Merge branch 'master' of git://1984.lsi.us.es/nf

Pablo Neira Ayuso Says:

====================
The following patchset contains Netfilter/IPVS updates for your
net tree, they are:

* Fix incorrect hooks for SNAT and DNAT (bug introduced in recent IPv6
  NAT changes), from Elison Niven.

* Fix xt_TEE (got broken with recent rt_gateway semantic change),
  from Eric Dumazet.

* Fix custom conntrack timeout policy attachment for IPv6, from myself.

* Always initialize ip_vs_timeout_user in case that TCP or UDP protocols
  is disabled, from Arnd Bergmann.

Note that I had to pull from your tree to obtain:

(c92b96553a80c1 ipv4: Add FLOWI_FLAG_KNOWN_NH)

which was required for the xt_TEE fix.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

4 files changed, 13 insertions, 9 deletions

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 7e7198b51c06..c4ee43710aab 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2589,6 +2589,8 @@ __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
         struct ip_vs_proto_data *pd;
 #endif
 
+        memset(u, 0, sizeof (*u));
+
 #ifdef CONFIG_IP_VS_PROTO_TCP
         pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
         u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
@@ -2766,7 +2768,6 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         {
                 struct ip_vs_timeout_user t;
 
-                memset(&t, 0, sizeof(t));
                 __ip_vs_get_timeouts(net, &t);
                 if (copy_to_user(user, &t, sizeof(t)) != 0)
                         ret = -EFAULT;
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 16c712563860..ae7f5daeee43 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -180,9 +180,9 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
         struct ctnl_timeout *timeout;
         struct nf_conn_timeout *timeout_ext;
-        const struct ipt_entry *e = par->entryinfo;
         struct nf_conntrack_l4proto *l4proto;
         int ret = 0;
+        u8 proto;
 
         rcu_read_lock();
         timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
@@ -192,9 +192,11 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
                 goto out;
         }
 
-        if (e->ip.invflags & IPT_INV_PROTO) {
+        proto = xt_ct_find_proto(par);
+        if (!proto) {
                 ret = -EINVAL;
-                pr_info("You cannot use inversion on L4 protocol\n");
+                pr_info("You must specify a L4 protocol, and not use "
+                        "inversions on it.\n");
                 goto out;
         }
 
@@ -214,7 +216,7 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         /* Make sure the timeout policy matches any existing protocol tracker,
          * otherwise default to generic.
          */
-        l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);
+        l4proto = __nf_ct_l4proto_find(par->family, proto);
         if (timeout->l4proto->l4proto != l4proto->l4proto) {
                 ret = -EINVAL;
                 pr_info("Timeout policy `%s' can only be used by L4 protocol "
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index ee2e5bc5a8c7..bd93e51d30ac 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -70,6 +70,7 @@ tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
         fl4.daddr = info->gw.ip;
         fl4.flowi4_tos = RT_TOS(iph->tos);
         fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+        fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
         rt = ip_route_output_key(net, &fl4);
         if (IS_ERR(rt))
                 return false;
diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
index 81aafa8e4fef..bea7464cc43f 100644
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -111,7 +111,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                 .family         = NFPROTO_IPV4,
                 .table          = "nat",
                 .hooks          = (1 << NF_INET_POST_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
+                                  (1 << NF_INET_LOCAL_IN),
                 .me             = THIS_MODULE,
         },
         {
@@ -123,7 +123,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                 .family         = NFPROTO_IPV4,
                 .table          = "nat",
                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN),
+                                  (1 << NF_INET_LOCAL_OUT),
                 .me             = THIS_MODULE,
         },
         {
@@ -133,7 +133,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                 .targetsize     = sizeof(struct nf_nat_range),
                 .table          = "nat",
                 .hooks          = (1 << NF_INET_POST_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
+                                  (1 << NF_INET_LOCAL_IN),
                 .me             = THIS_MODULE,
         },
         {
@@ -143,7 +143,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                 .targetsize     = sizeof(struct nf_nat_range),
                 .table          = "nat",
                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN),
+                                  (1 << NF_INET_LOCAL_OUT),
                 .me             = THIS_MODULE,
         },
 };