Commit 4f4ecd5f authored by David S. Miller's avatar David S. Miller

Merge branch 'master' of git://1984.lsi.us.es/nf

Pablo Neira Ayuso says:

====================
The following patchset contains netfilter updates for your net tree,
they are:

* Fix missing the skb->trace reset in nf_reset, noticed by Gao Feng
  while using the TRACE target with several net namespaces.

* Fix prefix translation in IPv6 NPT if non-multiple of 32 prefixes
  are used, from Matthias Schiffer.

* Fix invalid nfacct objects with empty name, they are now rejected
  with -EINVAL, spotted by Michael Zintakis, patch from myself.

* A couple of fixes for wrong return values in the error path of
  nfnetlink_queue and nf_conntrack, from Wei Yongjun.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 518314ff 906b1c39
...@@ -2641,6 +2641,9 @@ static inline void nf_reset(struct sk_buff *skb) ...@@ -2641,6 +2641,9 @@ static inline void nf_reset(struct sk_buff *skb)
nf_bridge_put(skb->nf_bridge); nf_bridge_put(skb->nf_bridge);
skb->nf_bridge = NULL; skb->nf_bridge = NULL;
#endif #endif
#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
skb->nf_trace = 0;
#endif
} }
/* Note: This doesn't put any conntrack and bridge info in dst. */ /* Note: This doesn't put any conntrack and bridge info in dst. */
......
...@@ -57,7 +57,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, ...@@ -57,7 +57,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
if (pfx_len - i >= 32) if (pfx_len - i >= 32)
mask = 0; mask = 0;
else else
mask = htonl(~((1 << (pfx_len - i)) - 1)); mask = htonl((1 << (i - pfx_len + 32)) - 1);
idx = i / 32; idx = i / 32;
addr->s6_addr32[idx] &= mask; addr->s6_addr32[idx] &= mask;
......
...@@ -568,6 +568,7 @@ static int __init nf_conntrack_standalone_init(void) ...@@ -568,6 +568,7 @@ static int __init nf_conntrack_standalone_init(void)
register_net_sysctl(&init_net, "net", nf_ct_netfilter_table); register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
if (!nf_ct_netfilter_header) { if (!nf_ct_netfilter_header) {
pr_err("nf_conntrack: can't register to sysctl.\n"); pr_err("nf_conntrack: can't register to sysctl.\n");
ret = -ENOMEM;
goto out_sysctl; goto out_sysctl;
} }
#endif #endif
......
...@@ -49,6 +49,8 @@ nfnl_acct_new(struct sock *nfnl, struct sk_buff *skb, ...@@ -49,6 +49,8 @@ nfnl_acct_new(struct sock *nfnl, struct sk_buff *skb,
return -EINVAL; return -EINVAL;
acct_name = nla_data(tb[NFACCT_NAME]); acct_name = nla_data(tb[NFACCT_NAME]);
if (strlen(acct_name) == 0)
return -EINVAL;
list_for_each_entry(nfacct, &nfnl_acct_list, head) { list_for_each_entry(nfacct, &nfnl_acct_list, head) {
if (strncmp(nfacct->name, acct_name, NFACCT_NAME_MAX) != 0) if (strncmp(nfacct->name, acct_name, NFACCT_NAME_MAX) != 0)
......
...@@ -1062,8 +1062,10 @@ static int __init nfnetlink_queue_init(void) ...@@ -1062,8 +1062,10 @@ static int __init nfnetlink_queue_init(void)
#ifdef CONFIG_PROC_FS #ifdef CONFIG_PROC_FS
if (!proc_create("nfnetlink_queue", 0440, if (!proc_create("nfnetlink_queue", 0440,
proc_net_netfilter, &nfqnl_file_ops)) proc_net_netfilter, &nfqnl_file_ops)) {
status = -ENOMEM;
goto cleanup_subsys; goto cleanup_subsys;
}
#endif #endif
register_netdevice_notifier(&nfqnl_dev_notifier); register_netdevice_notifier(&nfqnl_dev_notifier);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment