linux-stable.git/include/linux/netfilter.h, branch linux-2.6.38.y

netfilter: allow hooks to pass error code back up the stack

2010-11-17T18:54:34+00:00

SELinux would like to pass certain fatal errors back up the stack.  This patch
implements the generic netfilter support for this functionality.

Based-on-patch-by: Patrick McHardy 
Signed-off-by: Eric Paris 
Signed-off-by: David S. Miller

netfilter: NF_HOOK_COND has wrong conditional

2010-11-12T07:26:06+00:00

The NF_HOOK_COND returns 0 when it shouldn't due to what I believe to be an
error in the code as the order of operations is not what was intended.  C will
evalutate == before =.  Which means ret is getting set to the bool result,
rather than the return value of the function call.  The code says

if (ret = function() == 1)
when it meant to say:
if ((ret = function()) == 1)

Normally the compiler would warn, but it doesn't notice it because its
a actually complex conditional and so the wrong code is wrapped in an explict
set of () [exactly what the compiler wants you to do if this was intentional].
Fixing this means that errors when netfilter denies a packet get propagated
back up the stack rather than lost.

Problem introduced by commit 2249065f (netfilter: get rid of the grossness
in netfilter.h).

Signed-off-by: Eric Paris 
Cc: stable@kernel.org
Signed-off-by: Patrick McHardy

netfilter: restore POST_ROUTING hook in NF_HOOK_COND

2010-02-19T07:03:28+00:00

Commit 2249065 ("netfilter: get rid of the grossness in netfilter.h")
inverted the logic for conditional hook invocation, breaking the
POST_ROUTING hook invoked by ip_output().

Correct the logic and remove an unnecessary initialization.

Reported-by: Stephen Hemminger 
Signed-off-by: Patrick McHardy

netfilter: get rid of the grossness in netfilter.h

2010-02-15T15:56:51+00:00

GCC is now smart enough to follow the inline trail correctly.
vmlinux size remain the same.

Signed-off-by: Jan Engelhardt

netfilter: reduce NF_HOOK by one argument

2010-02-15T15:56:51+00:00

No changes in vmlinux filesize.

Signed-off-by: Jan Engelhardt

netfilter: xtables: CONFIG_COMPAT redux

2010-02-02T14:03:24+00:00

Ifdef out
	struct nf_sockopt_ops::compat_set
	struct nf_sockopt_ops::compat_get
	struct xt_match::compat_from_user
	struct xt_match::compat_to_user
	struct xt_match::compatsize
to make structures smaller on COMPAT=n kernels.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy

net: cleanup include/linux

2009-11-04T17:50:58+00:00

This cleanup patch puts struct/union/enum opening braces,
in first line to ease grep games.

struct something
{

becomes :

struct something {

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: Make setsockopt() optlen be unsigned.

2009-09-30T23:12:20+00:00

This provides safety against negative optlen at the type
level instead of depending upon (sometimes non-trivial)
checks against this sprinkled all over the the place, in
each and every implementation.

Based upon work done by Arjan van de Ven and feedback
from Linus Torvalds.

Signed-off-by: David S. Miller

netfilter: netns: remove nf_*_net() wrappers

2008-10-08T09:35:01+00:00

Now that dev_net() exists, the usefullness of them is even less. Also they're
a big problem in resolving circular header dependencies necessary for
NOTRACK-in-netns patch. See below.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy

netfilter: Introduce NFPROTO_* constants

2008-10-08T09:35:00+00:00

The netfilter subsystem only supports a handful of protocols (much
less than PF_*) and even non-PF protocols like ARP and
pseudo-protocols like PF_BRIDGE. By creating NFPROTO_*, we can earn a
few memory savings on arrays that previously were always PF_MAX-sized
and keep the pseudo-protocols to ourselves.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy