Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 086cb6a4 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains a large batch with Netfilter fixes for
your net tree, they are:

1) Two patches to solve conntrack garbage collector cpu hogging, one to
   remove GC_MAX_EVICTS and another to look at the ratio (scanned entries
   vs. evicted entries) to make a decision on whether to reduce or not
   the scanning interval. From Florian Westphal.

2) Two patches to fix incorrect set element counting if NLM_F_EXCL is
   is not set. Moreover, don't decrenent set->nelems from abort patch
   if -ENFILE which leaks a spare slot in the set. This includes a
   patch to deconstify the set walk callback to update set->ndeact.

3) Two fixes for the fwmark_reflect sysctl feature: Propagate mark to
   reply packets both from nf_reject and local stack, from Pau Espin Pedrol.

4) Fix incorrect handling of loopback traffic in rpfilter and nf_tables
   fib expression, from Liping Zhang.

5) Fix oops on stateful objects netlink dump, when no filter is specified.
   Also from Liping Zhang.

6) Fix a build error if proc is not available in ipt_CLUSTERIP, related
   to fix that was applied in the previous batch for net. From Arnd Bergmann.

7) Fix lack of string validation in table, chain, set and stateful
   object names in nf_tables, from Liping Zhang. Moreover, restrict
   maximum log prefix length to 127 bytes, otherwise explicitly bail
   out.

8) Two patches to fix spelling and typos in nf_tables uapi header file
   and Kconfig, patches from Alexander Alemayhu and William Breathitt Gray.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 214767fa b2c11e4b

include/net/netfilter/nf_tables.h

+3 −3
Original line number Diff line number Diff line
@@ -207,9 +207,9 @@ struct nft_set_iter { 
	unsigned int	skip;

	int		err;

	int		(*fn)(const struct nft_ctx *ctx,

			      const struct nft_set *set,

			      struct nft_set *set,

			      const struct nft_set_iter *iter,

			      const struct nft_set_elem *elem);

			      struct nft_set_elem *elem);

};



/**
@@ -301,7 +301,7 @@ struct nft_set_ops { 
	void				(*remove)(const struct nft_set *set,

						  const struct nft_set_elem *elem);

	void				(*walk)(const struct nft_ctx *ctx,

						const struct nft_set *set,

						struct nft_set *set,

						struct nft_set_iter *iter);



	unsigned int			(*privsize)(const struct nlattr * const nla[]);

include/net/netfilter/nft_fib.h

+6 −0
Original line number Diff line number Diff line
@@ -9,6 +9,12 @@ struct nft_fib { 


extern const struct nla_policy nft_fib_policy[];



static inline bool

nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in)

{

	return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK;

}



int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr);

int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,

		 const struct nlattr * const tb[]);

include/uapi/linux/netfilter/nf_log.h

+2 −0
Original line number Diff line number Diff line
@@ -9,4 +9,6 @@ 
#define NF_LOG_MACDECODE	0x20	/* Decode MAC header */

#define NF_LOG_MASK		0x2f



#define NF_LOG_PREFIXLEN	128



#endif /* _NETFILTER_NF_LOG_H */

include/uapi/linux/netfilter/nf_tables.h

+2 −2
Original line number Diff line number Diff line
@@ -235,7 +235,7 @@ enum nft_rule_compat_flags { 
/**

 * enum nft_rule_compat_attributes - nf_tables rule compat attributes

 *

 * @NFTA_RULE_COMPAT_PROTO: numerice value of handled protocol (NLA_U32)

 * @NFTA_RULE_COMPAT_PROTO: numeric value of handled protocol (NLA_U32)

 * @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)

 */

enum nft_rule_compat_attributes {
@@ -499,7 +499,7 @@ enum nft_bitwise_attributes { 
 * enum nft_byteorder_ops - nf_tables byteorder operators

 *

 * @NFT_BYTEORDER_NTOH: network to host operator

 * @NFT_BYTEORDER_HTON: host to network opertaor

 * @NFT_BYTEORDER_HTON: host to network operator

 */

enum nft_byteorder_ops {

	NFT_BYTEORDER_NTOH,

net/ipv4/ip_output.c

+1 −0
Original line number Diff line number Diff line
@@ -1629,6 +1629,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, 
	sk->sk_protocol = ip_hdr(skb)->protocol;

	sk->sk_bound_dev_if = arg->bound_dev_if;

	sk->sk_sndbuf = sysctl_wmem_default;

	sk->sk_mark = fl4.flowi4_mark;

	err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,

			     len, 0, &ipc, &rt, MSG_DONTWAIT);

	if (unlikely(err)) {