linux-toradex.git/net/netfilter, branch v2.6.18.4

[NETFILTER]: xt_quota: add missing module aliases

2006-09-19T20:00:57+00:00

Add missing aliases for ipt_quota and ip6t_quota to make autoload
work.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ctnetlink: fix deadlock in table dumping

2006-08-18T01:12:38+00:00

ip_conntrack_put must not be called while holding ip_conntrack_lock
since destroy_conntrack takes it again.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: xt_physdev build fix

2006-08-17T23:29:47+00:00

It needs netfilter_bridge.h for brnf_deferred_hooks

Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

[NETFILTER]: ulog: fix panic on SMP kernels

2006-08-14T01:57:54+00:00

Fix kernel panic on various SMP machines. The culprit is a null
ub->skb in ulog_send(). If ulog_timer() has already been scheduled on
one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the
queue on another CPU by calling ulog_send() right before it exits,
there will be no skbuff when ulog_timer() acquires the lock and calls
ulog_send(). Cancelling the timer in ulog_send() doesn't help because
it has already been scheduled and is running on the first CPU.

Similar problem exists in ebt_ulog.c and nfnetlink_log.c.

Signed-off-by: Mark Huang 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: xt_string: fix negation

2006-08-14T01:05:35+00:00

The xt_string match is broken with ! negation.
This resolves a portion of netfilter bugzilla #497.

Signed-off-by: Phil Oester 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: xt_hashlimit/xt_string: missing string validation

2006-08-02T20:38:29+00:00

The hashlimit table name and the textsearch algorithm need to be
terminated, the textsearch pattern length must not exceed the
maximum size.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[SECURITY] secmark: nul-terminate secdata

2006-08-02T20:38:23+00:00

The patch below fixes a problem in the iptables SECMARK target, where
the user-supplied 'selctx' string may not be nul-terminated.

From initial analysis, it seems that the strlen() called from
selinux_string_to_sid() could run until it arbitrarily finds a zero,
and possibly cause a kernel oops before then.

The impact of this appears limited because the operation requires
CAP_NET_ADMIN, which is essentially always root.  Also, the module is
not yet in wide use.

Signed-off-by: James Morris 
Signed-off-by: Stephen Smalley 
Signed-off-by: David S. Miller

[NETFILTER]: Demote xt_sctp to EXPERIMENTAL

2006-07-25T05:55:29+00:00

After the recent problems with all the SCTP stuff it seems reasonable
to mark this as experimental.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: bridge netfilter: add deferred output hooks to feature-removal-schedule

2006-07-25T05:54:55+00:00

Add bridge netfilter deferred output hooks to feature-removal-schedule
and disable them by default. Until their removal they will be
activated by the physdev match when needed.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: xt_pkttype: fix mismatches on locally generated packets

2006-07-25T05:54:14+00:00

Locally generated broadcast and multicast packets have pkttype set to
PACKET_LOOPBACK instead of PACKET_BROADCAST or PACKET_MULTICAST. This
causes the pkttype match to fail to match packets of either type.

The below patch remedies this by using the daddr as a hint as to
broadcast|multicast. While not pretty, this seems like the only way
to solve the problem short of just noting this as a limitation of the
match.

This resolves netfilter bugzilla #484

Signed-off-by: Phil Oester 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller