETFILTER_XT_MATCH_CONNLABEL ...@@ -909,7 +909,7 @@ config NETFILTER_XT_MATCH_CONNLABEL
connection simultaneously. connection simultaneously.
config NETFILTER_XT_MATCH_CONNLIMIT config NETFILTER_XT_MATCH_CONNLIMIT
tristate '"connlimit" match support"' tristate '"connlimit" match support'
depends on NF_CONNTRACK depends on NF_CONNTRACK
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
---help--- ---help---
......
...@@ -764,9 +764,10 @@ void nf_conntrack_free(struct nf_conn *ct) ...@@ -764,9 +764,10 @@ void nf_conntrack_free(struct nf_conn *ct)
struct net *net = nf_ct_net(ct); struct net *net = nf_ct_net(ct);
nf_ct_ext_destroy(ct); nf_ct_ext_destroy(ct);
atomic_dec(&net->ct.count);
nf_ct_ext_free(ct); nf_ct_ext_free(ct);
kmem_cache_free(net->ct.nf_conntrack_cachep, ct); kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
smp_mb__before_atomic_dec();
atomic_dec(&net->ct.count);
} }
EXPORT_SYMBOL_GPL(nf_conntrack_free); EXPORT_SYMBOL_GPL(nf_conntrack_free);
......
...@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo, ...@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
spin_lock_bh(&ct->lock); spin_lock_bh(&ct->lock);
this_way = &seqadj->seq[dir]; this_way = &seqadj->seq[dir];
if (this_way->offset_before == this_way->offset_after || if (this_way->offset_before == this_way->offset_after ||
before(this_way->correction_pos, seq)) { before(this_way->correction_pos, ntohl(seq))) {
this_way->correction_pos = seq; this_way->correction_pos = ntohl(seq);
this_way->offset_before = this_way->offset_after; this_way->offset_before = this_way->offset_after;
this_way->offset_after += off; this_way->offset_after += off;
} }
......
...@@ -151,9 +151,10 @@ void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info, ...@@ -151,9 +151,10 @@ void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
opts->tsecr = opts->tsval; opts->tsecr = opts->tsval;
opts->tsval = tcp_time_stamp & ~0x3f; opts->tsval = tcp_time_stamp & ~0x3f;
if (opts->options & XT_SYNPROXY_OPT_WSCALE) if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
opts->tsval |= info->wscale; opts->tsval |= opts->wscale;
else opts->wscale = info->wscale;
} else
opts->tsval |= 0xf; opts->tsval |= 0xf;
if (opts->options & XT_SYNPROXY_OPT_SACK_PERM) if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
......
...@@ -128,7 +128,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] ...@@ -128,7 +128,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
[NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 }, [NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 },
}; };
static u8 nft_parse_compat(const struct nlattr *attr, bool *inv) static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
{ {
struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1]; struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
u32 flags; u32 flags;
...@@ -148,7 +148,8 @@ static u8 nft_parse_compat(const struct nlattr *attr, bool *inv) ...@@ -148,7 +148,8 @@ static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
if (flags & NFT_RULE_COMPAT_F_INV) if (flags & NFT_RULE_COMPAT_F_INV)
*inv = true; *inv = true;
return ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
return 0;
} }
static int static int
...@@ -166,8 +167,11 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ...@@ -166,8 +167,11 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info); target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
if (ctx->nla[NFTA_RULE_COMPAT]) if (ctx->nla[NFTA_RULE_COMPAT]) {
proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv); ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
if (ret < 0)
goto err;
}
nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv); nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
...@@ -356,8 +360,11 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ...@@ -356,8 +360,11 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info); match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
if (ctx->nla[NFTA_RULE_COMPAT]) if (ctx->nla[NFTA_RULE_COMPAT]) {
proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv); ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
if (ret < 0)
goto err;
}
nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv); nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment