* [PATCH 1/7] netfilter: fix connlimit Kconfig prompt string
2013-11-21 9:05 [PATCH 0/7] netfilter fixes for net Pablo Neira Ayuso
@ 2013-11-21 9:05 ` Pablo Neira Ayuso
2013-11-21 9:05 ` [PATCH 2/7] netfilter: synproxy: send mss option to backend Pablo Neira Ayuso
` (6 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2013-11-21 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Randy Dunlap <rdunlap@infradead.org>
Under Core Netfilter Configuration, connlimit match support has
an extra double quote at the end of it.
Fixes a portion of kernel bugzilla #52671:
https://bugzilla.kernel.org/show_bug.cgi?id=52671
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: lailavrazda1979@gmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 48acec1..c3398cd 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -909,7 +909,7 @@ config NETFILTER_XT_MATCH_CONNLABEL
connection simultaneously.
config NETFILTER_XT_MATCH_CONNLIMIT
- tristate '"connlimit" match support"'
+ tristate '"connlimit" match support'
depends on NF_CONNTRACK
depends on NETFILTER_ADVANCED
---help---
--
1.7.10.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 2/7] netfilter: synproxy: send mss option to backend
2013-11-21 9:05 [PATCH 0/7] netfilter fixes for net Pablo Neira Ayuso
2013-11-21 9:05 ` [PATCH 1/7] netfilter: fix connlimit Kconfig prompt string Pablo Neira Ayuso
@ 2013-11-21 9:05 ` Pablo Neira Ayuso
2013-11-21 9:05 ` [PATCH 3/7] netfilter: synproxy: correct wscale option passing Pablo Neira Ayuso
` (5 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2013-11-21 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Martin Topholm <mph@one.com>
When the synproxy_parse_options is called on the client ack the mss
option will not be present. Consequently mss wont be included in the
backend syn packet, which falls back to 536 bytes mss.
Therefore XT_SYNPROXY_OPT_MSS is explicitly flagged when recovering mss
value from cookie.
Signed-off-by: Martin Topholm <mph@one.com>
Reviewed-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/ipt_SYNPROXY.c | 1 +
net/ipv6/netfilter/ip6t_SYNPROXY.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 01cffea..f13bd91 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -244,6 +244,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
this_cpu_inc(snet->stats->cookie_valid);
opts->mss = mss;
+ opts->options |= XT_SYNPROXY_OPT_MSS;
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
synproxy_check_timestamp_cookie(opts);
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index bf9f612..f78f41a 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -259,6 +259,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
this_cpu_inc(snet->stats->cookie_valid);
opts->mss = mss;
+ opts->options |= XT_SYNPROXY_OPT_MSS;
if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
synproxy_check_timestamp_cookie(opts);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 3/7] netfilter: synproxy: correct wscale option passing
2013-11-21 9:05 [PATCH 0/7] netfilter fixes for net Pablo Neira Ayuso
2013-11-21 9:05 ` [PATCH 1/7] netfilter: fix connlimit Kconfig prompt string Pablo Neira Ayuso
2013-11-21 9:05 ` [PATCH 2/7] netfilter: synproxy: send mss option to backend Pablo Neira Ayuso
@ 2013-11-21 9:05 ` Pablo Neira Ayuso
2013-11-22 17:19 ` Sergei Shtylyov
2013-11-21 9:05 ` [PATCH 4/7] netfilter: fix wrong byte order in nf_ct_seqadj_set internal information Pablo Neira Ayuso
` (4 subsequent siblings)
7 siblings, 1 reply; 11+ messages in thread
From: Pablo Neira Ayuso @ 2013-11-21 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Martin Topholm <mph@one.com>
Timestamp are used to store additional syncookie parameters such as sack,
ecn, and wscale. The wscale value we need to encode is the client's
wscale, since we can't recover that later in the session. Next overwrite
the wscale option so the later synproxy_send_client_synack will send
the backend's wscale to the client.
Signed-off-by: Martin Topholm <mph@one.com>
Reviewed-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_synproxy_core.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index cdf4567..9858e3e 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -151,9 +151,10 @@ void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
opts->tsecr = opts->tsval;
opts->tsval = tcp_time_stamp & ~0x3f;
- if (opts->options & XT_SYNPROXY_OPT_WSCALE)
- opts->tsval |= info->wscale;
- else
+ if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
+ opts->tsval |= opts->wscale;
+ opts->wscale = info->wscale;
+ } else
opts->tsval |= 0xf;
if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH 3/7] netfilter: synproxy: correct wscale option passing
2013-11-21 9:05 ` [PATCH 3/7] netfilter: synproxy: correct wscale option passing Pablo Neira Ayuso
@ 2013-11-22 17:19 ` Sergei Shtylyov
0 siblings, 0 replies; 11+ messages in thread
From: Sergei Shtylyov @ 2013-11-22 17:19 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: davem, netdev
Hello.
On 21-11-2013 13:05, Pablo Neira Ayuso wrote:
> From: Martin Topholm <mph@one.com>
> Timestamp are used to store additional syncookie parameters such as sack,
> ecn, and wscale. The wscale value we need to encode is the client's
> wscale, since we can't recover that later in the session. Next overwrite
> the wscale option so the later synproxy_send_client_synack will send
> the backend's wscale to the client.
> Signed-off-by: Martin Topholm <mph@one.com>
> Reviewed-by: Jesper Dangaard Brouer <brouer@redhat.com>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> net/netfilter/nf_synproxy_core.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
> diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
> index cdf4567..9858e3e 100644
> --- a/net/netfilter/nf_synproxy_core.c
> +++ b/net/netfilter/nf_synproxy_core.c
> @@ -151,9 +151,10 @@ void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
> opts->tsecr = opts->tsval;
> opts->tsval = tcp_time_stamp & ~0x3f;
>
> - if (opts->options & XT_SYNPROXY_OPT_WSCALE)
> - opts->tsval |= info->wscale;
> - else
> + if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
> + opts->tsval |= opts->wscale;
> + opts->wscale = info->wscale;
> + } else
> opts->tsval |= 0xf;
According to Documentation/CodingStyle, both arms of *if* statement should
have {} if one arm has it.
WBR, Sergei
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH 4/7] netfilter: fix wrong byte order in nf_ct_seqadj_set internal information
2013-11-21 9:05 [PATCH 0/7] netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2013-11-21 9:05 ` [PATCH 3/7] netfilter: synproxy: correct wscale option passing Pablo Neira Ayuso
@ 2013-11-21 9:05 ` Pablo Neira Ayuso
2013-11-22 17:16 ` Sergei Shtylyov
2013-11-21 9:05 ` [PATCH 5/7] netfilter: nft_compat: fix error path in nft_parse_compat() Pablo Neira Ayuso
` (3 subsequent siblings)
7 siblings, 1 reply; 11+ messages in thread
From: Pablo Neira Ayuso @ 2013-11-21 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Phil Oester <kernel@linuxace.com>
In commit 41d73ec053d2, sequence number adjustments were moved to a
separate file. Unfortunately, the sequence numbers that are stored
in the nf_ct_seqadj structure are expressed in host byte order. The
necessary ntohl call was removed when the call to adjust_tcp_sequence
was collapsed into nf_ct_seqadj_set. This broke the FTP NAT helper.
Fix it by adding back the byte order conversions.
Reported-by: Dawid Stawiarski <dawid.stawiarski@netart.pl>
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_seqadj.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 5f9bfd0..17c1bcb 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
spin_lock_bh(&ct->lock);
this_way = &seqadj->seq[dir];
if (this_way->offset_before == this_way->offset_after ||
- before(this_way->correction_pos, seq)) {
- this_way->correction_pos = seq;
+ before(this_way->correction_pos, ntohl(seq))) {
+ this_way->correction_pos = ntohl(seq);
this_way->offset_before = this_way->offset_after;
this_way->offset_after += off;
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH 4/7] netfilter: fix wrong byte order in nf_ct_seqadj_set internal information
2013-11-21 9:05 ` [PATCH 4/7] netfilter: fix wrong byte order in nf_ct_seqadj_set internal information Pablo Neira Ayuso
@ 2013-11-22 17:16 ` Sergei Shtylyov
0 siblings, 0 replies; 11+ messages in thread
From: Sergei Shtylyov @ 2013-11-22 17:16 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: davem, netdev
Hello.
On 21-11-2013 13:05, Pablo Neira Ayuso wrote:
> From: Phil Oester <kernel@linuxace.com>
> In commit 41d73ec053d2, sequence number adjustments were moved to a
Please also specify that commit's summary line in parens.
> separate file. Unfortunately, the sequence numbers that are stored
> in the nf_ct_seqadj structure are expressed in host byte order. The
> necessary ntohl call was removed when the call to adjust_tcp_sequence
> was collapsed into nf_ct_seqadj_set. This broke the FTP NAT helper.
> Fix it by adding back the byte order conversions.
> Reported-by: Dawid Stawiarski <dawid.stawiarski@netart.pl>
> Signed-off-by: Phil Oester <kernel@linuxace.com>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
WBR, Sergei
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH 5/7] netfilter: nft_compat: fix error path in nft_parse_compat()
2013-11-21 9:05 [PATCH 0/7] netfilter fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2013-11-21 9:05 ` [PATCH 4/7] netfilter: fix wrong byte order in nf_ct_seqadj_set internal information Pablo Neira Ayuso
@ 2013-11-21 9:05 ` Pablo Neira Ayuso
2013-11-21 9:05 ` [PATCH 6/7] netfilter: nf_conntrack: decrement global counter after object release Pablo Neira Ayuso
` (2 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2013-11-21 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
The patch 0ca743a55991: "netfilter: nf_tables: add compatibility
layer for x_tables", leads to the following Smatch
warning: "net/netfilter/nft_compat.c:140 nft_parse_compat()
warn: signedness bug returning '(-34)'"
This nft_parse_compat function returns error codes but the return
type is u8 so the error codes are transformed into small positive
values. The callers don't check the return.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_compat.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index a82667c..da0c1f4 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -128,7 +128,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
[NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 },
};
-static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
+static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
{
struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
u32 flags;
@@ -148,7 +148,8 @@ static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
if (flags & NFT_RULE_COMPAT_F_INV)
*inv = true;
- return ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+ *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+ return 0;
}
static int
@@ -166,8 +167,11 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
- if (ctx->nla[NFTA_RULE_COMPAT])
- proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
+ if (ctx->nla[NFTA_RULE_COMPAT]) {
+ ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
+ if (ret < 0)
+ goto err;
+ }
nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
@@ -356,8 +360,11 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
- if (ctx->nla[NFTA_RULE_COMPAT])
- proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
+ if (ctx->nla[NFTA_RULE_COMPAT]) {
+ ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
+ if (ret < 0)
+ goto err;
+ }
nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 6/7] netfilter: nf_conntrack: decrement global counter after object release
2013-11-21 9:05 [PATCH 0/7] netfilter fixes for net Pablo Neira Ayuso
` (4 preceding siblings ...)
2013-11-21 9:05 ` [PATCH 5/7] netfilter: nft_compat: fix error path in nft_parse_compat() Pablo Neira Ayuso
@ 2013-11-21 9:05 ` Pablo Neira Ayuso
2013-11-21 9:05 ` [PATCH 7/7] netfilter: ebt_ip6: fix source and destination matching Pablo Neira Ayuso
2013-11-21 17:45 ` [PATCH 0/7] netfilter fixes for net David Miller
7 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2013-11-21 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
nf_conntrack_free() decrements our counter (net->ct.count)
before releasing the conntrack object. That counter is used in the
nf_conntrack_cleanup_net_list path to check if it's time to
kmem_cache_destroy our cache of conntrack objects. I think we have
a race there that should be easier to trigger (although still hard)
with CONFIG_DEBUG_OBJECTS_FREE as object releases become slowier
according to the following splat:
[ 1136.321305] WARNING: CPU: 2 PID: 2483 at lib/debugobjects.c:260
debug_print_object+0x83/0xa0()
[ 1136.321311] ODEBUG: free active (active state 0) object type:
timer_list hint: delayed_work_timer_fn+0x0/0x20
...
[ 1136.321390] Call Trace:
[ 1136.321398] [<ffffffff8160d4a2>] dump_stack+0x45/0x56
[ 1136.321405] [<ffffffff810514e8>] warn_slowpath_common+0x78/0xa0
[ 1136.321410] [<ffffffff81051557>] warn_slowpath_fmt+0x47/0x50
[ 1136.321414] [<ffffffff812f8883>] debug_print_object+0x83/0xa0
[ 1136.321420] [<ffffffff8106aa90>] ? execute_in_process_context+0x90/0x90
[ 1136.321424] [<ffffffff812f99fb>] debug_check_no_obj_freed+0x20b/0x250
[ 1136.321429] [<ffffffff8112e7f2>] ? kmem_cache_destroy+0x92/0x100
[ 1136.321433] [<ffffffff8115d945>] kmem_cache_free+0x125/0x210
[ 1136.321436] [<ffffffff8112e7f2>] kmem_cache_destroy+0x92/0x100
[ 1136.321443] [<ffffffffa046b806>] nf_conntrack_cleanup_net_list+0x126/0x160 [nf_conntrack]
[ 1136.321449] [<ffffffffa046c43d>] nf_conntrack_pernet_exit+0x6d/0x80 [nf_conntrack]
[ 1136.321453] [<ffffffff81511cc3>] ops_exit_list.isra.3+0x53/0x60
[ 1136.321457] [<ffffffff815124f0>] cleanup_net+0x100/0x1b0
[ 1136.321460] [<ffffffff8106b31e>] process_one_work+0x18e/0x430
[ 1136.321463] [<ffffffff8106bf49>] worker_thread+0x119/0x390
[ 1136.321467] [<ffffffff8106be30>] ? manage_workers.isra.23+0x2a0/0x2a0
[ 1136.321470] [<ffffffff8107210b>] kthread+0xbb/0xc0
[ 1136.321472] [<ffffffff81072050>] ? kthread_create_on_node+0x110/0x110
[ 1136.321477] [<ffffffff8161b8fc>] ret_from_fork+0x7c/0xb0
[ 1136.321479] [<ffffffff81072050>] ? kthread_create_on_node+0x110/0x110
[ 1136.321481] ---[ end trace 25f53c192da70825 ]---
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e22d950..43549eb 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -764,9 +764,10 @@ void nf_conntrack_free(struct nf_conn *ct)
struct net *net = nf_ct_net(ct);
nf_ct_ext_destroy(ct);
- atomic_dec(&net->ct.count);
nf_ct_ext_free(ct);
kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
+ smp_mb__before_atomic_dec();
+ atomic_dec(&net->ct.count);
}
EXPORT_SYMBOL_GPL(nf_conntrack_free);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 7/7] netfilter: ebt_ip6: fix source and destination matching
2013-11-21 9:05 [PATCH 0/7] netfilter fixes for net Pablo Neira Ayuso
` (5 preceding siblings ...)
2013-11-21 9:05 ` [PATCH 6/7] netfilter: nf_conntrack: decrement global counter after object release Pablo Neira Ayuso
@ 2013-11-21 9:05 ` Pablo Neira Ayuso
2013-11-21 17:45 ` [PATCH 0/7] netfilter fixes for net David Miller
7 siblings, 0 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2013-11-21 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Luís Fernando Cornachioni Estrozi <lestrozi@uolinc.com>
This bug was introduced on commit 0898f99a2. This just recovers two
checks that existed before as suggested by Bart De Schuymer.
Signed-off-by: Luís Fernando Cornachioni Estrozi <lestrozi@uolinc.com>
Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/ebt_ip6.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c
index 99c8566..17fd5f2 100644
--- a/net/bridge/netfilter/ebt_ip6.c
+++ b/net/bridge/netfilter/ebt_ip6.c
@@ -48,10 +48,12 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
if (info->bitmask & EBT_IP6_TCLASS &&
FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
return false;
- if (FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
- &info->saddr), EBT_IP6_SOURCE) ||
+ if ((info->bitmask & EBT_IP6_SOURCE &&
+ FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
+ &info->saddr), EBT_IP6_SOURCE)) ||
+ (info->bitmask & EBT_IP6_DEST &&
FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
- &info->daddr), EBT_IP6_DEST))
+ &info->daddr), EBT_IP6_DEST)))
return false;
if (info->bitmask & EBT_IP6_PROTO) {
uint8_t nexthdr = ih6->nexthdr;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH 0/7] netfilter fixes for net
2013-11-21 9:05 [PATCH 0/7] netfilter fixes for net Pablo Neira Ayuso
` (6 preceding siblings ...)
2013-11-21 9:05 ` [PATCH 7/7] netfilter: ebt_ip6: fix source and destination matching Pablo Neira Ayuso
@ 2013-11-21 17:45 ` David Miller
7 siblings, 0 replies; 11+ messages in thread
From: David Miller @ 2013-11-21 17:45 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 21 Nov 2013 10:05:21 +0100
> The following patchset contains fixes for your net tree, they are:
>
> * Remove extra quote from connlimit configuration in Kconfig, from
> Randy Dunlap.
>
> * Fix missing mss option in syn packets sent to the backend in our
> new synproxy target, from Martin Topholm.
>
> * Use window scale announced by client when sending the forged
> syn to the backend, from Martin Topholm.
>
> * Fix IPv6 address comparison in ebtables, from Luís Fernando
> Cornachioni Estrozi.
>
> * Fix wrong endianess in sequence adjustment which breaks helpers
> in NAT configurations, from Phil Oester.
>
> * Fix the error path handling of nft_compat, from me.
>
> * Make sure the global conntrack counter is decremented after the
> object has been released, also from me.
Pulled, thanks a lot Pablo.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 11+ messages in thread