Author: nbd Date: 2015-03-17 18:15:15 +0100 (Tue, 17 Mar 2015) New Revision: 44874
Removed: branches/barrier_breaker/target/linux/generic/patches-3.10/617-netfilter_skip_filter_sysctl.patch Modified: branches/barrier_breaker/package/base-files/files/etc/sysctl.conf Log: kernel: remove the netfilter optimization that skips the filter table, it has caused too many issues Signed-off-by: Felix Fietkau <[email protected]> Backport of r44873 Modified: branches/barrier_breaker/package/base-files/files/etc/sysctl.conf =================================================================== --- branches/barrier_breaker/package/base-files/files/etc/sysctl.conf 2015-03-17 17:14:48 UTC (rev 44873) +++ branches/barrier_breaker/package/base-files/files/etc/sysctl.conf 2015-03-17 17:15:15 UTC (rev 44874) @@ -22,7 +22,6 @@ net.netfilter.nf_conntrack_tcp_timeout_established=7440 net.netfilter.nf_conntrack_udp_timeout=60 net.netfilter.nf_conntrack_udp_timeout_stream=180 -net.netfilter.nf_conntrack_skip_filter=1 # disable bridge firewalling by default net.bridge.bridge-nf-call-arptables=0 Deleted: branches/barrier_breaker/target/linux/generic/patches-3.10/617-netfilter_skip_filter_sysctl.patch =================================================================== --- branches/barrier_breaker/target/linux/generic/patches-3.10/617-netfilter_skip_filter_sysctl.patch 2015-03-17 17:14:48 UTC (rev 44873) +++ branches/barrier_breaker/target/linux/generic/patches-3.10/617-netfilter_skip_filter_sysctl.patch 2015-03-17 17:15:15 UTC (rev 44874) @@ -1,87 +0,0 @@ ---- a/include/net/netns/conntrack.h -+++ b/include/net/netns/conntrack.h -@@ -80,6 +80,7 @@ struct netns_ct { - int sysctl_acct; - int sysctl_tstamp; - int sysctl_checksum; -+ int skip_filter; - unsigned int sysctl_log_invalid; /* Log invalid packets */ - int sysctl_auto_assign_helper; - bool auto_assign_helper_warned; ---- a/net/ipv4/netfilter/iptable_filter.c -+++ b/net/ipv4/netfilter/iptable_filter.c -@@ -15,6 +15,7 @@ - #include <linux/netfilter_ipv4/ip_tables.h> - #include <linux/slab.h> - #include <net/ip.h> -+#include <net/netfilter/nf_conntrack.h> - - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Netfilter Core Team <[email protected]>"); -@@ -37,6 +38,7 @@ iptable_filter_hook(unsigned int hook, s - const struct net_device *in, const struct net_device *out, - int (*okfn)(struct sk_buff *)) - { -+ enum ip_conntrack_info ctinfo; - const struct net *net; - - if (hook == NF_INET_LOCAL_OUT && -@@ -46,6 +48,11 @@ iptable_filter_hook(unsigned int hook, s - return NF_ACCEPT; - - net = dev_net((in != NULL) ? in : out); -+ nf_ct_get(skb, &ctinfo); -+ if ((ctinfo == IP_CT_ESTABLISHED_REPLY || ctinfo == IP_CT_ESTABLISHED) && -+ net->ct.skip_filter) -+ return NF_ACCEPT; -+ - return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter); - } - ---- a/net/ipv6/netfilter/ip6table_filter.c -+++ b/net/ipv6/netfilter/ip6table_filter.c -@@ -13,6 +13,7 @@ - #include <linux/moduleparam.h> - #include <linux/netfilter_ipv6/ip6_tables.h> - #include <linux/slab.h> -+#include <net/netfilter/nf_conntrack.h> - - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Netfilter Core Team <[email protected]>"); -@@ -37,6 +38,12 @@ ip6table_filter_hook(unsigned int hook, - int (*okfn)(struct sk_buff *)) - { - const struct net *net = dev_net((in != NULL) ? in : out); -+ enum ip_conntrack_info ctinfo; -+ -+ nf_ct_get(skb, &ctinfo); -+ if ((ctinfo == IP_CT_ESTABLISHED_REPLY || ctinfo == IP_CT_ESTABLISHED) && -+ net->ct.skip_filter) -+ return NF_ACCEPT; - - return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter); - } ---- a/net/netfilter/nf_conntrack_standalone.c -+++ b/net/netfilter/nf_conntrack_standalone.c -@@ -477,6 +477,13 @@ static ctl_table nf_ct_sysctl_table[] = - .extra2 = &log_invalid_proto_max, - }, - { -+ .procname = "nf_conntrack_skip_filter", -+ .data = &init_net.ct.skip_filter, -+ .maxlen = sizeof(int), -+ .mode = 0644, -+ .proc_handler = proc_dointvec, -+ }, -+ { - .procname = "nf_conntrack_expect_max", - .data = &nf_ct_expect_max, - .maxlen = sizeof(int), -@@ -512,6 +519,7 @@ static int nf_conntrack_standalone_init_ - table[2].data = &net->ct.htable_size; - table[3].data = &net->ct.sysctl_checksum; - table[4].data = &net->ct.sysctl_log_invalid; -+ table[5].data = &net->ct.skip_filter; - - /* Don't export sysctls to unprivileged users */ - if (net->user_ns != &init_user_ns) _______________________________________________ openwrt-commits mailing list [email protected] https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-commits
