linux-stable.git/include/linux/netfilter, branch linux-3.10.y

netfilter: x_tables: introduce and use xt_copy_counters_from_user

2016-08-21T21:22:32+00:00

commit 63ecb81aadf1c823c85c70a2bfd1ec9df3341a72 upstream.

commit d7591f0c41ce3e67600a982bab6989ef0f07b3ce upstream

The three variants use same copy&pasted code, condense this into a
helper and use that.

Make sure info.name is 0-terminated.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

netfilter: x_tables: xt_compat_match_from_user doesn't need a retval

2016-08-21T21:22:31+00:00

commit 0188346f21e6546498c2a0f84888797ad4063fc5 upstream.

Always returned 0.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Willy Tarreau

netfilter: x_tables: check for bogus target offset

2016-08-21T21:22:29+00:00

commit ce683e5f9d045e5d67d1312a42b359cb2ab2a13c upstream.

We're currently asserting that targetoff + targetsize <= nextoff.

Extend it to also check that targetoff is >= sizeof(xt_entry).
Since this is generic code, add an argument pointing to the start of the
match/target, we can then derive the base structure size from the delta.

We also need the e->elems pointer in a followup change to validate matches.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Willy Tarreau

netfilter: x_tables: add compat version of xt_check_entry_offsets

2016-08-21T21:22:28+00:00

commit fc1221b3a163d1386d1052184202d5dc50d302d1 upstream.

32bit rulesets have different layout and alignment requirements, so once
more integrity checks get added to xt_check_entry_offsets it will reject
well-formed 32bit rulesets.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Willy Tarreau

netfilter: x_tables: add and use xt_check_entry_offsets

2016-08-21T21:22:28+00:00

commit 7d35812c3214afa5b37a675113555259cfd67b98 upstream.

Currently arp/ip and ip6tables each implement a short helper to check that
the target offset is large enough to hold one xt_entry_target struct and
that t->u.target_size fits within the current rule.

Unfortunately these checks are not sufficient.

To avoid adding new tests to all of ip/ip6/arptables move the current
checks into a helper, then extend this helper in followup patches.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Willy Tarreau

netfilter: ipset: set match: add support to match the counters

2013-04-29T18:09:03+00:00

The new revision of the set match supports to match the counters
and to suppress updating the counters at matching too.

At the set:list types, the updating of the subcounters can be
suppressed as well.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Introduce the counter extension in the core

2013-04-29T18:08:59+00:00

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Unified hash type generation

2013-04-29T18:08:56+00:00

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Unified bitmap type generation

2013-04-29T18:08:54+00:00

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Introduce extensions to elements in the core

2013-04-29T18:08:54+00:00

Introduce extensions to elements in the core and prepare timeout as
the first one.

This patch also modifies the em_ipset classifier to use the new
extension struct layout.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso