Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ccba543 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://1984.lsi.us.es/nf-next 



Pablo Neira Ayuso says:

====================
The following patchset contain updates for your net-next tree, they are:

* Fix (for just added) connlabel dependencies, from Florian Westphal.

* Add aliasing support for conntrack, thus users can either use -m state
  or -m conntrack from iptables while using the same kernel module, from
  Jozsef Kadlecsik.

* Some code refactoring for the CT target to merge common code in
  revision 0 and 1, from myself.

* Add aliasing support for CT, based on patch from Jozsef Kadlecsik.

* Add one mutex per nfnetlink subsystem, from myself.

* Improved logging for packets that are dropped by helpers, from myself.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 6338a53a b20ab9cc

include/linux/netfilter/nfnetlink.h

+2 −2
Original line number Original line Diff line number Diff line
@@ -34,8 +34,8 @@ extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigne 
extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);

extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);

extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);

extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);





extern void nfnl_lock(void);

extern void nfnl_lock(__u8 subsys_id);

extern void nfnl_unlock(void);

extern void nfnl_unlock(__u8 subsys_id);





#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \

#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \

	MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))

	MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))

include/net/netfilter/nf_conntrack_helper.h

+4 −0
Original line number Original line Diff line number Diff line
@@ -100,6 +100,10 @@ struct nf_ct_helper_expectfn { 
	void (*expectfn)(struct nf_conn *ct, struct nf_conntrack_expect *exp);

	void (*expectfn)(struct nf_conn *ct, struct nf_conntrack_expect *exp);

};

};





__printf(3,4)

void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct,

		      const char *fmt, ...);



void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n);

void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n);

void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n);

void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n);

struct nf_ct_helper_expectfn *

struct nf_ct_helper_expectfn *

include/uapi/linux/netfilter/xt_CT.h

+5 −1
Original line number Original line Diff line number Diff line
@@ -3,7 +3,11 @@ 




#include <linux/types.h>

#include <linux/types.h>





#define XT_CT_NOTRACK	0x1

enum {

	XT_CT_NOTRACK		= 1 << 0,

	XT_CT_NOTRACK_ALIAS	= 1 << 1,

	XT_CT_MASK		= XT_CT_NOTRACK | XT_CT_NOTRACK_ALIAS,

};





struct xt_ct_target_info {

struct xt_ct_target_info {

	__u16 flags;

	__u16 flags;

include/uapi/linux/netfilter/xt_conntrack.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -31,6 +31,7 @@ enum { 
	XT_CONNTRACK_REPLSRC_PORT = 1 << 10,

	XT_CONNTRACK_REPLSRC_PORT = 1 << 10,

	XT_CONNTRACK_REPLDST_PORT = 1 << 11,

	XT_CONNTRACK_REPLDST_PORT = 1 << 11,

	XT_CONNTRACK_DIRECTION    = 1 << 12,

	XT_CONNTRACK_DIRECTION    = 1 << 12,

	XT_CONNTRACK_STATE_ALIAS  = 1 << 13,

};

};





struct xt_conntrack_mtinfo1 {

struct xt_conntrack_mtinfo1 {

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

+2 −8
Original line number Original line Diff line number Diff line
@@ -100,7 +100,6 @@ static unsigned int ipv4_helper(unsigned int hooknum, 
	enum ip_conntrack_info ctinfo;

	enum ip_conntrack_info ctinfo;

	const struct nf_conn_help *help;

	const struct nf_conn_help *help;

	const struct nf_conntrack_helper *helper;

	const struct nf_conntrack_helper *helper;

	unsigned int ret;





	/* This is where we call the helper: as the packet goes out. */

	/* This is where we call the helper: as the packet goes out. */

	ct = nf_ct_get(skb, &ctinfo);

	ct = nf_ct_get(skb, &ctinfo);
@@ -116,13 +115,8 @@ static unsigned int ipv4_helper(unsigned int hooknum, 
	if (!helper)

	if (!helper)

		return NF_ACCEPT;

		return NF_ACCEPT;





	ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),

	return helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),

			    ct, ctinfo);

			    ct, ctinfo);

	if (ret != NF_ACCEPT && (ret & NF_VERDICT_MASK) != NF_QUEUE) {

		nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL,

			      "nf_ct_%s: dropping packet", helper->name);

	}

	return ret;

}

}





static unsigned int ipv4_confirm(unsigned int hooknum,

static unsigned int ipv4_confirm(unsigned int hooknum,