diff options
author | David S. Miller <davem@davemloft.net> | 2012-10-31 14:54:15 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2012-10-31 14:54:15 -0400 |
commit | f8450bbe8c7e94b7ef83e74d270d48e057173ed0 (patch) | |
tree | b3717a754de855a9186f31635da345ec710beee3 /net | |
parent | 3c172868cbbe3eb138fd57bb346c77dffb22b182 (diff) | |
parent | f1df1374dc83d62588667e566e959df384718ad1 (diff) |
Merge branch 'master' of git://1984.lsi.us.es/nf
Pablo Neira Ayuso says:
====================
The following patchset contains fixes for your net tree, two of them
are due to relatively recent changes, one has been a longstanding bug,
they are:
* Fix incorrect usage of rt_gateway in the H.323 helper, from
Julian Anastasov.
* Skip re-route in nf_nat code for ICMP traffic. If CONFIG_XFRM is
enabled, we waste cycles to look up for the route again. This problem
seems to be there since really long time. From Ulrich Weber.
* Fix mismatching section in nf_conntrack_reasm, from Hein Tibosch.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/ipv4/netfilter/iptable_nat.c | 4 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6table_nat.c | 4 | ||||
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_reasm.c | 4 | ||||
-rw-r--r-- | net/netfilter/nf_conntrack_h323_main.c | 3 |
4 files changed, 10 insertions, 5 deletions
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c index 9e0ffaf1d942..a82047282dbb 100644 --- a/net/ipv4/netfilter/iptable_nat.c +++ b/net/ipv4/netfilter/iptable_nat.c | |||
@@ -184,7 +184,8 @@ nf_nat_ipv4_out(unsigned int hooknum, | |||
184 | 184 | ||
185 | if ((ct->tuplehash[dir].tuple.src.u3.ip != | 185 | if ((ct->tuplehash[dir].tuple.src.u3.ip != |
186 | ct->tuplehash[!dir].tuple.dst.u3.ip) || | 186 | ct->tuplehash[!dir].tuple.dst.u3.ip) || |
187 | (ct->tuplehash[dir].tuple.src.u.all != | 187 | (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP && |
188 | ct->tuplehash[dir].tuple.src.u.all != | ||
188 | ct->tuplehash[!dir].tuple.dst.u.all)) | 189 | ct->tuplehash[!dir].tuple.dst.u.all)) |
189 | if (nf_xfrm_me_harder(skb, AF_INET) < 0) | 190 | if (nf_xfrm_me_harder(skb, AF_INET) < 0) |
190 | ret = NF_DROP; | 191 | ret = NF_DROP; |
@@ -221,6 +222,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum, | |||
221 | } | 222 | } |
222 | #ifdef CONFIG_XFRM | 223 | #ifdef CONFIG_XFRM |
223 | else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && | 224 | else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && |
225 | ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP && | ||
224 | ct->tuplehash[dir].tuple.dst.u.all != | 226 | ct->tuplehash[dir].tuple.dst.u.all != |
225 | ct->tuplehash[!dir].tuple.src.u.all) | 227 | ct->tuplehash[!dir].tuple.src.u.all) |
226 | if (nf_xfrm_me_harder(skb, AF_INET) < 0) | 228 | if (nf_xfrm_me_harder(skb, AF_INET) < 0) |
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c index e418bd6350a4..d57dab17a182 100644 --- a/net/ipv6/netfilter/ip6table_nat.c +++ b/net/ipv6/netfilter/ip6table_nat.c | |||
@@ -186,7 +186,8 @@ nf_nat_ipv6_out(unsigned int hooknum, | |||
186 | 186 | ||
187 | if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, | 187 | if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, |
188 | &ct->tuplehash[!dir].tuple.dst.u3) || | 188 | &ct->tuplehash[!dir].tuple.dst.u3) || |
189 | (ct->tuplehash[dir].tuple.src.u.all != | 189 | (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 && |
190 | ct->tuplehash[dir].tuple.src.u.all != | ||
190 | ct->tuplehash[!dir].tuple.dst.u.all)) | 191 | ct->tuplehash[!dir].tuple.dst.u.all)) |
191 | if (nf_xfrm_me_harder(skb, AF_INET6) < 0) | 192 | if (nf_xfrm_me_harder(skb, AF_INET6) < 0) |
192 | ret = NF_DROP; | 193 | ret = NF_DROP; |
@@ -222,6 +223,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum, | |||
222 | } | 223 | } |
223 | #ifdef CONFIG_XFRM | 224 | #ifdef CONFIG_XFRM |
224 | else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && | 225 | else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && |
226 | ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 && | ||
225 | ct->tuplehash[dir].tuple.dst.u.all != | 227 | ct->tuplehash[dir].tuple.dst.u.all != |
226 | ct->tuplehash[!dir].tuple.src.u.all) | 228 | ct->tuplehash[!dir].tuple.src.u.all) |
227 | if (nf_xfrm_me_harder(skb, AF_INET6)) | 229 | if (nf_xfrm_me_harder(skb, AF_INET6)) |
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c index 18bd9bbbd1c6..22c8ea951185 100644 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c | |||
@@ -85,7 +85,7 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = { | |||
85 | { } | 85 | { } |
86 | }; | 86 | }; |
87 | 87 | ||
88 | static int __net_init nf_ct_frag6_sysctl_register(struct net *net) | 88 | static int nf_ct_frag6_sysctl_register(struct net *net) |
89 | { | 89 | { |
90 | struct ctl_table *table; | 90 | struct ctl_table *table; |
91 | struct ctl_table_header *hdr; | 91 | struct ctl_table_header *hdr; |
@@ -127,7 +127,7 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net) | |||
127 | } | 127 | } |
128 | 128 | ||
129 | #else | 129 | #else |
130 | static int __net_init nf_ct_frag6_sysctl_register(struct net *net) | 130 | static int nf_ct_frag6_sysctl_register(struct net *net) |
131 | { | 131 | { |
132 | return 0; | 132 | return 0; |
133 | } | 133 | } |
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c index 1b30b0dee708..962795e839ab 100644 --- a/net/netfilter/nf_conntrack_h323_main.c +++ b/net/netfilter/nf_conntrack_h323_main.c | |||
@@ -753,7 +753,8 @@ static int callforward_do_filter(const union nf_inet_addr *src, | |||
753 | flowi4_to_flowi(&fl1), false)) { | 753 | flowi4_to_flowi(&fl1), false)) { |
754 | if (!afinfo->route(&init_net, (struct dst_entry **)&rt2, | 754 | if (!afinfo->route(&init_net, (struct dst_entry **)&rt2, |
755 | flowi4_to_flowi(&fl2), false)) { | 755 | flowi4_to_flowi(&fl2), false)) { |
756 | if (rt1->rt_gateway == rt2->rt_gateway && | 756 | if (rt_nexthop(rt1, fl1.daddr) == |
757 | rt_nexthop(rt2, fl2.daddr) && | ||
757 | rt1->dst.dev == rt2->dst.dev) | 758 | rt1->dst.dev == rt2->dst.dev) |
758 | ret = 1; | 759 | ret = 1; |
759 | dst_release(&rt2->dst); | 760 | dst_release(&rt2->dst); |