Julian Anastasov 2a71d94e4f ipvs: remove IPS_NAT_MASK check to fix passive FTP ...

[ Upstream commit 8a949fff03 ]

The IPS_NAT_MASK check in 4.12 replaced previous check for nfct_nat()
which was needed to fix a crash in 2.6.36-rc, see
commit 7bcbf81a22 ("ipvs: avoid oops for passive FTP").
But as IPVS does not set the IPS_SRC_NAT and IPS_DST_NAT bits,
checking for IPS_NAT_MASK prevents PASV response to be properly
mangled and blocks the transfer. Remove the check as it is not
needed after 3.12 commit 41d73ec053 ("netfilter: nf_conntrack:
make sequence number adjustments usuable without NAT") which
changes nfct_nat() with nfct_seqadj() and especially after 3.13
commit b25adce160 ("ipvs: correct usage/allocation of seqadj
ext in ipvs").

Thanks to Li Shuang and Florian Westphal for reporting the problem!

Reported-by: Li Shuang <shuali@redhat.com>
Fixes: be7be6e161 ("netfilter: ipvs: fix incorrect conflict resolution")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-05-30 07:52:07 +02:00

..

ip_vs_app.c

netfilter: ipvs: avoid unused variable warnings

2016-02-18 09:17:58 +09:00

ip_vs_conn.c

netfilter: refcounter conversions

2017-03-17 12:49:43 +01:00

ip_vs_core.c

netfilter: nf_hook_ops structs can be const

2017-07-31 19:10:44 +02:00

ip_vs_ctl.c

ipvs: fix rtnl_lock lockups caused by start_sync_thread

2018-05-16 10:10:22 +02:00

ip_vs_dh.c

lib/vsprintf.c: remove %Z support

2017-02-27 18:43:47 -08:00

ip_vs_est.c

ipvs: Pass ipvs not net to ip_vs_estimator_net_init and ip_vs_estimator_cleanup

2015-09-24 09:34:39 +09:00

ip_vs_fo.c

ipvs: use correct address family in scheduler logs

2014-09-18 08:59:23 +09:00

ip_vs_ftp.c

ipvs: remove IPS_NAT_MASK check to fix passive FTP

2018-05-30 07:52:07 +02:00

ip_vs_lblc.c

netfilter: refcounter conversions

2017-03-17 12:49:43 +01:00

ip_vs_lblcr.c

netfilter: refcounter conversions

2017-03-17 12:49:43 +01:00

ip_vs_lc.c

ipvs: use correct address family in scheduler logs

2014-09-18 08:59:23 +09:00

ip_vs_nfct.c

netfilter: remove nf_ct_is_untracked

2017-04-15 11:51:33 +02:00

ip_vs_nq.c

netfilter: refcounter conversions

2017-03-17 12:49:43 +01:00

ip_vs_ovf.c

ipvs: Add ovf scheduler

2015-08-21 09:08:39 -07:00

ip_vs_pe_sip.c

ipvs: handle connections started by real-servers

2016-04-20 12:34:17 +10:00

ip_vs_pe.c

netfilter: Deletion of unnecessary checks before two function calls

2014-11-20 13:08:43 +01:00

ip_vs_proto_ah_esp.c

ipvs: Pass ipvs into .conn_schedule and ip_vs_try_to_schedule

2015-09-24 09:34:41 +09:00

ip_vs_proto_sctp.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ip_vs_proto_tcp.c

netfilter: Remove duplicated rcu_read_lock.

2017-07-24 13:24:46 +02:00

ip_vs_proto_udp.c

netfilter: Remove duplicated rcu_read_lock.

2017-07-24 13:24:46 +02:00

ip_vs_proto.c

ipvs: remove unused function ip_vs_set_state_timeout

2017-04-28 12:00:10 +02:00

ip_vs_rr.c

netfilter: refcounter conversions

2017-03-17 12:49:43 +01:00

ip_vs_sched.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2015-08-04 23:57:45 -07:00

ip_vs_sed.c

netfilter: refcounter conversions

2017-03-17 12:49:43 +01:00

ip_vs_sh.c

lib/vsprintf.c: remove %Z support

2017-02-27 18:43:47 -08:00

ip_vs_sync.c

ipvs: fix rtnl_lock lockups caused by start_sync_thread

2018-05-16 10:10:22 +02:00

ip_vs_wlc.c

netfilter: refcounter conversions

2017-03-17 12:49:43 +01:00

ip_vs_wrr.c

netfilter: refcounter conversions

2017-03-17 12:49:43 +01:00

ip_vs_xmit.c

netfilter: ipvs: full-functionality option for ECN encapsulation in tunnel

2017-09-26 14:06:33 +02:00

Kconfig

ipvs: Add ovf scheduler

2015-08-21 09:08:39 -07:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00