Merge branch 'master' of git://1984.lsi.us.es/nf
Pablo Neira Ayuso says: ==================== The following patchset contains netfilter updates for your net tree, they are: * Fix missing the skb->trace reset in nf_reset, noticed by Gao Feng while using the TRACE target with several net namespaces. * Fix prefix translation in IPv6 NPT if non-multiple of 32 prefixes are used, from Matthias Schiffer. * Fix invalid nfacct objects with empty name, they are now rejected with -EINVAL, spotted by Michael Zintakis, patch from myself. * A couple of fixes for wrong return values in the error path of nfnetlink_queue and nf_conntrack, from Wei Yongjun. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
commit
4f4ecd5f2a
|
@ -2641,6 +2641,9 @@ static inline void nf_reset(struct sk_buff *skb)
|
||||||
nf_bridge_put(skb->nf_bridge);
|
nf_bridge_put(skb->nf_bridge);
|
||||||
skb->nf_bridge = NULL;
|
skb->nf_bridge = NULL;
|
||||||
#endif
|
#endif
|
||||||
|
#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
|
||||||
|
skb->nf_trace = 0;
|
||||||
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Note: This doesn't put any conntrack and bridge info in dst. */
|
/* Note: This doesn't put any conntrack and bridge info in dst. */
|
||||||
|
|
|
@ -57,7 +57,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
|
||||||
if (pfx_len - i >= 32)
|
if (pfx_len - i >= 32)
|
||||||
mask = 0;
|
mask = 0;
|
||||||
else
|
else
|
||||||
mask = htonl(~((1 << (pfx_len - i)) - 1));
|
mask = htonl((1 << (i - pfx_len + 32)) - 1);
|
||||||
|
|
||||||
idx = i / 32;
|
idx = i / 32;
|
||||||
addr->s6_addr32[idx] &= mask;
|
addr->s6_addr32[idx] &= mask;
|
||||||
|
|
|
@ -568,6 +568,7 @@ static int __init nf_conntrack_standalone_init(void)
|
||||||
register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
|
register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
|
||||||
if (!nf_ct_netfilter_header) {
|
if (!nf_ct_netfilter_header) {
|
||||||
pr_err("nf_conntrack: can't register to sysctl.\n");
|
pr_err("nf_conntrack: can't register to sysctl.\n");
|
||||||
|
ret = -ENOMEM;
|
||||||
goto out_sysctl;
|
goto out_sysctl;
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
|
@ -49,6 +49,8 @@ nfnl_acct_new(struct sock *nfnl, struct sk_buff *skb,
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
|
||||||
acct_name = nla_data(tb[NFACCT_NAME]);
|
acct_name = nla_data(tb[NFACCT_NAME]);
|
||||||
|
if (strlen(acct_name) == 0)
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
list_for_each_entry(nfacct, &nfnl_acct_list, head) {
|
list_for_each_entry(nfacct, &nfnl_acct_list, head) {
|
||||||
if (strncmp(nfacct->name, acct_name, NFACCT_NAME_MAX) != 0)
|
if (strncmp(nfacct->name, acct_name, NFACCT_NAME_MAX) != 0)
|
||||||
|
|
|
@ -1062,8 +1062,10 @@ static int __init nfnetlink_queue_init(void)
|
||||||
|
|
||||||
#ifdef CONFIG_PROC_FS
|
#ifdef CONFIG_PROC_FS
|
||||||
if (!proc_create("nfnetlink_queue", 0440,
|
if (!proc_create("nfnetlink_queue", 0440,
|
||||||
proc_net_netfilter, &nfqnl_file_ops))
|
proc_net_netfilter, &nfqnl_file_ops)) {
|
||||||
|
status = -ENOMEM;
|
||||||
goto cleanup_subsys;
|
goto cleanup_subsys;
|
||||||
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
register_netdevice_notifier(&nfqnl_dev_notifier);
|
register_netdevice_notifier(&nfqnl_dev_notifier);
|
||||||
|
|
Loading…
Reference in a new issue