Commit 450bbc33 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) nf_conntrack_tuple_taken() needs to recheck zone for
   NAT clash resolution, from Florian Westphal.

2) Restore support for stateful expressions when set definition
   specifies no stateful expressions.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 1c5fae9c 664899e8

net/netfilter/nf_conntrack_core.c

+2 −1
Original line number Diff line number Diff line
@@ -1229,7 +1229,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, 
			 * Let nf_ct_resolve_clash() deal with this later.

			 */

			if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,

					      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))

					      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&

					      nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL))

				continue;



			NF_CT_STAT_INC_ATOMIC(net, found);

net/netfilter/nf_tables_api.c

+15 −13
Original line number Diff line number Diff line
@@ -5281,6 +5281,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
	struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {};

	struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];

	u8 genmask = nft_genmask_next(ctx->net);

	u32 flags = 0, size = 0, num_exprs = 0;

	struct nft_set_ext_tmpl tmpl;

	struct nft_set_ext *ext, *ext2;

	struct nft_set_elem elem;
@@ -5290,7 +5291,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
	struct nft_data_desc desc;

	enum nft_registers dreg;

	struct nft_trans *trans;

	u32 flags = 0, size = 0;

	u64 timeout;

	u64 expiration;

	int err, i;
@@ -5356,7 +5356,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
	if (nla[NFTA_SET_ELEM_EXPR]) {

		struct nft_expr *expr;



		if (set->num_exprs != 1)

		if (set->num_exprs && set->num_exprs != 1)

			return -EOPNOTSUPP;



		expr = nft_set_elem_expr_alloc(ctx, set,
@@ -5365,8 +5365,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
			return PTR_ERR(expr);



		expr_array[0] = expr;

		num_exprs = 1;



		if (set->exprs[0] && set->exprs[0]->ops != expr->ops) {

		if (set->num_exprs && set->exprs[0]->ops != expr->ops) {

			err = -EOPNOTSUPP;

			goto err_set_elem_expr;

		}
@@ -5375,12 +5376,10 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
		struct nlattr *tmp;

		int left;



		if (set->num_exprs == 0)

			return -EOPNOTSUPP;



		i = 0;

		nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) {

			if (i == set->num_exprs) {

			if (i == NFT_SET_EXPR_MAX ||

			    (set->num_exprs && set->num_exprs == i)) {

				err = -E2BIG;

				goto err_set_elem_expr;

			}
@@ -5394,14 +5393,15 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
				goto err_set_elem_expr;

			}

			expr_array[i] = expr;

			num_exprs++;



			if (expr->ops != set->exprs[i]->ops) {

			if (set->num_exprs && expr->ops != set->exprs[i]->ops) {

				err = -EOPNOTSUPP;

				goto err_set_elem_expr;

			}

			i++;

		}

		if (set->num_exprs != i) {

		if (set->num_exprs && set->num_exprs != i) {

			err = -EOPNOTSUPP;

			goto err_set_elem_expr;

		}
@@ -5409,6 +5409,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
		err = nft_set_elem_expr_clone(ctx, set, expr_array);

		if (err < 0)

			goto err_set_elem_expr_clone;



		num_exprs = set->num_exprs;

	}



	err = nft_setelem_parse_key(ctx, set, &elem.key.val,
@@ -5433,8 +5435,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
			nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);

	}



	if (set->num_exprs) {

		for (i = 0; i < set->num_exprs; i++)

	if (num_exprs) {

		for (i = 0; i < num_exprs; i++)

			size += expr_array[i]->ops->size;



		nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS,
@@ -5522,7 +5524,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
		*nft_set_ext_obj(ext) = obj;

		obj->use++;

	}

	for (i = 0; i < set->num_exprs; i++)

	for (i = 0; i < num_exprs; i++)

		nft_set_elem_expr_setup(ext, i, expr_array);



	trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
@@ -5584,7 +5586,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
err_parse_key:

	nft_data_release(&elem.key.val, NFT_DATA_VALUE);

err_set_elem_expr:

	for (i = 0; i < set->num_exprs && expr_array[i]; i++)

	for (i = 0; i < num_exprs && expr_array[i]; i++)

		nft_expr_destroy(ctx, expr_array[i]);

err_set_elem_expr_clone:

	return err;