AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_log_invalid sysctl

Browse Source 
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Alexey Dobriyan 2008-10-08 11:35:08 +02:00 committed by Patrick McHardy
parent c04d05529a
commit c2a2c7e0cc
11 changed files with 39 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
include/net/netfilter/nf_conntrack_l4proto.h
View File

@ -117,20 +117,19 @@ extern int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
struct nf_conntrack_tuple *t); struct nf_conntrack_tuple *t);
extern const struct nla_policy nf_ct_port_nla_policy[]; extern const struct nla_policy nf_ct_port_nla_policy[];
/* Log invalid packets */
extern unsigned int nf_ct_log_invalid;
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
#ifdef DEBUG_INVALID_PACKETS #ifdef DEBUG_INVALID_PACKETS
#define LOG_INVALID(proto) \ #define LOG_INVALID(net, proto) \
(nf_ct_log_invalid == (proto) || nf_ct_log_invalid == IPPROTO_RAW) ((net)->ct.sysctl_log_invalid == (proto) || \
(net)->ct.sysctl_log_invalid == IPPROTO_RAW)
#else #else
#define LOG_INVALID(proto) \ #define LOG_INVALID(net, proto) \
((nf_ct_log_invalid == (proto) || nf_ct_log_invalid == IPPROTO_RAW) \ (((net)->ct.sysctl_log_invalid == (proto) || \
(net)->ct.sysctl_log_invalid == IPPROTO_RAW) \
&& net_ratelimit()) && net_ratelimit())
#endif #endif
#else #else
#define LOG_INVALID(proto) 0 #define LOG_INVALID(net, proto) 0
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
#endif /*_NF_CONNTRACK_PROTOCOL_H*/ #endif /*_NF_CONNTRACK_PROTOCOL_H*/

1
include/net/netns/conntrack.h
View File

@ -18,6 +18,7 @@ struct netns_ct {
struct nf_conntrack_ecache *ecache; struct nf_conntrack_ecache *ecache;
#endif #endif
int sysctl_checksum; int sysctl_checksum;
unsigned int sysctl_log_invalid; /* Log invalid packets */
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
struct ctl_table_header *sysctl_header; struct ctl_table_header *sysctl_header;
#endif #endif

2
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
View File

@ -278,7 +278,7 @@ static ctl_table ip_ct_sysctl_table[] = {
{ {
.ctl_name = NET_IPV4_NF_CONNTRACK_LOG_INVALID, .ctl_name = NET_IPV4_NF_CONNTRACK_LOG_INVALID,
.procname = "ip_conntrack_log_invalid", .procname = "ip_conntrack_log_invalid",
.data = &nf_ct_log_invalid, .data = &init_net.ct.sysctl_log_invalid,
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = &proc_dointvec_minmax, .proc_handler = &proc_dointvec_minmax,

6
net/ipv4/netfilter/nf_conntrack_proto_icmp.c
View File

@ -181,7 +181,7 @@ icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
/* Not enough header? */ /* Not enough header? */
icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih); icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
if (icmph == NULL) { if (icmph == NULL) {
if (LOG_INVALID(IPPROTO_ICMP)) if (LOG_INVALID(net, IPPROTO_ICMP))
nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL, nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
"nf_ct_icmp: short packet "); "nf_ct_icmp: short packet ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -190,7 +190,7 @@ icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
/* See ip_conntrack_proto_tcp.c */ /* See ip_conntrack_proto_tcp.c */
if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_ip_checksum(skb, hooknum, dataoff, 0)) { nf_ip_checksum(skb, hooknum, dataoff, 0)) {
if (LOG_INVALID(IPPROTO_ICMP)) if (LOG_INVALID(net, IPPROTO_ICMP))
nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL, nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
"nf_ct_icmp: bad HW ICMP checksum "); "nf_ct_icmp: bad HW ICMP checksum ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -203,7 +203,7 @@ icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
* discarded. * discarded.
*/ */
if (icmph->type > NR_ICMP_TYPES) { if (icmph->type > NR_ICMP_TYPES) {
if (LOG_INVALID(IPPROTO_ICMP)) if (LOG_INVALID(net, IPPROTO_ICMP))
nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL, nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
"nf_ct_icmp: invalid ICMP type "); "nf_ct_icmp: invalid ICMP type ");
return -NF_ACCEPT; return -NF_ACCEPT;

2
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
View File

@ -181,7 +181,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih); icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
if (icmp6h == NULL) { if (icmp6h == NULL) {
if (LOG_INVALID(IPPROTO_ICMPV6)) if (LOG_INVALID(net, IPPROTO_ICMPV6))
nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL, nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
"nf_ct_icmpv6: short packet "); "nf_ct_icmpv6: short packet ");
return -NF_ACCEPT; return -NF_ACCEPT;

1
net/netfilter/nf_conntrack_core.c
View File

@ -53,7 +53,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max);
struct nf_conn nf_conntrack_untracked __read_mostly; struct nf_conn nf_conntrack_untracked __read_mostly;
EXPORT_SYMBOL_GPL(nf_conntrack_untracked); EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
unsigned int nf_ct_log_invalid __read_mostly;
static struct kmem_cache *nf_conntrack_cachep __read_mostly; static struct kmem_cache *nf_conntrack_cachep __read_mostly;
static int nf_conntrack_hash_rnd_initted; static int nf_conntrack_hash_rnd_initted;

10
net/netfilter/nf_conntrack_proto_dccp.c
View File

@ -418,6 +418,7 @@ static bool dccp_invert_tuple(struct nf_conntrack_tuple *inv,
static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb, static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
unsigned int dataoff) unsigned int dataoff)
{ {
struct net *net = nf_ct_net(ct);
struct dccp_hdr _dh, *dh; struct dccp_hdr _dh, *dh;
const char *msg; const char *msg;
u_int8_t state; u_int8_t state;
@ -445,7 +446,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
return true; return true;
out_invalid: out_invalid:
if (LOG_INVALID(IPPROTO_DCCP)) if (LOG_INVALID(net, IPPROTO_DCCP))
nf_log_packet(nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL, msg); nf_log_packet(nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL, msg);
return false; return false;
} }
@ -463,6 +464,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
unsigned int dataoff, enum ip_conntrack_info ctinfo, unsigned int dataoff, enum ip_conntrack_info ctinfo,
u_int8_t pf, unsigned int hooknum) u_int8_t pf, unsigned int hooknum)
{ {
struct net *net = nf_ct_net(ct);
enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
struct dccp_hdr _dh, *dh; struct dccp_hdr _dh, *dh;
u_int8_t type, old_state, new_state; u_int8_t type, old_state, new_state;
@ -524,13 +526,13 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
ct->proto.dccp.last_pkt = type; ct->proto.dccp.last_pkt = type;
write_unlock_bh(&dccp_lock); write_unlock_bh(&dccp_lock);
if (LOG_INVALID(IPPROTO_DCCP)) if (LOG_INVALID(net, IPPROTO_DCCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_dccp: invalid packet ignored "); "nf_ct_dccp: invalid packet ignored ");
return NF_ACCEPT; return NF_ACCEPT;
case CT_DCCP_INVALID: case CT_DCCP_INVALID:
write_unlock_bh(&dccp_lock); write_unlock_bh(&dccp_lock);
if (LOG_INVALID(IPPROTO_DCCP)) if (LOG_INVALID(net, IPPROTO_DCCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_dccp: invalid state transition "); "nf_ct_dccp: invalid state transition ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -590,7 +592,7 @@ static int dccp_error(struct net *net, struct sk_buff *skb,
return NF_ACCEPT; return NF_ACCEPT;
out_invalid: out_invalid:
if (LOG_INVALID(IPPROTO_DCCP)) if (LOG_INVALID(net, IPPROTO_DCCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, msg); nf_log_packet(pf, 0, skb, NULL, NULL, NULL, msg);
return -NF_ACCEPT; return -NF_ACCEPT;
} }

18
net/netfilter/nf_conntrack_proto_tcp.c
View File

@ -488,6 +488,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
const struct tcphdr *tcph, const struct tcphdr *tcph,
u_int8_t pf) u_int8_t pf)
{ {
struct net *net = nf_ct_net(ct);
struct ip_ct_tcp_state *sender = &state->seen[dir]; struct ip_ct_tcp_state *sender = &state->seen[dir];
struct ip_ct_tcp_state *receiver = &state->seen[!dir]; struct ip_ct_tcp_state *receiver = &state->seen[!dir];
const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple; const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
@ -668,7 +669,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL || if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
nf_ct_tcp_be_liberal) nf_ct_tcp_be_liberal)
res = true; res = true;
if (!res && LOG_INVALID(IPPROTO_TCP)) if (!res && LOG_INVALID(net, IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: %s ", "nf_ct_tcp: %s ",
before(seq, sender->td_maxend + 1) ? before(seq, sender->td_maxend + 1) ?
@ -761,7 +762,7 @@ static int tcp_error(struct net *net,
/* Smaller that minimal TCP header? */ /* Smaller that minimal TCP header? */
th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph); th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
if (th == NULL) { if (th == NULL) {
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(net, IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: short packet "); "nf_ct_tcp: short packet ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -769,7 +770,7 @@ static int tcp_error(struct net *net,
/* Not whole TCP header or malformed packet */ /* Not whole TCP header or malformed packet */
if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) { if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(net, IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: truncated/malformed packet "); "nf_ct_tcp: truncated/malformed packet ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -782,7 +783,7 @@ static int tcp_error(struct net *net,
/* FIXME: Source route IP option packets --RR */ /* FIXME: Source route IP option packets --RR */
if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) { nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(net, IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: bad TCP checksum "); "nf_ct_tcp: bad TCP checksum ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -791,7 +792,7 @@ static int tcp_error(struct net *net,
/* Check TCP flags. */ /* Check TCP flags. */
tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH)); tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
if (!tcp_valid_flags[tcpflags]) { if (!tcp_valid_flags[tcpflags]) {
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(net, IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: invalid TCP flag combination "); "nf_ct_tcp: invalid TCP flag combination ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -808,6 +809,7 @@ static int tcp_packet(struct nf_conn *ct,
u_int8_t pf, u_int8_t pf,
unsigned int hooknum) unsigned int hooknum)
{ {
struct net *net = nf_ct_net(ct);
struct nf_conntrack_tuple *tuple; struct nf_conntrack_tuple *tuple;
enum tcp_conntrack new_state, old_state; enum tcp_conntrack new_state, old_state;
enum ip_conntrack_dir dir; enum ip_conntrack_dir dir;
@ -886,7 +888,7 @@ static int tcp_packet(struct nf_conn *ct,
* thus initiate a clean new session. * thus initiate a clean new session.
*/ */
write_unlock_bh(&tcp_lock); write_unlock_bh(&tcp_lock);
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(net, IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: killing out of sync session "); "nf_ct_tcp: killing out of sync session ");
nf_ct_kill(ct); nf_ct_kill(ct);
@ -899,7 +901,7 @@ static int tcp_packet(struct nf_conn *ct,
segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th); segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
write_unlock_bh(&tcp_lock); write_unlock_bh(&tcp_lock);
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(net, IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: invalid packet ignored "); "nf_ct_tcp: invalid packet ignored ");
return NF_ACCEPT; return NF_ACCEPT;
@ -908,7 +910,7 @@ static int tcp_packet(struct nf_conn *ct,
pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n", pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
dir, get_conntrack_index(th), old_state); dir, get_conntrack_index(th), old_state);
write_unlock_bh(&tcp_lock); write_unlock_bh(&tcp_lock);
if (LOG_INVALID(IPPROTO_TCP)) if (LOG_INVALID(net, IPPROTO_TCP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: invalid state "); "nf_ct_tcp: invalid state ");
return -NF_ACCEPT; return -NF_ACCEPT;

6
net/netfilter/nf_conntrack_proto_udp.c
View File

@ -101,7 +101,7 @@ static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
/* Header is too small? */ /* Header is too small? */
hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr); hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
if (hdr == NULL) { if (hdr == NULL) {
if (LOG_INVALID(IPPROTO_UDP)) if (LOG_INVALID(net, IPPROTO_UDP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_udp: short packet "); "nf_ct_udp: short packet ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -109,7 +109,7 @@ static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
/* Truncated/malformed packets */ /* Truncated/malformed packets */
if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) { if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) {
if (LOG_INVALID(IPPROTO_UDP)) if (LOG_INVALID(net, IPPROTO_UDP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_udp: truncated/malformed packet "); "nf_ct_udp: truncated/malformed packet ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -125,7 +125,7 @@ static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
* FIXME: Source route IP option packets --RR */ * FIXME: Source route IP option packets --RR */
if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) { nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) {
if (LOG_INVALID(IPPROTO_UDP)) if (LOG_INVALID(net, IPPROTO_UDP))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_udp: bad UDP checksum "); "nf_ct_udp: bad UDP checksum ");
return -NF_ACCEPT; return -NF_ACCEPT;

8
net/netfilter/nf_conntrack_proto_udplite.c
View File

@ -104,7 +104,7 @@ static int udplite_error(struct net *net,
/* Header is too small? */ /* Header is too small? */
hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr); hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
if (hdr == NULL) { if (hdr == NULL) {
if (LOG_INVALID(IPPROTO_UDPLITE)) if (LOG_INVALID(net, IPPROTO_UDPLITE))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_udplite: short packet "); "nf_ct_udplite: short packet ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -114,7 +114,7 @@ static int udplite_error(struct net *net,
if (cscov == 0) if (cscov == 0)
cscov = udplen; cscov = udplen;
else if (cscov < sizeof(*hdr) || cscov > udplen) { else if (cscov < sizeof(*hdr) || cscov > udplen) {
if (LOG_INVALID(IPPROTO_UDPLITE)) if (LOG_INVALID(net, IPPROTO_UDPLITE))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_udplite: invalid checksum coverage "); "nf_ct_udplite: invalid checksum coverage ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -122,7 +122,7 @@ static int udplite_error(struct net *net,
/* UDPLITE mandates checksums */ /* UDPLITE mandates checksums */
if (!hdr->check) { if (!hdr->check) {
if (LOG_INVALID(IPPROTO_UDPLITE)) if (LOG_INVALID(net, IPPROTO_UDPLITE))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_udplite: checksum missing "); "nf_ct_udplite: checksum missing ");
return -NF_ACCEPT; return -NF_ACCEPT;
@ -132,7 +132,7 @@ static int udplite_error(struct net *net,
if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP, nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP,
pf)) { pf)) {
if (LOG_INVALID(IPPROTO_UDPLITE)) if (LOG_INVALID(net, IPPROTO_UDPLITE))
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_udplite: bad UDPLite checksum "); "nf_ct_udplite: bad UDPLite checksum ");
return -NF_ACCEPT; return -NF_ACCEPT;

6
net/netfilter/nf_conntrack_standalone.c
View File

@ -365,7 +365,7 @@ static ctl_table nf_ct_sysctl_table[] = {
{ {
.ctl_name = NET_NF_CONNTRACK_LOG_INVALID, .ctl_name = NET_NF_CONNTRACK_LOG_INVALID,
.procname = "nf_conntrack_log_invalid", .procname = "nf_conntrack_log_invalid",
.data = &nf_ct_log_invalid, .data = &init_net.ct.sysctl_log_invalid,
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = &proc_dointvec_minmax, .proc_handler = &proc_dointvec_minmax,
@ -403,8 +403,6 @@ static struct ctl_path nf_ct_path[] = {
{ } { }
}; };
EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
static int nf_conntrack_standalone_init_sysctl(struct net *net) static int nf_conntrack_standalone_init_sysctl(struct net *net)
{ {
struct ctl_table *table; struct ctl_table *table;
@ -423,6 +421,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
table[1].data = &net->ct.count; table[1].data = &net->ct.count;
table[3].data = &net->ct.sysctl_checksum; table[3].data = &net->ct.sysctl_checksum;
table[4].data = &net->ct.sysctl_log_invalid;
net->ct.sysctl_header = register_net_sysctl_table(net, net->ct.sysctl_header = register_net_sysctl_table(net,
nf_net_netfilter_sysctl_path, table); nf_net_netfilter_sysctl_path, table);
@ -473,6 +472,7 @@ static int nf_conntrack_net_init(struct net *net)
if (ret < 0) if (ret < 0)
goto out_proc; goto out_proc;
net->ct.sysctl_checksum = 1; net->ct.sysctl_checksum = 1;
net->ct.sysctl_log_invalid = 0;
ret = nf_conntrack_standalone_init_sysctl(net); ret = nf_conntrack_standalone_init_sysctl(net);
if (ret < 0) if (ret < 0)
goto out_sysctl; goto out_sysctl;