summaryrefslogtreecommitdiff
path: root/target/linux
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2009-05-28 15:52:18 +0000
committerFelix Fietkau <nbd@openwrt.org>2009-05-28 15:52:18 +0000
commit38e76887a4a5e86508b735f1454d0110eb8f0200 (patch)
treee7cb8496796d6cabc1d967f387336b8c0af79985 /target/linux
parent23260054dcff2f1c0e4128bf20a2fb4998a9ae9e (diff)
downloadmtk-20170518-38e76887a4a5e86508b735f1454d0110eb8f0200.zip
mtk-20170518-38e76887a4a5e86508b735f1454d0110eb8f0200.tar.gz
mtk-20170518-38e76887a4a5e86508b735f1454d0110eb8f0200.tar.bz2
brcm-2.4: fix conntrack structure inconsistency with iptables, which can cause problems with port matching/forwarding and protocol matching
SVN-Revision: 16141
Diffstat (limited to 'target/linux')
-rw-r--r--target/linux/generic-2.4/patches/626-netfilter_conntrack_fix.patch49
1 files changed, 49 insertions, 0 deletions
diff --git a/target/linux/generic-2.4/patches/626-netfilter_conntrack_fix.patch b/target/linux/generic-2.4/patches/626-netfilter_conntrack_fix.patch
new file mode 100644
index 0000000..865df8d
--- /dev/null
+++ b/target/linux/generic-2.4/patches/626-netfilter_conntrack_fix.patch
@@ -0,0 +1,49 @@
+--- a/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
++++ b/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
+@@ -68,6 +68,35 @@ struct ip_conntrack_tuple
+ } dst;
+ };
+
++/* This is exposed to userspace, so remains frozen in time. */
++struct ip_conntrack_old_tuple
++{
++ struct ip_conntrack_manip src;
++
++ /* These are the parts of the tuple which are fixed. */
++ struct {
++ u_int32_t ip;
++ union {
++ /* Add other protocols here. */
++ u_int16_t all;
++
++ struct {
++ u_int16_t port;
++ } tcp;
++ struct {
++ u_int16_t port;
++ } udp;
++ struct {
++ u_int8_t type, code;
++ } icmp;
++ } u;
++
++ /* The protocol. */
++ u_int16_t protonum;
++ } dst;
++};
++
++
+ /* This is optimized opposed to a memset of the whole structure. Everything we
+ * really care about is the source/destination unions */
+ #define IP_CT_TUPLE_U_BLANK(tuple) \
+--- a/include/linux/netfilter_ipv4/ipt_conntrack.h
++++ b/include/linux/netfilter_ipv4/ipt_conntrack.h
+@@ -25,7 +25,7 @@ struct ipt_conntrack_info
+ {
+ unsigned int statemask, statusmask;
+
+- struct ip_conntrack_tuple tuple[IP_CT_DIR_MAX];
++ struct ip_conntrack_old_tuple tuple[IP_CT_DIR_MAX];
+ struct in_addr sipmsk[IP_CT_DIR_MAX], dipmsk[IP_CT_DIR_MAX];
+
+ unsigned long expires_min, expires_max;