Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8dbad1a8 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Fix compilation warning in xt_hashlimit on m68k 32-bits, from
   Geert Uytterhoeven.

2) Fix wrong timeout in set elements added from packet path via
   nft_dynset, from Anders K. Pedersen.

3) Remove obsolete nf_conntrack_events_retry_timeout sysctl
   documentation, from Nicolas Dichtel.

4) Ensure proper initialization of log flags via xt_LOG, from
   Liping Zhang.

5) Missing alias to autoload ipcomp, also from Liping Zhang.

6) Missing NFTA_HASH_OFFSET attribute validation, again from Liping.

7) Wrong integer type in the new nft_parse_u32_check() function,
   from Dan Carpenter.

8) Another wrong integer type declaration in nft_exthdr_init, also
   from Dan Carpenter.

9) Fix insufficient mode validation in nft_range.

10) Fix compilation warning in nft_range due to possible uninitialized
    value, from Arnd Bergmann.

11) Zero nf_hook_ops allocated via xt_hook_alloc() in x_tables to
    calm down kmemcheck, from Florian Westphal.

12) Schedule gc_worker() to run again if GC_MAX_EVICTS quota is reached,
    from Nicolas Dichtel.

13) Fix nf_queue() after conversion to single-linked hook list, related
    to incorrect bypass flag handling and incorrect hook point of
    reinjection.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 97dcaa0f 7034b566

Documentation/networking/nf_conntrack-sysctl.txt

+0 −18
Original line number Diff line number Diff line
@@ -33,24 +33,6 @@ nf_conntrack_events - BOOLEAN 
	If this option is enabled, the connection tracking code will

	provide userspace with connection tracking events via ctnetlink.



nf_conntrack_events_retry_timeout - INTEGER (seconds)

	default 15



	This option is only relevant when "reliable connection tracking

	events" are used.  Normally, ctnetlink is "lossy", that is,

	events are normally dropped when userspace listeners can't keep up.



	Userspace can request "reliable event mode".  When this mode is

	active, the conntrack will only be destroyed after the event was

	delivered.  If event delivery fails, the kernel periodically

	re-tries to send the event to userspace.



	This is the maximum interval the kernel should use when re-trying

	to deliver the destroy event.



	A higher number means there will be fewer delivery retries and it

	will take longer for a backlog to be processed.



nf_conntrack_expect_max - INTEGER

	Maximum size of expectation table.  Default value is

	nf_conntrack_buckets / 256. Minimum is 1.

net/netfilter/core.c

+3 −10
Original line number Diff line number Diff line
@@ -361,16 +361,9 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state) 
		if (ret == 0)

			ret = -EPERM;

	} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {

		int err;



		RCU_INIT_POINTER(state->hook_entries, entry);

		err = nf_queue(skb, state, verdict >> NF_VERDICT_QBITS);

		if (err < 0) {

			if (err == -ESRCH &&

			   (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS))

		ret = nf_queue(skb, state, &entry, verdict);

		if (ret == 1 && entry)

			goto next_hook;

			kfree_skb(skb);

		}

	}

	return ret;

}

net/netfilter/nf_conntrack_core.c

+1 −1
Original line number Diff line number Diff line
@@ -983,7 +983,7 @@ static void gc_worker(struct work_struct *work) 
		return;



	ratio = scanned ? expired_count * 100 / scanned : 0;

	if (ratio >= 90)

	if (ratio >= 90 || expired_count == GC_MAX_EVICTS)

		next_run = 0;



	gc_work->last_bucket = i;

net/netfilter/nf_internals.h

+1 −1
Original line number Diff line number Diff line
@@ -18,7 +18,7 @@ unsigned int nf_iterate(struct sk_buff *skb, struct nf_hook_state *state, 


/* nf_queue.c */

int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,

	     unsigned int queuenum);

	     struct nf_hook_entry **entryp, unsigned int verdict);

void nf_queue_nf_hook_drop(struct net *net, const struct nf_hook_entry *entry);

int __init netfilter_queue_init(void);

net/netfilter/nf_queue.c

+32 −16
Original line number Diff line number Diff line
@@ -107,12 +107,7 @@ void nf_queue_nf_hook_drop(struct net *net, const struct nf_hook_entry *entry) 
	rcu_read_unlock();

}



/*

 * Any packet that leaves via this function must come back

 * through nf_reinject().

 */

int nf_queue(struct sk_buff *skb,

	     struct nf_hook_state *state,

static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,

		      unsigned int queuenum)

{

	int status = -ENOENT;
@@ -161,6 +156,27 @@ int nf_queue(struct sk_buff *skb, 
	return status;

}



/* Packets leaving via this function must come back through nf_reinject(). */

int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,

	     struct nf_hook_entry **entryp, unsigned int verdict)

{

	struct nf_hook_entry *entry = *entryp;

	int ret;



	RCU_INIT_POINTER(state->hook_entries, entry);

	ret = __nf_queue(skb, state, verdict >> NF_VERDICT_QBITS);

	if (ret < 0) {

		if (ret == -ESRCH &&

		    (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS)) {

			*entryp = rcu_dereference(entry->next);

			return 1;

		}

		kfree_skb(skb);

	}



	return 0;

}



void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)

{

	struct nf_hook_entry *hook_entry;
@@ -187,6 +203,8 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) 
	entry->state.thresh = INT_MIN;



	if (verdict == NF_ACCEPT) {

		hook_entry = rcu_dereference(hook_entry->next);

		if (hook_entry)

next_hook:

			verdict = nf_iterate(skb, &entry->state, &hook_entry);

	}
@@ -194,19 +212,17 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) 
	switch (verdict & NF_VERDICT_MASK) {

	case NF_ACCEPT:

	case NF_STOP:

okfn:

		local_bh_disable();

		entry->state.okfn(entry->state.net, entry->state.sk, skb);

		local_bh_enable();

		break;

	case NF_QUEUE:

		RCU_INIT_POINTER(entry->state.hook_entries, hook_entry);

		err = nf_queue(skb, &entry->state,

			       verdict >> NF_VERDICT_QBITS);

		if (err < 0) {

			if (err == -ESRCH &&

			   (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS))

		err = nf_queue(skb, &entry->state, &hook_entry, verdict);

		if (err == 1) {

			if (hook_entry)

				goto next_hook;

			kfree_skb(skb);

			goto okfn;

		}

		break;

	case NF_STOLEN: