diff options
| author | Felix Fietkau <nbd@openwrt.org> | 2015-04-13 22:23:14 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@openwrt.org> | 2015-04-13 22:23:14 +0000 |
| commit | d0ba3bb1e24702e472eee2f3a5b7f9e4646b8ff1 (patch) | |
| tree | add3d722fc72f04832f496eac303310600fabe23 /target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch | |
| parent | 87f854059aa3c703a87e08649801b15c93b845e7 (diff) | |
| download | master-31e0f0ae-d0ba3bb1e24702e472eee2f3a5b7f9e4646b8ff1.tar.gz master-31e0f0ae-d0ba3bb1e24702e472eee2f3a5b7f9e4646b8ff1.tar.bz2 master-31e0f0ae-d0ba3bb1e24702e472eee2f3a5b7f9e4646b8ff1.zip | |
kernel: finally remove layer7 filter support
it has been non-functional for years and caused numerous memleaks and
crashes for people that tried to enable it.
it has no maintained upstream source, and it does not look like it's
going to be fixed any time soon
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 45423
Diffstat (limited to 'target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch')
| -rw-r--r-- | target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch | 86 |
1 files changed, 86 insertions, 0 deletions
diff --git a/target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch b/target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch new file mode 100644 index 0000000000..cc428580a1 --- /dev/null +++ b/target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch @@ -0,0 +1,86 @@ +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -17,6 +17,7 @@ + #include <linux/percpu.h> + #include <linux/netdevice.h> + #include <linux/security.h> ++#include <linux/inet.h> + #include <net/net_namespace.h> + #ifdef CONFIG_SYSCTL + #include <linux/sysctl.h> +@@ -262,10 +263,66 @@ static int ct_open(struct inode *inode, + sizeof(struct ct_iter_state)); + } + ++struct kill_request { ++ u16 family; ++ union nf_inet_addr addr; ++}; ++ ++static int kill_matching(struct nf_conn *i, void *data) ++{ ++ struct kill_request *kr = data; ++ struct nf_conntrack_tuple *t1 = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple; ++ struct nf_conntrack_tuple *t2 = &i->tuplehash[IP_CT_DIR_REPLY].tuple; ++ ++ if (!kr->family) ++ return 1; ++ ++ if (t1->src.l3num != kr->family) ++ return 0; ++ ++ return (nf_inet_addr_cmp(&kr->addr, &t1->src.u3) || ++ nf_inet_addr_cmp(&kr->addr, &t1->dst.u3) || ++ nf_inet_addr_cmp(&kr->addr, &t2->src.u3) || ++ nf_inet_addr_cmp(&kr->addr, &t2->dst.u3)); ++} ++ ++static ssize_t ct_file_write(struct file *file, const char __user *buf, ++ size_t count, loff_t *ppos) ++{ ++ struct seq_file *seq = file->private_data; ++ struct net *net = seq_file_net(seq); ++ struct kill_request kr = { }; ++ char req[INET6_ADDRSTRLEN] = { }; ++ ++ if (count == 0) ++ return 0; ++ ++ if (count >= INET6_ADDRSTRLEN) ++ count = INET6_ADDRSTRLEN - 1; ++ ++ if (copy_from_user(req, buf, count)) ++ return -EFAULT; ++ ++ if (strnchr(req, count, ':')) { ++ kr.family = AF_INET6; ++ if (!in6_pton(req, count, (void *)&kr.addr, '\n', NULL)) ++ return -EINVAL; ++ } else if (strnchr(req, count, '.')) { ++ kr.family = AF_INET; ++ if (!in4_pton(req, count, (void *)&kr.addr, '\n', NULL)) ++ return -EINVAL; ++ } ++ ++ nf_ct_iterate_cleanup(net, kill_matching, &kr, 0, 0); ++ ++ return count; ++} ++ + static const struct file_operations ct_file_ops = { + .owner = THIS_MODULE, + .open = ct_open, + .read = seq_read, ++ .write = ct_file_write, + .llseek = seq_lseek, + .release = seq_release_net, + }; +@@ -367,7 +424,7 @@ static int nf_conntrack_standalone_init_ + { + struct proc_dir_entry *pde; + +- pde = proc_create("nf_conntrack", 0440, net->proc_net, &ct_file_ops); ++ pde = proc_create("nf_conntrack", 0660, net->proc_net, &ct_file_ops); + if (!pde) + goto out_nf_conntrack; + |