Merge branch 'master' of git://dev.medozas.de/linux

6 files changed, 54 insertions, 37 deletions

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index ced1f2c0cb65..a5d0c27cc26f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -8,7 +8,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/capability.h>
 #include <linux/in.h>
 #include <linux/skbuff.h>
@@ -222,16 +222,11 @@ get_entry(void *base, unsigned int offset)
 
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
-static inline int
-unconditional(const struct ip6t_ip6 *ipv6)
+static inline bool unconditional(const struct ip6t_ip6 *ipv6)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(*ipv6); i++)
-                if (((char *)ipv6)[i])
-                        break;
+        static const struct ip6t_ip6 uncond;
 
-        return (i == sizeof(*ipv6));
+        return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
 }
 
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
@@ -745,6 +740,21 @@ find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
         return ret;
 }
 
+static bool check_underflow(struct ip6t_entry *e)
+{
+        const struct ip6t_entry_target *t;
+        unsigned int verdict;
+
+        if (!unconditional(&e->ipv6))
+                return false;
+        t = ip6t_get_target(e);
+        if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+                return false;
+        verdict = ((struct ip6t_standard_target *)t)->verdict;
+        verdict = -verdict - 1;
+        return verdict == NF_DROP || verdict == NF_ACCEPT;
+}
+
 static int
 check_entry_size_and_hooks(struct ip6t_entry *e,
                            struct xt_table_info *newinfo,
@@ -752,6 +762,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
                            unsigned char *limit,
                            const unsigned int *hook_entries,
                            const unsigned int *underflows,
+                           unsigned int valid_hooks,
                            unsigned int *i)
 {
         unsigned int h;
@@ -771,15 +782,21 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
 
         /* Check hooks & underflows */
         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+                if (!(valid_hooks & (1 << h)))
+                        continue;
                 if ((unsigned char *)e - base == hook_entries[h])
                         newinfo->hook_entry[h] = hook_entries[h];
-                if ((unsigned char *)e - base == underflows[h])
+                if ((unsigned char *)e - base == underflows[h]) {
+                        if (!check_underflow(e)) {
+                                pr_err("Underflows must be unconditional and "
+                                       "use the STANDARD target with "
+                                       "ACCEPT/DROP\n");
+                                return -EINVAL;
+                        }
                         newinfo->underflow[h] = underflows[h];
+                }
         }
 
-        /* FIXME: underflows must be unconditional, standard verdicts
-           < 0 (not IP6T_RETURN). --RR */
-
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
         e->comefrom = 0;
@@ -842,7 +859,7 @@ translate_table(const char *name,
                                 newinfo,
                                 entry0,
                                 entry0 + size,
-                                hook_entries, underflows, &i);
+                                hook_entries, underflows, valid_hooks, &i);
         if (ret != 0)
                 return ret;
 
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index ef5a0a32bf8e..0a3ae48ac4d5 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -55,7 +55,7 @@ static struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET6,
+        .af             = NFPROTO_IPV6,
 };
 
 /* The work comes in here from netfilter.c. */
@@ -95,21 +95,21 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         {
                 .hook           = ip6t_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP6_PRI_FILTER,
         },
         {
                 .hook           = ip6t_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_FORWARD,
                 .priority       = NF_IP6_PRI_FILTER,
         },
         {
                 .hook           = ip6t_local_out_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP6_PRI_FILTER,
         },
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index ab0d398a2ba7..0f49e005a8c5 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -61,7 +61,7 @@ static struct xt_table packet_mangler = {
         .name           = "mangle",
         .valid_hooks    = MANGLE_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET6,
+        .af             = NFPROTO_IPV6,
 };
 
 /* The work comes in here from netfilter.c. */
@@ -136,35 +136,35 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         {
                 .hook           = ip6t_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
         {
                 .hook           = ip6t_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
         {
                 .hook           = ip6t_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_FORWARD,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
         {
                 .hook           = ip6t_local_out_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
         {
                 .hook           = ip6t_post_routing_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_POST_ROUTING,
                 .priority       = NF_IP6_PRI_MANGLE,
         },
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 4b792b6ca321..679865e3d5ff 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -39,7 +39,7 @@ static struct xt_table packet_raw = {
         .name = "raw",
         .valid_hooks = RAW_VALID_HOOKS,
         .me = THIS_MODULE,
-        .af = AF_INET6,
+        .af = NFPROTO_IPV6,
 };
 
 /* The work comes in here from netfilter.c. */
@@ -68,14 +68,14 @@ ip6t_local_out_hook(unsigned int hook,
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         {
           .hook = ip6t_pre_routing_hook,
-          .pf = PF_INET6,
+          .pf = NFPROTO_IPV6,
           .hooknum = NF_INET_PRE_ROUTING,
           .priority = NF_IP6_PRI_FIRST,
           .owner = THIS_MODULE,
         },
         {
           .hook = ip6t_local_out_hook,
-          .pf = PF_INET6,
+          .pf = NFPROTO_IPV6,
           .hooknum = NF_INET_LOCAL_OUT,
           .priority = NF_IP6_PRI_FIRST,
           .owner = THIS_MODULE,
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index 0ea37ff15d56..822afabbdc88 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -60,7 +60,7 @@ static struct xt_table security_table = {
         .name           = "security",
         .valid_hooks    = SECURITY_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET6,
+        .af             = NFPROTO_IPV6,
 };
 
 static unsigned int
@@ -101,21 +101,21 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         {
                 .hook           = ip6t_local_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP6_PRI_SECURITY,
         },
         {
                 .hook           = ip6t_forward_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_FORWARD,
                 .priority       = NF_IP6_PRI_SECURITY,
         },
         {
                 .hook           = ip6t_local_out_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP6_PRI_SECURITY,
         },
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 2a15c2d66c69..a7f4cd607356 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -265,42 +265,42 @@ static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
         {
                 .hook           = ipv6_defrag,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
         },
         {
                 .hook           = ipv6_conntrack_in,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP6_PRI_CONNTRACK,
         },
         {
                 .hook           = ipv6_conntrack_local,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP6_PRI_CONNTRACK,
         },
         {
                 .hook           = ipv6_defrag,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
         },
         {
                 .hook           = ipv6_confirm,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_POST_ROUTING,
                 .priority       = NF_IP6_PRI_LAST,
         },
         {
                 .hook           = ipv6_confirm,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
+                .pf             = NFPROTO_IPV6,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP6_PRI_LAST-1,
         },