Commit c8a8ead0 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

1) Pass conntrack -f to specify family in netfilter conntrack helper
   selftests, from Chen Yi.

2) Honor hashsize modparam from nf_conntrack_buckets sysctl,
   from Jesper D. Brouer.

3) Fix memleak in nf_nat_init() error path, from Dinghao Liu.

* git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf:
  netfilter: nf_nat: Fix memleak in nf_nat_init
  netfilter: conntrack: fix reading nf_conntrack_buckets
  selftests: netfilter: Pass family parameter "-f" to conntrack tool
====================

Link: https://lore.kernel.org/r/20210112222033.9732-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 5527d0ea 869f4fda

net/netfilter/nf_conntrack_standalone.c

+3 −0
Original line number Diff line number Diff line
@@ -523,6 +523,9 @@ nf_conntrack_hash_sysctl(struct ctl_table *table, int write, 
{

	int ret;



	/* module_param hashsize could have changed value */

	nf_conntrack_htable_size_user = nf_conntrack_htable_size;



	ret = proc_dointvec(table, write, buffer, lenp, ppos);

	if (ret < 0 || !write)

		return ret;

net/netfilter/nf_nat_core.c

+1 −0
Original line number Diff line number Diff line
@@ -1174,6 +1174,7 @@ static int __init nf_nat_init(void) 
	ret = register_pernet_subsys(&nat_net_ops);

	if (ret < 0) {

		nf_ct_extend_unregister(&nat_extend);

		kvfree(nf_nat_bysource);

		return ret;

	}

tools/testing/selftests/netfilter/nft_conntrack_helper.sh

+9 −3
Original line number Diff line number Diff line
@@ -94,7 +94,13 @@ check_for_helper() 
	local message=$2

	local port=$3



	ip netns exec ${netns} conntrack -L -p tcp --dport $port 2> /dev/null |grep -q 'helper=ftp'

	if echo $message |grep -q 'ipv6';then

		local family="ipv6"

	else

		local family="ipv4"

	fi



	ip netns exec ${netns} conntrack -L -f $family -p tcp --dport $port 2> /dev/null |grep -q 'helper=ftp'

	if [ $? -ne 0 ] ; then

		echo "FAIL: ${netns} did not show attached helper $message" 1>&2

		ret=1
@@ -111,8 +117,8 @@ test_helper() 


	sleep 3 | ip netns exec ${ns2} nc -w 2 -l -p $port > /dev/null &



	sleep 1

	sleep 1 | ip netns exec ${ns1} nc -w 2 10.0.1.2 $port > /dev/null &

	sleep 1



	check_for_helper "$ns1" "ip $msg" $port

	check_for_helper "$ns2" "ip $msg" $port
@@ -128,8 +134,8 @@ test_helper() 


	sleep 3 | ip netns exec ${ns2} nc -w 2 -6 -l -p $port > /dev/null &



	sleep 1

	sleep 1 | ip netns exec ${ns1} nc -w 2 -6 dead:1::2 $port > /dev/null &

	sleep 1



	check_for_helper "$ns1" "ipv6 $msg" $port

	check_for_helper "$ns2" "ipv6 $msg" $port