Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a3d9dd89 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
The following patchset contains five fixes for Netfilter/IPVS, they are:

* A skb leak fix in fragmentation handling in case that helpers are in place,
  it occurs since the IPV6 NAT infrastructure, from Phil Oester.

* Fix SCTP port mangling in ICMP packets for IPVS, from Julian Anastasov.

* Fix event delivery in ctnetlink regarding the new connlabel infrastructure,
  from Florian Westphal.

* Fix mangling in the SIP NAT helper, from Balazs Peter Odor.

* Fix crash in ipt_ULOG introduced while adding netnamespace support,
  from Gao Feng.

I'll take care of passing several of these patches to -stable once they hit
Linus' tree.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f57da7a6 c8fc51cf

net/ipv4/netfilter/ipt_ULOG.c

+8 −4
Original line number Diff line number Diff line
@@ -125,15 +125,16 @@ static void ulog_send(struct ulog_net *ulog, unsigned int nlgroupnum) 
/* timer function to flush queue in flushtimeout time */

static void ulog_timer(unsigned long data)

{

	unsigned int groupnum = *((unsigned int *)data);

	struct ulog_net *ulog = container_of((void *)data,

					     struct ulog_net,

					     nlgroup[*(unsigned int *)data]);

					     nlgroup[groupnum]);

	pr_debug("timer function called, calling ulog_send\n");



	/* lock to protect against somebody modifying our structure

	 * from ipt_ulog_target at the same time */

	spin_lock_bh(&ulog->lock);

	ulog_send(ulog, data);

	ulog_send(ulog, groupnum);

	spin_unlock_bh(&ulog->lock);

}
@@ -407,8 +408,11 @@ static int __net_init ulog_tg_net_init(struct net *net) 


	spin_lock_init(&ulog->lock);

	/* initialize ulog_buffers */

	for (i = 0; i < ULOG_MAXNLGROUPS; i++)

		setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer, i);

	for (i = 0; i < ULOG_MAXNLGROUPS; i++) {

		ulog->nlgroup[i] = i;

		setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer,

			    (unsigned long)&ulog->nlgroup[i]);

	}



	ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);

	if (!ulog->nflognl)

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

+1 −1
Original line number Diff line number Diff line
@@ -204,7 +204,7 @@ static unsigned int __ipv6_conntrack_in(struct net *net, 
		if (ct != NULL && !nf_ct_is_untracked(ct)) {

			help = nfct_help(ct);

			if ((help && help->helper) || !nf_ct_is_confirmed(ct)) {

				nf_conntrack_get_reasm(skb);

				nf_conntrack_get_reasm(reasm);

				NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm,

					       (struct net_device *)in,

					       (struct net_device *)out,

net/netfilter/ipvs/ip_vs_core.c

+2 −1
Original line number Diff line number Diff line
@@ -1442,7 +1442,8 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) 


	/* do the statistics and put it back */

	ip_vs_in_stats(cp, skb);

	if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)

	if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol ||

	    IPPROTO_SCTP == cih->protocol)

		offset += 2 * sizeof(__u16);

	verdict = ip_vs_icmp_xmit(skb, cp, pp, offset, hooknum, &ciph);

net/netfilter/nf_conntrack_labels.c

+1 −1
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ int nf_connlabel_set(struct nf_conn *ct, u16 bit) 
	if (test_bit(bit, labels->bits))

		return 0;



	if (test_and_set_bit(bit, labels->bits))

	if (!test_and_set_bit(bit, labels->bits))

		nf_conntrack_event_cache(IPCT_LABEL, ct);



	return 0;

net/netfilter/nf_conntrack_netlink.c

+1 −0
Original line number Diff line number Diff line
@@ -1825,6 +1825,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, 
			nf_conntrack_eventmask_report((1 << IPCT_REPLY) |

						      (1 << IPCT_ASSURED) |

						      (1 << IPCT_HELPER) |

						      (1 << IPCT_LABEL) |

						      (1 << IPCT_PROTOINFO) |

						      (1 << IPCT_NATSEQADJ) |

						      (1 << IPCT_MARK),