-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' of git://1984.lsi.us.es/nf-next
Pablo says: ==================== The following patchset provides fixes for issues that were recently introduced by my new cthelper infrastructure. They have been spotted by Randy Dunlap, Andrew Morton and Dan Carpenter. The patches provide: * compilation fixes if CONFIG_NF_CONNTRACK is disabled: I moved all the conntrack code from nfnetlink_queue.c to nfnetlink_queue_ct.c to avoid peppering the entire code with lots of ifdefs. I needed to rename nfnetlink_queue.c to nfnetlink_queue_core.c to get it working with the Makefile tweaks I've added. * fix NULL pointer dereference via ctnetlink while trying to change the helper for an existing conntrack entry. I don't find any reasonable use case for changing the helper from one to another in run-time. Thus, now ctnetlink returns -EOPNOTSUPP for this operation. * fix possible out-of-bound zeroing of the conntrack extension area due to the helper automatic assignation routine. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
- Loading branch information
Showing
7 changed files
with
187 additions
and
67 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| #ifndef _NET_NFNL_QUEUE_H_ | ||
| #define _NET_NFNL_QUEUE_H_ | ||
|
|
||
| #include <linux/netfilter/nf_conntrack_common.h> | ||
|
|
||
| struct nf_conn; | ||
|
|
||
| #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) | ||
| struct nf_conn *nfqnl_ct_get(struct sk_buff *entskb, size_t *size, | ||
| enum ip_conntrack_info *ctinfo); | ||
| struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb, | ||
| const struct nlattr *attr, | ||
| enum ip_conntrack_info *ctinfo); | ||
| int nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct, | ||
| enum ip_conntrack_info ctinfo); | ||
| void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct, | ||
| enum ip_conntrack_info ctinfo, int diff); | ||
| #else | ||
| inline struct nf_conn * | ||
| nfqnl_ct_get(struct sk_buff *entskb, size_t *size, enum ip_conntrack_info *ctinfo) | ||
| { | ||
| return NULL; | ||
| } | ||
|
|
||
| inline struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb, | ||
| const struct nlattr *attr, | ||
| enum ip_conntrack_info *ctinfo) | ||
| { | ||
| return NULL; | ||
| } | ||
|
|
||
| inline int | ||
| nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo) | ||
| { | ||
| return 0; | ||
| } | ||
|
|
||
| inline void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct, | ||
| enum ip_conntrack_info ctinfo, int diff) | ||
| { | ||
| } | ||
| #endif /* NF_CONNTRACK */ | ||
| #endif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| /* | ||
| * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> | ||
| * | ||
| * This program is free software; you can redistribute it and/or modify | ||
| * it under the terms of the GNU General Public License version 2 as | ||
| * published by the Free Software Foundation. | ||
| * | ||
| */ | ||
|
|
||
| #include <linux/skbuff.h> | ||
| #include <linux/netfilter.h> | ||
| #include <linux/netfilter/nfnetlink.h> | ||
| #include <linux/netfilter/nfnetlink_queue.h> | ||
| #include <net/netfilter/nf_conntrack.h> | ||
|
|
||
| struct nf_conn *nfqnl_ct_get(struct sk_buff *entskb, size_t *size, | ||
| enum ip_conntrack_info *ctinfo) | ||
| { | ||
| struct nfq_ct_hook *nfq_ct; | ||
| struct nf_conn *ct; | ||
|
|
||
| /* rcu_read_lock()ed by __nf_queue already. */ | ||
| nfq_ct = rcu_dereference(nfq_ct_hook); | ||
| if (nfq_ct == NULL) | ||
| return NULL; | ||
|
|
||
| ct = nf_ct_get(entskb, ctinfo); | ||
| if (ct) { | ||
| if (!nf_ct_is_untracked(ct)) | ||
| *size += nfq_ct->build_size(ct); | ||
| else | ||
| ct = NULL; | ||
| } | ||
| return ct; | ||
| } | ||
|
|
||
| struct nf_conn * | ||
| nfqnl_ct_parse(const struct sk_buff *skb, const struct nlattr *attr, | ||
| enum ip_conntrack_info *ctinfo) | ||
| { | ||
| struct nfq_ct_hook *nfq_ct; | ||
| struct nf_conn *ct; | ||
|
|
||
| /* rcu_read_lock()ed by __nf_queue already. */ | ||
| nfq_ct = rcu_dereference(nfq_ct_hook); | ||
| if (nfq_ct == NULL) | ||
| return NULL; | ||
|
|
||
| ct = nf_ct_get(skb, ctinfo); | ||
| if (ct && !nf_ct_is_untracked(ct)) | ||
| nfq_ct->parse(attr, ct); | ||
|
|
||
| return ct; | ||
| } | ||
|
|
||
| int nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct, | ||
| enum ip_conntrack_info ctinfo) | ||
| { | ||
| struct nfq_ct_hook *nfq_ct; | ||
| struct nlattr *nest_parms; | ||
| u_int32_t tmp; | ||
|
|
||
| nfq_ct = rcu_dereference(nfq_ct_hook); | ||
| if (nfq_ct == NULL) | ||
| return 0; | ||
|
|
||
| nest_parms = nla_nest_start(skb, NFQA_CT | NLA_F_NESTED); | ||
| if (!nest_parms) | ||
| goto nla_put_failure; | ||
|
|
||
| if (nfq_ct->build(skb, ct) < 0) | ||
| goto nla_put_failure; | ||
|
|
||
| nla_nest_end(skb, nest_parms); | ||
|
|
||
| tmp = ctinfo; | ||
| if (nla_put_be32(skb, NFQA_CT_INFO, htonl(tmp))) | ||
| goto nla_put_failure; | ||
|
|
||
| return 0; | ||
|
|
||
| nla_put_failure: | ||
| return -1; | ||
| } | ||
|
|
||
| void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct, | ||
| enum ip_conntrack_info ctinfo, int diff) | ||
| { | ||
| struct nfq_ct_hook *nfq_ct; | ||
|
|
||
| nfq_ct = rcu_dereference(nfq_ct_hook); | ||
| if (nfq_ct == NULL) | ||
| return; | ||
|
|
||
| if ((ct->status & IPS_NAT_MASK) && diff) | ||
| nfq_ct->seq_adjust(skb, ct, ctinfo, diff); | ||
| } |