lael-labs/linux

include/net/ip_vs.h+17−0

@@ -791,6 +791,7 @@ struct ip_vs_app { · 790 unmodified lines
791	/* IPVS in network namespace */	791	/* IPVS in network namespace */
792	struct netns_ipvs {	792	struct netns_ipvs {
793	int gen; /* Generation */	793	int gen; /* Generation */
		794	int enable; /* enable like nf_hooks do */
794	/*	795	/*
795	* Hash table: for real service lookups	796	* Hash table: for real service lookups
796	*/	797	*/
@@ -1089,6 +1090,22 @@ ip_vs_control_add(struct ip_vs_conn cp, struct ip_vs_conn ctl_cp) · 292 unmodified lines
1089	atomic_inc(&ctl_cp->n_control);	1090	atomic_inc(&ctl_cp->n_control);
1090	}	1091	}
1091		1092
		1093	/*
		1094	* IPVS netns init & cleanup functions
		1095	*/
		1096	extern int __ip_vs_estimator_init(struct net *net);
		1097	extern int __ip_vs_control_init(struct net *net);
		1098	extern int __ip_vs_protocol_init(struct net *net);
		1099	extern int __ip_vs_app_init(struct net *net);
		1100	extern int __ip_vs_conn_init(struct net *net);
		1101	extern int __ip_vs_sync_init(struct net *net);
		1102	extern void __ip_vs_conn_cleanup(struct net *net);
		1103	extern void __ip_vs_app_cleanup(struct net *net);
		1104	extern void __ip_vs_protocol_cleanup(struct net *net);
		1105	extern void __ip_vs_control_cleanup(struct net *net);
		1106	extern void __ip_vs_estimator_cleanup(struct net *net);
		1107	extern void __ip_vs_sync_cleanup(struct net *net);
		1108	extern void __ip_vs_service_cleanup(struct net *net);
1092		1109
1093	/*	1110	/*
1094	* IPVS application functions	1111	* IPVS application functions

net/bridge/netfilter/ebtables.c+11−53

@@ -1766,7 +1766,7 @@ static int compat_table_info(const struct ebt_table_info *info, · 1765 unmodified lines
1766		1766
1767	newinfo->entries_size = size;	1767	newinfo->entries_size = size;
1768		1768
1769	xt_compat_init_offsets(AF_INET, info->nentries);	1769	xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
1770	return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,	1770	return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1771	entries, newinfo);	1771	entries, newinfo);
1772	}	1772	}
@@ -1882,7 +1882,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, · 109 unmodified lines
1882	struct xt_match *match;	1882	struct xt_match *match;
1883	struct xt_target *wt;	1883	struct xt_target *wt;
1884	void *dst = NULL;	1884	void *dst = NULL;
1885	int off, pad = 0, ret = 0;	1885	int off, pad = 0;
1886	unsigned int size_kern, entry_offset, match_size = mwt->match_size;	1886	unsigned int size_kern, entry_offset, match_size = mwt->match_size;
1887		1887
1888	strlcpy(name, mwt->u.name, sizeof(name));	1888	strlcpy(name, mwt->u.name, sizeof(name));
@@ -1935,13 +1935,6 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, · 46 unmodified lines
1935	break;	1935	break;
1936	}	1936	}
1937		1937
1938	if (!dst) {
1939	ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
1940	off + ebt_compat_entry_padsize());
1941	if (ret < 0)
1942	return ret;
1943	}
1944
1945	state->buf_kern_offset += match_size + off;	1938	state->buf_kern_offset += match_size + off;
1946	state->buf_user_offset += match_size;	1939	state->buf_user_offset += match_size;
1947	pad = XT_ALIGN(size_kern) - size_kern;	1940	pad = XT_ALIGN(size_kern) - size_kern;
@@ -2016,50 +2009,6 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, · 68 unmodified lines
2016	return growth;	2009	return growth;
2017	}	2010	}
2018		2011
2019	#define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...) \
2020	({ \
2021	unsigned int __i; \
2022	int __ret = 0; \
2023	struct compat_ebt_entry_mwt *__watcher; \
2024	\
2025	for (__i = e->watchers_offset; \
2026	__i < (e)->target_offset; \
2027	__i += __watcher->watcher_size + \
2028	sizeof(struct compat_ebt_entry_mwt)) { \
2029	__watcher = (void *)(e) + __i; \
2030	__ret = fn(__watcher , ## args); \
2031	if (__ret != 0) \
2032	break; \
2033	} \
2034	if (__ret == 0) { \
2035	if (__i != (e)->target_offset) \
2036	__ret = -EINVAL; \
2037	} \
2038	__ret; \
2039	})
2040
2041	#define EBT_COMPAT_MATCH_ITERATE(e, fn, args...) \
2042	({ \
2043	unsigned int __i; \
2044	int __ret = 0; \
2045	struct compat_ebt_entry_mwt *__match; \
2046	\
2047	for (__i = sizeof(struct ebt_entry); \
2048	__i < (e)->watchers_offset; \
2049	__i += __match->match_size + \
2050	sizeof(struct compat_ebt_entry_mwt)) { \
2051	__match = (void *)(e) + __i; \
2052	__ret = fn(__match , ## args); \
2053	if (__ret != 0) \
2054	break; \
2055	} \
2056	if (__ret == 0) { \
2057	if (__i != (e)->watchers_offset) \
2058	__ret = -EINVAL; \
2059	} \
2060	__ret; \
2061	})
2062
2063	/* called for all ebt_entry structures. */	2012	/* called for all ebt_entry structures. */
2064	static int size_entry_mwt(struct ebt_entry entry, const unsigned char base,	2013	static int size_entry_mwt(struct ebt_entry entry, const unsigned char base,
2065	unsigned int *total,	2014	unsigned int *total,
@@ -2132,6 +2081,14 @@ static int size_entry_mwt(struct ebt_entry entry, const unsigned char base, · 66 unmodified lines
2132	}	2081	}
2133	}	2082	}
2134		2083
		2084	if (state->buf_kern_start == NULL) {
		2085	unsigned int offset = buf_start - (char *) base;
		2086
		2087	ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
		2088	if (ret < 0)
		2089	return ret;
		2090	}
		2091
2135	startoff = state->buf_user_offset - startoff;	2092	startoff = state->buf_user_offset - startoff;
2136		2093
2137	BUG_ON(*total < startoff);	2094	BUG_ON(*total < startoff);
@@ -2240,6 +2197,7 @@ static int compat_do_replace(struct net net, void __user user, · 102 unmodified lines
2240		2197
2241	xt_compat_lock(NFPROTO_BRIDGE);	2198	xt_compat_lock(NFPROTO_BRIDGE);
2242		2199
		2200	xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
2243	ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);	2201	ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2244	if (ret < 0)	2202	if (ret < 0)
2245	goto out_unlock;	2203	goto out_unlock;

net/ipv6/netfilter/ip6t_REJECT.c+3−1

 	int tcphoff, needs_ack;
 	const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
 	struct ipv6hdr *ip6h;
+#define DEFAULT_TOS_VALUE	0x0U
+	const __u8 tclass = DEFAULT_TOS_VALUE;
 	struct dst_entry *dst = NULL;
 	u8 proto;
 	struct flowi6 fl6;
 	skb_put(nskb, sizeof(struct ipv6hdr));
 	skb_reset_network_header(nskb);
 	ip6h = ipv6_hdr(nskb);
-	ip6h->version = 6;
+	*(__be32 *)ip6h =  htonl(0x60000000 | (tclass << 20));
 	ip6h->hop_limit = ip6_dst_hoplimit(dst);
 	ip6h->nexthdr = IPPROTO_TCP;
 	ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);

net/netfilter/ipvs/ip_vs_app.c+3−12

 };
 #endif
-static int __net_init __ip_vs_app_init(struct net *net)
+int __net_init __ip_vs_app_init(struct net *net)
 {
 	struct netns_ipvs *ipvs = net_ipvs(net);
 	return 0;
 }
-static void __net_exit __ip_vs_app_cleanup(struct net *net)
+void __net_exit __ip_vs_app_cleanup(struct net *net)
 {
 	proc_net_remove(net, "ip_vs_app");
 }
-static struct pernet_operations ip_vs_app_ops = {
-	.init = __ip_vs_app_init,
-	.exit = __ip_vs_app_cleanup,
-};
 int __init ip_vs_app_init(void)
 {
-	int rv;
+	return 0;
-	rv = register_pernet_subsys(&ip_vs_app_ops);
-	return rv;
 }
 void ip_vs_app_cleanup(void)
 {
-	unregister_pernet_subsys(&ip_vs_app_ops);
 }

net/netfilter/ipvs/ip_vs_conn.c+2−10

 	return 0;
 }
-static void __net_exit __ip_vs_conn_cleanup(struct net *net)
+void __net_exit __ip_vs_conn_cleanup(struct net *net)
 {
 	/* flush all the connection entries first */
 	ip_vs_conn_flush(net);
 	proc_net_remove(net, "ip_vs_conn");
 	proc_net_remove(net, "ip_vs_conn_sync");
 }
-static struct pernet_operations ipvs_conn_ops = {
-	.init = __ip_vs_conn_init,
-	.exit = __ip_vs_conn_cleanup,
-};
 int __init ip_vs_conn_init(void)
 {
 	int idx;
-	int retc;
 	/* Compute size and mask */
 	ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
 		rwlock_init(&__ip_vs_conntbl_lock_array[idx].l);
 	}
-	retc = register_pernet_subsys(&ipvs_conn_ops);
 	/* calculate the random value for connection hash */
 	get_random_bytes(&ip_vs_conn_rnd, sizeof(ip_vs_conn_rnd));
-	return retc;
+	return 0;
 }
 void ip_vs_conn_cleanup(void)
 {
-	unregister_pernet_subsys(&ipvs_conn_ops);
 	/* Release the empty cache */
 	kmem_cache_destroy(ip_vs_conn_cachep);
 	vfree(ip_vs_conn_tab);

net/netfilter/ipvs/ip_vs_core.c+93−10

 		return NF_ACCEPT;
 	net = skb_net(skb);
+	if (!net_ipvs(net)->enable)
+		return NF_ACCEPT;
 	ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 #ifdef CONFIG_IP_VS_IPV6
 	if (af == AF_INET6) {
 		return NF_ACCEPT; /* The packet looks wrong, ignore */
 	net = skb_net(skb);
 	pd = ip_vs_proto_data_get(net, cih->protocol);
 	if (!pd)
 		return NF_ACCEPT;
 			      IP_VS_DBG_ADDR(af, &iph.daddr), hooknum);
 		return NF_ACCEPT;
 	}
+	/* ipvs enabled in this netns ? */
+	net = skb_net(skb);
+	if (!net_ipvs(net)->enable)
+		return NF_ACCEPT;
 	ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 	/* Bad... Do not break raw sockets */
 			ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 		}
-	net = skb_net(skb);
 	/* Protocol supported? */
 	pd = ip_vs_proto_data_get(net, iph.protocol);
 	if (unlikely(!pd))
 	}
 	IP_VS_DBG_PKT(11, af, pp, skb, 0, "Incoming packet");
-	net = skb_net(skb);
 	ipvs = net_ipvs(net);
 	/* Check the server status */
 	if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
 		   int (*okfn)(struct sk_buff *))
 {
 	int r;
+	struct net *net;
 	if (ip_hdr(skb)->protocol != IPPROTO_ICMP)
 		return NF_ACCEPT;
+	/* ipvs enabled in this netns ? */
+	net = skb_net(skb);
+	if (!net_ipvs(net)->enable)
+		return NF_ACCEPT;
 	return ip_vs_in_icmp(skb, &r, hooknum);
 }
 		      int (*okfn)(struct sk_buff *))
 {
 	int r;
+	struct net *net;
 	if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
 		return NF_ACCEPT;
+	/* ipvs enabled in this netns ? */
+	net = skb_net(skb);
+	if (!net_ipvs(net)->enable)
+		return NF_ACCEPT;
 	return ip_vs_in_icmp_v6(skb, &r, hooknum);
 }
 #endif
 		pr_err("%s(): no memory.\n", __func__);
 		return -ENOMEM;
 	}
+	/* Hold the beast until a service is registerd */
+	ipvs->enable = 0;
 	ipvs->net = net;
 	/* Counters used for creating unique names */
 	ipvs->gen = atomic_read(&ipvs_netns_cnt);
 	atomic_inc(&ipvs_netns_cnt);
 	net->ipvs = ipvs;
+	if (__ip_vs_estimator_init(net) < 0)
+		goto estimator_fail;
+	if (__ip_vs_control_init(net) < 0)
+		goto control_fail;
+	if (__ip_vs_protocol_init(net) < 0)
+		goto protocol_fail;
+	if (__ip_vs_app_init(net) < 0)
+		goto app_fail;
+	if (__ip_vs_conn_init(net) < 0)
+		goto conn_fail;
+	if (__ip_vs_sync_init(net) < 0)
+		goto sync_fail;
 	printk(KERN_INFO "IPVS: Creating netns size=%zu id=%d\n",
 			 sizeof(struct netns_ipvs), ipvs->gen);
 	return 0;
+/*
+ * Error handling
+ */
+sync_fail:
+	__ip_vs_conn_cleanup(net);
+conn_fail:
+	__ip_vs_app_cleanup(net);
+app_fail:
+	__ip_vs_protocol_cleanup(net);
+protocol_fail:
+	__ip_vs_control_cleanup(net);
+control_fail:
+	__ip_vs_estimator_cleanup(net);
+estimator_fail:
+	return -ENOMEM;
 }
 static void __net_exit __ip_vs_cleanup(struct net *net)
 {
-	IP_VS_DBG(10, "ipvs netns %d released\n", net_ipvs(net)->gen);
+	__ip_vs_service_cleanup(net);	/* ip_vs_flush() with locks */
+	__ip_vs_conn_cleanup(net);
+	__ip_vs_app_cleanup(net);
+	__ip_vs_protocol_cleanup(net);
+	__ip_vs_control_cleanup(net);
+	__ip_vs_estimator_cleanup(net);
+	IP_VS_DBG(2, "ipvs netns %d released\n", net_ipvs(net)->gen);
+}
+static void __net_exit __ip_vs_dev_cleanup(struct net *net)
+{
+	EnterFunction(2);
+	net_ipvs(net)->enable = 0;	/* Disable packet reception */
+	__ip_vs_sync_cleanup(net);
+	LeaveFunction(2);
 }
 static struct pernet_operations ipvs_core_ops = {
 	.size = sizeof(struct netns_ipvs),
 };
+static struct pernet_operations ipvs_core_dev_ops = {
+	.exit = __ip_vs_dev_cleanup,
+};
 /*
  *	Initialize IP Virtual Server
  */
 {
 	int ret;
-	ret = register_pernet_subsys(&ipvs_core_ops);	/* Alloc ip_vs struct */
-	if (ret < 0)
-		return ret;
 	ip_vs_estimator_init();
 	ret = ip_vs_control_init();
 	if (ret < 0) {
 		goto cleanup_conn;
 	}
+	ret = register_pernet_subsys(&ipvs_core_ops);	/* Alloc ip_vs struct */
+	if (ret < 0)
+		goto cleanup_sync;
+	ret = register_pernet_device(&ipvs_core_dev_ops);
+	if (ret < 0)
+		goto cleanup_sub;
 	ret = nf_register_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
 	if (ret < 0) {
 		pr_err("can't register hooks.\n");
-		goto cleanup_sync;
+		goto cleanup_dev;
 	}
 	pr_info("ipvs loaded.\n");
 	return ret;
+cleanup_dev:
+	unregister_pernet_device(&ipvs_core_dev_ops);
+cleanup_sub:
+	unregister_pernet_subsys(&ipvs_core_ops);
 cleanup_sync:
 	ip_vs_sync_cleanup();
   cleanup_conn:
 	ip_vs_control_cleanup();
   cleanup_estimator:
 	ip_vs_estimator_cleanup();
-	unregister_pernet_subsys(&ipvs_core_ops);	/* free ip_vs struct */
 	return ret;
 }
 static void __exit ip_vs_cleanup(void)
 {
 	nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+	unregister_pernet_device(&ipvs_core_dev_ops);
+	unregister_pernet_subsys(&ipvs_core_ops);	/* free ip_vs struct */
 	ip_vs_sync_cleanup();
 	ip_vs_conn_cleanup();
 	ip_vs_app_cleanup();
 	ip_vs_protocol_cleanup();
 	ip_vs_control_cleanup();
 	ip_vs_estimator_cleanup();
-	unregister_pernet_subsys(&ipvs_core_ops);	/* free ip_vs struct */
 	pr_info("ipvs unloaded.\n");
 }

net/netfilter/ipvs/ip_vs_ctl.c+101−19

@@ -69,6 +69,11 @@ int ip_vs_get_debug_level(void) · 68 unmodified lines
69	}	69	}
70	#endif	70	#endif
71		71
		72
		73	/* Protos */
		74	static void __ip_vs_del_service(struct ip_vs_service *svc);
		75
		76
72	#ifdef CONFIG_IP_VS_IPV6	77	#ifdef CONFIG_IP_VS_IPV6
73	/* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */	78	/* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
74	static int __ip_vs_addr_is_local_v6(struct net *net,	79	static int __ip_vs_addr_is_local_v6(struct net *net,
@@ -1214,6 +1219,8 @@ ip_vs_add_service(struct net net, struct ip_vs_service_user_kern u, · 1139 unmodified lines
1214	write_unlock_bh(&__ip_vs_svc_lock);	1219	write_unlock_bh(&__ip_vs_svc_lock);
1215		1220
1216	*svc_p = svc;	1221	*svc_p = svc;
		1222	/* Now there is a service - full throttle */
		1223	ipvs->enable = 1;
1217	return 0;	1224	return 0;
1218		1225
1219		1226
@@ -1472,6 +1479,84 @@ static int ip_vs_flush(struct net *net) · 252 unmodified lines
1472	return 0;	1479	return 0;
1473	}	1480	}
1474		1481
		1482	/*
		1483	* Delete service by {netns} in the service table.
		1484	* Called by __ip_vs_cleanup()
		1485	*/
		1486	void __ip_vs_service_cleanup(struct net *net)
		1487	{
		1488	EnterFunction(2);
		1489	/* Check for "full" addressed entries */
		1490	mutex_lock(&__ip_vs_mutex);
		1491	ip_vs_flush(net);
		1492	mutex_unlock(&__ip_vs_mutex);
		1493	LeaveFunction(2);
		1494	}
		1495	/*
		1496	* Release dst hold by dst_cache
		1497	*/
		1498	static inline void
		1499	__ip_vs_dev_reset(struct ip_vs_dest dest, struct net_device dev)
		1500	{
		1501	spin_lock_bh(&dest->dst_lock);
		1502	if (dest->dst_cache && dest->dst_cache->dev == dev) {
		1503	IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
		1504	dev->name,
		1505	IP_VS_DBG_ADDR(dest->af, &dest->addr),
		1506	ntohs(dest->port),
		1507	atomic_read(&dest->refcnt));
		1508	ip_vs_dst_reset(dest);
		1509	}
		1510	spin_unlock_bh(&dest->dst_lock);
		1511
		1512	}
		1513	/*
		1514	* Netdev event receiver
		1515	* Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
		1516	* a device that is "unregister" it must be released.
		1517	*/
		1518	static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
		1519	void *ptr)
		1520	{
		1521	struct net_device *dev = ptr;
		1522	struct net *net = dev_net(dev);
		1523	struct ip_vs_service *svc;
		1524	struct ip_vs_dest *dest;
		1525	unsigned int idx;
		1526
		1527	if (event != NETDEV_UNREGISTER)
		1528	return NOTIFY_DONE;
		1529	IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
		1530	EnterFunction(2);
		1531	mutex_lock(&__ip_vs_mutex);
		1532	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
		1533	list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
		1534	if (net_eq(svc->net, net)) {
		1535	list_for_each_entry(dest, &svc->destinations,
		1536	n_list) {
		1537	__ip_vs_dev_reset(dest, dev);
		1538	}
		1539	}
		1540	}
		1541
		1542	list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
		1543	if (net_eq(svc->net, net)) {
		1544	list_for_each_entry(dest, &svc->destinations,
		1545	n_list) {
		1546	__ip_vs_dev_reset(dest, dev);
		1547	}
		1548	}
		1549
		1550	}
		1551	}
		1552
		1553	list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) {
		1554	__ip_vs_dev_reset(dest, dev);
		1555	}
		1556	mutex_unlock(&__ip_vs_mutex);
		1557	LeaveFunction(2);
		1558	return NOTIFY_DONE;
		1559	}
1475		1560
1476	/*	1561	/*
1477	* Zero counters in a service or all services	1562	* Zero counters in a service or all services
@@ -3588,6 +3673,10 @@ void __net_init __ip_vs_control_cleanup_sysctl(struct net *net) { } · 2110 unmodified lines
3588		3673
3589	#endif	3674	#endif
3590		3675
		3676	static struct notifier_block ip_vs_dst_notifier = {
		3677	.notifier_call = ip_vs_dst_event,
		3678	};
		3679
3591	int __net_init __ip_vs_control_init(struct net *net)	3680	int __net_init __ip_vs_control_init(struct net *net)
3592	{	3681	{
3593	int idx;	3682	int idx;
@@ -3626,7 +3715,7 @@ err: · 32 unmodified lines
3626	return -ENOMEM;	3715	return -ENOMEM;
3627	}	3716	}
3628		3717
3629	static void __net_exit __ip_vs_control_cleanup(struct net *net)	3718	void __net_exit __ip_vs_control_cleanup(struct net *net)
3630	{	3719	{
3631	struct netns_ipvs *ipvs = net_ipvs(net);	3720	struct netns_ipvs *ipvs = net_ipvs(net);
3632		3721
@@ -3639,11 +3728,6 @@ static void __net_exit __ip_vs_control_cleanup(struct net *net) · 6 unmodified lines
3639	free_percpu(ipvs->tot_stats.cpustats);	3728	free_percpu(ipvs->tot_stats.cpustats);
3640	}	3729	}
3641		3730
3642	static struct pernet_operations ipvs_control_ops = {
3643	.init = __ip_vs_control_init,
3644	.exit = __ip_vs_control_cleanup,
3645	};
3646
3647	int __init ip_vs_control_init(void)	3731	int __init ip_vs_control_init(void)
3648	{	3732	{
3649	int idx;	3733	int idx;
@@ -3657,33 +3741,32 @@ int __init ip_vs_control_init(void) · 7 unmodified lines
3657	INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);	3741	INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3658	}	3742	}
3659		3743
3660	ret = register_pernet_subsys(&ipvs_control_ops);
3661	if (ret) {
3662	pr_err("cannot register namespace.\n");
3663	goto err;
3664	}
3665
3666	smp_wmb(); /* Do we really need it now ? */	3744	smp_wmb(); /* Do we really need it now ? */
3667		3745
3668	ret = nf_register_sockopt(&ip_vs_sockopts);	3746	ret = nf_register_sockopt(&ip_vs_sockopts);
3669	if (ret) {	3747	if (ret) {
3670	pr_err("cannot register sockopt.\n");	3748	pr_err("cannot register sockopt.\n");
3671	goto err_net;	3749	goto err_sock;
3672	}	3750	}
3673		3751
3674	ret = ip_vs_genl_register();	3752	ret = ip_vs_genl_register();
3675	if (ret) {	3753	if (ret) {
3676	pr_err("cannot register Generic Netlink interface.\n");	3754	pr_err("cannot register Generic Netlink interface.\n");
3677	nf_unregister_sockopt(&ip_vs_sockopts);	3755	goto err_genl;
3678	goto err_net;
3679	}	3756	}
3680		3757
		3758	ret = register_netdevice_notifier(&ip_vs_dst_notifier);
		3759	if (ret < 0)
		3760	goto err_notf;
		3761
3681	LeaveFunction(2);	3762	LeaveFunction(2);
3682	return 0;	3763	return 0;
3683		3764
3684	err_net:	3765	err_notf:
3685	unregister_pernet_subsys(&ipvs_control_ops);	3766	ip_vs_genl_unregister();
3686	err:	3767	err_genl:
		3768	nf_unregister_sockopt(&ip_vs_sockopts);
		3769	err_sock:
3687	return ret;	3770	return ret;
3688	}	3771	}
3689		3772
@@ -3691,7 +3774,6 @@ err: · 1 unmodified line
3691	void ip_vs_control_cleanup(void)	3774	void ip_vs_control_cleanup(void)
3692	{	3775	{
3693	EnterFunction(2);	3776	EnterFunction(2);
3694	unregister_pernet_subsys(&ipvs_control_ops);
3695	ip_vs_genl_unregister();	3777	ip_vs_genl_unregister();
3696	nf_unregister_sockopt(&ip_vs_sockopts);	3778	nf_unregister_sockopt(&ip_vs_sockopts);
3697	LeaveFunction(2);	3779	LeaveFunction(2);

net/netfilter/ipvs/ip_vs_est.c+3−11

 	dst->outbps = (e->outbps + 0xF) >> 5;
 }
-static int __net_init __ip_vs_estimator_init(struct net *net)
+int __net_init __ip_vs_estimator_init(struct net *net)
 {
 	struct netns_ipvs *ipvs = net_ipvs(net);
 	return 0;
 }
-static void __net_exit __ip_vs_estimator_exit(struct net *net)
+void __net_exit __ip_vs_estimator_cleanup(struct net *net)
 {
 	del_timer_sync(&net_ipvs(net)->est_timer);
 }
-static struct pernet_operations ip_vs_app_ops = {
-	.init = __ip_vs_estimator_init,
-	.exit = __ip_vs_estimator_exit,
-};
 int __init ip_vs_estimator_init(void)
 {
-	int rv;
+	return 0;
-	rv = register_pernet_subsys(&ip_vs_app_ops);
-	return rv;
 }
 void ip_vs_estimator_cleanup(void)
 {
-	unregister_pernet_subsys(&ip_vs_app_ops);
 }

net/netfilter/ipvs/ip_vs_proto.c+2−9

 /*
  * per network name-space init
  */
-static int __net_init __ip_vs_protocol_init(struct net *net)
+int __net_init __ip_vs_protocol_init(struct net *net)
 {
 #ifdef CONFIG_IP_VS_PROTO_TCP
 	register_ip_vs_proto_netns(net, &ip_vs_protocol_tcp);
 	return 0;
 }
-static void __net_exit __ip_vs_protocol_cleanup(struct net *net)
+void __net_exit __ip_vs_protocol_cleanup(struct net *net)
 {
 	struct netns_ipvs *ipvs = net_ipvs(net);
 	struct ip_vs_proto_data *pd;
 	}
 }
-static struct pernet_operations ipvs_proto_ops = {
-	.init = __ip_vs_protocol_init,
-	.exit = __ip_vs_protocol_cleanup,
-};
 int __init ip_vs_protocol_init(void)
 {
 	char protocols[64];
 	REGISTER_PROTOCOL(&ip_vs_protocol_esp);
 #endif
 	pr_info("Registered protocols (%s)\n", &protocols[2]);
-	return register_pernet_subsys(&ipvs_proto_ops);
 	return 0;
 }
 	struct ip_vs_protocol *pp;
 	int i;
-	unregister_pernet_subsys(&ipvs_proto_ops);
 	/* unregister all the ipvs protocols */
 	for (i = 0; i < IP_VS_PROTO_TAB_SIZE; i++) {
 		while ((pp = ip_vs_proto_table[i]) != NULL)

net/netfilter/ipvs/ip_vs_sync.c+37−28

@@ -1303,13 +1303,18 @@ static struct socket make_send_sock(struct net net) · 1302 unmodified lines
1303	struct socket *sock;	1303	struct socket *sock;
1304	int result;	1304	int result;
1305		1305
1306	/* First create a socket */	1306	/* First create a socket move it to right name space later */
1307	result = __sock_create(net, PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock, 1);	1307	result = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock);
1308	if (result < 0) {	1308	if (result < 0) {
1309	pr_err("Error during creation of socket; terminating\n");	1309	pr_err("Error during creation of socket; terminating\n");
1310	return ERR_PTR(result);	1310	return ERR_PTR(result);
1311	}	1311	}
1312		1312	/*
		1313	* Kernel sockets that are a part of a namespace, should not
		1314	* hold a reference to a namespace in order to allow to stop it.
		1315	* After sk_change_net should be released using sk_release_kernel.
		1316	*/
		1317	sk_change_net(sock->sk, net);
1313	result = set_mcast_if(sock->sk, ipvs->master_mcast_ifn);	1318	result = set_mcast_if(sock->sk, ipvs->master_mcast_ifn);
1314	if (result < 0) {	1319	if (result < 0) {
1315	pr_err("Error setting outbound mcast interface\n");	1320	pr_err("Error setting outbound mcast interface\n");
@@ -1334,8 +1339,8 @@ static struct socket make_send_sock(struct net net) · 18 unmodified lines
1334		1339
1335	return sock;	1340	return sock;
1336		1341
1337	error:	1342	error:
1338	sock_release(sock);	1343	sk_release_kernel(sock->sk);
1339	return ERR_PTR(result);	1344	return ERR_PTR(result);
1340	}	1345	}
1341		1346
@@ -1350,12 +1355,17 @@ static struct socket make_receive_sock(struct net net) · 8 unmodified lines
1350	int result;	1355	int result;
1351		1356
1352	/* First create a socket */	1357	/* First create a socket */
1353	result = __sock_create(net, PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock, 1);	1358	result = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock);
1354	if (result < 0) {	1359	if (result < 0) {
1355	pr_err("Error during creation of socket; terminating\n");	1360	pr_err("Error during creation of socket; terminating\n");
1356	return ERR_PTR(result);	1361	return ERR_PTR(result);
1357	}	1362	}
1358		1363	/*
		1364	* Kernel sockets that are a part of a namespace, should not
		1365	* hold a reference to a namespace in order to allow to stop it.
		1366	* After sk_change_net should be released using sk_release_kernel.
		1367	*/
		1368	sk_change_net(sock->sk, net);
1359	/* it is equivalent to the REUSEADDR option in user-space */	1369	/* it is equivalent to the REUSEADDR option in user-space */
1360	sock->sk->sk_reuse = 1;	1370	sock->sk->sk_reuse = 1;
1361		1371
@@ -1377,8 +1387,8 @@ static struct socket make_receive_sock(struct net net) · 15 unmodified lines
1377		1387
1378	return sock;	1388	return sock;
1379		1389
1380	error:	1390	error:
1381	sock_release(sock);	1391	sk_release_kernel(sock->sk);
1382	return ERR_PTR(result);	1392	return ERR_PTR(result);
1383	}	1393	}
1384		1394
@@ -1473,7 +1483,7 @@ static int sync_thread_master(void *data) · 88 unmodified lines
1473	ip_vs_sync_buff_release(sb);	1483	ip_vs_sync_buff_release(sb);
1474		1484
1475	/* release the sending multicast socket */	1485	/* release the sending multicast socket */
1476	sock_release(tinfo->sock);	1486	sk_release_kernel(tinfo->sock->sk);
1477	kfree(tinfo);	1487	kfree(tinfo);
1478		1488
1479	return 0;	1489	return 0;
@@ -1513,7 +1523,7 @@ static int sync_thread_backup(void *data) · 33 unmodified lines
1513	}	1523	}
1514		1524
1515	/* release the sending multicast socket */	1525	/* release the sending multicast socket */
1516	sock_release(tinfo->sock);	1526	sk_release_kernel(tinfo->sock->sk);
1517	kfree(tinfo->buf);	1527	kfree(tinfo->buf);
1518	kfree(tinfo);	1528	kfree(tinfo);
1519		1529
@@ -1601,7 +1611,7 @@ outtinfo: · 81 unmodified lines
1601	outbuf:	1611	outbuf:
1602	kfree(buf);	1612	kfree(buf);
1603	outsocket:	1613	outsocket:
1604	sock_release(sock);	1614	sk_release_kernel(sock->sk);
1605	out:	1615	out:
1606	return result;	1616	return result;
1607	}	1617	}
@@ -1610,6 +1620,7 @@ out: · 2 unmodified lines
1610	int stop_sync_thread(struct net *net, int state)	1620	int stop_sync_thread(struct net *net, int state)
1611	{	1621	{
1612	struct netns_ipvs *ipvs = net_ipvs(net);	1622	struct netns_ipvs *ipvs = net_ipvs(net);
		1623	int retc = -EINVAL;
1613		1624
1614	IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));	1625	IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
1615		1626
@@ -1629,7 +1640,7 @@ int stop_sync_thread(struct net *net, int state) · 13 unmodified lines
1629	spin_lock_bh(&ipvs->sync_lock);	1640	spin_lock_bh(&ipvs->sync_lock);
1630	ipvs->sync_state &= ~IP_VS_STATE_MASTER;	1641	ipvs->sync_state &= ~IP_VS_STATE_MASTER;
1631	spin_unlock_bh(&ipvs->sync_lock);	1642	spin_unlock_bh(&ipvs->sync_lock);
1632	kthread_stop(ipvs->master_thread);	1643	retc = kthread_stop(ipvs->master_thread);
1633	ipvs->master_thread = NULL;	1644	ipvs->master_thread = NULL;
1634	} else if (state == IP_VS_STATE_BACKUP) {	1645	} else if (state == IP_VS_STATE_BACKUP) {
1635	if (!ipvs->backup_thread)	1646	if (!ipvs->backup_thread)
@@ -1639,22 +1650,20 @@ int stop_sync_thread(struct net *net, int state) · 3 unmodified lines
1639	task_pid_nr(ipvs->backup_thread));	1650	task_pid_nr(ipvs->backup_thread));
1640		1651
1641	ipvs->sync_state &= ~IP_VS_STATE_BACKUP;	1652	ipvs->sync_state &= ~IP_VS_STATE_BACKUP;
1642	kthread_stop(ipvs->backup_thread);	1653	retc = kthread_stop(ipvs->backup_thread);
1643	ipvs->backup_thread = NULL;	1654	ipvs->backup_thread = NULL;
1644	} else {
1645	return -EINVAL;
1646	}	1655	}
1647		1656
1648	/* decrease the module use count */	1657	/* decrease the module use count */
1649	ip_vs_use_count_dec();	1658	ip_vs_use_count_dec();
1650		1659
1651	return 0;	1660	return retc;
1652	}	1661	}
1653		1662
1654	/*	1663	/*
1655	* Initialize data struct for each netns	1664	* Initialize data struct for each netns
1656	*/	1665	*/
1657	static int __net_init __ip_vs_sync_init(struct net *net)	1666	int __net_init __ip_vs_sync_init(struct net *net)
1658	{	1667	{
1659	struct netns_ipvs *ipvs = net_ipvs(net);	1668	struct netns_ipvs *ipvs = net_ipvs(net);
1660		1669
@@ -1668,24 +1677,24 @@ static int __net_init __ip_vs_sync_init(struct net *net) · 7 unmodified lines
1668	return 0;	1677	return 0;
1669	}	1678	}
1670		1679
1671	static void __ip_vs_sync_cleanup(struct net *net)	1680	void __ip_vs_sync_cleanup(struct net *net)
1672	{	1681	{
1673	stop_sync_thread(net, IP_VS_STATE_MASTER);	1682	int retc;
1674	stop_sync_thread(net, IP_VS_STATE_BACKUP);
1675	}
1676		1683
1677	static struct pernet_operations ipvs_sync_ops = {	1684	retc = stop_sync_thread(net, IP_VS_STATE_MASTER);
1678	.init = __ip_vs_sync_init,	1685	if (retc && retc != -ESRCH)
1679	.exit = __ip_vs_sync_cleanup,	1686	pr_err("Failed to stop Master Daemon\n");
1680	};
1681		1687
		1688	retc = stop_sync_thread(net, IP_VS_STATE_BACKUP);
		1689	if (retc && retc != -ESRCH)
		1690	pr_err("Failed to stop Backup Daemon\n");
		1691	}
1682		1692
1683	int __init ip_vs_sync_init(void)	1693	int __init ip_vs_sync_init(void)
1684	{	1694	{
1685	return register_pernet_subsys(&ipvs_sync_ops);	1695	return 0;
1686	}	1696	}
1687		1697
1688	void ip_vs_sync_cleanup(void)	1698	void ip_vs_sync_cleanup(void)
1689	{	1699	{
1690	unregister_pernet_subsys(&ipvs_sync_ops);
1691	}	1700	}

net/netfilter/nf_conntrack_netlink.c+4−0

 	struct nf_conn *ct;
 	int err = -EINVAL;
 	struct nf_conntrack_helper *helper;
+	struct nf_conn_tstamp *tstamp;
 	ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);
 	if (IS_ERR(ct))
 		__set_bit(IPS_EXPECTED_BIT, &ct->status);
 		ct->master = master_ct;
 	}
+	tstamp = nf_conn_tstamp_find(ct);
+	if (tstamp)
+		tstamp->start = ktime_to_ns(ktime_get_real());
 	add_timer(&ct->timeout);
 	nf_conntrack_hash_insert(ct);

net/netfilter/x_tables.c+2−2

 		vfree(xt[af].compat_tab);
 		xt[af].compat_tab = NULL;
 		xt[af].number = 0;
+		xt[af].cur = 0;
 	}
 }
 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
 		else
 			return mid ? tmp[mid - 1].delta : 0;
 	}
-	WARN_ON_ONCE(1);
+	return left ? tmp[left - 1].delta : 0;
-	return 0;
 }
 EXPORT_SYMBOL_GPL(xt_compat_calc_jump);

net/netfilter/xt_DSCP.c+1−1

@@ -99,7 +99,7 @@ tos_tg6(struct sk_buff skb, const struct xt_action_param par) · 98 unmodified lines
99	u_int8_t orig, nv;	99	u_int8_t orig, nv;
100		100
101	orig = ipv6_get_dsfield(iph);	101	orig = ipv6_get_dsfield(iph);
102	nv = (orig & info->tos_mask) ^ info->tos_value;	102	nv = (orig & ~info->tos_mask) ^ info->tos_value;
103		103
104	if (orig != nv) {	104	if (orig != nv) {
105	if (!skb_make_writable(skb, sizeof(struct iphdr)))	105	if (!skb_make_writable(skb, sizeof(struct iphdr)))

net/netfilter/xt_conntrack.c+0−5

 {
 	int ret;
-	if (strcmp(par->table, "raw") == 0) {
-		pr_info("state is undetermined at the time of raw table\n");
-		return -EINVAL;
-	}
 	ret = nf_ct_l3proto_try_module_get(par->family);
 	if (ret < 0)
 		pr_info("cannot load conntrack support for proto=%u\n",