8 files changed, 67 insertions, 16 deletions

diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index cf08218ddbcf..ff4b781b1056 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -231,8 +231,10 @@ static void ipt_ulog_packet(struct net *net,
         put_unaligned(tv.tv_usec, &pm->timestamp_usec);
         put_unaligned(skb->mark, &pm->mark);
         pm->hook = hooknum;
-        if (prefix != NULL)
-                strncpy(pm->prefix, prefix, sizeof(pm->prefix));
+        if (prefix != NULL) {
+                strncpy(pm->prefix, prefix, sizeof(pm->prefix) - 1);
+                pm->prefix[sizeof(pm->prefix) - 1] = '\0';
+        }
         else if (loginfo->prefix[0] != '\0')
                 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
         else
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d1ab6ab29a55..d1b2d8034b54 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1487,7 +1487,7 @@ static int ipv6_count_addresses(struct inet6_dev *idev)
 }
 
 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
-                  struct net_device *dev, int strict)
+                  const struct net_device *dev, int strict)
 {
         struct inet6_ifaddr *ifp;
         unsigned int hash = inet6_addr_hash(addr);
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 72836f40b730..95f3f1da0d7f 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -10,6 +10,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/export.h>
+#include <net/addrconf.h>
 #include <net/dst.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
@@ -186,6 +187,10 @@ static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
         return csum;
 };
 
+static const struct nf_ipv6_ops ipv6ops = {
+        .chk_addr       = ipv6_chk_addr,
+};
+
 static const struct nf_afinfo nf_ip6_afinfo = {
         .family                 = AF_INET6,
         .checksum               = nf_ip6_checksum,
@@ -198,6 +203,7 @@ static const struct nf_afinfo nf_ip6_afinfo = {
 
 int __init ipv6_netfilter_init(void)
 {
+        RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops);
         return nf_register_afinfo(&nf_ip6_afinfo);
 }
 
@@ -206,5 +212,6 @@ int __init ipv6_netfilter_init(void)
  */
 void ipv6_netfilter_fini(void)
 {
+        RCU_INIT_POINTER(nf_ipv6_ops, NULL);
         nf_unregister_afinfo(&nf_ip6_afinfo);
 }
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 07c865a31a3d..857ca9f35177 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -30,6 +30,8 @@ static DEFINE_MUTEX(afinfo_mutex);
 
 const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
 EXPORT_SYMBOL(nf_afinfo);
+const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;
+EXPORT_SYMBOL_GPL(nf_ipv6_ops);
 
 int nf_register_afinfo(const struct nf_afinfo *afinfo)
 {
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 085b5880ab0d..05565d2b3a61 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1001,6 +1001,32 @@ static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len)
         return th->rst;
 }
 
+static inline bool is_new_conn(const struct sk_buff *skb,
+                               struct ip_vs_iphdr *iph)
+{
+        switch (iph->protocol) {
+        case IPPROTO_TCP: {
+                struct tcphdr _tcph, *th;
+
+                th = skb_header_pointer(skb, iph->len, sizeof(_tcph), &_tcph);
+                if (th == NULL)
+                        return false;
+                return th->syn;
+        }
+        case IPPROTO_SCTP: {
+                sctp_chunkhdr_t *sch, schunk;
+
+                sch = skb_header_pointer(skb, iph->len + sizeof(sctp_sctphdr_t),
+                                         sizeof(schunk), &schunk);
+                if (sch == NULL)
+                        return false;
+                return sch->type == SCTP_CID_INIT;
+        }
+        default:
+                return false;
+        }
+}
+
 /* Handle response packets: rewrite addresses and send away...
  */
 static unsigned int
@@ -1612,6 +1638,15 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
          * Check if the packet belongs to an existing connection entry
          */
         cp = pp->conn_in_get(af, skb, &iph, 0);
+
+        if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp && cp->dest &&
+            unlikely(!atomic_read(&cp->dest->weight)) && !iph.fragoffs &&
+            is_new_conn(skb, &iph)) {
+                ip_vs_conn_expire_now(cp);
+                __ip_vs_conn_put(cp);
+                cp = NULL;
+        }
+
         if (unlikely(!cp) && !iph.fragoffs) {
                 /* No (second) fragments need to enter here, as nf_defrag_ipv6
                  * replayed fragment zero will already have created the cp
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index 0df269d7c99f..a65edfe4b16c 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -67,8 +67,8 @@ struct ip_vs_sh_bucket {
 #define IP_VS_SH_TAB_MASK               (IP_VS_SH_TAB_SIZE - 1)
 
 struct ip_vs_sh_state {
-        struct ip_vs_sh_bucket          buckets[IP_VS_SH_TAB_SIZE];
         struct rcu_head                 rcu_head;
+        struct ip_vs_sh_bucket          buckets[IP_VS_SH_TAB_SIZE];
 };
 
 /*
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index 491c7d821a0b..5ab24843370a 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -737,7 +737,7 @@ static void dump_ipv6_packet(struct sbuff *m,
                 dump_sk_uid_gid(m, skb->sk);
 
         /* Max length: 16 "MARK=0xFFFFFFFF " */
-        if (!recurse && skb->mark)
+        if (recurse && skb->mark)
                 sb_add(m, "MARK=0x%x ", skb->mark);
 }
 
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 49c5ff7f6dd6..68ff29f60867 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -22,6 +22,7 @@
 #include <net/ip6_fib.h>
 #endif
 
+#include <linux/netfilter_ipv6.h>
 #include <linux/netfilter/xt_addrtype.h>
 #include <linux/netfilter/x_tables.h>
 
@@ -33,12 +34,12 @@ MODULE_ALIAS("ip6t_addrtype");
 
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
-                            const struct in6_addr *addr)
+                            const struct in6_addr *addr, u16 mask)
 {
         const struct nf_afinfo *afinfo;
         struct flowi6 flow;
         struct rt6_info *rt;
-        u32 ret;
+        u32 ret = 0;
         int route_err;
 
         memset(&flow, 0, sizeof(flow));
@@ -49,12 +50,19 @@ static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
         rcu_read_lock();
 
         afinfo = nf_get_afinfo(NFPROTO_IPV6);
-        if (afinfo != NULL)
+        if (afinfo != NULL) {
+                const struct nf_ipv6_ops *v6ops;
+
+                if (dev && (mask & XT_ADDRTYPE_LOCAL)) {
+                        v6ops = nf_get_ipv6_ops();
+                        if (v6ops && v6ops->chk_addr(net, addr, dev, true))
+                                ret = XT_ADDRTYPE_LOCAL;
+                }
                 route_err = afinfo->route(net, (struct dst_entry **)&rt,
-                                        flowi6_to_flowi(&flow), !!dev);
-        else
+                                          flowi6_to_flowi(&flow), false);
+        } else {
                 route_err = 1;
-
+        }
         rcu_read_unlock();
 
         if (route_err)
@@ -62,15 +70,12 @@ static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
 
         if (rt->rt6i_flags & RTF_REJECT)
                 ret = XT_ADDRTYPE_UNREACHABLE;
-        else
-                ret = 0;
 
-        if (rt->rt6i_flags & RTF_LOCAL)
+        if (dev == NULL && rt->rt6i_flags & RTF_LOCAL)
                 ret |= XT_ADDRTYPE_LOCAL;
         if (rt->rt6i_flags & RTF_ANYCAST)
                 ret |= XT_ADDRTYPE_ANYCAST;
 
-
         dst_release(&rt->dst);
         return ret;
 }
@@ -90,7 +95,7 @@ static bool match_type6(struct net *net, const struct net_device *dev,
 
         if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
              XT_ADDRTYPE_UNREACHABLE) & mask)
-                return !!(mask & match_lookup_rt6(net, dev, addr));
+                return !!(mask & match_lookup_rt6(net, dev, addr, mask));
         return true;
 }