Commit f8450bbe authored by David S. Miller's avatar David S. Miller

Merge branch 'master' of git://1984.lsi.us.es/nf

Pablo Neira Ayuso says:

====================
The following patchset contains fixes for your net tree, two of them
are due to relatively recent changes, one has been a longstanding bug,
they are:

* Fix incorrect usage of rt_gateway in the H.323 helper, from
  Julian Anastasov.

* Skip re-route in nf_nat code for ICMP traffic. If CONFIG_XFRM is
  enabled, we waste cycles to look up for the route again. This problem
  seems to be there since really long time. From Ulrich Weber.

* Fix mismatching section in nf_conntrack_reasm, from Hein Tibosch.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 3c172868 f1df1374
...@@ -184,7 +184,8 @@ nf_nat_ipv4_out(unsigned int hooknum, ...@@ -184,7 +184,8 @@ nf_nat_ipv4_out(unsigned int hooknum,
if ((ct->tuplehash[dir].tuple.src.u3.ip != if ((ct->tuplehash[dir].tuple.src.u3.ip !=
ct->tuplehash[!dir].tuple.dst.u3.ip) || ct->tuplehash[!dir].tuple.dst.u3.ip) ||
(ct->tuplehash[dir].tuple.src.u.all != (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
ct->tuplehash[dir].tuple.src.u.all !=
ct->tuplehash[!dir].tuple.dst.u.all)) ct->tuplehash[!dir].tuple.dst.u.all))
if (nf_xfrm_me_harder(skb, AF_INET) < 0) if (nf_xfrm_me_harder(skb, AF_INET) < 0)
ret = NF_DROP; ret = NF_DROP;
...@@ -221,6 +222,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum, ...@@ -221,6 +222,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum,
} }
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM
else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
ct->tuplehash[dir].tuple.dst.u.all != ct->tuplehash[dir].tuple.dst.u.all !=
ct->tuplehash[!dir].tuple.src.u.all) ct->tuplehash[!dir].tuple.src.u.all)
if (nf_xfrm_me_harder(skb, AF_INET) < 0) if (nf_xfrm_me_harder(skb, AF_INET) < 0)
......
...@@ -186,7 +186,8 @@ nf_nat_ipv6_out(unsigned int hooknum, ...@@ -186,7 +186,8 @@ nf_nat_ipv6_out(unsigned int hooknum,
if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
&ct->tuplehash[!dir].tuple.dst.u3) || &ct->tuplehash[!dir].tuple.dst.u3) ||
(ct->tuplehash[dir].tuple.src.u.all != (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
ct->tuplehash[dir].tuple.src.u.all !=
ct->tuplehash[!dir].tuple.dst.u.all)) ct->tuplehash[!dir].tuple.dst.u.all))
if (nf_xfrm_me_harder(skb, AF_INET6) < 0) if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
ret = NF_DROP; ret = NF_DROP;
...@@ -222,6 +223,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum, ...@@ -222,6 +223,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
} }
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM
else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
ct->tuplehash[dir].tuple.dst.u.all != ct->tuplehash[dir].tuple.dst.u.all !=
ct->tuplehash[!dir].tuple.src.u.all) ct->tuplehash[!dir].tuple.src.u.all)
if (nf_xfrm_me_harder(skb, AF_INET6)) if (nf_xfrm_me_harder(skb, AF_INET6))
......
...@@ -85,7 +85,7 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = { ...@@ -85,7 +85,7 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = {
{ } { }
}; };
static int __net_init nf_ct_frag6_sysctl_register(struct net *net) static int nf_ct_frag6_sysctl_register(struct net *net)
{ {
struct ctl_table *table; struct ctl_table *table;
struct ctl_table_header *hdr; struct ctl_table_header *hdr;
...@@ -127,7 +127,7 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net) ...@@ -127,7 +127,7 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
} }
#else #else
static int __net_init nf_ct_frag6_sysctl_register(struct net *net) static int nf_ct_frag6_sysctl_register(struct net *net)
{ {
return 0; return 0;
} }
......
...@@ -753,7 +753,8 @@ static int callforward_do_filter(const union nf_inet_addr *src, ...@@ -753,7 +753,8 @@ static int callforward_do_filter(const union nf_inet_addr *src,
flowi4_to_flowi(&fl1), false)) { flowi4_to_flowi(&fl1), false)) {
if (!afinfo->route(&init_net, (struct dst_entry **)&rt2, if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
flowi4_to_flowi(&fl2), false)) { flowi4_to_flowi(&fl2), false)) {
if (rt1->rt_gateway == rt2->rt_gateway && if (rt_nexthop(rt1, fl1.daddr) ==
rt_nexthop(rt2, fl2.daddr) &&
rt1->dst.dev == rt2->dst.dev) rt1->dst.dev == rt2->dst.dev)
ret = 1; ret = 1;
dst_release(&rt2->dst); dst_release(&rt2->dst);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment