Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6 (424eff97) · Commits · e / devices / android_kernel_oneplus_sm7250

include/linux/netfilter/nf_conntrack_tcp.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -66,6 +66,9 @@ struct ip_ct_tcp {
		u_int32_t last_ack; /* Last sequence number seen in opposite dir */
		u_int32_t last_end; /* Last seq + len */
		u_int16_t last_win; /* Last window advertisement seen in dir */
		/* For SYN packets while we may be out-of-sync */
		u_int8_t last_wscale; /* Last window scaling factor seen */
		u_int8_t last_flags; /* Last flags set */
		};

		#endif /* __KERNEL__ */

net/ipv4/netfilter/arp_tables.c

+11 −11

Original line number	Diff line number	Diff line
		@@ -384,11 +384,11 @@ static int mark_source_chains(struct xt_table_info *newinfo,
		\|= ((1 << hook) \| (1 << NF_ARP_NUMHOOKS));

		/* Unconditional return/END. */
		if ((e->target_offset == sizeof(struct arpt_entry)
		&& (strcmp(t->target.u.user.name,
		ARPT_STANDARD_TARGET) == 0)
		&& t->verdict < 0
		&& unconditional(&e->arp)) \|\| visited) {
		if ((e->target_offset == sizeof(struct arpt_entry) &&
		(strcmp(t->target.u.user.name,
		ARPT_STANDARD_TARGET) == 0) &&
		t->verdict < 0 && unconditional(&e->arp)) \|\|
		visited) {
		unsigned int oldpos, size;

		if ((strcmp(t->target.u.user.name,
		@@ -427,8 +427,8 @@ static int mark_source_chains(struct xt_table_info *newinfo,
		int newpos = t->verdict;

		if (strcmp(t->target.u.user.name,
		ARPT_STANDARD_TARGET) == 0
		&& newpos >= 0) {
		ARPT_STANDARD_TARGET) == 0 &&
		newpos >= 0) {
		if (newpos > newinfo->size -
		sizeof(struct arpt_entry)) {
		duprintf("mark_source_chains: "
		@@ -559,8 +559,8 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
		{
		unsigned int h;

		if ((unsigned long)e % __alignof__(struct arpt_entry) != 0
		\|\| (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
		if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 \|\|
		(unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
		duprintf("Bad offset %p\n", e);
		return -EINVAL;
		}
		@@ -1251,8 +1251,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
		int ret, off, h;

		duprintf("check_compat_entry_size_and_hooks %p\n", e);
		if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0
		\|\| (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
		if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 \|\|
		(unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
		duprintf("Bad offset %p, limit = %p\n", e, limit);
		return -EINVAL;
		}

net/ipv4/netfilter/ip_queue.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -497,8 +497,7 @@ ipq_rcv_nl_event(struct notifier_block *this,
		{
		struct netlink_notify *n = ptr;

		if (event == NETLINK_URELEASE &&
		n->protocol == NETLINK_FIREWALL && n->pid) {
		if (event == NETLINK_URELEASE && n->protocol == NETLINK_FIREWALL) {
		write_lock_bh(&queue_lock);
		if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
		__ipq_reset();
		@@ -622,7 +621,7 @@ cleanup_ipqnl: __maybe_unused
		static void __exit ip_queue_fini(void)
		{
		nf_unregister_queue_handlers(&nfqh);
		synchronize_net();

		ipq_flush(NULL, 0);

		#ifdef CONFIG_SYSCTL

net/ipv4/netfilter/ip_tables.c

+23 −23

Original line number	Diff line number	Diff line
		@@ -89,8 +89,8 @@ ip_packet_match(const struct iphdr *ip,
		#define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))

		if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
		IPT_INV_SRCIP)
		\|\| FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
		IPT_INV_SRCIP) \|\|
		FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
		IPT_INV_DSTIP)) {
		dprintf("Source or dest mismatch.\n");

		@@ -122,8 +122,8 @@ ip_packet_match(const struct iphdr *ip,
		}

		/* Check specific protocol */
		if (ipinfo->proto
		&& FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
		if (ipinfo->proto &&
		FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
		dprintf("Packet protocol %hi does not match %hi.%s\n",
		ip->protocol, ipinfo->proto,
		ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
		@@ -246,11 +246,11 @@ get_chainname_rulenum(struct ipt_entry s, struct ipt_entry e,
		} else if (s == e) {
		(*rulenum)++;

		if (s->target_offset == sizeof(struct ipt_entry)
		&& strcmp(t->target.u.kernel.target->name,
		IPT_STANDARD_TARGET) == 0
		&& t->verdict < 0
		&& unconditional(&s->ip)) {
		if (s->target_offset == sizeof(struct ipt_entry) &&
		strcmp(t->target.u.kernel.target->name,
		IPT_STANDARD_TARGET) == 0 &&
		t->verdict < 0 &&
		unconditional(&s->ip)) {
		/* Tail of chains: STANDARD target (return/policy) */
		comment = chainname == hookname
		? comments[NF_IP_TRACE_COMMENT_POLICY]
		@@ -388,8 +388,8 @@ ipt_do_table(struct sk_buff *skb,
		back = get_entry(table_base, back->comefrom);
		continue;
		}
		if (table_base + v != ipt_next_entry(e)
		&& !(e->ip.flags & IPT_F_GOTO)) {
		if (table_base + v != ipt_next_entry(e) &&
		!(e->ip.flags & IPT_F_GOTO)) {
		/* Save old back ptr in next entry */
		struct ipt_entry *next = ipt_next_entry(e);
		next->comefrom = (void *)back - table_base;
		@@ -473,11 +473,11 @@ mark_source_chains(struct xt_table_info *newinfo,
		e->comefrom \|= ((1 << hook) \| (1 << NF_INET_NUMHOOKS));

		/* Unconditional return/END. */
		if ((e->target_offset == sizeof(struct ipt_entry)
		&& (strcmp(t->target.u.user.name,
		IPT_STANDARD_TARGET) == 0)
		&& t->verdict < 0
		&& unconditional(&e->ip)) \|\| visited) {
		if ((e->target_offset == sizeof(struct ipt_entry) &&
		(strcmp(t->target.u.user.name,
		IPT_STANDARD_TARGET) == 0) &&
		t->verdict < 0 && unconditional(&e->ip)) \|\|
		visited) {
		unsigned int oldpos, size;

		if ((strcmp(t->target.u.user.name,
		@@ -524,8 +524,8 @@ mark_source_chains(struct xt_table_info *newinfo,
		int newpos = t->verdict;

		if (strcmp(t->target.u.user.name,
		IPT_STANDARD_TARGET) == 0
		&& newpos >= 0) {
		IPT_STANDARD_TARGET) == 0 &&
		newpos >= 0) {
		if (newpos > newinfo->size -
		sizeof(struct ipt_entry)) {
		duprintf("mark_source_chains: "
		@@ -735,8 +735,8 @@ check_entry_size_and_hooks(struct ipt_entry *e,
		{
		unsigned int h;

		if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
		\|\| (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
		if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 \|\|
		(unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
		duprintf("Bad offset %p\n", e);
		return -EINVAL;
		}
		@@ -1548,8 +1548,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
		int ret, off, h;

		duprintf("check_compat_entry_size_and_hooks %p\n", e);
		if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
		\|\| (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
		if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 \|\|
		(unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
		duprintf("Bad offset %p, limit = %p\n", e, limit);
		return -EINVAL;
		}

net/ipv4/netfilter/ipt_CLUSTERIP.c

+10 −10

Original line number	Diff line number	Diff line
		@@ -303,9 +303,9 @@ clusterip_tg(struct sk_buff skb, const struct xt_target_param par)

		/* special case: ICMP error handling. conntrack distinguishes between
		* error messages (RELATED) and information requests (see below) */
		if (ip_hdr(skb)->protocol == IPPROTO_ICMP
		&& (ctinfo == IP_CT_RELATED
		\|\| ctinfo == IP_CT_RELATED+IP_CT_IS_REPLY))
		if (ip_hdr(skb)->protocol == IPPROTO_ICMP &&
		(ctinfo == IP_CT_RELATED \|\|
		ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY))
		return XT_CONTINUE;

		/* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO,
		@@ -362,8 +362,8 @@ static bool clusterip_tg_check(const struct xt_tgchk_param *par)
		return false;

		}
		if (e->ip.dmsk.s_addr != htonl(0xffffffff)
		\|\| e->ip.dst.s_addr == 0) {
		if (e->ip.dmsk.s_addr != htonl(0xffffffff) \|\|
		e->ip.dst.s_addr == 0) {
		printk(KERN_ERR "CLUSTERIP: Please specify destination IP\n");
		return false;
		}
		@@ -495,14 +495,14 @@ arp_mangle(unsigned int hook,
		struct clusterip_config *c;

		/* we don't care about non-ethernet and non-ipv4 ARP */
		if (arp->ar_hrd != htons(ARPHRD_ETHER)
		\|\| arp->ar_pro != htons(ETH_P_IP)
		\|\| arp->ar_pln != 4 \|\| arp->ar_hln != ETH_ALEN)
		if (arp->ar_hrd != htons(ARPHRD_ETHER) \|\|
		arp->ar_pro != htons(ETH_P_IP) \|\|
		arp->ar_pln != 4 \|\| arp->ar_hln != ETH_ALEN)
		return NF_ACCEPT;

		/* we only want to mangle arp requests and replies */
		if (arp->ar_op != htons(ARPOP_REPLY)
		&& arp->ar_op != htons(ARPOP_REQUEST))
		if (arp->ar_op != htons(ARPOP_REPLY) &&
		arp->ar_op != htons(ARPOP_REQUEST))
		return NF_ACCEPT;

		payload = (void *)(arp+1);