linux-stable.git/net/bridge/netfilter, branch linux-3.6.y

netfilter: log: Fix log-level processing

2012-09-12T15:17:35+00:00

auto75914331@hushmail.com reports that iptables does not correctly
output the KERN_.

$IPTABLES -A RULE_0_in  -j LOG  --log-level notice --log-prefix "DENY  in: "

result with linux 3.6-rc5
Sep 12 06:37:29 xxxxx kernel: <5>DENY  in: IN=eth0 OUT= MAC=.......

result with linux 3.5.3 and older:
Sep  9 10:43:01 xxxxx kernel: DENY  in: IN=eth0 OUT= MAC......

commit 04d2c8c83d0
("printk: convert the format for KERN_ to a 2 byte pattern")
updated the syslog header style but did not update netfilter uses.

Do so.

Use KERN_SOH and string concatenation instead of "%c" KERN_SOH_ASCII
as suggested by Eric Dumazet.

Signed-off-by: Joe Perches 
cc: auto75914331@hushmail.com
Signed-off-by: Pablo Neira Ayuso

netfilter: use kfree_skb() not kfree()

2012-07-01T00:26:51+00:00

This was should be a kfree_skb() here to free the sk_buff pointer.

Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller

netlink: add netlink_kernel_cfg parameter to netlink_kernel_create

2012-06-29T23:46:02+00:00

This patch adds the following structure:

struct netlink_kernel_cfg {
        unsigned int    groups;
        void            (*input)(struct sk_buff *skb);
        struct mutex    *cb_mutex;
};

That can be passed to netlink_kernel_create to set optional configurations
for netlink kernel sockets.

I've populated this structure by looking for NULL and zero parameters at the
existing code. The remaining parameters that always need to be set are still
left in the original interface.

That includes optional parameters for the netlink socket creation. This allows
easy extensibility of this interface in the future.

This patch also adapts all callers to use this new interface.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: ebt_ulog: Move away from NLMSG_PUT().

2012-06-27T04:23:42+00:00

And use nlmsg_data() while we're here too.

Also, free and NULL out skb when nlmsg_put() fails and remove
pointless kernel log message.

Signed-off-by: David S. Miller

bridge: netfilter: Convert compare_ether_addr to ether_addr_equal

2012-05-10T00:49:17+00:00

Use the new bool function ether_addr_equal to add
some clarity and reduce the likelihood for misuse
of compare_ether_addr for sorting.

Done via cocci script:

$ cat compare_ether_addr.cocci
@@
expression a,b;
@@
-	!compare_ether_addr(a, b)
+	ether_addr_equal(a, b)

@@
expression a,b;
@@
-	compare_ether_addr(a, b)
+	!ether_addr_equal(a, b)

@@
expression a,b;
@@
-	!ether_addr_equal(a, b) == 0
+	ether_addr_equal(a, b)

@@
expression a,b;
@@
-	!ether_addr_equal(a, b) != 0
+	!ether_addr_equal(a, b)

@@
expression a,b;
@@
-	ether_addr_equal(a, b) == 0
+	!ether_addr_equal(a, b)

@@
expression a,b;
@@
-	ether_addr_equal(a, b) != 0
+	ether_addr_equal(a, b)

@@
expression a,b;
@@
-	!!ether_addr_equal(a, b)
+	ether_addr_equal(a, b)

Signed-off-by: Joe Perches 
Acked-by: Stephen Hemminger 
Signed-off-by: David S. Miller

netfilter: bridge: fix wrong pointer dereference

2012-03-06T19:43:49+00:00

In adf7ff8, a invalid dereference was added in ebt_make_names.

CC [M]  net/bridge/netfilter/ebtables.o
net/bridge/netfilter/ebtables.c: In function `ebt_make_names':
net/bridge/netfilter/ebtables.c:1371:20: warning: `t' may be used uninitialized in this function [-Wuninitialized]

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: ebtables: fix wrong name length while copying to user-space

2012-03-06T19:43:49+00:00

user-space ebtables expects 32 bytes-long names, but xt_match names
use 29 bytes. We have to copy less 29 bytes and then, make sure we
fill the remaining bytes with zeroes.

Signed-off-by: Santosh Nayak 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: bridge: fix module autoload in compat case

2012-02-25T13:29:09+00:00

We expected 0 if module doesn't exist, which is no longer the case
(42046e2e45c109ba703993c510401a11f716c8df,
netfilter: x_tables: return -ENOENT for non-existant matches/targets).

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

net:bridge: use IS_ENABLED

2011-12-16T20:49:52+00:00

Use IS_ENABLED(CONFIG_FOO)
instead of defined(CONFIG_FOO) || defined (CONFIG_FOO_MODULE)

Signed-off-by: Igor Maravić 
Signed-off-by: David S. Miller

ipv6: Add fragment reporting to ipv6_skip_exthdr().

2011-12-03T17:35:10+00:00

While parsing through IPv6 extension headers, fragment headers are
skipped making them invisible to the caller.  This reports the
fragment offset of the last header in order to make it possible to
determine whether the packet is fragmented and, if so whether it is
a first or last fragment.

Signed-off-by: Jesse Gross