aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch
diff options
context:
space:
mode:
authorDaniel Golle <daniel@makrotopia.org>2019-06-12 01:14:25 +0200
committerDaniel Golle <daniel@makrotopia.org>2019-06-12 01:18:52 +0200
commit000d400baa0af2e42c9a462e42df7dc9abde1ec7 (patch)
treea11c2dd570e8f02c4a141f135fc8db1e1d391ef2 /target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch
parentc4e727f01cc40bd57274d0b885b0f75cde9c4683 (diff)
downloadupstream-000d400baa0af2e42c9a462e42df7dc9abde1ec7.tar.gz
upstream-000d400baa0af2e42c9a462e42df7dc9abde1ec7.tar.bz2
upstream-000d400baa0af2e42c9a462e42df7dc9abde1ec7.zip
kernel: drop everything not on kernel version 4.14
* Remove testing patches for kernel version 4.19 * remove targets ar7, ixp4xx, orion Those targets are still on kernel 4.9, patches for 4.14 were not ready in time. They may be readded once people prepare and test patches for kernel 4.14. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Diffstat (limited to 'target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch')
-rw-r--r--target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch82
1 files changed, 0 insertions, 82 deletions
diff --git a/target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch b/target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch
deleted file mode 100644
index ac7a73b60e..0000000000
--- a/target/linux/generic/backport-4.19/366-netfilter-nf_flow_table-clean-up-and-fix-dst-handlin.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 15 Mar 2018 18:21:43 +0100
-Subject: [PATCH] netfilter: nf_flow_table: clean up and fix dst handling
-
-dst handling in the code is inconsistent and possibly wrong. In my test,
-skb_dst(skb) holds the dst entry after routing but before NAT, so the
-code could possibly return the same dst entry for both directions of a
-connection.
-Additionally, there was some confusion over the dst entry vs the address
-passed as parameter to rt_nexthop/rt6_nexthop.
-
-Do an explicit dst lookup for both ends of the connection and always use
-the source address for it. When running the IP hook, use the dst entry
-for the opposite direction for determining the route.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/netfilter/nf_flow_table_ip.c
-+++ b/net/netfilter/nf_flow_table_ip.c
-@@ -241,7 +241,7 @@ nf_flow_offload_ip_hook(void *priv, stru
-
- dir = tuplehash->tuple.dir;
- flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
-- rt = (struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
-+ rt = (struct rtable *)flow->tuplehash[!dir].tuple.dst_cache;
-
- if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) &&
- (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0)
-@@ -459,7 +459,7 @@ nf_flow_offload_ipv6_hook(void *priv, st
-
- dir = tuplehash->tuple.dir;
- flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
-- rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
-+ rt = (struct rt6_info *)flow->tuplehash[!dir].tuple.dst_cache;
-
- if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
- return NF_ACCEPT;
---- a/net/netfilter/nft_flow_offload.c
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -18,13 +18,11 @@ struct nft_flow_offload {
- struct nft_flowtable *flowtable;
- };
-
--static int nft_flow_route(const struct nft_pktinfo *pkt,
-- const struct nf_conn *ct,
-- struct nf_flow_route *route,
-- enum ip_conntrack_dir dir)
-+static struct dst_entry *
-+nft_flow_dst(const struct nf_conn *ct, enum ip_conntrack_dir dir,
-+ const struct nft_pktinfo *pkt)
- {
-- struct dst_entry *this_dst = skb_dst(pkt->skb);
-- struct dst_entry *other_dst = NULL;
-+ struct dst_entry *dst;
- struct flowi fl;
-
- memset(&fl, 0, sizeof(fl));
-@@ -39,8 +37,21 @@ static int nft_flow_route(const struct n
- break;
- }
-
-- nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt));
-- if (!other_dst)
-+ nf_route(nft_net(pkt), &dst, &fl, false, nft_pf(pkt));
-+
-+ return dst;
-+}
-+
-+static int nft_flow_route(const struct nft_pktinfo *pkt,
-+ const struct nf_conn *ct,
-+ struct nf_flow_route *route,
-+ enum ip_conntrack_dir dir)
-+{
-+ struct dst_entry *this_dst, *other_dst;
-+
-+ this_dst = nft_flow_dst(ct, dir, pkt);
-+ other_dst = nft_flow_dst(ct, !dir, pkt);
-+ if (!this_dst || !other_dst)
- return -ENOENT;
-
- route->tuple[dir].dst = this_dst;