diff options
author | Brett Mastbergen <bmastbergen@untangle.com> | 2018-09-12 15:04:55 -0400 |
---|---|---|
committer | Hauke Mehrtens <hauke@hauke-m.de> | 2018-09-22 21:20:55 +0200 |
commit | f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c (patch) | |
tree | a852fcd9ee8d2a1746baff1b4a8e8f07501d8e91 /target/linux/generic/backport-4.14/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch | |
parent | d3a492c72f15ecf8debe56a3ee35eb213c9d9bcc (diff) | |
download | upstream-f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c.tar.gz upstream-f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c.tar.bz2 upstream-f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c.zip |
kernel: generic: Fix nftables inet table breakage
Commit b7265c59ab7d ("kernel: backport a series of netfilter cleanup
patches to 4.14") added patch 302-netfilter-nf_tables_inet-don-t-use-
multihook-infrast.patch. That patch switches the netfilter core in the
kernel to use the new native NFPROTO_INET support. Unfortunately, the
new native NFPROTO_INET support does not exist in 4.14 and was not
backported along with this patchset. As such, nftables inet tables never
see any traffic.
As an example the following nft counter rule should increment for every
packet coming into the box, but never will:
nft add table inet foo
nft add chain inet foo bar { type filter hook input priority 0\; }
nft add rule inet foo bar counter
This commit pulls in the required backport patches to add the new
native NFPROTO_INET support, and thus restore nftables inet table
functionality.
Tested on Turris Omnia (mvebu)
Fixes: b7265c59ab7d ("kernel: backport a series of netfilter cleanup ...")
Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com>
Diffstat (limited to 'target/linux/generic/backport-4.14/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch')
-rw-r--r-- | target/linux/generic/backport-4.14/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch | 51 |
1 files changed, 51 insertions, 0 deletions
diff --git a/target/linux/generic/backport-4.14/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch b/target/linux/generic/backport-4.14/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch new file mode 100644 index 0000000000..4c52635c13 --- /dev/null +++ b/target/linux/generic/backport-4.14/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch @@ -0,0 +1,51 @@ +From 30259408118f550f5969fda19c0d67020d21eda8 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sat, 9 Dec 2017 15:26:37 +0100 +Subject: [PATCH 10/11] netfilter: core: pass family as parameter to + nf_remove_net_hook() + +So static_key_slow_dec applies to the family behind NFPROTO_INET. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/netfilter/core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -365,7 +365,7 @@ EXPORT_SYMBOL(nf_register_net_hook); + * Therefore replace the to-be-removed hook with a dummy hook. + */ + static void nf_remove_net_hook(struct nf_hook_entries *old, +- const struct nf_hook_ops *unreg) ++ const struct nf_hook_ops *unreg, int pf) + { + struct nf_hook_ops **orig_ops; + bool found = false; +@@ -383,14 +383,14 @@ static void nf_remove_net_hook(struct nf + + if (found) { + #ifdef CONFIG_NETFILTER_INGRESS +- if (unreg->pf == NFPROTO_NETDEV && unreg->hooknum == NF_NETDEV_INGRESS) ++ if (pf == NFPROTO_NETDEV && unreg->hooknum == NF_NETDEV_INGRESS) + net_dec_ingress_queue(); + #endif + #ifdef HAVE_JUMP_LABEL +- static_key_slow_dec(&nf_hooks_needed[unreg->pf][unreg->hooknum]); ++ static_key_slow_dec(&nf_hooks_needed[pf][unreg->hooknum]); + #endif + } else { +- WARN_ONCE(1, "hook not found, pf %d num %d", unreg->pf, unreg->hooknum); ++ WARN_ONCE(1, "hook not found, pf %d num %d", pf, unreg->hooknum); + } + } + +@@ -411,7 +411,7 @@ void nf_unregister_net_hook(struct net * + return; + } + +- nf_remove_net_hook(p, reg); ++ nf_remove_net_hook(p, reg, reg->pf); + + p = __nf_hook_entries_try_shrink(pp); + mutex_unlock(&nf_hook_mutex); |