Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e8ad1a8f authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://1984.lsi.us.es/nf-next 



Pablo Neira Ayuso says:

====================
* Remove limitation in the maximum number of supported sets in ipset.
  Now ipset automagically increments the number of slots in the array
  of sets by 64 new spare slots, from Jozsef Kadlecsik.

* Partially remove the generic queue infrastructure now that ip_queue
  is gone. Its only client is nfnetlink_queue now, from Florian
  Westphal.

* Add missing attribute policy checkings in ctnetlink, from Florian
  Westphal.

* Automagically kill conntrack entries that use the wrong output
  interface for the masquerading case in case of routing changes,
  from Jozsef Kadlecsik.

* Two patches two improve ct object traceability. Now ct objects are
  always placed in any of the existing lists. This allows us to dump
  the content of unconfirmed and dying conntracks via ctnetlink as
  a way to provide more instrumentation in case you suspect leaks,
  from myself.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 099f7aa7 a0ecb85a

include/net/netfilter/nf_conntrack.h

+1 −1
Original line number Diff line number Diff line
@@ -182,7 +182,7 @@ __nf_conntrack_find(struct net *net, u16 zone, 


extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);

extern void nf_ct_delete_from_lists(struct nf_conn *ct);

extern void nf_ct_insert_dying_list(struct nf_conn *ct);

extern void nf_ct_dying_timeout(struct nf_conn *ct);



extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report);

include/net/netfilter/nf_nat.h

+15 −0
Original line number Diff line number Diff line
@@ -68,4 +68,19 @@ static inline struct nf_conn_nat *nfct_nat(const struct nf_conn *ct) 
#endif

}



static inline bool nf_nat_oif_changed(unsigned int hooknum,

				      enum ip_conntrack_info ctinfo,

				      struct nf_conn_nat *nat,

				      const struct net_device *out)

{

#if IS_ENABLED(CONFIG_IP_NF_TARGET_MASQUERADE) || \

    IS_ENABLED(CONFIG_IP6_NF_TARGET_MASQUERADE)

	return nat->masq_index && hooknum == NF_INET_POST_ROUTING &&

	       CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL &&

	       nat->masq_index != out->ifindex;

#else

	return false;

#endif

}



#endif

include/net/netfilter/nf_queue.h

+2 −6
Original line number Diff line number Diff line
@@ -21,14 +21,10 @@ struct nf_queue_entry { 
struct nf_queue_handler {

	int			(*outfn)(struct nf_queue_entry *entry,

					 unsigned int queuenum);

	char			*name;

};



extern int nf_register_queue_handler(u_int8_t pf,

				     const struct nf_queue_handler *qh);

extern int nf_unregister_queue_handler(u_int8_t pf,

				       const struct nf_queue_handler *qh);

extern void nf_unregister_queue_handlers(const struct nf_queue_handler *qh);

void nf_register_queue_handler(const struct nf_queue_handler *qh);

void nf_unregister_queue_handler(void);

extern void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);



#endif /* _NF_QUEUE_H */

include/uapi/linux/netfilter/nfnetlink_conntrack.h

+2 −0
Original line number Diff line number Diff line
@@ -9,6 +9,8 @@ enum cntl_msg_types { 
	IPCTNL_MSG_CT_GET_CTRZERO,

	IPCTNL_MSG_CT_GET_STATS_CPU,

	IPCTNL_MSG_CT_GET_STATS,

	IPCTNL_MSG_CT_GET_DYING,

	IPCTNL_MSG_CT_GET_UNCONFIRMED,



	IPCTNL_MSG_MAX

};

net/ipv4/netfilter/iptable_nat.c

+4 −0
Original line number Diff line number Diff line
@@ -134,6 +134,10 @@ nf_nat_ipv4_fn(unsigned int hooknum, 
		/* ESTABLISHED */

		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||

			     ctinfo == IP_CT_ESTABLISHED_REPLY);

		if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) {

			nf_ct_kill_acct(ct, ctinfo, skb);

			return NF_DROP;

		}

	}



	return nf_nat_packet(ct, ctinfo, hooknum, skb);