From d0ba3bb1e24702e472eee2f3a5b7f9e4646b8ff1 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Mon, 13 Apr 2015 22:23:14 +0000 Subject: kernel: finally remove layer7 filter support it has been non-functional for years and caused numerous memleaks and crashes for people that tried to enable it. it has no maintained upstream source, and it does not look like it's going to be fixed any time soon Signed-off-by: Felix Fietkau SVN-Revision: 45423 --- .../600-netfilter_conntrack_flush.patch | 86 ++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch (limited to 'target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch') diff --git a/target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch b/target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch new file mode 100644 index 0000000000..cc428580a1 --- /dev/null +++ b/target/linux/generic/patches-3.18/600-netfilter_conntrack_flush.patch @@ -0,0 +1,86 @@ +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #ifdef CONFIG_SYSCTL + #include +@@ -262,10 +263,66 @@ static int ct_open(struct inode *inode, + sizeof(struct ct_iter_state)); + } + ++struct kill_request { ++ u16 family; ++ union nf_inet_addr addr; ++}; ++ ++static int kill_matching(struct nf_conn *i, void *data) ++{ ++ struct kill_request *kr = data; ++ struct nf_conntrack_tuple *t1 = &i->tuplehash[IP_CT_DIR_ORIGINAL].tuple; ++ struct nf_conntrack_tuple *t2 = &i->tuplehash[IP_CT_DIR_REPLY].tuple; ++ ++ if (!kr->family) ++ return 1; ++ ++ if (t1->src.l3num != kr->family) ++ return 0; ++ ++ return (nf_inet_addr_cmp(&kr->addr, &t1->src.u3) || ++ nf_inet_addr_cmp(&kr->addr, &t1->dst.u3) || ++ nf_inet_addr_cmp(&kr->addr, &t2->src.u3) || ++ nf_inet_addr_cmp(&kr->addr, &t2->dst.u3)); ++} ++ ++static ssize_t ct_file_write(struct file *file, const char __user *buf, ++ size_t count, loff_t *ppos) ++{ ++ struct seq_file *seq = file->private_data; ++ struct net *net = seq_file_net(seq); ++ struct kill_request kr = { }; ++ char req[INET6_ADDRSTRLEN] = { }; ++ ++ if (count == 0) ++ return 0; ++ ++ if (count >= INET6_ADDRSTRLEN) ++ count = INET6_ADDRSTRLEN - 1; ++ ++ if (copy_from_user(req, buf, count)) ++ return -EFAULT; ++ ++ if (strnchr(req, count, ':')) { ++ kr.family = AF_INET6; ++ if (!in6_pton(req, count, (void *)&kr.addr, '\n', NULL)) ++ return -EINVAL; ++ } else if (strnchr(req, count, '.')) { ++ kr.family = AF_INET; ++ if (!in4_pton(req, count, (void *)&kr.addr, '\n', NULL)) ++ return -EINVAL; ++ } ++ ++ nf_ct_iterate_cleanup(net, kill_matching, &kr, 0, 0); ++ ++ return count; ++} ++ + static const struct file_operations ct_file_ops = { + .owner = THIS_MODULE, + .open = ct_open, + .read = seq_read, ++ .write = ct_file_write, + .llseek = seq_lseek, + .release = seq_release_net, + }; +@@ -367,7 +424,7 @@ static int nf_conntrack_standalone_init_ + { + struct proc_dir_entry *pde; + +- pde = proc_create("nf_conntrack", 0440, net->proc_net, &ct_file_ops); ++ pde = proc_create("nf_conntrack", 0660, net->proc_net, &ct_file_ops); + if (!pde) + goto out_nf_conntrack; + -- cgit v1.2.3