Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f6b15c3 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter/IPVS fixes for your net tree,
they are:

1) Fix handling of simultaneous open TCP connection in conntrack,
   from Jozsef Kadlecsik.

2) Insufficient sanitify check of xtables extension names, from
   Florian Westphal.

3) Skip unnecessary synchronize_rcu() call when transaction log
   is already empty, from Florian Westphal.

4) Incorrect destination mac validation in ebt_stp, from Stephen
   Hemminger.

5) xtables module reference counter leak in nft_compat, from
   Florian Westphal.

6) Incorrect connection reference counting logic in IPVS
   one-packet scheduler, from Julian Anastasov.

7) Wrong stats for 32-bits CPU in IPVS, also from Julian.

8) Calm down sparse error in netfilter core, also from Florian.

9) Use nla_strlcpy to fix compilation warning in nfnetlink_acct
   and nfnetlink_cthelper, again from Florian.

10) Missing module alias in icmp and icmp6 xtables extensions,
    from Florian Westphal.

11) Base chain statistics in nf_tables may be unset/null, from Florian.

12) Fix handling of large matchinfo size in nft_compat, this includes
    one preparation for before this fix. From Florian.

13) Fix bogus EBUSY error when deleting chains due to incorrect reference
    counting from the preparation phase of the two-phase commit protocol.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 91dfd02b f0dfd7a2

include/net/netfilter/nf_tables.h

+5 −0
Original line number Diff line number Diff line
@@ -170,6 +170,7 @@ struct nft_data_desc { 
int nft_data_init(const struct nft_ctx *ctx,

		  struct nft_data *data, unsigned int size,

		  struct nft_data_desc *desc, const struct nlattr *nla);

void nft_data_hold(const struct nft_data *data, enum nft_data_types type);

void nft_data_release(const struct nft_data *data, enum nft_data_types type);

int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,

		  enum nft_data_types type, unsigned int len);
@@ -736,6 +737,10 @@ struct nft_expr_ops { 
	int				(*init)(const struct nft_ctx *ctx,

						const struct nft_expr *expr,

						const struct nlattr * const tb[]);

	void				(*activate)(const struct nft_ctx *ctx,

						    const struct nft_expr *expr);

	void				(*deactivate)(const struct nft_ctx *ctx,

						      const struct nft_expr *expr);

	void				(*destroy)(const struct nft_ctx *ctx,

						   const struct nft_expr *expr);

	int				(*dump)(struct sk_buff *skb,

include/uapi/linux/netfilter/nf_conntrack_tcp.h

+3 −0
Original line number Diff line number Diff line
@@ -46,6 +46,9 @@ enum tcp_conntrack { 
/* Marks possibility for expected RFC5961 challenge ACK */

#define IP_CT_EXP_CHALLENGE_ACK 		0x40



/* Simultaneous open initialized */

#define IP_CT_TCP_SIMULTANEOUS_OPEN		0x80



struct nf_ct_tcp_flags {

	__u8 flags;

	__u8 mask;

net/bridge/netfilter/ebt_stp.c

+2 −2
Original line number Diff line number Diff line
@@ -161,8 +161,8 @@ static int ebt_stp_mt_check(const struct xt_mtchk_param *par) 
	/* Make sure the match only receives stp frames */

	if (!par->nft_compat &&

	    (!ether_addr_equal(e->destmac, eth_stp_addr) ||

	     !is_broadcast_ether_addr(e->destmsk) ||

	     !(e->bitmask & EBT_DESTMAC)))

	     !(e->bitmask & EBT_DESTMAC) ||

	     !is_broadcast_ether_addr(e->destmsk)))

		return -EINVAL;



	return 0;

net/ipv4/netfilter/ip_tables.c

+1 −0
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ 
MODULE_LICENSE("GPL");

MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");

MODULE_DESCRIPTION("IPv4 packet filter");

MODULE_ALIAS("ipt_icmp");



void *ipt_alloc_initial_table(const struct xt_table *info)

{

net/ipv6/netfilter/ip6_tables.c

+1 −0
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
MODULE_LICENSE("GPL");

MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");

MODULE_DESCRIPTION("IPv6 packet filter");

MODULE_ALIAS("ip6t_icmp6");



void *ip6t_alloc_initial_table(const struct xt_table *info)

{