target/linux/generic/patches-3.14/617-netfilter_skip_filter_sysctl.patch

   1 --- a/include/net/netns/conntrack.h
   2 +++ b/include/net/netns/conntrack.h
   3 @@ -73,6 +73,7 @@ struct netns_ct {
   4         struct ctl_table_header *helper_sysctl_header;
   5  #endif
   6         char                    *slabname;
   7 +       int                     skip_filter;
   8         unsigned int            sysctl_log_invalid; /* Log invalid packets */
   9         unsigned int            sysctl_events_retry_timeout;
  10         int                     sysctl_events;
  11 --- a/net/ipv4/netfilter/iptable_filter.c
  12 +++ b/net/ipv4/netfilter/iptable_filter.c
  13 @@ -15,6 +15,7 @@
  14  #include <linux/netfilter_ipv4/ip_tables.h>
  15  #include <linux/slab.h>
  16  #include <net/ip.h>
  17 +#include <net/netfilter/nf_conntrack.h>
  18
  19  MODULE_LICENSE("GPL");
  20  MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  21 @@ -37,6 +38,7 @@ iptable_filter_hook(const struct nf_hook
  22                     const struct net_device *in, const struct net_device *out,
  23                     int (*okfn)(struct sk_buff *))
  24  {
  25 +       enum ip_conntrack_info ctinfo;
  26         const struct net *net;
  27
  28         if (ops->hooknum == NF_INET_LOCAL_OUT &&
  29 @@ -46,6 +48,11 @@ iptable_filter_hook(const struct nf_hook
  30                 return NF_ACCEPT;
  31
  32         net = dev_net((in != NULL) ? in : out);
  33 +       nf_ct_get(skb, &ctinfo);
  34 +       if ((ctinfo == IP_CT_ESTABLISHED_REPLY || ctinfo == IP_CT_ESTABLISHED) &&
  35 +           net->ct.skip_filter)
  36 +           return NF_ACCEPT;
  37 +
  38         return ipt_do_table(skb, ops->hooknum, in, out,
  39                             net->ipv4.iptable_filter);
  40  }
  41 --- a/net/ipv6/netfilter/ip6table_filter.c
  42 +++ b/net/ipv6/netfilter/ip6table_filter.c
  43 @@ -13,6 +13,7 @@
  44  #include <linux/moduleparam.h>
  45  #include <linux/netfilter_ipv6/ip6_tables.h>
  46  #include <linux/slab.h>
  47 +#include <net/netfilter/nf_conntrack.h>
  48
  49  MODULE_LICENSE("GPL");
  50  MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  51 @@ -37,6 +38,12 @@ ip6table_filter_hook(const struct nf_hoo
  52                      int (*okfn)(struct sk_buff *))
  53  {
  54         const struct net *net = dev_net((in != NULL) ? in : out);
  55 +       enum ip_conntrack_info ctinfo;
  56 +
  57 +       nf_ct_get(skb, &ctinfo);
  58 +       if ((ctinfo == IP_CT_ESTABLISHED_REPLY || ctinfo == IP_CT_ESTABLISHED) &&
  59 +           net->ct.skip_filter)
  60 +           return NF_ACCEPT;
  61
  62         return ip6t_do_table(skb, ops->hooknum, in, out,
  63                              net->ipv6.ip6table_filter);
  64 --- a/net/netfilter/nf_conntrack_standalone.c
  65 +++ b/net/netfilter/nf_conntrack_standalone.c
  66 @@ -477,6 +477,13 @@ static struct ctl_table nf_ct_sysctl_tab
  67                 .extra2         = &log_invalid_proto_max,
  68         },
  69         {
  70 +               .procname       = "nf_conntrack_skip_filter",
  71 +               .data           = &init_net.ct.skip_filter,
  72 +               .maxlen         = sizeof(int),
  73 +               .mode           = 0644,
  74 +               .proc_handler   = proc_dointvec,
  75 +       },
  76 +       {
  77                 .procname       = "nf_conntrack_expect_max",
  78                 .data           = &nf_ct_expect_max,
  79                 .maxlen         = sizeof(int),
  80 @@ -512,6 +519,7 @@ static int nf_conntrack_standalone_init_
  81         table[2].data = &net->ct.htable_size;
  82         table[3].data = &net->ct.sysctl_checksum;
  83         table[4].data = &net->ct.sysctl_log_invalid;
  84 +       table[5].data = &net->ct.skip_filter;
  85
  86         /* Don't export sysctls to unprivileged users */
  87         if (net->user_ns != &init_user_ns)