diff options
| author | David S. Miller <davem@davemloft.net> | 2022-02-11 14:55:08 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2022-02-11 14:55:08 +0300 |
| commit | 525de9a79349bd83fe5276d7672f91887f9ee721 (patch) | |
| tree | 26044e5026d81e41e1f0742b563ab3b5ce4e8e85 /net | |
| parent | dcd54265c8bc14bd023815e36e2d5f9d66ee1fee (diff) | |
| parent | bbe4c0896d25009a7c86285d2ab024eed4374eea (diff) | |
| download | linux-525de9a79349bd83fe5276d7672f91887f9ee721.tar.xz | |
Merge ra.kernel.org:/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter fixes for net
The following patchset contains Netfilter fixes for net:
1) Add selftest for nft_synproxy, from Florian Westphal.
2) xt_socket destroy path incorrectly disables IPv4 defrag for
IPv6 traffic (typo), from Eric Dumazet.
3) Fix exit value selftest nft_concat_range.sh, from Hangbin Liu.
4) nft_synproxy disables the IPv4 hooks if the IPv6 hooks fail
to be registered.
5) disable rp_filter on router in selftest nft_fib.sh, also
from Hangbin Liu.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nft_synproxy.c | 4 | ||||
| -rw-r--r-- | net/netfilter/xt_socket.c | 2 |
2 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c index a0109fa1e92d..1133e06f3c40 100644 --- a/net/netfilter/nft_synproxy.c +++ b/net/netfilter/nft_synproxy.c @@ -191,8 +191,10 @@ static int nft_synproxy_do_init(const struct nft_ctx *ctx, if (err) goto nf_ct_failure; err = nf_synproxy_ipv6_init(snet, ctx->net); - if (err) + if (err) { + nf_synproxy_ipv4_fini(snet, ctx->net); goto nf_ct_failure; + } break; } diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index 5e6459e11605..662e5eb1cc39 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c @@ -221,7 +221,7 @@ static void socket_mt_destroy(const struct xt_mtdtor_param *par) if (par->family == NFPROTO_IPV4) nf_defrag_ipv4_disable(par->net); else if (par->family == NFPROTO_IPV6) - nf_defrag_ipv4_disable(par->net); + nf_defrag_ipv6_disable(par->net); } static struct xt_match socket_mt_reg[] __read_mostly = { |