lkml.org 
[lkml]   [2018]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 42/94] netfilter: xt_cluster: add dependency on conntrack module
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Martin Willi <martin@strongswan.org>

    [ Upstream commit c1dc2912059901f97345d9e10c96b841215fdc0f ]

    The cluster match requires conntrack for matching packets. If the
    netns does not have conntrack hooks registered, the match does not
    work at all.

    Implicitly load the conntrack hook for the family, exactly as many
    other extensions do. This ensures that the match works even if the
    hooks have not been registered by other means.

    Signed-off-by: Martin Willi <martin@strongswan.org>
    Acked-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/xt_cluster.c | 14 +++++++++++++-
    1 file changed, 13 insertions(+), 1 deletion(-)

    --- a/net/netfilter/xt_cluster.c
    +++ b/net/netfilter/xt_cluster.c
    @@ -133,6 +133,7 @@ xt_cluster_mt(const struct sk_buff *skb,
    static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
    {
    struct xt_cluster_match_info *info = par->matchinfo;
    + int ret;

    if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
    pr_info("you have exceeded the maximum "
    @@ -145,7 +146,17 @@ static int xt_cluster_mt_checkentry(cons
    "higher than the total number of nodes\n");
    return -EDOM;
    }
    - return 0;
    +
    + ret = nf_ct_netns_get(par->net, par->family);
    + if (ret < 0)
    + pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
    + par->family);
    + return ret;
    +}
    +
    +static void xt_cluster_mt_destroy(const struct xt_mtdtor_param *par)
    +{
    + nf_ct_netns_put(par->net, par->family);
    }

    static struct xt_match xt_cluster_match __read_mostly = {
    @@ -154,6 +165,7 @@ static struct xt_match xt_cluster_match
    .match = xt_cluster_mt,
    .checkentry = xt_cluster_mt_checkentry,
    .matchsize = sizeof(struct xt_cluster_match_info),
    + .destroy = xt_cluster_mt_destroy,
    .me = THIS_MODULE,
    };


    \
     
     \ /
      Last update: 2018-10-08 21:08    [W:3.612 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site