Commit 356d6c2d authored by David S. Miller's avatar David S. Miller
parents 86b698b8 fecc1133
#ifndef _XT_LED_H #ifndef _XT_LED_H
#define _XT_LED_H #define _XT_LED_H
#include <linux/types.h>
struct xt_led_info { struct xt_led_info {
char id[27]; /* Unique ID for this trigger in the LED class */ char id[27]; /* Unique ID for this trigger in the LED class */
__u8 always_blink; /* Blink even if the LED is already on */ __u8 always_blink; /* Blink even if the LED is already on */
......
...@@ -12,4 +12,6 @@ struct xt_cluster_match_info { ...@@ -12,4 +12,6 @@ struct xt_cluster_match_info {
u_int32_t flags; u_int32_t flags;
}; };
#define XT_CLUSTER_NODES_MAX 32
#endif /* _XT_CLUSTER_MATCH_H */ #endif /* _XT_CLUSTER_MATCH_H */
...@@ -50,14 +50,14 @@ ipv6header_mt6(const struct sk_buff *skb, const struct xt_match_param *par) ...@@ -50,14 +50,14 @@ ipv6header_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
struct ipv6_opt_hdr _hdr; struct ipv6_opt_hdr _hdr;
int hdrlen; int hdrlen;
/* Is there enough space for the next ext header? */
if (len < (int)sizeof(struct ipv6_opt_hdr))
return false;
/* No more exthdr -> evaluate */ /* No more exthdr -> evaluate */
if (nexthdr == NEXTHDR_NONE) { if (nexthdr == NEXTHDR_NONE) {
temp |= MASK_NONE; temp |= MASK_NONE;
break; break;
} }
/* Is there enough space for the next ext header? */
if (len < (int)sizeof(struct ipv6_opt_hdr))
return false;
/* ESP -> evaluate */ /* ESP -> evaluate */
if (nexthdr == NEXTHDR_ESP) { if (nexthdr == NEXTHDR_ESP) {
temp |= MASK_ESP; temp |= MASK_ESP;
......
...@@ -1186,28 +1186,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[]) ...@@ -1186,28 +1186,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[])
return 0; return 0;
} }
static inline void
ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)
{
unsigned int events = 0;
if (test_bit(IPS_EXPECTED_BIT, &ct->status))
events |= IPCT_RELATED;
else
events |= IPCT_NEW;
nf_conntrack_event_report(IPCT_STATUS |
IPCT_HELPER |
IPCT_REFRESH |
IPCT_PROTOINFO |
IPCT_NATSEQADJ |
IPCT_MARK |
events,
ct,
pid,
report);
}
static struct nf_conn * static struct nf_conn *
ctnetlink_create_conntrack(struct nlattr *cda[], ctnetlink_create_conntrack(struct nlattr *cda[],
struct nf_conntrack_tuple *otuple, struct nf_conntrack_tuple *otuple,
...@@ -1373,6 +1351,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, ...@@ -1373,6 +1351,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
err = -ENOENT; err = -ENOENT;
if (nlh->nlmsg_flags & NLM_F_CREATE) { if (nlh->nlmsg_flags & NLM_F_CREATE) {
struct nf_conn *ct; struct nf_conn *ct;
enum ip_conntrack_events events;
ct = ctnetlink_create_conntrack(cda, &otuple, ct = ctnetlink_create_conntrack(cda, &otuple,
&rtuple, u3); &rtuple, u3);
...@@ -1383,9 +1362,18 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, ...@@ -1383,9 +1362,18 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
err = 0; err = 0;
nf_conntrack_get(&ct->ct_general); nf_conntrack_get(&ct->ct_general);
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);
ctnetlink_event_report(ct, if (test_bit(IPS_EXPECTED_BIT, &ct->status))
NETLINK_CB(skb).pid, events = IPCT_RELATED;
nlmsg_report(nlh)); else
events = IPCT_NEW;
nf_conntrack_event_report(IPCT_STATUS |
IPCT_HELPER |
IPCT_PROTOINFO |
IPCT_NATSEQADJ |
IPCT_MARK | events,
ct, NETLINK_CB(skb).pid,
nlmsg_report(nlh));
nf_ct_put(ct); nf_ct_put(ct);
} else } else
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);
...@@ -1404,9 +1392,13 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, ...@@ -1404,9 +1392,13 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
if (err == 0) { if (err == 0) {
nf_conntrack_get(&ct->ct_general); nf_conntrack_get(&ct->ct_general);
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);
ctnetlink_event_report(ct, nf_conntrack_event_report(IPCT_STATUS |
NETLINK_CB(skb).pid, IPCT_HELPER |
nlmsg_report(nlh)); IPCT_PROTOINFO |
IPCT_NATSEQADJ |
IPCT_MARK,
ct, NETLINK_CB(skb).pid,
nlmsg_report(nlh));
nf_ct_put(ct); nf_ct_put(ct);
} else } else
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);
......
...@@ -135,7 +135,13 @@ static bool xt_cluster_mt_checkentry(const struct xt_mtchk_param *par) ...@@ -135,7 +135,13 @@ static bool xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
{ {
struct xt_cluster_match_info *info = par->matchinfo; struct xt_cluster_match_info *info = par->matchinfo;
if (info->node_mask >= (1 << info->total_nodes)) { if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
printk(KERN_ERR "xt_cluster: you have exceeded the maximum "
"number of cluster nodes (%u > %u)\n",
info->total_nodes, XT_CLUSTER_NODES_MAX);
return false;
}
if (info->node_mask >= (1ULL << info->total_nodes)) {
printk(KERN_ERR "xt_cluster: this node mask cannot be " printk(KERN_ERR "xt_cluster: this node mask cannot be "
"higher than the total number of nodes\n"); "higher than the total number of nodes\n");
return false; return false;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment