linux-stable.git/net/bridge/netfilter, branch linux-2.6.31.y

netfilter: ebtables: enforce CAP_NET_ADMIN

2010-01-18T18:28:48+00:00

commit dce766af541f6605fa9889892c0280bab31c66ab upstream.

normal users are currently allowed to set/modify ebtables rules.
Restrict it to processes with CAP_NET_ADMIN.

Note that this cannot be reproduced with unmodified ebtables binary
because it uses SOCK_RAW.

Signed-off-by: Florian Westphal 
Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

netfilter: ebt_ulog: fix checkentry return value

2009-10-05T16:32:32+00:00

netfilter: ebt_ulog: fix checkentry return value

Upstream commit 8a56df0a:

Commit 19eda87 (netfilter: change return types of check functions for
Ebtables extensions) broke the ebtables ulog module by missing a return
value conversion.

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

netfilter: x_tables: added hook number into match extension parameter structure.

2009-06-04T14:54:42+00:00

Signed-off-by: Evgeniy Polyakov 
Signed-off-by: Patrick McHardy

netfilter: xtables: consolidate open-coded logic

2009-05-08T08:30:48+00:00

Signed-off-by: Jan Engelhardt

netfilter: fix nf_logger name in ebt_ulog.

2009-03-26T08:04:28+00:00

This patch renames the ebt_ulog nf_logger from "ulog" to "ebt_ulog" to
be in sync with other modules naming. As this name was currently only
used for informational purpose, the renaming should be harmless.

Signed-off-by: Eric Leblond 
Signed-off-by: David S. Miller

netfilter: fix warning in ebt_ulog init function.

2009-03-26T08:04:02+00:00

The ebt_ulog module does not follow the fixed convention about function
return. Loading the module is triggering the following message:

sys_init_module: 'ebt_ulog'->init suspiciously returned 1, it should follow 0/-E convention
sys_init_module: loading module anyway...
Pid: 2334, comm: modprobe Not tainted 2.6.29-rc5edenwall0-00883-g199e57b #146
Call Trace:
 [] ? printk+0xf/0x16
 [] sys_init_module+0x107/0x186
 [] syscall_call+0x7/0xb

The following patch fixes the return treatment in ebt_ulog_init()
function.

Signed-off-by: Eric Leblond 
Signed-off-by: David S. Miller

netfilter: fix warning about invalid const usage

2009-03-26T08:03:23+00:00

This patch fixes the declaration of the logger structure in ebt_log
and ebt_ulog: I forgot to remove the const option from their declaration
in the commit ca735b3aaa945626ba65a3e51145bfe4ecd9e222 ("netfilter:
use a linked list of loggers").

Pointed-out-by: Stephen Rothwell 
Signed-off-by: Eric Leblond 
Signed-off-by: David S. Miller

netfilter: ebtables: remove unneeded initializations

2009-02-18T15:30:38+00:00

The initialization of the lock element is not needed
since the lock is always initialized in ebt_register_table.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Patrick McHardy

netfilter 05/09: ebtables: fix inversion in match code

2009-01-13T05:18:35+00:00

Commit 8cc784ee (netfilter: change return types of match functions
for ebtables extensions) broke ebtables matches by inverting the
sense of match/nomatch.

Reported-by: Matt Cross 
Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

net/bridge/netfilter: move a dereference below a NULL test

2009-01-11T08:06:33+00:00

In each case, if the NULL test is necessary, then the dereference should be
moved below the NULL test.

The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/)

// 
@@
type T;
expression E;
identifier i,fld;
statement S;
@@

- T i = E->fld;
+ T i;
  ... when != E
      when != i
  if (E == NULL) S
+ i = E->fld;
// 

Signed-off-by: Julia Lawall 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller