kernel: generic: Add kernel 4.14 support
[openwrt/openwrt.git] / target / linux / generic / pending-4.14 / 611-netfilter_match_bypass_default_table.patch
1 From: Felix Fietkau <nbd@nbd.name>
2 Subject: netfilter: match bypass default table
3
4 Signed-off-by: Felix Fietkau <nbd@nbd.name>
5 ---
6 net/ipv4/netfilter/ip_tables.c | 79 +++++++++++++++++++++++++++++++-----------
7 1 file changed, 58 insertions(+), 21 deletions(-)
8
9 --- a/net/ipv4/netfilter/ip_tables.c
10 +++ b/net/ipv4/netfilter/ip_tables.c
11 @@ -248,6 +248,33 @@ struct ipt_entry *ipt_next_entry(const s
12 return (void *)entry + entry->next_offset;
13 }
14
15 +static bool
16 +ipt_handle_default_rule(struct ipt_entry *e, unsigned int *verdict)
17 +{
18 + struct xt_entry_target *t;
19 + struct xt_standard_target *st;
20 +
21 + if (e->target_offset != sizeof(struct ipt_entry))
22 + return false;
23 +
24 + if (!(e->ip.flags & IPT_F_NO_DEF_MATCH))
25 + return false;
26 +
27 + t = ipt_get_target(e);
28 + if (t->u.kernel.target->target)
29 + return false;
30 +
31 + st = (struct xt_standard_target *) t;
32 + if (st->verdict == XT_RETURN)
33 + return false;
34 +
35 + if (st->verdict >= 0)
36 + return false;
37 +
38 + *verdict = (unsigned)(-st->verdict) - 1;
39 + return true;
40 +}
41 +
42 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
43 unsigned int
44 ipt_do_table(struct sk_buff *skb,
45 @@ -268,24 +295,8 @@ ipt_do_table(struct sk_buff *skb,
46 unsigned int addend;
47
48 /* Initialization */
49 - stackidx = 0;
50 - ip = ip_hdr(skb);
51 - indev = state->in ? state->in->name : nulldevname;
52 - outdev = state->out ? state->out->name : nulldevname;
53 - /* We handle fragments by dealing with the first fragment as
54 - * if it was a normal packet. All other fragments are treated
55 - * normally, except that they will NEVER match rules that ask
56 - * things we don't know, ie. tcp syn flag or ports). If the
57 - * rule is also a fragment-specific rule, non-fragments won't
58 - * match it. */
59 - acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
60 - acpar.thoff = ip_hdrlen(skb);
61 - acpar.hotdrop = false;
62 - acpar.state = state;
63 -
64 WARN_ON(!(table->valid_hooks & (1 << hook)));
65 local_bh_disable();
66 - addend = xt_write_recseq_begin();
67 private = table->private;
68 cpu = smp_processor_id();
69 /*
70 @@ -294,6 +305,23 @@ ipt_do_table(struct sk_buff *skb,
71 */
72 smp_read_barrier_depends();
73 table_base = private->entries;
74 +
75 + e = get_entry(table_base, private->hook_entry[hook]);
76 + if (ipt_handle_default_rule(e, &verdict)) {
77 + struct xt_counters *counter;
78 +
79 + counter = xt_get_this_cpu_counter(&e->counters);
80 + ADD_COUNTER(*counter, skb->len, 1);
81 + local_bh_enable();
82 + return verdict;
83 + }
84 +
85 + stackidx = 0;
86 + ip = ip_hdr(skb);
87 + indev = state->in ? state->in->name : nulldevname;
88 + outdev = state->out ? state->out->name : nulldevname;
89 +
90 + addend = xt_write_recseq_begin();
91 jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
92
93 /* Switch to alternate jumpstack if we're being invoked via TEE.
94 @@ -306,7 +334,16 @@ ipt_do_table(struct sk_buff *skb,
95 if (static_key_false(&xt_tee_enabled))
96 jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
97
98 - e = get_entry(table_base, private->hook_entry[hook]);
99 + /* We handle fragments by dealing with the first fragment as
100 + * if it was a normal packet. All other fragments are treated
101 + * normally, except that they will NEVER match rules that ask
102 + * things we don't know, ie. tcp syn flag or ports). If the
103 + * rule is also a fragment-specific rule, non-fragments won't
104 + * match it. */
105 + acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
106 + acpar.thoff = ip_hdrlen(skb);
107 + acpar.hotdrop = false;
108 + acpar.state = state;
109
110 do {
111 const struct xt_entry_target *t;