diff options
author | David S. Miller <davem@davemloft.net> | 2009-12-16 00:08:53 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2009-12-16 00:08:53 -0500 |
commit | 81e839efc22361e3fa7ee36f99fd57c57d0d1871 (patch) | |
tree | eac3550c8773ff0e6ccb91c280b930efc50b0e42 /net | |
parent | bb5b7c11263dbbe78253cd05945a6bf8f55add8e (diff) | |
parent | 258c889362aa95d0ab534b38ce8c15d3009705b1 (diff) |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6
Diffstat (limited to 'net')
-rw-r--r-- | net/ipv4/netfilter/nf_defrag_ipv4.c | 21 | ||||
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 19 | ||||
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_reasm.c | 7 | ||||
-rw-r--r-- | net/ipv6/reassembly.c | 5 | ||||
-rw-r--r-- | net/netfilter/ipvs/ip_vs_core.c | 1 | ||||
-rw-r--r-- | net/netfilter/ipvs/ip_vs_ctl.c | 4 |
6 files changed, 47 insertions, 10 deletions
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c index fa2d6b6fc3e5..331ead3ebd1b 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c | |||
@@ -14,6 +14,7 @@ | |||
14 | #include <net/route.h> | 14 | #include <net/route.h> |
15 | #include <net/ip.h> | 15 | #include <net/ip.h> |
16 | 16 | ||
17 | #include <linux/netfilter_bridge.h> | ||
17 | #include <linux/netfilter_ipv4.h> | 18 | #include <linux/netfilter_ipv4.h> |
18 | #include <net/netfilter/ipv4/nf_defrag_ipv4.h> | 19 | #include <net/netfilter/ipv4/nf_defrag_ipv4.h> |
19 | 20 | ||
@@ -34,6 +35,20 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user) | |||
34 | return err; | 35 | return err; |
35 | } | 36 | } |
36 | 37 | ||
38 | static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum, | ||
39 | struct sk_buff *skb) | ||
40 | { | ||
41 | #ifdef CONFIG_BRIDGE_NETFILTER | ||
42 | if (skb->nf_bridge && | ||
43 | skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING) | ||
44 | return IP_DEFRAG_CONNTRACK_BRIDGE_IN; | ||
45 | #endif | ||
46 | if (hooknum == NF_INET_PRE_ROUTING) | ||
47 | return IP_DEFRAG_CONNTRACK_IN; | ||
48 | else | ||
49 | return IP_DEFRAG_CONNTRACK_OUT; | ||
50 | } | ||
51 | |||
37 | static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, | 52 | static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, |
38 | struct sk_buff *skb, | 53 | struct sk_buff *skb, |
39 | const struct net_device *in, | 54 | const struct net_device *in, |
@@ -50,10 +65,8 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, | |||
50 | #endif | 65 | #endif |
51 | /* Gather fragments. */ | 66 | /* Gather fragments. */ |
52 | if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { | 67 | if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { |
53 | if (nf_ct_ipv4_gather_frags(skb, | 68 | enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb); |
54 | hooknum == NF_INET_PRE_ROUTING ? | 69 | if (nf_ct_ipv4_gather_frags(skb, user)) |
55 | IP_DEFRAG_CONNTRACK_IN : | ||
56 | IP_DEFRAG_CONNTRACK_OUT)) | ||
57 | return NF_STOLEN; | 70 | return NF_STOLEN; |
58 | } | 71 | } |
59 | return NF_ACCEPT; | 72 | return NF_ACCEPT; |
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c index 5f2ec208a8c3..0956ebabbff2 100644 --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | |||
@@ -20,6 +20,7 @@ | |||
20 | #include <net/ipv6.h> | 20 | #include <net/ipv6.h> |
21 | #include <net/inet_frag.h> | 21 | #include <net/inet_frag.h> |
22 | 22 | ||
23 | #include <linux/netfilter_bridge.h> | ||
23 | #include <linux/netfilter_ipv6.h> | 24 | #include <linux/netfilter_ipv6.h> |
24 | #include <net/netfilter/nf_conntrack.h> | 25 | #include <net/netfilter/nf_conntrack.h> |
25 | #include <net/netfilter/nf_conntrack_helper.h> | 26 | #include <net/netfilter/nf_conntrack_helper.h> |
@@ -187,6 +188,21 @@ out: | |||
187 | return nf_conntrack_confirm(skb); | 188 | return nf_conntrack_confirm(skb); |
188 | } | 189 | } |
189 | 190 | ||
191 | static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, | ||
192 | struct sk_buff *skb) | ||
193 | { | ||
194 | #ifdef CONFIG_BRIDGE_NETFILTER | ||
195 | if (skb->nf_bridge && | ||
196 | skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING) | ||
197 | return IP6_DEFRAG_CONNTRACK_BRIDGE_IN; | ||
198 | #endif | ||
199 | if (hooknum == NF_INET_PRE_ROUTING) | ||
200 | return IP6_DEFRAG_CONNTRACK_IN; | ||
201 | else | ||
202 | return IP6_DEFRAG_CONNTRACK_OUT; | ||
203 | |||
204 | } | ||
205 | |||
190 | static unsigned int ipv6_defrag(unsigned int hooknum, | 206 | static unsigned int ipv6_defrag(unsigned int hooknum, |
191 | struct sk_buff *skb, | 207 | struct sk_buff *skb, |
192 | const struct net_device *in, | 208 | const struct net_device *in, |
@@ -199,8 +215,7 @@ static unsigned int ipv6_defrag(unsigned int hooknum, | |||
199 | if (skb->nfct) | 215 | if (skb->nfct) |
200 | return NF_ACCEPT; | 216 | return NF_ACCEPT; |
201 | 217 | ||
202 | reasm = nf_ct_frag6_gather(skb); | 218 | reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb)); |
203 | |||
204 | /* queued */ | 219 | /* queued */ |
205 | if (reasm == NULL) | 220 | if (reasm == NULL) |
206 | return NF_STOLEN; | 221 | return NF_STOLEN; |
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c index e0b9424fa1b2..312c20adc83f 100644 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c | |||
@@ -168,13 +168,14 @@ out: | |||
168 | /* Creation primitives. */ | 168 | /* Creation primitives. */ |
169 | 169 | ||
170 | static __inline__ struct nf_ct_frag6_queue * | 170 | static __inline__ struct nf_ct_frag6_queue * |
171 | fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst) | 171 | fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst) |
172 | { | 172 | { |
173 | struct inet_frag_queue *q; | 173 | struct inet_frag_queue *q; |
174 | struct ip6_create_arg arg; | 174 | struct ip6_create_arg arg; |
175 | unsigned int hash; | 175 | unsigned int hash; |
176 | 176 | ||
177 | arg.id = id; | 177 | arg.id = id; |
178 | arg.user = user; | ||
178 | arg.src = src; | 179 | arg.src = src; |
179 | arg.dst = dst; | 180 | arg.dst = dst; |
180 | 181 | ||
@@ -559,7 +560,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff) | |||
559 | return 0; | 560 | return 0; |
560 | } | 561 | } |
561 | 562 | ||
562 | struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb) | 563 | struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user) |
563 | { | 564 | { |
564 | struct sk_buff *clone; | 565 | struct sk_buff *clone; |
565 | struct net_device *dev = skb->dev; | 566 | struct net_device *dev = skb->dev; |
@@ -605,7 +606,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb) | |||
605 | if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh) | 606 | if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh) |
606 | nf_ct_frag6_evictor(); | 607 | nf_ct_frag6_evictor(); |
607 | 608 | ||
608 | fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr); | 609 | fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr); |
609 | if (fq == NULL) { | 610 | if (fq == NULL) { |
610 | pr_debug("Can't find and can't create new queue\n"); | 611 | pr_debug("Can't find and can't create new queue\n"); |
611 | goto ret_orig; | 612 | goto ret_orig; |
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index 4d98549a6868..3b3a95607125 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c | |||
@@ -72,6 +72,7 @@ struct frag_queue | |||
72 | struct inet_frag_queue q; | 72 | struct inet_frag_queue q; |
73 | 73 | ||
74 | __be32 id; /* fragment id */ | 74 | __be32 id; /* fragment id */ |
75 | u32 user; | ||
75 | struct in6_addr saddr; | 76 | struct in6_addr saddr; |
76 | struct in6_addr daddr; | 77 | struct in6_addr daddr; |
77 | 78 | ||
@@ -141,7 +142,7 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a) | |||
141 | struct ip6_create_arg *arg = a; | 142 | struct ip6_create_arg *arg = a; |
142 | 143 | ||
143 | fq = container_of(q, struct frag_queue, q); | 144 | fq = container_of(q, struct frag_queue, q); |
144 | return (fq->id == arg->id && | 145 | return (fq->id == arg->id && fq->user == arg->user && |
145 | ipv6_addr_equal(&fq->saddr, arg->src) && | 146 | ipv6_addr_equal(&fq->saddr, arg->src) && |
146 | ipv6_addr_equal(&fq->daddr, arg->dst)); | 147 | ipv6_addr_equal(&fq->daddr, arg->dst)); |
147 | } | 148 | } |
@@ -163,6 +164,7 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a) | |||
163 | struct ip6_create_arg *arg = a; | 164 | struct ip6_create_arg *arg = a; |
164 | 165 | ||
165 | fq->id = arg->id; | 166 | fq->id = arg->id; |
167 | fq->user = arg->user; | ||
166 | ipv6_addr_copy(&fq->saddr, arg->src); | 168 | ipv6_addr_copy(&fq->saddr, arg->src); |
167 | ipv6_addr_copy(&fq->daddr, arg->dst); | 169 | ipv6_addr_copy(&fq->daddr, arg->dst); |
168 | } | 170 | } |
@@ -243,6 +245,7 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst, | |||
243 | unsigned int hash; | 245 | unsigned int hash; |
244 | 246 | ||
245 | arg.id = id; | 247 | arg.id = id; |
248 | arg.user = IP6_DEFRAG_LOCAL_DELIVER; | ||
246 | arg.src = src; | 249 | arg.src = src; |
247 | arg.dst = dst; | 250 | arg.dst = dst; |
248 | 251 | ||
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c index b95699f00545..847ffca40184 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c | |||
@@ -1366,6 +1366,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, | |||
1366 | == sysctl_ip_vs_sync_threshold[0])) || | 1366 | == sysctl_ip_vs_sync_threshold[0])) || |
1367 | ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) && | 1367 | ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) && |
1368 | ((cp->state == IP_VS_TCP_S_FIN_WAIT) || | 1368 | ((cp->state == IP_VS_TCP_S_FIN_WAIT) || |
1369 | (cp->state == IP_VS_TCP_S_CLOSE) || | ||
1369 | (cp->state == IP_VS_TCP_S_CLOSE_WAIT) || | 1370 | (cp->state == IP_VS_TCP_S_CLOSE_WAIT) || |
1370 | (cp->state == IP_VS_TCP_S_TIME_WAIT))))) | 1371 | (cp->state == IP_VS_TCP_S_TIME_WAIT))))) |
1371 | ip_vs_sync_conn(cp); | 1372 | ip_vs_sync_conn(cp); |
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index e55a6861d26f..6bde12da2fe0 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c | |||
@@ -2714,6 +2714,8 @@ static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc, | |||
2714 | if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr)))) | 2714 | if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr)))) |
2715 | return -EINVAL; | 2715 | return -EINVAL; |
2716 | 2716 | ||
2717 | memset(usvc, 0, sizeof(*usvc)); | ||
2718 | |||
2717 | usvc->af = nla_get_u16(nla_af); | 2719 | usvc->af = nla_get_u16(nla_af); |
2718 | #ifdef CONFIG_IP_VS_IPV6 | 2720 | #ifdef CONFIG_IP_VS_IPV6 |
2719 | if (usvc->af != AF_INET && usvc->af != AF_INET6) | 2721 | if (usvc->af != AF_INET && usvc->af != AF_INET6) |
@@ -2901,6 +2903,8 @@ static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest, | |||
2901 | if (!(nla_addr && nla_port)) | 2903 | if (!(nla_addr && nla_port)) |
2902 | return -EINVAL; | 2904 | return -EINVAL; |
2903 | 2905 | ||
2906 | memset(udest, 0, sizeof(*udest)); | ||
2907 | |||
2904 | nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr)); | 2908 | nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr)); |
2905 | udest->port = nla_get_u16(nla_port); | 2909 | udest->port = nla_get_u16(nla_port); |
2906 | 2910 | ||