5 files changed, 34 insertions, 32 deletions

diff --git a/include/linux/netfilter/xt_LED.h b/include/linux/netfilter/xt_LED.h
index 4c91a0d770d0..f5509e7524d3 100644
--- a/include/linux/netfilter/xt_LED.h
+++ b/include/linux/netfilter/xt_LED.h
@@ -1,6 +1,8 @@
 #ifndef _XT_LED_H
 #define _XT_LED_H
 
+#include <linux/types.h>
+
 struct xt_led_info {
         char id[27];        /* Unique ID for this trigger in the LED class */
         __u8 always_blink;  /* Blink even if the LED is already on */
diff --git a/include/linux/netfilter/xt_cluster.h b/include/linux/netfilter/xt_cluster.h
index 5e0a0d07b526..886682656f09 100644
--- a/include/linux/netfilter/xt_cluster.h
+++ b/include/linux/netfilter/xt_cluster.h
@@ -12,4 +12,6 @@ struct xt_cluster_match_info {
         u_int32_t               flags;
 };
 
+#define XT_CLUSTER_NODES_MAX    32
+
 #endif /* _XT_CLUSTER_MATCH_H */
diff --git a/net/ipv6/netfilter/ip6t_ipv6header.c b/net/ipv6/netfilter/ip6t_ipv6header.c
index 14e6724d5672..91490ad9302c 100644
--- a/net/ipv6/netfilter/ip6t_ipv6header.c
+++ b/net/ipv6/netfilter/ip6t_ipv6header.c
@@ -50,14 +50,14 @@ ipv6header_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                 struct ipv6_opt_hdr _hdr;
                 int hdrlen;
 
-                /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return false;
                 /* No more exthdr -> evaluate */
                 if (nexthdr == NEXTHDR_NONE) {
                         temp |= MASK_NONE;
                         break;
                 }
+                /* Is there enough space for the next ext header? */
+                if (len < (int)sizeof(struct ipv6_opt_hdr))
+                        return false;
                 /* ESP -> evaluate */
                 if (nexthdr == NEXTHDR_ESP) {
                         temp |= MASK_ESP;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index f13fc57e1ecb..c523f0b8cee5 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1186,28 +1186,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[])
         return 0;
 }
 
-static inline void
-ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)
-{
-        unsigned int events = 0;
-
-        if (test_bit(IPS_EXPECTED_BIT, &ct->status))
-                events |= IPCT_RELATED;
-        else
-                events |= IPCT_NEW;
-
-        nf_conntrack_event_report(IPCT_STATUS |
-                                  IPCT_HELPER |
-                                  IPCT_REFRESH |
-                                  IPCT_PROTOINFO |
-                                  IPCT_NATSEQADJ |
-                                  IPCT_MARK |
-                                  events,
-                                  ct,
-                                  pid,
-                                  report);
-}
-
 static struct nf_conn *
 ctnetlink_create_conntrack(struct nlattr *cda[],
                            struct nf_conntrack_tuple *otuple,
@@ -1373,6 +1351,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
                         struct nf_conn *ct;
+                        enum ip_conntrack_events events;
 
                         ct = ctnetlink_create_conntrack(cda, &otuple,
                                                         &rtuple, u3);
@@ -1383,9 +1362,18 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         err = 0;
                         nf_conntrack_get(&ct->ct_general);
                         spin_unlock_bh(&nf_conntrack_lock);
-                        ctnetlink_event_report(ct,
-                                               NETLINK_CB(skb).pid,
-                                               nlmsg_report(nlh));
+                        if (test_bit(IPS_EXPECTED_BIT, &ct->status))
+                                events = IPCT_RELATED;
+                        else
+                                events = IPCT_NEW;
+
+                        nf_conntrack_event_report(IPCT_STATUS |
+                                                  IPCT_HELPER |
+                                                  IPCT_PROTOINFO |
+                                                  IPCT_NATSEQADJ |
+                                                  IPCT_MARK | events,
+                                                  ct, NETLINK_CB(skb).pid,
+                                                  nlmsg_report(nlh));
                         nf_ct_put(ct);
                 } else
                         spin_unlock_bh(&nf_conntrack_lock);
@@ -1404,9 +1392,13 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 if (err == 0) {
                         nf_conntrack_get(&ct->ct_general);
                         spin_unlock_bh(&nf_conntrack_lock);
-                        ctnetlink_event_report(ct,
-                                               NETLINK_CB(skb).pid,
-                                               nlmsg_report(nlh));
+                        nf_conntrack_event_report(IPCT_STATUS |
+                                                  IPCT_HELPER |
+                                                  IPCT_PROTOINFO |
+                                                  IPCT_NATSEQADJ |
+                                                  IPCT_MARK,
+                                                  ct, NETLINK_CB(skb).pid,
+                                                  nlmsg_report(nlh));
                         nf_ct_put(ct);
                 } else
                         spin_unlock_bh(&nf_conntrack_lock);
diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c
index 6c4847662b85..69a639f35403 100644
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -135,7 +135,13 @@ static bool xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
 {
         struct xt_cluster_match_info *info = par->matchinfo;
 
-        if (info->node_mask >= (1 << info->total_nodes)) {
+        if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
+                printk(KERN_ERR "xt_cluster: you have exceeded the maximum "
+                                "number of cluster nodes (%u > %u)\n",
+                                info->total_nodes, XT_CLUSTER_NODES_MAX);
+                return false;
+        }
+        if (info->node_mask >= (1ULL << info->total_nodes)) {
                 printk(KERN_ERR "xt_cluster: this node mask cannot be "
                                 "higher than the total number of nodes\n");
                 return false;