linux-stable.git/include/linux/netfilter, branch linux-2.6.17.y

[NETFILTER] x_tables: fix compat related crash on non-x86

2006-05-02T03:48:32+00:00

When iptables userspace adds an ipt_standard_target, it calculates the size
of the entire entry as:

sizeof(struct ipt_entry) + XT_ALIGN(sizeof(struct ipt_standard_target))

ipt_standard_target looks like this:

  struct xt_standard_target
  {
        struct xt_entry_target target;
        int verdict;
  };

xt_entry_target contains a pointer, so when compiled for 64 bit the
structure gets an extra 4 byte of padding at the end. On 32 bit
architectures where iptables aligns to 8 byte it will also have 4
byte padding at the end because it is only 36 bytes large.

The compat_ipt_standard_fn in the kernel adjusts the offsets by

  sizeof(struct ipt_standard_target) - sizeof(struct compat_ipt_standard_target),

which will always result in 4, even if the structure from userspace
was already padded to a multiple of 8. On x86 this works out by
accident because userspace only aligns to 4, on all other
architectures this is broken and causes incorrect adjustments to
the size and following offsets.

Thanks to Linus for lots of debugging help and testing.

Signed-off-by: Patrick McHardy 
Signed-off-by: Linus Torvalds

[NETFILTER]: Fix compat_xt_counters alignment for non-x86

2006-04-25T00:27:30+00:00

Some (?) non-x86 architectures require 8byte alignment for u_int64_t
even when compiled for 32bit, using u_int32_t in compat_xt_counters
breaks on these architectures, use u_int64_t for everything but x86.

Reported by Andreas Schwab .

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: iptables 32bit compat layer

2006-04-01T10:25:19+00:00

This patch extends current iptables compatibility layer in order to get
32bit iptables to work on 64bit kernel. Current layer is insufficient due
to alignment checks both in kernel and user space tools.

Patch is for current net-2.6.17 with addition of move of ipt_entry_{match|
target} definitions to xt_entry_{match|target}.

Signed-off-by: Dmitry Mishin 
Acked-off-by: Kirill Korotaev 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: unify IPv4/IPv6 multiport match

2006-04-01T10:22:54+00:00

This unifies ipt_multiport and ip6t_multiport to xt_multiport.
As a result, this addes support for inversion and port range match
to IPv6 packets.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: unify IPv4/IPv6 esp match

2006-04-01T10:22:30+00:00

This unifies ipt_esp and ip6t_esp to xt_esp. Please note that now
a user program needs to specify IPPROTO_ESP as protocol to use esp match
with IPv6. This means that ip6tables requires '-p esp' like iptables.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: futher {ip,ip6,arp}_tables unification

2006-03-22T21:56:56+00:00

This patch moves {ip,ip6,arp}t_entry_{match,target} definitions to
x_tables.h. This move simplifies code and future compatibility fixes.

Signed-off-by: Dmitry Mishin 
Acked-off-by: Kirill Korotaev 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: set the protocol family in x_tables targets/matches

2006-03-22T21:55:40+00:00

Set the family field in xt_[matches|targets] registered.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ctnetlink: avoid unneccessary event message generation

2006-03-21T02:03:59+00:00

Avoid unneccessary event message generation by checking for netlink
listeners before building a message.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: replace IPv4/IPv6 policy match by address family independant version

2006-03-21T02:03:40+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: pass registered match/target data to match/target functions

2006-03-21T02:02:15+00:00

This allows to make decisions based on the revision (and address family
with a follow-up patch) at runtime.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller