Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6

diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index c25068e385169b3aee21594df68446696756ad91..5a449b44ba33255f4acebc28879a37ae7e3ab3bd 100644 (file)
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -62,7 +62,8 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
        if (ct && ct != &nf_conntrack_untracked) {
                if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
                        ret = __nf_conntrack_confirm(skb);
-               nf_ct_deliver_cached_events(ct);
+               if (likely(ret == NF_ACCEPT))
+                       nf_ct_deliver_cached_events(ct);
        }
        return ret;
 }

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index ed4d79a9e4a6263225a83f4874692fbca1911754..058a5e4a60c37e743c6dc001bcf603dc05474c82 100644 (file)
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -528,14 +528,14 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
                if (!ipv6_ext_hdr(nexthdr)) {
                        return -1;
                }
-               if (len < (int)sizeof(struct ipv6_opt_hdr)) {
-                       pr_debug("too short\n");
-                       return -1;
-               }
                if (nexthdr == NEXTHDR_NONE) {
                        pr_debug("next header is none\n");
                        return -1;
                }
+               if (len < (int)sizeof(struct ipv6_opt_hdr)) {
+                       pr_debug("too short\n");
+                       return -1;
+               }
                if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
                        BUG();
                if (nexthdr == NEXTHDR_AUTH)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 90ce9ddb9451a0c02f8d55b380ea07ee618265ed..f4935e344b61530a1e08732c873c1d3e7406d465 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -726,7 +726,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
        NF_CT_ASSERT(skb->nfct);
 
        ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
-       if (ret < 0) {
+       if (ret <= 0) {
                /* Invalid: inverse of the return code tells
                 * the netfilter core what to do */
                pr_debug("nf_conntrack_in: Can't track with proto module\n");

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index cb78aa00399e40c46ed15421eee8e01f612c5d63..ed6d873ad3840f50a0787a01b688597a93fa7516 100644 (file)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1780,6 +1780,7 @@ ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3, u32 pid, int report)
                goto out;
        }
 
+       exp->class = 0;
        exp->expectfn = NULL;
        exp->flags = 0;
        exp->master = ct;

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index a1edb9c1adee8625e5d81800c0fa8bb96ec483cc..f3fd154d1dddec9cc67c410d227421749539b6d1 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -859,7 +859,7 @@ static int tcp_packet(struct nf_conn *ct,
                         */
                        if (nf_ct_kill(ct))
                                return -NF_REPEAT;
-                       return -NF_DROP;
+                       return NF_DROP;
                }
                /* Fall through */
        case TCP_CONNTRACK_IGNORE:
@@ -892,7 +892,7 @@ static int tcp_packet(struct nf_conn *ct,
                                nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                          "nf_ct_tcp: killing out of sync session ");
                        nf_ct_kill(ct);
-                       return -NF_DROP;
+                       return NF_DROP;
                }
                ct->proto.tcp.last_index = index;
                ct->proto.tcp.last_dir = dir;