aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2015-06-20 18:39:40 -0400
committerDavid S. Miller <davem@davemloft.net>2015-06-20 18:39:40 -0400
commit120119623b6798b70384248c0cacf8f8de419c9a (patch)
tree52cb7d6d6f5c30420833450a18c378b4d121825b
parentb67ea97fcd4e29c97ced1ecba15443ecfce395b1 (diff)
parentdcb8f5c8139ef945cdfd55900fae265c4dbefc02 (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains a final Netfilter pull request for net-next 4.2. This mostly addresses some fallout from the previous pull request, small netns updates and a couple of new features for nfnetlink_log and the socket match that didn't get in time for the previous pull request. More specifically they are: 1) Add security context information to nfnetlink_queue, from Roman Kubiak. 2) Add support to restore the sk_mark into skb->mark through xt_socket, from Harout Hedeshian. 3) Force alignment of 16 bytes of per cpu xt_counters, from Eric Dumazet. 4) Rename br_netfilter.c to br_netfilter_hooks.c to prepare split of IPv6 code into a separated file. 5) Move the IPv6 code in br_netfilter into a separated file. 6) Remove unused RCV_SKB_FAIL() in nfnetlink_queue and nfetlink_log, from Eric Biederman. 7) Two liner to simplify netns logic in em_ipset_match(). 8) Add missing includes to net/net_namespace.h to avoid compilation problems that result from not including linux/netfilter.h in netns headers. 9) Use a forward declaration instead of including linux/proc_fs.h from netns/netfilter.h 10) Add a new linux/netfilter_defs.h to replace the linux/netfilter.h inclusion in netns headers. 11) Remove spurious netfilter.h file included in the net tree, also from Eric Biederman. 12) Fix x_tables compilation warnings on 32 bits platforms that resulted from recent changes in x_tables counters, from Florian Westphal. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat
-rw-r--r--drivers/net/hamradio/bpqether.c1
-rw-r--r--drivers/net/ppp/pptp.c2
-rw-r--r--drivers/net/wan/lapbether.c1
-rw-r--r--include/linux/netfilter.h6
-rw-r--r--include/linux/netfilter/x_tables.h14
-rw-r--r--include/linux/netfilter_defs.h9
-rw-r--r--include/net/net_namespace.h2
-rw-r--r--include/net/netfilter/br_netfilter.h60
-rw-r--r--include/net/netns/netfilter.h4
-rw-r--r--include/net/netns/x_tables.h2
-rw-r--r--include/uapi/linux/netfilter.h3
-rw-r--r--include/uapi/linux/netfilter/nfnetlink_queue.h4
-rw-r--r--include/uapi/linux/netfilter/xt_socket.h8
-rw-r--r--net/ax25/af_ax25.c1
-rw-r--r--net/ax25/ax25_in.c1
-rw-r--r--net/ax25/ax25_ip.c1
-rw-r--r--net/ax25/ax25_out.c1
-rw-r--r--net/ax25/ax25_uid.c1
-rw-r--r--net/bridge/Makefile2
-rw-r--r--net/bridge/br_netfilter_hooks.c (renamed from net/bridge/br_netfilter.c)248
-rw-r--r--net/bridge/br_netfilter_ipv6.c245
-rw-r--r--net/ipv6/output_core.c1
-rw-r--r--net/netfilter/nf_synproxy_core.c1
-rw-r--r--net/netfilter/nfnetlink_log.c2
-rw-r--r--net/netfilter/nfnetlink_queue_core.c37
-rw-r--r--net/netfilter/xt_socket.c59
-rw-r--r--net/netrom/nr_route.c1
-rw-r--r--net/rose/rose_link.c1
-rw-r--r--net/rose/rose_route.c1
-rw-r--r--net/sched/em_ipset.c4
-rw-r--r--security/selinux/xfrm.c3
31 files changed, 444 insertions, 282 deletions
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index 63ff08a26da8..7856b6ccf5c5 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -76,7 +76,6 @@
76#include <linux/proc_fs.h> 76#include <linux/proc_fs.h>
77#include <linux/seq_file.h> 77#include <linux/seq_file.h>
78#include <linux/stat.h> 78#include <linux/stat.h>
79#include <linux/netfilter.h>
80#include <linux/module.h> 79#include <linux/module.h>
81#include <linux/init.h> 80#include <linux/init.h>
82#include <linux/rtnetlink.h> 81#include <linux/rtnetlink.h>
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 14839bc0aaf5..686f37daa262 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -28,8 +28,6 @@
28#include <linux/file.h> 28#include <linux/file.h>
29#include <linux/in.h> 29#include <linux/in.h>
30#include <linux/ip.h> 30#include <linux/ip.h>
31#include <linux/netfilter.h>
32#include <linux/netfilter_ipv4.h>
33#include <linux/rcupdate.h> 31#include <linux/rcupdate.h>
34#include <linux/spinlock.h> 32#include <linux/spinlock.h>
35 33
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 2f5eda8a7227..6676607164d6 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -40,7 +40,6 @@
40#include <linux/interrupt.h> 40#include <linux/interrupt.h>
41#include <linux/notifier.h> 41#include <linux/notifier.h>
42#include <linux/stat.h> 42#include <linux/stat.h>
43#include <linux/netfilter.h>
44#include <linux/module.h> 43#include <linux/module.h>
45#include <linux/lapb.h> 44#include <linux/lapb.h>
46#include <linux/init.h> 45#include <linux/init.h>
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index f5ff5d156da8..00050dfd9f23 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -10,7 +10,8 @@
10#include <linux/wait.h> 10#include <linux/wait.h>
11#include <linux/list.h> 11#include <linux/list.h>
12#include <linux/static_key.h> 12#include <linux/static_key.h>
13#include <uapi/linux/netfilter.h> 13#include <linux/netfilter_defs.h>
14
14#ifdef CONFIG_NETFILTER 15#ifdef CONFIG_NETFILTER
15static inline int NF_DROP_GETERR(int verdict) 16static inline int NF_DROP_GETERR(int verdict)
16{ 17{
@@ -38,9 +39,6 @@ static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
38 39
39int netfilter_init(void); 40int netfilter_init(void);
40 41
41/* Largest hook number + 1 */
42#define NF_MAX_HOOKS 8
43
44struct sk_buff; 42struct sk_buff;
45 43
46struct nf_hook_ops; 44struct nf_hook_ops;
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 95693c4cebdd..286098a5667f 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -356,7 +356,8 @@ static inline unsigned long ifname_compare_aligned(const char *_a,
356 * so nothing needs to be done there. 356 * so nothing needs to be done there.
357 * 357 *
358 * xt_percpu_counter_alloc returns the address of the percpu 358 * xt_percpu_counter_alloc returns the address of the percpu
359 * counter, or 0 on !SMP. 359 * counter, or 0 on !SMP. We force an alignment of 16 bytes
360 * so that bytes/packets share a common cache line.
360 * 361 *
361 * Hence caller must use IS_ERR_VALUE to check for error, this 362 * Hence caller must use IS_ERR_VALUE to check for error, this
362 * allows us to return 0 for single core systems without forcing 363 * allows us to return 0 for single core systems without forcing
@@ -365,12 +366,13 @@ static inline unsigned long ifname_compare_aligned(const char *_a,
365static inline u64 xt_percpu_counter_alloc(void) 366static inline u64 xt_percpu_counter_alloc(void)
366{ 367{
367 if (nr_cpu_ids > 1) { 368 if (nr_cpu_ids > 1) {
368 void __percpu *res = alloc_percpu(struct xt_counters); 369 void __percpu *res = __alloc_percpu(sizeof(struct xt_counters),
370 sizeof(struct xt_counters));
369 371
370 if (res == NULL) 372 if (res == NULL)
371 return (u64) -ENOMEM; 373 return (u64) -ENOMEM;
372 374
373 return (__force u64) res; 375 return (u64) (__force unsigned long) res;
374 } 376 }
375 377
376 return 0; 378 return 0;
@@ -378,14 +380,14 @@ static inline u64 xt_percpu_counter_alloc(void)
378static inline void xt_percpu_counter_free(u64 pcnt) 380static inline void xt_percpu_counter_free(u64 pcnt)
379{ 381{
380 if (nr_cpu_ids > 1) 382 if (nr_cpu_ids > 1)
381 free_percpu((void __percpu *) pcnt); 383 free_percpu((void __percpu *) (unsigned long) pcnt);
382} 384}
383 385
384static inline struct xt_counters * 386static inline struct xt_counters *
385xt_get_this_cpu_counter(struct xt_counters *cnt) 387xt_get_this_cpu_counter(struct xt_counters *cnt)
386{ 388{
387 if (nr_cpu_ids > 1) 389 if (nr_cpu_ids > 1)
388 return this_cpu_ptr((void __percpu *) cnt->pcnt); 390 return this_cpu_ptr((void __percpu *) (unsigned long) cnt->pcnt);
389 391
390 return cnt; 392 return cnt;
391} 393}
@@ -394,7 +396,7 @@ static inline struct xt_counters *
394xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) 396xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
395{ 397{
396 if (nr_cpu_ids > 1) 398 if (nr_cpu_ids > 1)
397 return per_cpu_ptr((void __percpu *) cnt->pcnt, cpu); 399 return per_cpu_ptr((void __percpu *) (unsigned long) cnt->pcnt, cpu);
398 400
399 return cnt; 401 return cnt;
400} 402}
diff --git a/include/linux/netfilter_defs.h b/include/linux/netfilter_defs.h
new file mode 100644
index 000000000000..d3a7f8597e82
--- /dev/null
+++ b/include/linux/netfilter_defs.h
@@ -0,0 +1,9 @@
1#ifndef __LINUX_NETFILTER_CORE_H_
2#define __LINUX_NETFILTER_CORE_H_
3
4#include <uapi/linux/netfilter.h>
5
6/* Largest hook number + 1, see uapi/linux/netfilter_decnet.h */
7#define NF_MAX_HOOKS 8
8
9#endif
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 72eb23723294..e951453e0a23 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -28,6 +28,8 @@
28#include <net/netns/xfrm.h> 28#include <net/netns/xfrm.h>
29#include <net/netns/mpls.h> 29#include <net/netns/mpls.h>
30#include <linux/ns_common.h> 30#include <linux/ns_common.h>
31#include <linux/idr.h>
32#include <linux/skbuff.h>
31 33
32struct user_namespace; 34struct user_namespace;
33struct proc_dir_entry; 35struct proc_dir_entry;
diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h
index 2aa6048a55c1..bab824bde92c 100644
--- a/include/net/netfilter/br_netfilter.h
+++ b/include/net/netfilter/br_netfilter.h
@@ -1,6 +1,66 @@
1#ifndef _BR_NETFILTER_H_ 1#ifndef _BR_NETFILTER_H_
2#define _BR_NETFILTER_H_ 2#define _BR_NETFILTER_H_
3 3
4#include "../../../net/bridge/br_private.h"
5
6static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
7{
8 skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);
9
10 if (likely(skb->nf_bridge))
11 atomic_set(&(skb->nf_bridge->use), 1);
12
13 return skb->nf_bridge;
14}
15
16void nf_bridge_update_protocol(struct sk_buff *skb);
17
18static inline struct nf_bridge_info *
19nf_bridge_info_get(const struct sk_buff *skb)
20{
21 return skb->nf_bridge;
22}
23
24unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb);
25
26static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
27{
28 unsigned int len = nf_bridge_encap_header_len(skb);
29
30 skb_push(skb, len);
31 skb->network_header -= len;
32}
33
34int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb);
35
36static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
37{
38 struct net_bridge_port *port;
39
40 port = br_port_get_rcu(dev);
41 return port ? &port->br->fake_rtable : NULL;
42}
43
44struct net_device *setup_pre_routing(struct sk_buff *skb);
4void br_netfilter_enable(void); 45void br_netfilter_enable(void);
5 46
47#if IS_ENABLED(CONFIG_IPV6)
48int br_validate_ipv6(struct sk_buff *skb);
49unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
50 struct sk_buff *skb,
51 const struct nf_hook_state *state);
52#else
53static inline int br_validate_ipv6(struct sk_buff *skb)
54{
55 return -1;
56}
57
58static inline unsigned int
59br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops, struct sk_buff *skb,
60 const struct nf_hook_state *state)
61{
62 return NF_DROP;
63}
64#endif
65
6#endif /* _BR_NETFILTER_H_ */ 66#endif /* _BR_NETFILTER_H_ */
diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h
index 88740024ccf3..532e4ba64f49 100644
--- a/include/net/netns/netfilter.h
+++ b/include/net/netns/netfilter.h
@@ -1,9 +1,9 @@
1#ifndef __NETNS_NETFILTER_H 1#ifndef __NETNS_NETFILTER_H
2#define __NETNS_NETFILTER_H 2#define __NETNS_NETFILTER_H
3 3
4#include <linux/proc_fs.h> 4#include <linux/netfilter_defs.h>
5#include <linux/netfilter.h>
6 5
6struct proc_dir_entry;
7struct nf_logger; 7struct nf_logger;
8 8
9struct netns_nf { 9struct netns_nf {
diff --git a/include/net/netns/x_tables.h b/include/net/netns/x_tables.h
index 4d6597ad6067..c8a7681efa6a 100644
--- a/include/net/netns/x_tables.h
+++ b/include/net/netns/x_tables.h
@@ -2,7 +2,7 @@
2#define __NETNS_X_TABLES_H 2#define __NETNS_X_TABLES_H
3 3
4#include <linux/list.h> 4#include <linux/list.h>
5#include <linux/netfilter.h> 5#include <linux/netfilter_defs.h>
6 6
7struct ebt_table; 7struct ebt_table;
8 8
diff --git a/include/uapi/linux/netfilter.h b/include/uapi/linux/netfilter.h
index 177027cce6b3..d93f949d1d9a 100644
--- a/include/uapi/linux/netfilter.h
+++ b/include/uapi/linux/netfilter.h
@@ -4,7 +4,8 @@
4#include <linux/types.h> 4#include <linux/types.h>
5#include <linux/compiler.h> 5#include <linux/compiler.h>
6#include <linux/sysctl.h> 6#include <linux/sysctl.h>
7 7#include <linux/in.h>
8#include <linux/in6.h>
8 9
9/* Responses from hook functions. */ 10/* Responses from hook functions. */
10#define NF_DROP 0 11#define NF_DROP 0
diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h
index 8dd819e2b5fe..b67a853638ff 100644
--- a/include/uapi/linux/netfilter/nfnetlink_queue.h
+++ b/include/uapi/linux/netfilter/nfnetlink_queue.h
@@ -49,6 +49,7 @@ enum nfqnl_attr_type {
49 NFQA_EXP, /* nf_conntrack_netlink.h */ 49 NFQA_EXP, /* nf_conntrack_netlink.h */
50 NFQA_UID, /* __u32 sk uid */ 50 NFQA_UID, /* __u32 sk uid */
51 NFQA_GID, /* __u32 sk gid */ 51 NFQA_GID, /* __u32 sk gid */
52 NFQA_SECCTX, /* security context string */
52 53
53 __NFQA_MAX 54 __NFQA_MAX
54}; 55};
@@ -102,7 +103,8 @@ enum nfqnl_attr_config {
102#define NFQA_CFG_F_CONNTRACK (1 << 1) 103#define NFQA_CFG_F_CONNTRACK (1 << 1)
103#define NFQA_CFG_F_GSO (1 << 2) 104#define NFQA_CFG_F_GSO (1 << 2)
104#define NFQA_CFG_F_UID_GID (1 << 3) 105#define NFQA_CFG_F_UID_GID (1 << 3)
105#define NFQA_CFG_F_MAX (1 << 4) 106#define NFQA_CFG_F_SECCTX (1 << 4)
107#define NFQA_CFG_F_MAX (1 << 5)
106 108
107/* flags for NFQA_SKB_INFO */ 109/* flags for NFQA_SKB_INFO */
108/* packet appears to have wrong checksums, but they are ok */ 110/* packet appears to have wrong checksums, but they are ok */
diff --git a/include/uapi/linux/netfilter/xt_socket.h b/include/uapi/linux/netfilter/xt_socket.h
index 6315e2ac3474..87644f832494 100644
--- a/include/uapi/linux/netfilter/xt_socket.h
+++ b/include/uapi/linux/netfilter/xt_socket.h
@@ -6,6 +6,7 @@
6enum { 6enum {
7 XT_SOCKET_TRANSPARENT = 1 << 0, 7 XT_SOCKET_TRANSPARENT = 1 << 0,
8 XT_SOCKET_NOWILDCARD = 1 << 1, 8 XT_SOCKET_NOWILDCARD = 1 << 1,
9 XT_SOCKET_RESTORESKMARK = 1 << 2,
9}; 10};
10 11
11struct xt_socket_mtinfo1 { 12struct xt_socket_mtinfo1 {
@@ -18,4 +19,11 @@ struct xt_socket_mtinfo2 {
18}; 19};
19#define XT_SOCKET_FLAGS_V2 (XT_SOCKET_TRANSPARENT | XT_SOCKET_NOWILDCARD) 20#define XT_SOCKET_FLAGS_V2 (XT_SOCKET_TRANSPARENT | XT_SOCKET_NOWILDCARD)
20 21
22struct xt_socket_mtinfo3 {
23 __u8 flags;
24};
25#define XT_SOCKET_FLAGS_V3 (XT_SOCKET_TRANSPARENT \
26 | XT_SOCKET_NOWILDCARD \
27 | XT_SOCKET_RESTORESKMARK)
28
21#endif /* _XT_SOCKET_H */ 29#endif /* _XT_SOCKET_H */
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 4273533d22b1..9c891d0412a2 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -40,7 +40,6 @@
40#include <linux/notifier.h> 40#include <linux/notifier.h>
41#include <linux/proc_fs.h> 41#include <linux/proc_fs.h>
42#include <linux/stat.h> 42#include <linux/stat.h>
43#include <linux/netfilter.h>
44#include <linux/sysctl.h> 43#include <linux/sysctl.h>
45#include <linux/init.h> 44#include <linux/init.h>
46#include <linux/spinlock.h> 45#include <linux/spinlock.h>
diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 7ed8ab724819..29a3687237aa 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -23,7 +23,6 @@
23#include <linux/inet.h> 23#include <linux/inet.h>
24#include <linux/netdevice.h> 24#include <linux/netdevice.h>
25#include <linux/skbuff.h> 25#include <linux/skbuff.h>
26#include <linux/netfilter.h>
27#include <net/sock.h> 26#include <net/sock.h>
28#include <net/tcp_states.h> 27#include <net/tcp_states.h>
29#include <asm/uaccess.h> 28#include <asm/uaccess.h>
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
index 7c646bb2c6f7..b563a3f5f2a8 100644
--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -31,7 +31,6 @@
31#include <linux/notifier.h> 31#include <linux/notifier.h>
32#include <linux/proc_fs.h> 32#include <linux/proc_fs.h>
33#include <linux/stat.h> 33#include <linux/stat.h>
34#include <linux/netfilter.h>
35#include <linux/sysctl.h> 34#include <linux/sysctl.h>
36#include <net/ip.h> 35#include <net/ip.h>
37#include <net/arp.h> 36#include <net/arp.h>
diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index be2acab9be9d..8ddd41baa81c 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -24,7 +24,6 @@
24#include <linux/inet.h> 24#include <linux/inet.h>
25#include <linux/netdevice.h> 25#include <linux/netdevice.h>
26#include <linux/skbuff.h> 26#include <linux/skbuff.h>
27#include <linux/netfilter.h>
28#include <net/sock.h> 27#include <net/sock.h>
29#include <asm/uaccess.h> 28#include <asm/uaccess.h>
30#include <linux/fcntl.h> 29#include <linux/fcntl.h>
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 71c4badbc807..4ad2fb7bcd35 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -34,7 +34,6 @@
34#include <linux/proc_fs.h> 34#include <linux/proc_fs.h>
35#include <linux/seq_file.h> 35#include <linux/seq_file.h>
36#include <linux/stat.h> 36#include <linux/stat.h>
37#include <linux/netfilter.h>
38#include <linux/sysctl.h> 37#include <linux/sysctl.h>
39#include <linux/export.h> 38#include <linux/export.h>
40#include <net/ip.h> 39#include <net/ip.h>
diff --git a/net/bridge/Makefile b/net/bridge/Makefile
index fd7ee03c59b3..a1cda5d4718d 100644
--- a/net/bridge/Makefile
+++ b/net/bridge/Makefile
@@ -12,6 +12,8 @@ bridge-$(CONFIG_SYSFS) += br_sysfs_if.o br_sysfs_br.o
12 12
13bridge-$(subst m,y,$(CONFIG_BRIDGE_NETFILTER)) += br_nf_core.o 13bridge-$(subst m,y,$(CONFIG_BRIDGE_NETFILTER)) += br_nf_core.o
14 14
15br_netfilter-y := br_netfilter_hooks.o
16br_netfilter-$(subst m,y,$(CONFIG_IPV6)) += br_netfilter_ipv6.o
15obj-$(CONFIG_BRIDGE_NETFILTER) += br_netfilter.o 17obj-$(CONFIG_BRIDGE_NETFILTER) += br_netfilter.o
16 18
17bridge-$(CONFIG_BRIDGE_IGMP_SNOOPING) += br_multicast.o br_mdb.o 19bridge-$(CONFIG_BRIDGE_IGMP_SNOOPING) += br_multicast.o br_mdb.o
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter_hooks.c
index e4e5f2f29173..d89f4fac0bc5 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -123,11 +123,6 @@ struct brnf_frag_data {
123static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage); 123static DEFINE_PER_CPU(struct brnf_frag_data, brnf_frag_data_storage);
124#endif 124#endif
125 125
126static struct nf_bridge_info *nf_bridge_info_get(const struct sk_buff *skb)
127{
128 return skb->nf_bridge;
129}
130
131static void nf_bridge_info_free(struct sk_buff *skb) 126static void nf_bridge_info_free(struct sk_buff *skb)
132{ 127{
133 if (skb->nf_bridge) { 128 if (skb->nf_bridge) {
@@ -136,14 +131,6 @@ static void nf_bridge_info_free(struct sk_buff *skb)
136 } 131 }
137} 132}
138 133
139static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
140{
141 struct net_bridge_port *port;
142
143 port = br_port_get_rcu(dev);
144 return port ? &port->br->fake_rtable : NULL;
145}
146
147static inline struct net_device *bridge_parent(const struct net_device *dev) 134static inline struct net_device *bridge_parent(const struct net_device *dev)
148{ 135{
149 struct net_bridge_port *port; 136 struct net_bridge_port *port;
@@ -152,15 +139,6 @@ static inline struct net_device *bridge_parent(const struct net_device *dev)
152 return port ? port->br->dev : NULL; 139 return port ? port->br->dev : NULL;
153} 140}
154 141
155static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
156{
157 skb->nf_bridge = kzalloc(sizeof(struct nf_bridge_info), GFP_ATOMIC);
158 if (likely(skb->nf_bridge))
159 atomic_set(&(skb->nf_bridge->use), 1);
160
161 return skb->nf_bridge;
162}
163
164static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb) 142static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
165{ 143{
166 struct nf_bridge_info *nf_bridge = skb->nf_bridge; 144 struct nf_bridge_info *nf_bridge = skb->nf_bridge;
@@ -178,7 +156,7 @@ static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
178 return nf_bridge; 156 return nf_bridge;
179} 157}
180 158
181static unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb) 159unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
182{ 160{
183 switch (skb->protocol) { 161 switch (skb->protocol) {
184 case __cpu_to_be16(ETH_P_8021Q): 162 case __cpu_to_be16(ETH_P_8021Q):
@@ -190,14 +168,6 @@ static unsigned int nf_bridge_encap_header_len(const struct sk_buff *skb)
190 } 168 }
191} 169}
192 170
193static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
194{
195 unsigned int len = nf_bridge_encap_header_len(skb);
196
197 skb_push(skb, len);
198 skb->network_header -= len;
199}
200
201static inline void nf_bridge_pull_encap_header(struct sk_buff *skb) 171static inline void nf_bridge_pull_encap_header(struct sk_buff *skb)
202{ 172{
203 unsigned int len = nf_bridge_encap_header_len(skb); 173 unsigned int len = nf_bridge_encap_header_len(skb);
@@ -267,112 +237,7 @@ drop:
267 return -1; 237 return -1;
268} 238}
269 239
270/* We only check the length. A bridge shouldn't do any hop-by-hop stuff 240void nf_bridge_update_protocol(struct sk_buff *skb)
271 * anyway
272 */
273static int check_hbh_len(struct sk_buff *skb)
274{
275 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
276 u32 pkt_len;
277 const unsigned char *nh = skb_network_header(skb);
278 int off = raw - nh;
279 int len = (raw[1] + 1) << 3;
280
281 if ((raw + len) - skb->data > skb_headlen(skb))
282 goto bad;
283
284 off += 2;
285 len -= 2;
286
287 while (len > 0) {
288 int optlen = nh[off + 1] + 2;
289
290 switch (nh[off]) {
291 case IPV6_TLV_PAD1:
292 optlen = 1;
293 break;
294
295 case IPV6_TLV_PADN:
296 break;
297
298 case IPV6_TLV_JUMBO:
299 if (nh[off + 1] != 4 || (off & 3) != 2)
300 goto bad;
301 pkt_len = ntohl(*(__be32 *)(nh + off + 2));
302 if (pkt_len <= IPV6_MAXPLEN ||
303 ipv6_hdr(skb)->payload_len)
304 goto bad;
305 if (pkt_len > skb->len - sizeof(struct ipv6hdr))
306 goto bad;
307 if (pskb_trim_rcsum(skb,
308 pkt_len + sizeof(struct ipv6hdr)))
309 goto bad;
310 nh = skb_network_header(skb);
311 break;
312 default:
313 if (optlen > len)
314 goto bad;
315 break;
316 }
317 off += optlen;
318 len -= optlen;
319 }
320 if (len == 0)
321 return 0;
322bad:
323 return -1;
324}
325
326/* Equivalent to br_validate_ipv4 for IPv6 */
327static int br_validate_ipv6(struct sk_buff *skb)
328{
329 const struct ipv6hdr *hdr;
330 struct net_device *dev = skb->dev;
331 struct inet6_dev *idev = in6_dev_get(skb->dev);
332 u32 pkt_len;
333 u8 ip6h_len = sizeof(struct ipv6hdr);
334
335 if (!pskb_may_pull(skb, ip6h_len))
336 goto inhdr_error;
337
338 if (skb->len < ip6h_len)
339 goto drop;
340
341 hdr = ipv6_hdr(skb);
342
343 if (hdr->version != 6)
344 goto inhdr_error;
345
346 pkt_len = ntohs(hdr->payload_len);
347
348 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
349 if (pkt_len + ip6h_len > skb->len) {
350 IP6_INC_STATS_BH(dev_net(dev), idev,
351 IPSTATS_MIB_INTRUNCATEDPKTS);
352 goto drop;
353 }
354 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
355 IP6_INC_STATS_BH(dev_net(dev), idev,
356 IPSTATS_MIB_INDISCARDS);
357 goto drop;
358 }
359 }
360 if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
361 goto drop;
362
363 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
364 /* No IP options in IPv6 header; however it should be
365 * checked if some next headers need special treatment
366 */
367 return 0;
368
369inhdr_error:
370 IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS);
371drop:
372 return -1;
373}
374
375static void nf_bridge_update_protocol(struct sk_buff *skb)
376{ 241{
377 switch (skb->nf_bridge->orig_proto) { 242 switch (skb->nf_bridge->orig_proto) {
378 case BRNF_PROTO_8021Q: 243 case BRNF_PROTO_8021Q:
@@ -391,7 +256,7 @@ static void nf_bridge_update_protocol(struct sk_buff *skb)
391 * don't, we use the neighbour framework to find out. In both cases, we make 256 * don't, we use the neighbour framework to find out. In both cases, we make
392 * sure that br_handle_frame_finish() is called afterwards. 257 * sure that br_handle_frame_finish() is called afterwards.
393 */ 258 */
394static int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb) 259int br_nf_pre_routing_finish_bridge(struct sock *sk, struct sk_buff *skb)
395{ 260{
396 struct neighbour *neigh; 261 struct neighbour *neigh;
397 struct dst_entry *dst; 262 struct dst_entry *dst;
@@ -431,77 +296,11 @@ free_skb:
431 return 0; 296 return 0;
432} 297}
433 298
434static bool daddr_was_changed(const struct sk_buff *skb, 299static inline bool
435 const struct nf_bridge_info *nf_bridge) 300br_nf_ipv4_daddr_was_changed(const struct sk_buff *skb,
301 const struct nf_bridge_info *nf_bridge)
436{ 302{
437 switch (skb->protocol) { 303 return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
438 case htons(ETH_P_IP):
439 return ip_hdr(skb)->daddr != nf_bridge->ipv4_daddr;
440 case htons(ETH_P_IPV6):
441 return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
442 sizeof(ipv6_hdr(skb)->daddr)) != 0;
443 default:
444 return false;
445 }
446}
447
448/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
449 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
450 * for br_nf_pre_routing_finish(), same logic is used here but
451 * equivalent IPv6 function ip6_route_input() called indirectly.
452 */
453static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)
454{
455 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
456 struct rtable *rt;
457 struct net_device *dev = skb->dev;
458 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
459
460 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
461
462 if (nf_bridge->pkt_otherhost) {
463 skb->pkt_type = PACKET_OTHERHOST;
464 nf_bridge->pkt_otherhost = false;
465 }
466 nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;
467 if (daddr_was_changed(skb, nf_bridge)) {
468 skb_dst_drop(skb);
469 v6ops->route_input(skb);
470
471 if (skb_dst(skb)->error) {
472 kfree_skb(skb);
473 return 0;
474 }
475
476 if (skb_dst(skb)->dev == dev) {
477 skb->dev = nf_bridge->physindev;
478 nf_bridge_update_protocol(skb);
479 nf_bridge_push_encap_header(skb);
480 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,
481 sk, skb, skb->dev, NULL,
482 br_nf_pre_routing_finish_bridge,
483 1);
484 return 0;
485 }
486 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
487 skb->pkt_type = PACKET_HOST;
488 } else {
489 rt = bridge_parent_rtable(nf_bridge->physindev);
490 if (!rt) {
491 kfree_skb(skb);
492 return 0;
493 }
494 skb_dst_set_noref(skb, &rt->dst);
495 }
496
497 skb->dev = nf_bridge->physindev;
498 nf_bridge_update_protocol(skb);
499 nf_bridge_push_encap_header(skb);
500 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,
501 skb->dev, NULL,
502 br_handle_frame_finish, 1);
503
504 return 0;
505} 304}
506 305
507/* This requires some explaining. If DNAT has taken place, 306/* This requires some explaining. If DNAT has taken place,
@@ -558,7 +357,7 @@ static int br_nf_pre_routing_finish(struct sock *sk, struct sk_buff *skb)
558 nf_bridge->pkt_otherhost = false; 357 nf_bridge->pkt_otherhost = false;
559 } 358 }
560 nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING; 359 nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;
561 if (daddr_was_changed(skb, nf_bridge)) { 360 if (br_nf_ipv4_daddr_was_changed(skb, nf_bridge)) {
562 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) { 361 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
563 struct in_device *in_dev = __in_dev_get_rcu(dev); 362 struct in_device *in_dev = __in_dev_get_rcu(dev);
564 363
@@ -636,7 +435,7 @@ static struct net_device *brnf_get_logical_dev(struct sk_buff *skb, const struct
636} 435}
637 436
638/* Some common code for IPv4/IPv6 */ 437/* Some common code for IPv4/IPv6 */
639static struct net_device *setup_pre_routing(struct sk_buff *skb) 438struct net_device *setup_pre_routing(struct sk_buff *skb)
640{ 439{
641 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); 440 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
642 441
@@ -659,35 +458,6 @@ static struct net_device *setup_pre_routing(struct sk_buff *skb)
659 return skb->dev; 458 return skb->dev;
660} 459}
661 460
662/* Replicate the checks that IPv6 does on packet reception and pass the packet
663 * to ip6tables.
664 */
665static unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
666 struct sk_buff *skb,
667 const struct nf_hook_state *state)
668{
669 struct nf_bridge_info *nf_bridge;
670
671 if (br_validate_ipv6(skb))
672 return NF_DROP;
673
674 nf_bridge_put(skb->nf_bridge);
675 if (!nf_bridge_alloc(skb))
676 return NF_DROP;
677 if (!setup_pre_routing(skb))
678 return NF_DROP;
679
680 nf_bridge = nf_bridge_info_get(skb);
681 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
682
683 skb->protocol = htons(ETH_P_IPV6);
684 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb,
685 skb->dev, NULL,
686 br_nf_pre_routing_finish_ipv6);
687
688 return NF_STOLEN;
689}
690
691/* Direct IPv6 traffic to br_nf_pre_routing_ipv6. 461/* Direct IPv6 traffic to br_nf_pre_routing_ipv6.
692 * Replicate the checks that IPv4 does on packet reception. 462 * Replicate the checks that IPv4 does on packet reception.
693 * Set skb->dev to the bridge device (i.e. parent of the 463 * Set skb->dev to the bridge device (i.e. parent of the
diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
new file mode 100644
index 000000000000..6d12d2675c80
--- /dev/null
+++ b/net/bridge/br_netfilter_ipv6.c
@@ -0,0 +1,245 @@
1/*
2 * Handle firewalling
3 * Linux ethernet bridge
4 *
5 * Authors:
6 * Lennert Buytenhek <buytenh@gnu.org>
7 * Bart De Schuymer <bdschuym@pandora.be>
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
13 *
14 * Lennert dedicates this file to Kerstin Wurdinger.
15 */
16
17#include <linux/module.h>
18#include <linux/kernel.h>
19#include <linux/slab.h>
20#include <linux/ip.h>
21#include <linux/netdevice.h>
22#include <linux/skbuff.h>
23#include <linux/if_arp.h>
24#include <linux/if_ether.h>
25#include <linux/if_vlan.h>
26#include <linux/if_pppox.h>
27#include <linux/ppp_defs.h>
28#include <linux/netfilter_bridge.h>
29#include <linux/netfilter_ipv4.h>
30#include <linux/netfilter_ipv6.h>
31#include <linux/netfilter_arp.h>
32#include <linux/in_route.h>
33#include <linux/inetdevice.h>
34
35#include <net/ip.h>
36#include <net/ipv6.h>
37#include <net/addrconf.h>
38#include <net/route.h>
39#include <net/netfilter/br_netfilter.h>
40
41#include <asm/uaccess.h>
42#include "br_private.h"
43#ifdef CONFIG_SYSCTL
44#include <linux/sysctl.h>
45#endif
46
47/* We only check the length. A bridge shouldn't do any hop-by-hop stuff
48 * anyway
49 */
50static int br_nf_check_hbh_len(struct sk_buff *skb)
51{
52 unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1);
53 u32 pkt_len;
54 const unsigned char *nh = skb_network_header(skb);
55 int off = raw - nh;
56 int len = (raw[1] + 1) << 3;
57
58 if ((raw + len) - skb->data > skb_headlen(skb))
59 goto bad;
60
61 off += 2;
62 len -= 2;
63
64 while (len > 0) {
65 int optlen = nh[off + 1] + 2;
66
67 switch (nh[off]) {
68 case IPV6_TLV_PAD1:
69 optlen = 1;
70 break;
71
72 case IPV6_TLV_PADN:
73 break;
74
75 case IPV6_TLV_JUMBO:
76 if (nh[off + 1] != 4 || (off & 3) != 2)
77 goto bad;
78 pkt_len = ntohl(*(__be32 *)(nh + off + 2));
79 if (pkt_len <= IPV6_MAXPLEN ||
80 ipv6_hdr(skb)->payload_len)
81 goto bad;
82 if (pkt_len > skb->len - sizeof(struct ipv6hdr))
83 goto bad;
84 if (pskb_trim_rcsum(skb,
85 pkt_len + sizeof(struct ipv6hdr)))
86 goto bad;
87 nh = skb_network_header(skb);
88 break;
89 default:
90 if (optlen > len)
91 goto bad;
92 break;
93 }
94 off += optlen;
95 len -= optlen;
96 }
97 if (len == 0)
98 return 0;
99bad:
100 return -1;
101}
102
103int br_validate_ipv6(struct sk_buff *skb)
104{
105 const struct ipv6hdr *hdr;
106 struct net_device *dev = skb->dev;
107 struct inet6_dev *idev = in6_dev_get(skb->dev);
108 u32 pkt_len;
109 u8 ip6h_len = sizeof(struct ipv6hdr);
110
111 if (!pskb_may_pull(skb, ip6h_len))
112 goto inhdr_error;
113
114 if (skb->len < ip6h_len)
115 goto drop;
116
117 hdr = ipv6_hdr(skb);
118
119 if (hdr->version != 6)
120 goto inhdr_error;
121
122 pkt_len = ntohs(hdr->payload_len);
123
124 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
125 if (pkt_len + ip6h_len > skb->len) {
126 IP6_INC_STATS_BH(dev_net(dev), idev,
127 IPSTATS_MIB_INTRUNCATEDPKTS);
128 goto drop;
129 }
130 if (pskb_trim_rcsum(skb, pkt_len + ip6h_len)) {
131 IP6_INC_STATS_BH(dev_net(dev), idev,
132 IPSTATS_MIB_INDISCARDS);
133 goto drop;
134 }
135 }
136 if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
137 goto drop;
138
139 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
140 /* No IP options in IPv6 header; however it should be
141 * checked if some next headers need special treatment
142 */
143 return 0;
144
145inhdr_error:
146 IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS);
147drop:
148 return -1;
149}
150
151static inline bool
152br_nf_ipv6_daddr_was_changed(const struct sk_buff *skb,
153 const struct nf_bridge_info *nf_bridge)
154{
155 return memcmp(&nf_bridge->ipv6_daddr, &ipv6_hdr(skb)->daddr,
156 sizeof(ipv6_hdr(skb)->daddr)) != 0;
157}
158
159/* PF_BRIDGE/PRE_ROUTING: Undo the changes made for ip6tables
160 * PREROUTING and continue the bridge PRE_ROUTING hook. See comment
161 * for br_nf_pre_routing_finish(), same logic is used here but
162 * equivalent IPv6 function ip6_route_input() called indirectly.
163 */
164static int br_nf_pre_routing_finish_ipv6(struct sock *sk, struct sk_buff *skb)
165{
166 struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
167 struct rtable *rt;
168 struct net_device *dev = skb->dev;
169 const struct nf_ipv6_ops *v6ops = nf_get_ipv6_ops();
170
171 nf_bridge->frag_max_size = IP6CB(skb)->frag_max_size;
172
173 if (nf_bridge->pkt_otherhost) {
174 skb->pkt_type = PACKET_OTHERHOST;
175 nf_bridge->pkt_otherhost = false;
176 }
177 nf_bridge->mask &= ~BRNF_NF_BRIDGE_PREROUTING;
178 if (br_nf_ipv6_daddr_was_changed(skb, nf_bridge)) {
179 skb_dst_drop(skb);
180 v6ops->route_input(skb);
181
182 if (skb_dst(skb)->error) {
183 kfree_skb(skb);
184 return 0;
185 }
186
187 if (skb_dst(skb)->dev == dev) {
188 skb->dev = nf_bridge->physindev;
189 nf_bridge_update_protocol(skb);
190 nf_bridge_push_encap_header(skb);
191 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,
192 sk, skb, skb->dev, NULL,
193 br_nf_pre_routing_finish_bridge,
194 1);
195 return 0;
196 }
197 ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr);
198 skb->pkt_type = PACKET_HOST;
199 } else {
200 rt = bridge_parent_rtable(nf_bridge->physindev);
201 if (!rt) {
202 kfree_skb(skb);
203 return 0;
204 }
205 skb_dst_set_noref(skb, &rt->dst);
206 }
207
208 skb->dev = nf_bridge->physindev;
209 nf_bridge_update_protocol(skb);
210 nf_bridge_push_encap_header(skb);
211 NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, sk, skb,
212 skb->dev, NULL,
213 br_handle_frame_finish, 1);
214
215 return 0;
216}
217
218/* Replicate the checks that IPv6 does on packet reception and pass the packet
219 * to ip6tables.
220 */
221unsigned int br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops,
222 struct sk_buff *skb,
223 const struct nf_hook_state *state)
224{
225 struct nf_bridge_info *nf_bridge;
226
227 if (br_validate_ipv6(skb))
228 return NF_DROP;
229
230 nf_bridge_put(skb->nf_bridge);
231 if (!nf_bridge_alloc(skb))
232 return NF_DROP;
233 if (!setup_pre_routing(skb))
234 return NF_DROP;
235
236 nf_bridge = nf_bridge_info_get(skb);
237 nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
238
239 skb->protocol = htons(ETH_P_IPV6);
240 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->sk, skb,
241 skb->dev, NULL,
242 br_nf_pre_routing_finish_ipv6);
243
244 return NF_STOLEN;
245}
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 21678acd4521..928a0fb0b744 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -8,6 +8,7 @@
8#include <net/ip6_fib.h> 8#include <net/ip6_fib.h>
9#include <net/addrconf.h> 9#include <net/addrconf.h>
10#include <net/secure_seq.h> 10#include <net/secure_seq.h>
11#include <linux/netfilter.h>
11 12
12static u32 __ipv6_select_ident(struct net *net, u32 hashrnd, 13static u32 __ipv6_select_ident(struct net *net, u32 hashrnd,
13 const struct in6_addr *dst, 14 const struct in6_addr *dst,
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 52e20c9a46a5..789feeae6c44 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -11,6 +11,7 @@
11#include <asm/unaligned.h> 11#include <asm/unaligned.h>
12#include <net/tcp.h> 12#include <net/tcp.h>
13#include <net/netns/generic.h> 13#include <net/netns/generic.h>
14#include <linux/proc_fs.h>
14 15
15#include <linux/netfilter_ipv4/ip_tables.h> 16#include <linux/netfilter_ipv4/ip_tables.h>
16#include <linux/netfilter/x_tables.h> 17#include <linux/netfilter/x_tables.h>
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 4ef1fae8445e..4670821b569d 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -598,8 +598,6 @@ nla_put_failure:
598 return -1; 598 return -1;
599} 599}
600 600
601#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
602
603static struct nf_loginfo default_loginfo = { 601static struct nf_loginfo default_loginfo = {
604 .type = NF_LOG_TYPE_ULOG, 602 .type = NF_LOG_TYPE_ULOG,
605 .u = { 603 .u = {
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 22a5ac76683e..e26a46ef19ba 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -278,6 +278,23 @@ nla_put_failure:
278 return -1; 278 return -1;
279} 279}
280 280
281static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
282{
283 u32 seclen = 0;
284#if IS_ENABLED(CONFIG_NETWORK_SECMARK)
285 if (!skb || !sk_fullsock(skb->sk))
286 return 0;
287
288 read_lock_bh(&skb->sk->sk_callback_lock);
289
290 if (skb->secmark)
291 security_secid_to_secctx(skb->secmark, secdata, &seclen);
292
293 read_unlock_bh(&skb->sk->sk_callback_lock);
294#endif
295 return seclen;
296}
297
281static struct sk_buff * 298static struct sk_buff *
282nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, 299nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
283 struct nf_queue_entry *entry, 300 struct nf_queue_entry *entry,
@@ -297,6 +314,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
297 struct nf_conn *ct = NULL; 314 struct nf_conn *ct = NULL;
298 enum ip_conntrack_info uninitialized_var(ctinfo); 315 enum ip_conntrack_info uninitialized_var(ctinfo);
299 bool csum_verify; 316 bool csum_verify;
317 char *secdata = NULL;
318 u32 seclen = 0;
300 319
301 size = nlmsg_total_size(sizeof(struct nfgenmsg)) 320 size = nlmsg_total_size(sizeof(struct nfgenmsg))
302 + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr)) 321 + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
@@ -352,6 +371,12 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
352 + nla_total_size(sizeof(u_int32_t))); /* gid */ 371 + nla_total_size(sizeof(u_int32_t))); /* gid */
353 } 372 }
354 373
374 if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
375 seclen = nfqnl_get_sk_secctx(entskb, &secdata);
376 if (seclen)
377 size += nla_total_size(seclen);
378 }
379
355 skb = nfnetlink_alloc_skb(net, size, queue->peer_portid, 380 skb = nfnetlink_alloc_skb(net, size, queue->peer_portid,
356 GFP_ATOMIC); 381 GFP_ATOMIC);
357 if (!skb) { 382 if (!skb) {
@@ -479,6 +504,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
479 nfqnl_put_sk_uidgid(skb, entskb->sk) < 0) 504 nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)
480 goto nla_put_failure; 505 goto nla_put_failure;
481 506
507 if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
508 goto nla_put_failure;
509
482 if (ct && nfqnl_ct_put(skb, ct, ctinfo) < 0) 510 if (ct && nfqnl_ct_put(skb, ct, ctinfo) < 0)
483 goto nla_put_failure; 511 goto nla_put_failure;
484 512
@@ -806,8 +834,6 @@ nfqnl_dev_drop(struct net *net, int ifindex)
806 rcu_read_unlock(); 834 rcu_read_unlock();
807} 835}
808 836
809#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
810
811static int 837static int
812nfqnl_rcv_dev_event(struct notifier_block *this, 838nfqnl_rcv_dev_event(struct notifier_block *this,
813 unsigned long event, void *ptr) 839 unsigned long event, void *ptr)
@@ -1142,7 +1168,12 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
1142 ret = -EOPNOTSUPP; 1168 ret = -EOPNOTSUPP;
1143 goto err_out_unlock; 1169 goto err_out_unlock;
1144 } 1170 }
1145 1171#if !IS_ENABLED(CONFIG_NETWORK_SECMARK)
1172 if (flags & mask & NFQA_CFG_F_SECCTX) {
1173 ret = -EOPNOTSUPP;
1174 goto err_out_unlock;
1175 }
1176#endif
1146 spin_lock_bh(&queue->lock); 1177 spin_lock_bh(&queue->lock);
1147 queue->flags &= ~mask; 1178 queue->flags &= ~mask;
1148 queue->flags |= flags & mask; 1179 queue->flags |= flags & mask;
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index e092cb046326..43e26c881100 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -205,6 +205,7 @@ static bool
205socket_match(const struct sk_buff *skb, struct xt_action_param *par, 205socket_match(const struct sk_buff *skb, struct xt_action_param *par,
206 const struct xt_socket_mtinfo1 *info) 206 const struct xt_socket_mtinfo1 *info)
207{ 207{
208 struct sk_buff *pskb = (struct sk_buff *)skb;
208 struct sock *sk = skb->sk; 209 struct sock *sk = skb->sk;
209 210
210 if (!sk) 211 if (!sk)
@@ -226,6 +227,10 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
226 if (info->flags & XT_SOCKET_TRANSPARENT) 227 if (info->flags & XT_SOCKET_TRANSPARENT)
227 transparent = xt_socket_sk_is_transparent(sk); 228 transparent = xt_socket_sk_is_transparent(sk);
228 229
230 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
231 transparent)
232 pskb->mark = sk->sk_mark;
233
229 if (sk != skb->sk) 234 if (sk != skb->sk)
230 sock_gen_put(sk); 235 sock_gen_put(sk);
231 236
@@ -247,7 +252,7 @@ socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
247} 252}
248 253
249static bool 254static bool
250socket_mt4_v1_v2(const struct sk_buff *skb, struct xt_action_param *par) 255socket_mt4_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
251{ 256{
252 return socket_match(skb, par, par->matchinfo); 257 return socket_match(skb, par, par->matchinfo);
253} 258}
@@ -371,9 +376,10 @@ static struct sock *xt_socket_lookup_slow_v6(const struct sk_buff *skb,
371} 376}
372 377
373static bool 378static bool
374socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par) 379socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
375{ 380{
376 const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo; 381 const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
382 struct sk_buff *pskb = (struct sk_buff *)skb;
377 struct sock *sk = skb->sk; 383 struct sock *sk = skb->sk;
378 384
379 if (!sk) 385 if (!sk)
@@ -395,6 +401,10 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
395 if (info->flags & XT_SOCKET_TRANSPARENT) 401 if (info->flags & XT_SOCKET_TRANSPARENT)
396 transparent = xt_socket_sk_is_transparent(sk); 402 transparent = xt_socket_sk_is_transparent(sk);
397 403
404 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
405 transparent)
406 pskb->mark = sk->sk_mark;
407
398 if (sk != skb->sk) 408 if (sk != skb->sk)
399 sock_gen_put(sk); 409 sock_gen_put(sk);
400 410
@@ -428,6 +438,19 @@ static int socket_mt_v2_check(const struct xt_mtchk_param *par)
428 return 0; 438 return 0;
429} 439}
430 440
441static int socket_mt_v3_check(const struct xt_mtchk_param *par)
442{
443 const struct xt_socket_mtinfo3 *info =
444 (struct xt_socket_mtinfo3 *)par->matchinfo;
445
446 if (info->flags & ~XT_SOCKET_FLAGS_V3) {
447 pr_info("unknown flags 0x%x\n",
448 info->flags & ~XT_SOCKET_FLAGS_V3);
449 return -EINVAL;
450 }
451 return 0;
452}
453
431static struct xt_match socket_mt_reg[] __read_mostly = { 454static struct xt_match socket_mt_reg[] __read_mostly = {
432 { 455 {
433 .name = "socket", 456 .name = "socket",
@@ -442,7 +465,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
442 .name = "socket", 465 .name = "socket",
443 .revision = 1, 466 .revision = 1,
444 .family = NFPROTO_IPV4, 467 .family = NFPROTO_IPV4,
445 .match = socket_mt4_v1_v2, 468 .match = socket_mt4_v1_v2_v3,
446 .checkentry = socket_mt_v1_check, 469 .checkentry = socket_mt_v1_check,
447 .matchsize = sizeof(struct xt_socket_mtinfo1), 470 .matchsize = sizeof(struct xt_socket_mtinfo1),
448 .hooks = (1 << NF_INET_PRE_ROUTING) | 471 .hooks = (1 << NF_INET_PRE_ROUTING) |
@@ -454,7 +477,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
454 .name = "socket", 477 .name = "socket",
455 .revision = 1, 478 .revision = 1,
456 .family = NFPROTO_IPV6, 479 .family = NFPROTO_IPV6,
457 .match = socket_mt6_v1_v2, 480 .match = socket_mt6_v1_v2_v3,
458 .checkentry = socket_mt_v1_check, 481 .checkentry = socket_mt_v1_check,
459 .matchsize = sizeof(struct xt_socket_mtinfo1), 482 .matchsize = sizeof(struct xt_socket_mtinfo1),
460 .hooks = (1 << NF_INET_PRE_ROUTING) | 483 .hooks = (1 << NF_INET_PRE_ROUTING) |
@@ -466,7 +489,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
466 .name = "socket", 489 .name = "socket",
467 .revision = 2, 490 .revision = 2,
468 .family = NFPROTO_IPV4, 491 .family = NFPROTO_IPV4,
469 .match = socket_mt4_v1_v2, 492 .match = socket_mt4_v1_v2_v3,
470 .checkentry = socket_mt_v2_check, 493 .checkentry = socket_mt_v2_check,
471 .matchsize = sizeof(struct xt_socket_mtinfo1), 494 .matchsize = sizeof(struct xt_socket_mtinfo1),
472 .hooks = (1 << NF_INET_PRE_ROUTING) | 495 .hooks = (1 << NF_INET_PRE_ROUTING) |
@@ -478,7 +501,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
478 .name = "socket", 501 .name = "socket",
479 .revision = 2, 502 .revision = 2,
480 .family = NFPROTO_IPV6, 503 .family = NFPROTO_IPV6,
481 .match = socket_mt6_v1_v2, 504 .match = socket_mt6_v1_v2_v3,
482 .checkentry = socket_mt_v2_check, 505 .checkentry = socket_mt_v2_check,
483 .matchsize = sizeof(struct xt_socket_mtinfo1), 506 .matchsize = sizeof(struct xt_socket_mtinfo1),
484 .hooks = (1 << NF_INET_PRE_ROUTING) | 507 .hooks = (1 << NF_INET_PRE_ROUTING) |
@@ -486,6 +509,30 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
486 .me = THIS_MODULE, 509 .me = THIS_MODULE,
487 }, 510 },
488#endif 511#endif
512 {
513 .name = "socket",
514 .revision = 3,
515 .family = NFPROTO_IPV4,
516 .match = socket_mt4_v1_v2_v3,
517 .checkentry = socket_mt_v3_check,
518 .matchsize = sizeof(struct xt_socket_mtinfo1),
519 .hooks = (1 << NF_INET_PRE_ROUTING) |
520 (1 << NF_INET_LOCAL_IN),
521 .me = THIS_MODULE,
522 },
523#ifdef XT_SOCKET_HAVE_IPV6
524 {
525 .name = "socket",
526 .revision = 3,
527 .family = NFPROTO_IPV6,
528 .match = socket_mt6_v1_v2_v3,
529 .checkentry = socket_mt_v3_check,
530 .matchsize = sizeof(struct xt_socket_mtinfo1),
531 .hooks = (1 << NF_INET_PRE_ROUTING) |
532 (1 << NF_INET_LOCAL_IN),
533 .me = THIS_MODULE,
534 },
535#endif
489}; 536};
490 537
491static int __init socket_mt_init(void) 538static int __init socket_mt_init(void)
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 96b64d2f6dbf..d72a4f1558f2 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -31,7 +31,6 @@
31#include <linux/mm.h> 31#include <linux/mm.h>
32#include <linux/interrupt.h> 32#include <linux/interrupt.h>
33#include <linux/notifier.h> 33#include <linux/notifier.h>
34#include <linux/netfilter.h>
35#include <linux/init.h> 34#include <linux/init.h>
36#include <linux/spinlock.h> 35#include <linux/spinlock.h>
37#include <net/netrom.h> 36#include <net/netrom.h>
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index e873d7d9f857..c76638cc2cd5 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -25,7 +25,6 @@
25#include <linux/fcntl.h> 25#include <linux/fcntl.h>
26#include <linux/mm.h> 26#include <linux/mm.h>
27#include <linux/interrupt.h> 27#include <linux/interrupt.h>
28#include <linux/netfilter.h>
29#include <net/rose.h> 28#include <net/rose.h>
30 29
31static void rose_ftimer_expiry(unsigned long); 30static void rose_ftimer_expiry(unsigned long);
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 40148932c8a4..0fc76d845103 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -31,7 +31,6 @@
31#include <linux/mm.h> 31#include <linux/mm.h>
32#include <linux/interrupt.h> 32#include <linux/interrupt.h>
33#include <linux/notifier.h> 33#include <linux/notifier.h>
34#include <linux/netfilter.h>
35#include <linux/init.h> 34#include <linux/init.h>
36#include <net/rose.h> 35#include <net/rose.h>
37#include <linux/seq_file.h> 36#include <linux/seq_file.h>
diff --git a/net/sched/em_ipset.c b/net/sched/em_ipset.c
index a3d79c8bf3b8..df0328ba6a48 100644
--- a/net/sched/em_ipset.c
+++ b/net/sched/em_ipset.c
@@ -92,8 +92,8 @@ static int em_ipset_match(struct sk_buff *skb, struct tcf_ematch *em,
92 92
93 rcu_read_lock(); 93 rcu_read_lock();
94 94
95 if (dev && skb->skb_iif) 95 if (skb->skb_iif)
96 indev = dev_get_by_index_rcu(dev_net(dev), skb->skb_iif); 96 indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
97 97
98 acpar.in = indev ? indev : dev; 98 acpar.in = indev ? indev : dev;
99 acpar.out = dev; 99 acpar.out = dev;
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 98b042630a9e..56e354fcdfc6 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -35,9 +35,6 @@
35#include <linux/init.h> 35#include <linux/init.h>
36#include <linux/security.h> 36#include <linux/security.h>
37#include <linux/types.h> 37#include <linux/types.h>
38#include <linux/netfilter.h>
39#include <linux/netfilter_ipv4.h>
40#include <linux/netfilter_ipv6.h>
41#include <linux/slab.h> 38#include <linux/slab.h>
42#include <linux/ip.h> 39#include <linux/ip.h>
43#include <linux/tcp.h> 40#include <linux/tcp.h>
generated by cgit v1.2.2 (git 2.25.0) at 2025-04-13 02:48:52 -0400