linux-toradex.git/net/netfilter, branch v2.6.24.2

[NETFILTER]: xt_helper: Do not bypass RCU

2008-01-11T06:41:28+00:00

Use the @helper variable that was just obtained.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack_ipv4: fix module parameter compatibility

2007-12-27T03:36:33+00:00

Some users do "modprobe ip_conntrack hashsize=...". Since we have the
module aliases this loads nf_conntrack_ipv4 and nf_conntrack, the
hashsize parameter is unknown for nf_conntrack_ipv4 however and makes
it fail.

Allow to specify hashsize= for both nf_conntrack and nf_conntrack_ipv4.

Note: the nf_conntrack message in the ringbuffer will display an
incorrect hashsize since nf_conntrack is first pulled in as a
dependency and calculates the size itself, then it gets changed
through a call to nf_conntrack_set_hashsize().

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Spelling fixes

2007-12-20T22:04:24+00:00

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

[NETFILTER]: xt_hashlimit should use time_after_eq()

2007-12-14T21:54:36+00:00

In order to avoid jiffies wraparound and its effect, special care must
be taken
when doing comparisons ...

Signed-off-by: Eric Dumazet 
Acked-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ip_tables: fix compat copy race

2007-12-14T21:54:35+00:00

When copying entries to user, the kernel makes two passes through the
data, first copying all the entries, then fixing up names and counters.
On the second pass it copies the kernel and match data from userspace
to the kernel again to find the corresponding structures, expecting
that kernel pointers contained in the data are still valid.

This is obviously broken, fix by avoiding the second pass completely
and fixing names and counters while dumping the ruleset, using the
kernel-internal data structures.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ctnetlink: set expected bit for related conntracks

2007-12-14T21:54:33+00:00

This patch is a fix. It sets IPS_EXPECTED for related conntracks.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK

2007-11-30T13:01:50+00:00

Fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK

When xt_CONNMARK is used outside the mangle table and the user specified
"--restore-mark", the connmark_tg_check() function will (correctly)
error out, but (incorrectly) forgets to release the L3 conntrack module.
Same for xt_CONNSECMARK.

Fix is to move the call to acquire the L3 module after the basic
constraint checks.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy 
Signed-off-by: Herbert Xu

[NETFILTER]: xt_TCPMSS: remove network triggerable WARN_ON

2007-11-30T12:58:03+00:00

ipv6_skip_exthdr() returns -1 for invalid packets. don't WARN_ON
that.

Signed-off-by: Patrick McHardy 
Signed-off-by: Herbert Xu

[NETFILTER]: Fix NULL pointer dereference in nf_nat_move_storage()

2007-11-15T23:52:32+00:00

Reported by Chuck Ebbert as:

	https://bugzilla.redhat.com/show_bug.cgi?id=259501#c14

This routine is called each time hash should be replaced, nf_conn has
extension list which contains pointers to connection tracking users
(like nat, which is right now the only such user), so when replace takes
place it should copy own extensions. Loop above checks for own
extension, but tries to move higer-layer one, which can lead to above
oops.

Signed-off-by: Evgeniy Polyakov 
Signed-off-by: David S. Miller

[NETFILTER]: fix compat_nf_sockopt typo

2007-11-15T22:29:21+00:00

It should pass opt to the ->get/->set functions, not ops.

Tested-by: Luca Tettamanti 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller