diff options
| author | Hauke Mehrtens <hauke@hauke-m.de> | 2018-11-01 17:57:55 +0100 |
|---|---|---|
| committer | Hauke Mehrtens <hauke@hauke-m.de> | 2018-12-15 12:50:06 +0100 |
| commit | 52a82ce3dd901a1536c7d7d9d963e9c2d761c816 (patch) | |
| tree | 79020fb59420fcea7bdc4b12272f7251e101fe64 /target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch | |
| parent | a272af75cd8c67d265400f96c1e6bb172315c23c (diff) | |
| download | upstream-52a82ce3dd901a1536c7d7d9d963e9c2d761c816.tar.gz upstream-52a82ce3dd901a1536c7d7d9d963e9c2d761c816.tar.bz2 upstream-52a82ce3dd901a1536c7d7d9d963e9c2d761c816.zip | |
kernel: Copy patches from kernel 4.14 to 4.19
This just copies the files from the kernel 4.14 specific folders into
the kernel 4.19 specific folder, no changes are done to the files in
this commit.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Diffstat (limited to 'target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch')
| -rw-r--r-- | target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch b/target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch new file mode 100644 index 0000000000..2a470f77e3 --- /dev/null +++ b/target/linux/generic/backport-4.19/367-v4.18-netfilter-nf_flow_table-add-missing-condition-for-TC.patch @@ -0,0 +1,48 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Fri, 23 Mar 2018 17:15:22 +0100 +Subject: [PATCH] netfilter: nf_flow_table: add missing condition for TCP state + check + +Avoid looking at unrelated fields in UDP packets + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -15,11 +15,14 @@ + #include <linux/tcp.h> + #include <linux/udp.h> + +-static int nf_flow_tcp_state_check(struct flow_offload *flow, +- struct sk_buff *skb, unsigned int thoff) ++static int nf_flow_state_check(struct flow_offload *flow, int proto, ++ struct sk_buff *skb, unsigned int thoff) + { + struct tcphdr *tcph; + ++ if (proto != IPPROTO_TCP) ++ return 0; ++ + if (!pskb_may_pull(skb, thoff + sizeof(*tcph))) + return -1; + +@@ -248,7 +251,7 @@ nf_flow_offload_ip_hook(void *priv, stru + return NF_DROP; + + thoff = ip_hdr(skb)->ihl * 4; +- if (nf_flow_tcp_state_check(flow, skb, thoff)) ++ if (nf_flow_state_check(flow, ip_hdr(skb)->protocol, skb, thoff)) + return NF_ACCEPT; + + if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) && +@@ -460,7 +463,8 @@ nf_flow_offload_ipv6_hook(void *priv, st + if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu))) + return NF_ACCEPT; + +- if (nf_flow_tcp_state_check(flow, skb, sizeof(*ip6h))) ++ if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb, ++ sizeof(*ip6h))) + return NF_ACCEPT; + + if (skb_try_make_writable(skb, sizeof(*ip6h))) |