5 files changed, 40 insertions, 12 deletions

diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 8e757dd53396..aee0d6bea309 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -22,6 +22,7 @@
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_log.h>
 
 static DEFINE_RWLOCK(dccp_lock);
@@ -553,6 +554,9 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
         ct->proto.dccp.state = new_state;
         write_unlock_bh(&dccp_lock);
 
+        if (new_state != old_state)
+                nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
+
         dn = dccp_pernet(net);
         nf_ct_refresh_acct(ct, ctinfo, skb, dn->dccp_timeout[new_state]);
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index b5ccf2b4b2e7..97a6e93d742e 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -634,6 +634,14 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         sender->td_end = end;
                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
                 }
+                if (tcph->ack) {
+                        if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
+                                sender->td_maxack = ack;
+                                sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
+                        } else if (after(ack, sender->td_maxack))
+                                sender->td_maxack = ack;
+                }
+
                 /*
                  * Update receiver data.
                  */
@@ -919,6 +927,16 @@ static int tcp_packet(struct nf_conn *ct,
                 return -NF_ACCEPT;
         case TCP_CONNTRACK_CLOSE:
                 if (index == TCP_RST_SET
+                    && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
+                    && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
+                        /* Invalid RST  */
+                        write_unlock_bh(&tcp_lock);
+                        if (LOG_INVALID(net, IPPROTO_TCP))
+                                nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
+                                          "nf_ct_tcp: invalid RST ");
+                        return -NF_ACCEPT;
+                }
+                if (index == TCP_RST_SET
                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
                          && ct->proto.tcp.last_index == TCP_SYN_SET)
                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index fd326ac27ec8..66a6dd5c519a 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -581,6 +581,12 @@ nfulnl_log_packet(u_int8_t pf,
                 + nla_total_size(sizeof(struct nfulnl_msg_packet_hw))
                 + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp));
 
+        if (in && skb_mac_header_was_set(skb)) {
+                size +=   nla_total_size(skb->dev->hard_header_len)
+                        + nla_total_size(sizeof(u_int16_t))     /* hwtype */
+                        + nla_total_size(sizeof(u_int16_t));    /* hwlen */
+        }
+
         spin_lock_bh(&inst->lock);
 
         if (inst->flags & NFULNL_CFG_F_SEQ)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index a5b5369c30f9..219dcdbe388c 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -926,7 +926,7 @@ static int dl_seq_show(struct seq_file *s, void *v)
         if (!hlist_empty(&htable->hash[*bucket])) {
                 hlist_for_each_entry(ent, pos, &htable->hash[*bucket], node)
                         if (dl_seq_real_show(ent, htable->family, s))
-                                return 1;
+                                return -1;
         }
         return 0;
 }
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 91a3db4a76f8..cc29b44b1500 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -104,8 +104,7 @@ static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp,
                                struct tcf_result *res)
 {
         struct cls_cgroup_head *head = tp->root;
-        struct cgroup_cls_state *cs;
-        int ret = 0;
+        u32 classid;
 
         /*
          * Due to the nature of the classifier it is required to ignore all
@@ -121,17 +120,18 @@ static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp,
                 return -1;
 
         rcu_read_lock();
-        cs = task_cls_state(current);
-        if (cs->classid && tcf_em_tree_match(skb, &head->ematches, NULL)) {
-                res->classid = cs->classid;
-                res->class = 0;
-                ret = tcf_exts_exec(skb, &head->exts, res);
-        } else
-                ret = -1;
-
+        classid = task_cls_state(current)->classid;
         rcu_read_unlock();
 
-        return ret;
+        if (!classid)
+                return -1;
+
+        if (!tcf_em_tree_match(skb, &head->ematches, NULL))
+                return -1;
+
+        res->classid = classid;
+        res->class = 0;
+        return tcf_exts_exec(skb, &head->exts, res);
 }
 
 static unsigned long cls_cgroup_get(struct tcf_proto *tp, u32 handle)