linux-toradex.git/net/netfilter, branch v3.2.3 Linux kernel for Apalis and Colibri modules net: reintroduce missing rcu_assign_pointer() calls 2012-02-03T17:22:20+00:00 Eric Dumazet eric.dumazet@gmail.com 2012-01-12T04:41:32+00:00 4704f3edfdd3cc5918932577373c0dc165d52959 [ Upstream commit cf778b00e96df6d64f8e21b8395d1f8a859ecdc7 ] commit a9b3cd7f32 (rcu: convert uses of rcu_assign_pointer(x, NULL) to RCU_INIT_POINTER) did a lot of incorrect changes, since it did a complete conversion of rcu_assign_pointer(x, y) to RCU_INIT_POINTER(x, y). We miss needed barriers, even on x86, when y is not NULL. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: Stephen Hemminger <shemminger@vyatta.com> CC: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
[ Upstream commit cf778b00e96df6d64f8e21b8395d1f8a859ecdc7 ]

commit a9b3cd7f32 (rcu: convert uses of rcu_assign_pointer(x, NULL) to
RCU_INIT_POINTER) did a lot of incorrect changes, since it did a
complete conversion of rcu_assign_pointer(x, y) to RCU_INIT_POINTER(x,
y).

We miss needed barriers, even on x86, when y is not NULL.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Stephen Hemminger <shemminger@vyatta.com>
CC: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
netfilter: ctnetlink: fix timeout calculation 2011-12-31T15:59:04+00:00 Xi Wang xi.wang@gmail.com 2011-12-30T15:40:17+00:00 c121638277a71c1e1fb44c3e654ea353357bbc2c The sanity check (timeout < 0) never works; the dividend is unsigned and so is the division, which should have been a signed division. long timeout = (ct->timeout.expires - jiffies) / HZ; if (timeout < 0) timeout = 0; This patch converts the time values to signed for the division. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
The sanity check (timeout < 0) never works; the dividend is unsigned
and so is the division, which should have been a signed division.

	long timeout = (ct->timeout.expires - jiffies) / HZ;
	if (timeout < 0)
		timeout = 0;

This patch converts the time values to signed for the division.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ipvs: try also real server with port 0 in backup server 2011-12-31T15:06:29+00:00 Julian Anastasov ja@ssi.bg 2011-12-30T05:19:02+00:00 52793dbe3d60bd73bbebe28b2bfc9f6b4b920d4c We should not forget to try for real server with port 0 in the backup server when processing the sync message. We should do it in all cases because the backup server can use different forwarding method. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
	We should not forget to try for real server with port 0
in the backup server when processing the sync message. We should
do it in all cases because the backup server can use different
forwarding method.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge branch 'nf' of git://1984.lsi.us.es/net 2011-12-24T21:10:26+00:00 David S. Miller davem@davemloft.net 2011-12-24T21:10:26+00:00 c43c5f39584c0f388a7e5372312c2c48221a4415 






netfilter: ctnetlink: fix scheduling while atomic if helper is autoloaded
2011-12-24T18:49:04+00:00

Pablo Neira Ayuso
pablo@netfilter.org

2011-12-24T18:28:47+00:00

1a31a4a8388a90e9240fb4e5e5c9c909fcfdfd0e

This patch fixes one scheduling while atomic error:

[  385.565186] ctnetlink v0.93: registering with nfnetlink.
[  385.565349] BUG: scheduling while atomic: lt-expect_creat/16163/0x00000200

It can be triggered with utils/expect_create included in
libnetfilter_conntrack if the FTP helper is not loaded.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>





This patch fixes one scheduling while atomic error:

[  385.565186] ctnetlink v0.93: registering with nfnetlink.
[  385.565349] BUG: scheduling while atomic: lt-expect_creat/16163/0x00000200

It can be triggered with utils/expect_create included in
libnetfilter_conntrack if the FTP helper is not loaded.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>







netfilter: ctnetlink: fix return value of ctnetlink_get_expect()
2011-12-24T18:49:04+00:00

Pablo Neira Ayuso
pablo@netfilter.org

2011-12-24T18:03:46+00:00

81378f728fe560e175fb2e8fd33206793567e896

This fixes one bogus error that is returned to user-space:

libnetfilter_conntrack/utils# ./expect_get
TEST: get expectation (-1)(Unknown error 18446744073709551504)

This patch includes the correct handling for EAGAIN (nfnetlink
uses this error value to restart the operation after module
auto-loading).

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>





This fixes one bogus error that is returned to user-space:

libnetfilter_conntrack/utils# ./expect_get
TEST: get expectation (-1)(Unknown error 18446744073709551504)

This patch includes the correct handling for EAGAIN (nfnetlink
uses this error value to restart the operation after module
auto-loading).

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>







netfilter: xt_connbytes: handle negation correctly
2011-12-23T13:50:19+00:00

Florian Westphal
fw@strlen.de

2011-12-16T17:35:15+00:00

0354b48f633ae435acbc01b470a1ce8cfeff3e9f

"! --connbytes 23:42" should match if the packet/byte count is not in range.

As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).

However, "what <= 23 && what >= 42" will always be false.

Change things so we use "||" in case "from" is larger than "to".

This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>





"! --connbytes 23:42" should match if the packet/byte count is not in range.

As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).

However, "what <= 23 && what >= 42" will always be false.

Change things so we use "||" in case "from" is larger than "to".

This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>







netfilter: Remove ADVANCED dependency from NF_CONNTRACK_NETBIOS_NS
2011-12-02T03:19:01+00:00

David S. Miller
davem@davemloft.net

2011-12-02T03:19:01+00:00

3ced1be5490f5c415d51a1e5918beeb9239d546b

firewalld in Fedora 16 needs this.

Signed-off-by: David S. Miller <davem@davemloft.net>





firewalld in Fedora 16 needs this.

Signed-off-by: David S. Miller <davem@davemloft.net>







Merge branch 'nf' of git://1984.lsi.us.es/net
2011-11-29T06:20:55+00:00

David S. Miller
davem@davemloft.net

2011-11-29T06:20:55+00:00

c1baa88431fe0fe4fad492dece4177a7735f89cf












netfilter: Remove NOTRACK/RAW dependency on NETFILTER_ADVANCED.
2011-11-23T21:07:00+00:00

David S. Miller
davem@davemloft.net

2011-11-23T21:07:00+00:00

46a246c4dff9f248913e791b69f2336cd8d4ec41

Distributions are using this in their default scripts, so don't hide
them behind the advanced setting.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>





Distributions are using this in their default scripts, so don't hide
them behind the advanced setting.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>