Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix a deadlock when module is requested via netlink_bind() in nfnetlink, from Florian Westphal. 2) Fix ipt_rpfilter and ip6t_rpfilter with VRF, from Miaohe Lin. 3) Skip master comparison in SIP helper to fix expectation clash under two valid scenarios, from xiao ruizhu. 4) Remove obsolete comments in nf_conntrack codebase, from Yonatan Goldschmidt. 5) Fix redirect extension module autoload, from Christian Hesse. 6) Fix incorrect mssg option sent to client in synproxy, from Fernando Fernandez. 7) Fix incorrect window calculations in TCP conntrack, from Florian Westphal. 8) Don't bail out when updating basechain policy due to recent offload works, also from Florian. 9) Allow symhash to use modulus 1 as other hash extensions do, from Laura.Garcia. 10) Missing NAT chain module autoload for the inet family, from Phil Sutter. 11) Fix missing adjustment of TCP RST packet in synproxy, from Fernando Fernandez. 12) Skip EAGAIN path when nft_meta_bridge is built-in or not selected. 13) Conntrack bridge does not depend on nf_tables_bridge. 14) Turn NF_TABLES_BRIDGE into tristate to fix possible link break of nft_meta_bridge, from Arnd Bergmann. ====================

David S. Miller committed 7 years ago

Commit 9a2f97b2 parents 31cc088 dfee0e944 files · +117 −82Browse files

Unified · Split

44 files

include/linux/netfilter/nf_conntrack_h323_asn1.h +1 −2
include/net/netfilter/nf_conntrack_expect.h +9 −3
include/net/netfilter/nf_conntrack_synproxy.h +1 −0
net/bridge/netfilter/Kconfig +3 −3
net/ipv4/netfilter/ipt_CLUSTERIP.c +2 −2
net/ipv4/netfilter/ipt_SYNPROXY.c +2 −0
net/ipv4/netfilter/ipt_rpfilter.c +1 −0
net/ipv4/netfilter/nf_nat_h323.c +6 −6
net/ipv6/netfilter/ip6t_SYNPROXY.c +2 −0
net/ipv6/netfilter/ip6t_rpfilter.c +6 −2
net/netfilter/Kconfig +2 −4
net/netfilter/ipvs/ip_vs_nfct.c +1 −1
net/netfilter/nf_conntrack_amanda.c +1 −1
net/netfilter/nf_conntrack_broadcast.c +1 −1
net/netfilter/nf_conntrack_core.c +1 −3
net/netfilter/nf_conntrack_expect.c +19 −7
net/netfilter/nf_conntrack_ftp.c +1 −1
net/netfilter/nf_conntrack_h323_asn1.c +2 −3
net/netfilter/nf_conntrack_h323_main.c +9 −9
net/netfilter/nf_conntrack_irc.c +1 −1
net/netfilter/nf_conntrack_netlink.c +2 −2
net/netfilter/nf_conntrack_pptp.c +2 −2
net/netfilter/nf_conntrack_proto_gre.c +0 −2
net/netfilter/nf_conntrack_proto_icmp.c +1 −1
net/netfilter/nf_conntrack_proto_tcp.c +5 −3
net/netfilter/nf_conntrack_sane.c +1 −1
net/netfilter/nf_conntrack_sip.c +7 −3
net/netfilter/nf_conntrack_tftp.c +1 −1
net/netfilter/nf_nat_amanda.c +1 −1
net/netfilter/nf_nat_core.c +1 −1
net/netfilter/nf_nat_ftp.c +1 −1
net/netfilter/nf_nat_irc.c +1 −1
net/netfilter/nf_nat_sip.c +5 −3
net/netfilter/nf_nat_tftp.c +1 −1
net/netfilter/nf_synproxy_core.c +4 −4
net/netfilter/nf_tables_api.c +2 −0
net/netfilter/nfnetlink.c +1 −1
net/netfilter/nft_chain_filter.c +1 −1
net/netfilter/nft_chain_nat.c +3 −0
net/netfilter/nft_ct.c +1 −1
net/netfilter/nft_hash.c +1 −1
net/netfilter/nft_meta.c +1 −1
net/netfilter/nft_redir.c +1 −1
net/netfilter/nft_synproxy.c +2 −0

include/linux/netfilter/nf_conntrack_h323_asn1.h+1−2

@@ -1,7 +1,6 @@
1	1	/* SPDX-License-Identifier: GPL-2.0-only */
2	2	/****************************************************************************
3		− * ip_conntrack_h323_asn1.h - BER and PER decoding library for H.323
4		− * conntrack/NAT module.
	3	+ * BER and PER decoding library for H.323 conntrack/NAT module.
5	4	*
6	5	* Copyright (c) 2006 by Jing Min Zhao <zhaojingmin@users.sourceforge.net>
7	6	*

include/net/netfilter/nf_conntrack_expect.h+9−3

@@ -76,6 +76,11 @@ struct nf_conntrack_expect_policy { · 75 unmodified lines
76	76	#define NF_CT_EXPECT_CLASS_DEFAULT 0
77	77	#define NF_CT_EXPECT_MAX_CNT 255
78	78
	79	+/* Allow to reuse expectations with the same tuples from different master
	80	+ * conntracks.
	81	+ */
	82	+#define NF_CT_EXP_F_SKIP_MASTER 0x1
	83	+
79	84	int nf_conntrack_expect_pernet_init(struct net *net);
80	85	void nf_conntrack_expect_pernet_fini(struct net *net);
81	86
@@ -122,10 +127,11 @@ void nf_ct_expect_init(struct nf_conntrack_expect *, unsigned int, u_int8_t, · 40 unmodified lines
122	127	u_int8_t, const __be16 , const __be16 );
123	128	void nf_ct_expect_put(struct nf_conntrack_expect *exp);
124	129	int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
125		− u32 portid, int report);
126		−static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect)
	130	+ u32 portid, int report, unsigned int flags);
	131	+static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect,
	132	+ unsigned int flags)
127	133	{
128		− return nf_ct_expect_related_report(expect, 0, 0);
	134	+ return nf_ct_expect_related_report(expect, 0, 0, flags);
129	135	}
130	136
131	137	#endif /_NF_CONNTRACK_EXPECT_H/

include/net/netfilter/nf_conntrack_synproxy.h+1−0

@@ -68,6 +68,7 @@ struct synproxy_options { · 67 unmodified lines
68	68	u8 options;
69	69	u8 wscale;
70	70	u16 mss;
	71	+ u16 mss_encode;
71	72	u32 tsval;
72	73	u32 tsecr;
73	74	};

net/bridge/netfilter/Kconfig+3−3

@@ -6,7 +6,7 @@ · 5 unmodified lines
6	6	menuconfig NF_TABLES_BRIDGE
7	7	depends on BRIDGE && NETFILTER && NF_TABLES
8	8	select NETFILTER_FAMILY_BRIDGE
9		− bool "Ethernet Bridge nf_tables support"
	9	+ tristate "Ethernet Bridge nf_tables support"
10	10
11	11	if NF_TABLES_BRIDGE
12	12
@@ -25,6 +25,8 @@ config NF_LOG_BRIDGE · 12 unmodified lines
25	25	tristate "Bridge packet logging"
26	26	select NF_LOG_COMMON
27	27
	28	+endif # NF_TABLES_BRIDGE
	29	+
28	30	config NF_CONNTRACK_BRIDGE
29	31	tristate "IPv4/IPV6 bridge connection tracking support"
30	32	depends on NF_CONNTRACK
@@ -39,8 +41,6 @@ config NF_CONNTRACK_BRIDGE · 8 unmodified lines
39	41
40	42	To compile it as a module, choose M here. If unsure, say N.
41	43
42		−endif # NF_TABLES_BRIDGE
43		−
44	44	menuconfig BRIDGE_NF_EBTABLES
45	45	tristate "Ethernet Bridge tables (ebtables) support"
46	46	depends on BRIDGE && NETFILTER && NETFILTER_XTABLES

net/ipv4/netfilter/ipt_CLUSTERIP.c+2−2

@@ -416,8 +416,8 @@ clusterip_tg(struct sk_buff skb, const struct xt_action_param par) · 415 unmodified lines
416	416	ctinfo == IP_CT_RELATED_REPLY))
417	417	return XT_CONTINUE;
418	418
419		− /* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO,
420		− * TIMESTAMP, INFO_REQUEST or ADDRESS type icmp packets from here
	419	+ /* nf_conntrack_proto_icmp guarantees us that we only have ICMP_ECHO,
	420	+ * TIMESTAMP, INFO_REQUEST or ICMP_ADDRESS type icmp packets from here
421	421	* on, which all have an ID field [relevant for hashing]. */
422	422
423	423	hash = clusterip_hashfn(skb, cipinfo->config);

net/ipv4/netfilter/ipt_SYNPROXY.c+2−0

@@ -36,6 +36,8 @@ synproxy_tg4(struct sk_buff skb, const struct xt_action_param par) · 35 unmodified lines
36	36	opts.options \|= XT_SYNPROXY_OPT_ECN;
37	37
38	38	opts.options &= info->options;
	39	+ opts.mss_encode = opts.mss;
	40	+ opts.mss = info->mss;
39	41	if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
40	42	synproxy_init_timestamp_cookie(info, &opts);
41	43	else

net/ipv4/netfilter/ipt_rpfilter.c+1−0

@@ -78,6 +78,7 @@ static bool rpfilter_mt(const struct sk_buff skb, struct xt_action_param par) · 77 unmodified lines
78	78	flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
79	79	flow.flowi4_tos = RT_TOS(iph->tos);
80	80	flow.flowi4_scope = RT_SCOPE_UNIVERSE;
	81	+ flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par));
81	82
82	83	return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert;
83	84	}

net/ipv4/netfilter/nf_nat_h323.c+6−6

@@ -221,11 +221,11 @@ static int nat_rtp_rtcp(struct sk_buff skb, struct nf_conn ct, · 220 unmodified lines
221	221	int ret;
222	222
223	223	rtp_exp->tuple.dst.u.udp.port = htons(nated_port);
224		− ret = nf_ct_expect_related(rtp_exp);
	224	+ ret = nf_ct_expect_related(rtp_exp, 0);
225	225	if (ret == 0) {
226	226	rtcp_exp->tuple.dst.u.udp.port =
227	227	htons(nated_port + 1);
228		− ret = nf_ct_expect_related(rtcp_exp);
	228	+ ret = nf_ct_expect_related(rtcp_exp, 0);
229	229	if (ret == 0)
230	230	break;
231	231	else if (ret == -EBUSY) {
@@ -296,7 +296,7 @@ static int nat_t120(struct sk_buff skb, struct nf_conn ct, · 64 unmodified lines
296	296	int ret;
297	297
298	298	exp->tuple.dst.u.tcp.port = htons(nated_port);
299		− ret = nf_ct_expect_related(exp);
	299	+ ret = nf_ct_expect_related(exp, 0);
300	300	if (ret == 0)
301	301	break;
302	302	else if (ret != -EBUSY) {
@@ -352,7 +352,7 @@ static int nat_h245(struct sk_buff skb, struct nf_conn ct, · 49 unmodified lines
352	352	int ret;
353	353
354	354	exp->tuple.dst.u.tcp.port = htons(nated_port);
355		− ret = nf_ct_expect_related(exp);
	355	+ ret = nf_ct_expect_related(exp, 0);
356	356	if (ret == 0)
357	357	break;
358	358	else if (ret != -EBUSY) {
@@ -444,7 +444,7 @@ static int nat_q931(struct sk_buff skb, struct nf_conn ct, · 85 unmodified lines
444	444	int ret;
445	445
446	446	exp->tuple.dst.u.tcp.port = htons(nated_port);
447		− ret = nf_ct_expect_related(exp);
	447	+ ret = nf_ct_expect_related(exp, 0);
448	448	if (ret == 0)
449	449	break;
450	450	else if (ret != -EBUSY) {
@@ -537,7 +537,7 @@ static int nat_callforwarding(struct sk_buff skb, struct nf_conn ct, · 86 unmodified lines
537	537	int ret;
538	538
539	539	exp->tuple.dst.u.tcp.port = htons(nated_port);
540		− ret = nf_ct_expect_related(exp);
	540	+ ret = nf_ct_expect_related(exp, 0);
541	541	if (ret == 0)
542	542	break;
543	543	else if (ret != -EBUSY) {

net/ipv6/netfilter/ip6t_SYNPROXY.c+2−0

@@ -36,6 +36,8 @@ synproxy_tg6(struct sk_buff skb, const struct xt_action_param par) · 35 unmodified lines
36	36	opts.options \|= XT_SYNPROXY_OPT_ECN;
37	37
38	38	opts.options &= info->options;
	39	+ opts.mss_encode = opts.mss;
	40	+ opts.mss = info->mss;
39	41	if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
40	42	synproxy_init_timestamp_cookie(info, &opts);
41	43	else

net/ipv6/netfilter/ip6t_rpfilter.c+6−2

@@ -55,7 +55,9 @@ static bool rpfilter_lookup_reverse6(struct net net, const struct sk_buff skb, · 54 unmodified lines
55	55	if (rpfilter_addr_linklocal(&iph->saddr)) {
56	56	lookup_flags \|= RT6_LOOKUP_F_IFACE;
57	57	fl6.flowi6_oif = dev->ifindex;
58		− } else if ((flags & XT_RPFILTER_LOOSE) == 0)
	58	+ /* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */
	59	+ } else if (netif_is_l3_master(dev) \|\| netif_is_l3_slave(dev) \|\|
	60	+ (flags & XT_RPFILTER_LOOSE) == 0)
59	61	fl6.flowi6_oif = dev->ifindex;
60	62
61	63	rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
@@ -70,7 +72,9 @@ static bool rpfilter_lookup_reverse6(struct net net, const struct sk_buff skb, · 8 unmodified lines
70	72	goto out;
71	73	}
72	74
73		− if (rt->rt6i_idev->dev == dev \|\| (flags & XT_RPFILTER_LOOSE))
	75	+ if (rt->rt6i_idev->dev == dev \|\|
	76	+ l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex \|\|
	77	+ (flags & XT_RPFILTER_LOOSE))
74	78	ret = true;
75	79	out:
76	80	ip6_rt_put(rt);

net/netfilter/Kconfig+2−4

@@ -223,8 +223,6 @@ config NF_CONNTRACK_FTP · 222 unmodified lines
223	223	of Network Address Translation on them.
224	224
225	225	This is FTP support on Layer 3 independent connection tracking.
226		− Layer 3 independent connection tracking is experimental scheme
227		− which generalize ip_conntrack to support other layer 3 protocols.
228	226
229	227	To compile it as a module, choose M here. If unsure, say N.
230	228
@@ -338,7 +336,7 @@ config NF_CONNTRACK_SIP · 107 unmodified lines
338	336	help
339	337	SIP is an application-layer control protocol that can establish,
340	338	modify, and terminate multimedia sessions (conferences) such as
341		− Internet telephony calls. With the ip_conntrack_sip and
	339	+ Internet telephony calls. With the nf_conntrack_sip and
342	340	the nf_nat_sip modules you can support the protocol on a connection
343	341	tracking/NATing firewall.
344	342
@@ -1313,7 +1311,7 @@ config NETFILTER_XT_MATCH_HELPER · 968 unmodified lines
1313	1311	depends on NETFILTER_ADVANCED
1314	1312	help
1315	1313	Helper matching allows you to match packets in dynamic connections
1316		− tracked by a conntrack-helper, ie. ip_conntrack_ftp
	1314	+ tracked by a conntrack-helper, ie. nf_conntrack_ftp
1317	1315
1318	1316	To compile it as a module, choose M here. If unsure, say Y.
1319	1317

net/netfilter/ipvs/ip_vs_nfct.c+1−1

@@ -231,7 +231,7 @@ void ip_vs_nfct_expect_related(struct sk_buff skb, struct nf_conn ct, · 230 unmodified lines
231	231
232	232	IP_VS_DBG_BUF(7, "%s: ct=%p, expect tuple=" FMT_TUPLE "\n",
233	233	__func__, ct, ARG_TUPLE(&exp->tuple));
234		− nf_ct_expect_related(exp);
	234	+ nf_ct_expect_related(exp, 0);
235	235	nf_ct_expect_put(exp);
236	236	}
237	237	EXPORT_SYMBOL(ip_vs_nfct_expect_related);

net/netfilter/nf_conntrack_amanda.c+1−1

@@ -159,7 +159,7 @@ static int amanda_help(struct sk_buff *skb, · 158 unmodified lines
159	159	if (nf_nat_amanda && ct->status & IPS_NAT_MASK)
160	160	ret = nf_nat_amanda(skb, ctinfo, protoff,
161	161	off - dataoff, len, exp);
162		− else if (nf_ct_expect_related(exp) != 0) {
	162	+ else if (nf_ct_expect_related(exp, 0) != 0) {
163	163	nf_ct_helper_log(skb, ct, "cannot add expectation");
164	164	ret = NF_DROP;
165	165	}

net/netfilter/nf_conntrack_broadcast.c+1−1

@@ -68,7 +68,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, · 67 unmodified lines
68	68	exp->class = NF_CT_EXPECT_CLASS_DEFAULT;
69	69	exp->helper = NULL;
70	70
71		− nf_ct_expect_related(exp);
	71	+ nf_ct_expect_related(exp, 0);
72	72	nf_ct_expect_put(exp);
73	73
74	74	nf_ct_refresh(ct, skb, timeout * HZ);

net/netfilter/nf_conntrack_core.c+1−3

@@ -1817,9 +1817,7 @@ EXPORT_SYMBOL_GPL(nf_ct_kill_acct); · 1816 unmodified lines
1817	1817	#include <linux/netfilter/nfnetlink_conntrack.h>
1818	1818	#include <linux/mutex.h>
1819	1819
1820		−/* Generic function for tcp/udp/sctp/dccp and alike. This needs to be
1821		− * in ip_conntrack_core, since we don't want the protocols to autoload
1822		− * or depend on ctnetlink */
	1820	+/* Generic function for tcp/udp/sctp/dccp and alike. */
1823	1821	int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
1824	1822	const struct nf_conntrack_tuple *tuple)
1825	1823	{

net/netfilter/nf_conntrack_expect.c+19−7

@@ -249,13 +249,22 @@ static inline int expect_clash(const struct nf_conntrack_expect *a, · 248 unmodified lines
249	249	static inline int expect_matches(const struct nf_conntrack_expect *a,
250	250	const struct nf_conntrack_expect *b)
251	251	{
252		− return a->master == b->master &&
253		− nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
	252	+ return nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
254	253	nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
255	254	net_eq(nf_ct_net(a->master), nf_ct_net(b->master)) &&
256	255	nf_ct_zone_equal_any(a->master, nf_ct_zone(b->master));
257	256	}
258	257
	258	+static bool master_matches(const struct nf_conntrack_expect *a,
	259	+ const struct nf_conntrack_expect *b,
	260	+ unsigned int flags)
	261	+{
	262	+ if (flags & NF_CT_EXP_F_SKIP_MASTER)
	263	+ return true;
	264	+
	265	+ return a->master == b->master;
	266	+}
	267	+
259	268	/* Generally a bad idea to call this: could have matched already. */
260	269	void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
261	270	{
@@ -399,7 +408,8 @@ static void evict_oldest_expect(struct nf_conn *master, · 137 unmodified lines
399	408	nf_ct_remove_expect(last);
400	409	}
401	410
402		−static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
	411	+static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
	412	+ unsigned int flags)
403	413	{
404	414	const struct nf_conntrack_expect_policy *p;
405	415	struct nf_conntrack_expect *i;
@@ -417,8 +427,10 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) · 11 unmodified lines
417	427	}
418	428	h = nf_ct_expect_dst_hash(net, &expect->tuple);
419	429	hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
420		− if (expect_matches(i, expect)) {
421		− if (i->class != expect->class)
	430	+ if (master_matches(i, expect, flags) &&
	431	+ expect_matches(i, expect)) {
	432	+ if (i->class != expect->class \|\|
	433	+ i->master != expect->master)
422	434	return -EALREADY;
423	435
424	436	if (nf_ct_remove_expect(i))
@@ -453,12 +465,12 @@ out: · 28 unmodified lines
453	465	}
454	466
455	467	int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
456		− u32 portid, int report)
	468	+ u32 portid, int report, unsigned int flags)
457	469	{
458	470	int ret;
459	471
460	472	spin_lock_bh(&nf_conntrack_expect_lock);
461		− ret = __nf_ct_expect_check(expect);
	473	+ ret = __nf_ct_expect_check(expect, flags);
462	474	if (ret < 0)
463	475	goto out;
464	476

net/netfilter/nf_conntrack_ftp.c+1−1

@@ -525,7 +525,7 @@ skip_nl_seq: · 524 unmodified lines
525	525	protoff, matchoff, matchlen, exp);
526	526	else {
527	527	/* Can't expect this? Best to drop packet now. */
528		− if (nf_ct_expect_related(exp) != 0) {
	528	+ if (nf_ct_expect_related(exp, 0) != 0) {
529	529	nf_ct_helper_log(skb, ct, "cannot add expectation");
530	530	ret = NF_DROP;
531	531	} else

net/netfilter/nf_conntrack_h323_asn1.c+2−3

@@ -1,11 +1,10 @@
1	1	// SPDX-License-Identifier: GPL-2.0-only
2	2	/*
3		− * ip_conntrack_helper_h323_asn1.c - BER and PER decoding library for H.323
4		− * conntrack/NAT module.
	3	+ * BER and PER decoding library for H.323 conntrack/NAT module.
5	4	*
6	5	* Copyright (c) 2006 by Jing Min Zhao <zhaojingmin@users.sourceforge.net>
7	6	*
8		− * See ip_conntrack_helper_h323_asn1.h for details.
	7	+ * See nf_conntrack_helper_h323_asn1.h for details.
9	8	*/
10	9
11	10	#ifdef __KERNEL__

net/netfilter/nf_conntrack_h323_main.c+9−9

@@ -305,8 +305,8 @@ static int expect_rtp_rtcp(struct sk_buff skb, struct nf_conn ct, · 304 unmodified lines
305	305	ret = nat_rtp_rtcp(skb, ct, ctinfo, protoff, data, dataoff,
306	306	taddr, port, rtp_port, rtp_exp, rtcp_exp);
307	307	} else { /* Conntrack only */
308		− if (nf_ct_expect_related(rtp_exp) == 0) {
309		− if (nf_ct_expect_related(rtcp_exp) == 0) {
	308	+ if (nf_ct_expect_related(rtp_exp, 0) == 0) {
	309	+ if (nf_ct_expect_related(rtcp_exp, 0) == 0) {
310	310	pr_debug("nf_ct_h323: expect RTP ");
311	311	nf_ct_dump_tuple(&rtp_exp->tuple);
312	312	pr_debug("nf_ct_h323: expect RTCP ");
@@ -364,7 +364,7 @@ static int expect_t120(struct sk_buff *skb, · 51 unmodified lines
364	364	ret = nat_t120(skb, ct, ctinfo, protoff, data, dataoff, taddr,
365	365	port, exp);
366	366	} else { /* Conntrack only */
367		− if (nf_ct_expect_related(exp) == 0) {
	367	+ if (nf_ct_expect_related(exp, 0) == 0) {
368	368	pr_debug("nf_ct_h323: expect T.120 ");
369	369	nf_ct_dump_tuple(&exp->tuple);
370	370	} else
@@ -701,7 +701,7 @@ static int expect_h245(struct sk_buff skb, struct nf_conn ct, · 330 unmodified lines
701	701	ret = nat_h245(skb, ct, ctinfo, protoff, data, dataoff, taddr,
702	702	port, exp);
703	703	} else { /* Conntrack only */
704		− if (nf_ct_expect_related(exp) == 0) {
	704	+ if (nf_ct_expect_related(exp, 0) == 0) {
705	705	pr_debug("nf_ct_q931: expect H.245 ");
706	706	nf_ct_dump_tuple(&exp->tuple);
707	707	} else
@@ -825,7 +825,7 @@ static int expect_callforwarding(struct sk_buff *skb, · 117 unmodified lines
825	825	protoff, data, dataoff,
826	826	taddr, port, exp);
827	827	} else { /* Conntrack only */
828		− if (nf_ct_expect_related(exp) == 0) {
	828	+ if (nf_ct_expect_related(exp, 0) == 0) {
829	829	pr_debug("nf_ct_q931: expect Call Forwarding ");
830	830	nf_ct_dump_tuple(&exp->tuple);
831	831	} else
@@ -1284,7 +1284,7 @@ static int expect_q931(struct sk_buff skb, struct nf_conn ct, · 452 unmodified lines
1284	1284	ret = nat_q931(skb, ct, ctinfo, protoff, data,
1285	1285	taddr, i, port, exp);
1286	1286	} else { /* Conntrack only */
1287		− if (nf_ct_expect_related(exp) == 0) {
	1287	+ if (nf_ct_expect_related(exp, 0) == 0) {
1288	1288	pr_debug("nf_ct_ras: expect Q.931 ");
1289	1289	nf_ct_dump_tuple(&exp->tuple);
1290	1290
@@ -1349,7 +1349,7 @@ static int process_gcf(struct sk_buff skb, struct nf_conn ct, · 58 unmodified lines
1349	1349	IPPROTO_UDP, NULL, &port);
1350	1350	exp->helper = nf_conntrack_helper_ras;
1351	1351
1352		− if (nf_ct_expect_related(exp) == 0) {
	1352	+ if (nf_ct_expect_related(exp, 0) == 0) {
1353	1353	pr_debug("nf_ct_ras: expect RAS ");
1354	1354	nf_ct_dump_tuple(&exp->tuple);
1355	1355	} else
@@ -1561,7 +1561,7 @@ static int process_acf(struct sk_buff skb, struct nf_conn ct, · 205 unmodified lines
1561	1561	exp->flags = NF_CT_EXPECT_PERMANENT;
1562	1562	exp->helper = nf_conntrack_helper_q931;
1563	1563
1564		− if (nf_ct_expect_related(exp) == 0) {
	1564	+ if (nf_ct_expect_related(exp, 0) == 0) {
1565	1565	pr_debug("nf_ct_ras: expect Q.931 ");
1566	1566	nf_ct_dump_tuple(&exp->tuple);
1567	1567	} else
@@ -1615,7 +1615,7 @@ static int process_lcf(struct sk_buff skb, struct nf_conn ct, · 47 unmodified lines
1615	1615	exp->flags = NF_CT_EXPECT_PERMANENT;
1616	1616	exp->helper = nf_conntrack_helper_q931;
1617	1617
1618		− if (nf_ct_expect_related(exp) == 0) {
	1618	+ if (nf_ct_expect_related(exp, 0) == 0) {
1619	1619	pr_debug("nf_ct_ras: expect Q.931 ");
1620	1620	nf_ct_dump_tuple(&exp->tuple);
1621	1621	} else

net/netfilter/nf_conntrack_irc.c+1−1

@@ -213,7 +213,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, · 212 unmodified lines
213	213	addr_beg_p - ib_ptr,
214	214	addr_end_p - addr_beg_p,
215	215	exp);
216		− else if (nf_ct_expect_related(exp) != 0) {
	216	+ else if (nf_ct_expect_related(exp, 0) != 0) {
217	217	nf_ct_helper_log(skb, ct,
218	218	"cannot add expectation");
219	219	ret = NF_DROP;

net/netfilter/nf_conntrack_netlink.c+2−2

@@ -2616,7 +2616,7 @@ ctnetlink_glue_attach_expect(const struct nlattr attr, struct nf_conn ct, · 2615 unmodified lines
2616	2616	if (IS_ERR(exp))
2617	2617	return PTR_ERR(exp);
2618	2618
2619		− err = nf_ct_expect_related_report(exp, portid, report);
	2619	+ err = nf_ct_expect_related_report(exp, portid, report, 0);
2620	2620	nf_ct_expect_put(exp);
2621	2621	return err;
2622	2622	}
@@ -3367,7 +3367,7 @@ ctnetlink_create_expect(struct net *net, · 744 unmodified lines
3367	3367	goto err_rcu;
3368	3368	}
3369	3369
3370		− err = nf_ct_expect_related_report(exp, portid, report);
	3370	+ err = nf_ct_expect_related_report(exp, portid, report, 0);
3371	3371	nf_ct_expect_put(exp);
3372	3372	err_rcu:
3373	3373	rcu_read_unlock();

net/netfilter/nf_conntrack_pptp.c+2−2

@@ -234,9 +234,9 @@ static int exp_gre(struct nf_conn *ct, __be16 callid, __be16 peer_callid) · 233 unmodified lines
234	234	nf_nat_pptp_exp_gre = rcu_dereference(nf_nat_pptp_hook_exp_gre);
235	235	if (nf_nat_pptp_exp_gre && ct->status & IPS_NAT_MASK)
236	236	nf_nat_pptp_exp_gre(exp_orig, exp_reply);
237		− if (nf_ct_expect_related(exp_orig) != 0)
	237	+ if (nf_ct_expect_related(exp_orig, 0) != 0)
238	238	goto out_put_both;
239		− if (nf_ct_expect_related(exp_reply) != 0)
	239	+ if (nf_ct_expect_related(exp_reply, 0) != 0)
240	240	goto out_unexpect_orig;
241	241
242	242	/* Add GRE keymap entries */

net/netfilter/nf_conntrack_proto_gre.c+0−2

@@ -1,7 +1,5 @@
1	1	// SPDX-License-Identifier: GPL-2.0-only
2	2	/*
3		− * ip_conntrack_proto_gre.c - Version 3.0
4		− *
5	3	* Connection tracking protocol helper module for GRE.
6	4	*
7	5	* GRE is a generic encapsulation protocol, which is generally not very

net/netfilter/nf_conntrack_proto_icmp.c+1−1

@@ -215,7 +215,7 @@ int nf_conntrack_icmpv4_error(struct nf_conn *tmpl, · 214 unmodified lines
215	215	return -NF_ACCEPT;
216	216	}
217	217
218		− /* See ip_conntrack_proto_tcp.c */
	218	+ /* See nf_conntrack_proto_tcp.c */
219	219	if (state->net->ct.sysctl_checksum &&
220	220	state->hook == NF_INET_PRE_ROUTING &&
221	221	nf_ip_checksum(skb, state->hook, dataoff, IPPROTO_ICMP)) {

net/netfilter/nf_conntrack_proto_tcp.c+5−3

@@ -472,6 +472,7 @@ static bool tcp_in_window(const struct nf_conn *ct, · 471 unmodified lines
472	472	struct ip_ct_tcp_state *receiver = &state->seen[!dir];
473	473	const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
474	474	__u32 seq, ack, sack, end, win, swin;
	475	+ u16 win_raw;
475	476	s32 receiver_offset;
476	477	bool res, in_recv_win;
477	478
@@ -480,7 +481,8 @@ static bool tcp_in_window(const struct nf_conn *ct, · 2 unmodified lines
480	481	*/
481	482	seq = ntohl(tcph->seq);
482	483	ack = sack = ntohl(tcph->ack_seq);
483		− win = ntohs(tcph->window);
	484	+ win_raw = ntohs(tcph->window);
	485	+ win = win_raw;
484	486	end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
485	487
486	488	if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
@@ -655,14 +657,14 @@ static bool tcp_in_window(const struct nf_conn *ct, · 168 unmodified lines
655	657	&& state->last_seq == seq
656	658	&& state->last_ack == ack
657	659	&& state->last_end == end
658		− && state->last_win == win)
	660	+ && state->last_win == win_raw)
659	661	state->retrans++;
660	662	else {
661	663	state->last_dir = dir;
662	664	state->last_seq = seq;
663	665	state->last_ack = ack;
664	666	state->last_end = end;
665		− state->last_win = win;
	667	+ state->last_win = win_raw;
666	668	state->retrans = 0;
667	669	}
668	670	}

net/netfilter/nf_conntrack_sane.c+1−1

@@ -153,7 +153,7 @@ static int help(struct sk_buff *skb, · 152 unmodified lines
153	153	nf_ct_dump_tuple(&exp->tuple);
154	154
155	155	/* Can't expect this? Best to drop packet now. */
156		− if (nf_ct_expect_related(exp) != 0) {
	156	+ if (nf_ct_expect_related(exp, 0) != 0) {
157	157	nf_ct_helper_log(skb, ct, "cannot add expectation");
158	158	ret = NF_DROP;
159	159	}

net/netfilter/nf_conntrack_sip.c+7−3

@@ -977,11 +977,15 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff, · 976 unmodified lines
977	977	/* -EALREADY handling works around end-points that send
978	978	* SDP messages with identical port but different media type,
979	979	* we pretend expectation was set up.
	980	+ * It also works in the case that SDP messages are sent with
	981	+ * identical expect tuples but for different master conntracks.
980	982	*/
981		− int errp = nf_ct_expect_related(rtp_exp);
	983	+ int errp = nf_ct_expect_related(rtp_exp,
	984	+ NF_CT_EXP_F_SKIP_MASTER);
982	985
983	986	if (errp == 0 \|\| errp == -EALREADY) {
984		− int errcp = nf_ct_expect_related(rtcp_exp);
	987	+ int errcp = nf_ct_expect_related(rtcp_exp,
	988	+ NF_CT_EXP_F_SKIP_MASTER);
985	989
986	990	if (errcp == 0 \|\| errcp == -EALREADY)
987	991	ret = NF_ACCEPT;
@@ -1296,7 +1300,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff, · 308 unmodified lines
1296	1300	ret = hooks->expect(skb, protoff, dataoff, dptr, datalen,
1297	1301	exp, matchoff, matchlen);
1298	1302	else {
1299		− if (nf_ct_expect_related(exp) != 0) {
	1303	+ if (nf_ct_expect_related(exp, 0) != 0) {
1300	1304	nf_ct_helper_log(skb, ct, "cannot add expectation");
1301	1305	ret = NF_DROP;
1302	1306	} else

net/netfilter/nf_conntrack_tftp.c+1−1

@@ -78,7 +78,7 @@ static int tftp_help(struct sk_buff *skb, · 77 unmodified lines
78	78	nf_nat_tftp = rcu_dereference(nf_nat_tftp_hook);
79	79	if (nf_nat_tftp && ct->status & IPS_NAT_MASK)
80	80	ret = nf_nat_tftp(skb, ctinfo, exp);
81		− else if (nf_ct_expect_related(exp) != 0) {
	81	+ else if (nf_ct_expect_related(exp, 0) != 0) {
82	82	nf_ct_helper_log(skb, ct, "cannot add expectation");
83	83	ret = NF_DROP;
84	84	}

net/netfilter/nf_nat_amanda.c+1−1

@@ -48,7 +48,7 @@ static unsigned int help(struct sk_buff *skb, · 47 unmodified lines
48	48	int res;
49	49
50	50	exp->tuple.dst.u.tcp.port = htons(port);
51		− res = nf_ct_expect_related(exp);
	51	+ res = nf_ct_expect_related(exp, 0);
52	52	if (res == 0)
53	53	break;
54	54	else if (res != -EBUSY) {

net/netfilter/nf_nat_core.c+1−1

@@ -519,7 +519,7 @@ another_round: · 518 unmodified lines
519	519	* and NF_INET_LOCAL_OUT, we change the destination to map into the
520	520	* range. It might not be possible to get a unique tuple, but we try.
521	521	* At worst (or if we race), we will end up with a final duplicate in
522		− * __ip_conntrack_confirm and drop the packet. */
	522	+ * __nf_conntrack_confirm and drop the packet. */
523	523	static void
524	524	get_unique_tuple(struct nf_conntrack_tuple *tuple,
525	525	const struct nf_conntrack_tuple *orig_tuple,

net/netfilter/nf_nat_ftp.c+1−1

@@ -91,7 +91,7 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb, · 90 unmodified lines
91	91	int ret;
92	92
93	93	exp->tuple.dst.u.tcp.port = htons(port);
94		− ret = nf_ct_expect_related(exp);
	94	+ ret = nf_ct_expect_related(exp, 0);
95	95	if (ret == 0)
96	96	break;
97	97	else if (ret != -EBUSY) {

net/netfilter/nf_nat_irc.c+1−1

@@ -53,7 +53,7 @@ static unsigned int help(struct sk_buff *skb, · 52 unmodified lines
53	53	int ret;
54	54
55	55	exp->tuple.dst.u.tcp.port = htons(port);
56		− ret = nf_ct_expect_related(exp);
	56	+ ret = nf_ct_expect_related(exp, 0);
57	57	if (ret == 0)
58	58	break;
59	59	else if (ret != -EBUSY) {

net/netfilter/nf_nat_sip.c+5−3

@@ -414,7 +414,7 @@ static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff, · 413 unmodified lines
414	414	int ret;
415	415
416	416	exp->tuple.dst.u.udp.port = htons(port);
417		− ret = nf_ct_expect_related(exp);
	417	+ ret = nf_ct_expect_related(exp, NF_CT_EXP_F_SKIP_MASTER);
418	418	if (ret == 0)
419	419	break;
420	420	else if (ret != -EBUSY) {
@@ -607,7 +607,8 @@ static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff, · 186 unmodified lines
607	607	int ret;
608	608
609	609	rtp_exp->tuple.dst.u.udp.port = htons(port);
610		− ret = nf_ct_expect_related(rtp_exp);
	610	+ ret = nf_ct_expect_related(rtp_exp,
	611	+ NF_CT_EXP_F_SKIP_MASTER);
611	612	if (ret == -EBUSY)
612	613	continue;
613	614	else if (ret < 0) {
@@ -615,7 +616,8 @@ static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff, · 1 unmodified line
615	616	break;
616	617	}
617	618	rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
618		− ret = nf_ct_expect_related(rtcp_exp);
	619	+ ret = nf_ct_expect_related(rtcp_exp,
	620	+ NF_CT_EXP_F_SKIP_MASTER);
619	621	if (ret == 0)
620	622	break;
621	623	else if (ret == -EBUSY) {

net/netfilter/nf_nat_tftp.c+1−1

@@ -30,7 +30,7 @@ static unsigned int help(struct sk_buff *skb, · 29 unmodified lines
30	30	= ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
31	31	exp->dir = IP_CT_DIR_REPLY;
32	32	exp->expectfn = nf_nat_follow_master;
33		− if (nf_ct_expect_related(exp) != 0) {
	33	+ if (nf_ct_expect_related(exp, 0) != 0) {
34	34	nf_ct_helper_log(skb, exp->master, "cannot add expectation");
35	35	return NF_DROP;
36	36	}

net/netfilter/nf_synproxy_core.c+4−4

@@ -470,7 +470,7 @@ synproxy_send_client_synack(struct net *net, · 469 unmodified lines
470	470	struct iphdr iph, niph;
471	471	struct tcphdr *nth;
472	472	unsigned int tcp_hdr_size;
473		− u16 mss = opts->mss;
	473	+ u16 mss = opts->mss_encode;
474	474
475	475	iph = ip_hdr(skb);
476	476
@@ -687,7 +687,7 @@ ipv4_synproxy_hook(void priv, struct sk_buff skb, · 210 unmodified lines
687	687	state = &ct->proto.tcp;
688	688	switch (state->state) {
689	689	case TCP_CONNTRACK_CLOSE:
690		− if (th->rst && !test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
	690	+ if (th->rst && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
691	691	nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
692	692	ntohl(th->seq) + 1);
693	693	break;
@@ -884,7 +884,7 @@ synproxy_send_client_synack_ipv6(struct net *net, · 190 unmodified lines
884	884	struct ipv6hdr iph, niph;
885	885	struct tcphdr *nth;
886	886	unsigned int tcp_hdr_size;
887		− u16 mss = opts->mss;
	887	+ u16 mss = opts->mss_encode;
888	888
889	889	iph = ipv6_hdr(skb);
890	890
@@ -1111,7 +1111,7 @@ ipv6_synproxy_hook(void priv, struct sk_buff skb, · 220 unmodified lines
1111	1111	state = &ct->proto.tcp;
1112	1112	switch (state->state) {
1113	1113	case TCP_CONNTRACK_CLOSE:
1114		− if (th->rst && !test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
	1114	+ if (th->rst && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
1115	1115	nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
1116	1116	ntohl(th->seq) + 1);
1117	1117	break;

net/netfilter/nf_tables_api.c+2−0

@@ -1900,6 +1900,8 @@ static int nf_tables_newchain(struct net net, struct sock nlsk, · 1899 unmodified lines
1900	1900
1901	1901	if (nla[NFTA_CHAIN_FLAGS])
1902	1902	flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
	1903	+ else if (chain)
	1904	+ flags = chain->flags;
1903	1905
1904	1906	nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
1905	1907

net/netfilter/nfnetlink.c+1−1

@@ -578,7 +578,7 @@ static int nfnetlink_bind(struct net *net, int group) · 577 unmodified lines
578	578	ss = nfnetlink_get_subsys(type << 8);
579	579	rcu_read_unlock();
580	580	if (!ss)
581		− request_module("nfnetlink-subsys-%d", type);
	581	+ request_module_nowait("nfnetlink-subsys-%d", type);
582	582	return 0;
583	583	}
584	584	#endif

net/netfilter/nft_chain_filter.c+1−1

@@ -193,7 +193,7 @@ static inline void nft_chain_filter_inet_init(void) {} · 192 unmodified lines
193	193	static inline void nft_chain_filter_inet_fini(void) {}
194	194	#endif /* CONFIG_NF_TABLES_IPV6 */
195	195
196		−#ifdef CONFIG_NF_TABLES_BRIDGE
	196	+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
197	197	static unsigned int
198	198	nft_do_chain_bridge(void *priv,
199	199	struct sk_buff *skb,

net/netfilter/nft_chain_nat.c+3−0

@@ -142,3 +142,6 @@ MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat"); · 141 unmodified lines
142	142	#ifdef CONFIG_NF_TABLES_IPV6
143	143	MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");
144	144	#endif
	145	+#ifdef CONFIG_NF_TABLES_INET
	146	+MODULE_ALIAS_NFT_CHAIN(1, "nat"); /* NFPROTO_INET */
	147	+#endif

net/netfilter/nft_ct.c+1−1

@@ -1252,7 +1252,7 @@ static void nft_ct_expect_obj_eval(struct nft_object *obj, · 1251 unmodified lines
1252	1252	priv->l4proto, NULL, &priv->dport);
1253	1253	exp->timeout.expires = jiffies + priv->timeout * HZ;
1254	1254
1255		− if (nf_ct_expect_related(exp) != 0)
	1255	+ if (nf_ct_expect_related(exp, 0) != 0)
1256	1256	regs->verdict.code = NF_DROP;
1257	1257	}
1258	1258

net/netfilter/nft_hash.c+1−1

@@ -129,7 +129,7 @@ static int nft_symhash_init(const struct nft_ctx *ctx, · 128 unmodified lines
129	129	priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
130	130
131	131	priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
132		− if (priv->modulus <= 1)
	132	+ if (priv->modulus < 1)
133	133	return -ERANGE;
134	134
135	135	if (priv->offset + priv->modulus - 1 < priv->offset)

net/netfilter/nft_meta.c+1−1

@@ -546,7 +546,7 @@ nft_meta_select_ops(const struct nft_ctx *ctx, · 545 unmodified lines
546	546	if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
547	547	return ERR_PTR(-EINVAL);
548	548
549		−#ifdef CONFIG_NF_TABLES_BRIDGE
	549	+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) && IS_MODULE(CONFIG_NFT_BRIDGE_META)
550	550	if (ctx->family == NFPROTO_BRIDGE)
551	551	return ERR_PTR(-EAGAIN);
552	552	#endif

net/netfilter/nft_redir.c+1−1

@@ -291,4 +291,4 @@ module_exit(nft_redir_module_exit); · 290 unmodified lines
291	291
292	292	MODULE_LICENSE("GPL");
293	293	MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo@debian.org>");
294		−MODULE_ALIAS_NFT_EXPR("nat");
	294	+MODULE_ALIAS_NFT_EXPR("redir");

net/netfilter/nft_synproxy.c+2−0

@@ -31,6 +31,8 @@ static void nft_synproxy_tcp_options(struct synproxy_options *opts, · 30 unmodified lines
31	31	opts->options \|= NF_SYNPROXY_OPT_ECN;
32	32
33	33	opts->options &= priv->info.options;
	34	+ opts->mss_encode = opts->mss;
	35	+ opts->mss = info->mss;
34	36	if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
35	37	synproxy_init_timestamp_cookie(info, opts);
36	38	else