kernel: refresh generic 3.10 patches
[openwrt/svn-archive/archive.git] / target / linux / generic / patches-3.10 / 617-netfilter_skip_filter_sysctl.patch
1 --- a/include/net/netns/conntrack.h
2 +++ b/include/net/netns/conntrack.h
3 @@ -80,6 +80,7 @@ struct netns_ct {
4 int sysctl_acct;
5 int sysctl_tstamp;
6 int sysctl_checksum;
7 + int skip_filter;
8 unsigned int sysctl_log_invalid; /* Log invalid packets */
9 int sysctl_auto_assign_helper;
10 bool auto_assign_helper_warned;
11 --- a/net/ipv4/netfilter/iptable_filter.c
12 +++ b/net/ipv4/netfilter/iptable_filter.c
13 @@ -15,6 +15,7 @@
14 #include <linux/netfilter_ipv4/ip_tables.h>
15 #include <linux/slab.h>
16 #include <net/ip.h>
17 +#include <net/netfilter/nf_conntrack.h>
18
19 MODULE_LICENSE("GPL");
20 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
21 @@ -37,6 +38,7 @@ iptable_filter_hook(unsigned int hook, s
22 const struct net_device *in, const struct net_device *out,
23 int (*okfn)(struct sk_buff *))
24 {
25 + enum ip_conntrack_info ctinfo;
26 const struct net *net;
27
28 if (hook == NF_INET_LOCAL_OUT &&
29 @@ -46,6 +48,11 @@ iptable_filter_hook(unsigned int hook, s
30 return NF_ACCEPT;
31
32 net = dev_net((in != NULL) ? in : out);
33 + nf_ct_get(skb, &ctinfo);
34 + if ((ctinfo == IP_CT_ESTABLISHED_REPLY || ctinfo == IP_CT_ESTABLISHED) &&
35 + net->ct.skip_filter)
36 + return NF_ACCEPT;
37 +
38 return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
39 }
40
41 --- a/net/ipv6/netfilter/ip6table_filter.c
42 +++ b/net/ipv6/netfilter/ip6table_filter.c
43 @@ -13,6 +13,7 @@
44 #include <linux/moduleparam.h>
45 #include <linux/netfilter_ipv6/ip6_tables.h>
46 #include <linux/slab.h>
47 +#include <net/netfilter/nf_conntrack.h>
48
49 MODULE_LICENSE("GPL");
50 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
51 @@ -37,6 +38,12 @@ ip6table_filter_hook(unsigned int hook,
52 int (*okfn)(struct sk_buff *))
53 {
54 const struct net *net = dev_net((in != NULL) ? in : out);
55 + enum ip_conntrack_info ctinfo;
56 +
57 + nf_ct_get(skb, &ctinfo);
58 + if ((ctinfo == IP_CT_ESTABLISHED_REPLY || ctinfo == IP_CT_ESTABLISHED) &&
59 + net->ct.skip_filter)
60 + return NF_ACCEPT;
61
62 return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
63 }
64 --- a/net/netfilter/nf_conntrack_standalone.c
65 +++ b/net/netfilter/nf_conntrack_standalone.c
66 @@ -510,6 +510,13 @@ static ctl_table nf_ct_sysctl_table[] =
67 .extra2 = &log_invalid_proto_max,
68 },
69 {
70 + .procname = "nf_conntrack_skip_filter",
71 + .data = &init_net.ct.skip_filter,
72 + .maxlen = sizeof(int),
73 + .mode = 0644,
74 + .proc_handler = proc_dointvec,
75 + },
76 + {
77 .procname = "nf_conntrack_expect_max",
78 .data = &nf_ct_expect_max,
79 .maxlen = sizeof(int),
80 @@ -545,6 +552,7 @@ static int nf_conntrack_standalone_init_
81 table[2].data = &net->ct.htable_size;
82 table[3].data = &net->ct.sysctl_checksum;
83 table[4].data = &net->ct.sysctl_log_invalid;
84 + table[5].data = &net->ct.skip_filter;
85
86 /* Don't export sysctls to unprivileged users */
87 if (net->user_ns != &init_user_ns)