3 files changed, 17 insertions, 22 deletions

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 34af7bb8df5..e89cfa3a8f2 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -89,25 +89,6 @@ ip6t_ext_hdr(u8 nexthdr)
                  (nexthdr == IPPROTO_DSTOPTS) );
 }
 
-static unsigned long ifname_compare(const char *_a, const char *_b,
-                                    const unsigned char *_mask)
-{
-        const unsigned long *a = (const unsigned long *)_a;
-        const unsigned long *b = (const unsigned long *)_b;
-        const unsigned long *mask = (const unsigned long *)_mask;
-        unsigned long ret;
-
-        ret = (a[0] ^ b[0]) & mask[0];
-        if (IFNAMSIZ > sizeof(unsigned long))
-                ret |= (a[1] ^ b[1]) & mask[1];
-        if (IFNAMSIZ > 2 * sizeof(unsigned long))
-                ret |= (a[2] ^ b[2]) & mask[2];
-        if (IFNAMSIZ > 3 * sizeof(unsigned long))
-                ret |= (a[3] ^ b[3]) & mask[3];
-        BUILD_BUG_ON(IFNAMSIZ > 4 * sizeof(unsigned long));
-        return ret;
-}
-
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
@@ -138,7 +119,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 return false;
         }
 
-        ret = ifname_compare(indev, ip6info->iniface, ip6info->iniface_mask);
+        ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
 
         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
                 dprintf("VIA in mismatch (%s vs %s).%s\n",
@@ -147,7 +128,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 return false;
         }
 
-        ret = ifname_compare(outdev, ip6info->outiface, ip6info->outiface_mask);
+        ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
 
         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
                 dprintf("VIA out mismatch (%s vs %s).%s\n",
@@ -536,7 +517,9 @@ mark_source_chains(struct xt_table_info *newinfo,
                             && unconditional(&e->ipv6)) || visited) {
                                 unsigned int oldpos, size;
 
-                                if (t->verdict < -NF_MAX_VERDICT - 1) {
+                                if ((strcmp(t->target.u.user.name,
+                                            IP6T_STANDARD_TARGET) == 0) &&
+                                    t->verdict < -NF_MAX_VERDICT - 1) {
                                         duprintf("mark_source_chains: bad "
                                                 "negative verdict (%i)\n",
                                                                 t->verdict);
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index e6852f61721..2a15c2d66c6 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -342,6 +342,11 @@ static int ipv6_nlattr_to_tuple(struct nlattr *tb[],
 
         return 0;
 }
+
+static int ipv6_nlattr_tuple_size(void)
+{
+        return nla_policy_len(ipv6_nla_policy, CTA_IP_MAX + 1);
+}
 #endif
 
 struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
@@ -353,6 +358,7 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
         .get_l4proto            = ipv6_get_l4proto,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nlattr        = ipv6_tuple_to_nlattr,
+        .nlattr_tuple_size      = ipv6_nlattr_tuple_size,
         .nlattr_to_tuple        = ipv6_nlattr_to_tuple,
         .nla_policy             = ipv6_nla_policy,
 #endif
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 41b8a956e1b..9903227bf37 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -269,6 +269,11 @@ static int icmpv6_nlattr_to_tuple(struct nlattr *tb[],
 
         return 0;
 }
+
+static int icmpv6_nlattr_tuple_size(void)
+{
+        return nla_policy_len(icmpv6_nla_policy, CTA_PROTO_MAX + 1);
+}
 #endif
 
 #ifdef CONFIG_SYSCTL
@@ -300,6 +305,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 __read_mostly =
         .error                  = icmpv6_error,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nlattr        = icmpv6_tuple_to_nlattr,
+        .nlattr_tuple_size      = icmpv6_nlattr_tuple_size,
         .nlattr_to_tuple        = icmpv6_nlattr_to_tuple,
         .nla_policy             = icmpv6_nla_policy,
 #endif