linux-stable.git/net/bridge/netfilter, branch v3.10

netfilter: log: netns NULL ptr bug when calling from conntrack

2013-05-15T12:11:07+00:00

Since (69b34fb netfilter: xt_LOG: add net namespace support
for xt_LOG), we hit this:

[ 4224.708977] BUG: unable to handle kernel NULL pointer dereference at 0000000000000388
[ 4224.709074] IP: [] ipt_log_packet+0x29/0x270

when callling log functions from conntrack both in and out
are NULL i.e. the net pointer is invalid.

Adding struct net *net in call to nf_logfn() will secure that
there always is a vaild net ptr.

Reported as netfilter's bugzilla bug 818:
https://bugzilla.netfilter.org/show_bug.cgi?id=818

Reported-by: Ronald 
Signed-off-by: Hans Schillstrom 
Signed-off-by: Pablo Neira Ayuso

Merge branch 'master' of git://1984.lsi.us.es/nf-next

2013-04-07T16:22:06+00:00

Pablo Neira Ayuso says:

====================
The following patchset contains Netfilter and IPVS updates for
your net-next tree, most relevantly they are:

* Add net namespace support to NFLOG, ULOG and ebt_ulog and NFQUEUE.
  The LOG and ebt_log target has been also adapted, but they still
  depend on the syslog netnamespace that seems to be missing, from
  Gao Feng.

* Don't lose indications of congestion in IPv6 fragmentation handling,
  from Hannes Frederic Sowa.i

* IPVS conversion to use RCU, including some code consolidation patches
  and optimizations, also some from Julian Anastasov.

* cpu fanout support for NFQUEUE, from Holger Eitzenberger.

* Better error reporting to userspace when dropping packets from
  all our _*_[xfrm|route]_me_harder functions, from Patrick McHardy.
====================

Signed-off-by: David S. Miller

netfilter: ebt_ulog: add net namespace support for ebt_ulog

2013-04-05T18:59:50+00:00

Add pernet support to ebt_ulog by means of the new nf_log_set
function added in (30e0c6a netfilter: nf_log: prepare net
namespace support for loggers).

This patch also make ulog_buffers and netlink socket
ebtulognl per netns.

Signed-off-by: Gao feng 
Signed-off-by: Pablo Neira Ayuso

netfilter: ebt_log: add net namespace support for ebt_log

2013-04-05T18:57:27+00:00

Add pernet support to ebt_log by means of the new nf_log_set
function added in (30e0c6a netfilter: nf_log: prepare net
namespace support for loggers).

Since syslog ns has yet not been implemented, we don't want
the containers to DDOS host's syslogd. So only enable ebt_log
only from init_net and wait for syslog ns support.

Signed-off-by: Gao feng 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_log: prepare net namespace support for loggers

2013-04-05T18:12:54+00:00

This patch adds netns support to nf_log and it prepares netns
support for existing loggers. It is composed of four major
changes.

1) nf_log_register has been split to two functions: nf_log_register
   and nf_log_set. The new nf_log_register is used to globally
   register the nf_logger and nf_log_set is used for enabling
   pernet support from nf_loggers.

   Per netns is not yet complete after this patch, it comes in
   separate follow up patches.

2) Add net as a parameter of nf_log_bind_pf. Per netns is not
   yet complete after this patch, it only allows to bind the
   nf_logger to the protocol family from init_net and it skips
   other cases.

3) Adapt all nf_log_packet callers to pass netns as parameter.
   After this patch, this function only works for init_net.

4) Make the sysctl net/netfilter/nf_log pernet.

Signed-off-by: Gao feng 
Signed-off-by: Pablo Neira Ayuso

net-next: replace obsolete NLMSG_* with type safe nlmsg_*

2013-03-28T18:25:25+00:00

Signed-off-by: Hong Zhiguo 
Signed-off-by: David S. Miller

net: add ETH_P_802_3_MIN

2013-03-28T05:20:42+00:00

Add a new constant ETH_P_802_3_MIN, the minimum ethernet type for
an 802.3 frame. Frames with a lower value in the ethernet type field
are Ethernet II.

Also update all the users of this value that David Miller and
I could find to use the new constant.

Also correct a bug in util.c. The comparison with ETH_P_802_3_MIN
should be >= not >.

As suggested by Jesse Gross.

Compile tested only.

Cc: David Miller 
Cc: Jesse Gross 
Cc: Karsten Keil 
Cc: John W. Linville 
Cc: Johannes Berg 
Cc: Bart De Schuymer 
Cc: Stephen Hemminger 
Cc: Patrick McHardy 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Cc: linux-bluetooth@vger.kernel.org
Cc: netfilter-devel@vger.kernel.org
Cc: bridge@lists.linux-foundation.org
Cc: linux-wireless@vger.kernel.org
Cc: linux1394-devel@lists.sourceforge.net
Cc: linux-media@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: dev@openvswitch.org
Acked-by: Mauro Carvalho Chehab 
Acked-by: Stefan Richter 
Signed-off-by: Simon Horman 
Signed-off-by: David S. Miller

netfilter: ebt_ulog: remove unnecessary spin lock protection

2013-03-15T10:56:09+00:00

No need for spinlock to protect the netlink skb in the
ebt_ulog_fini path. We are sure there is noone using it
at that stage.

Signed-off-by: Gao feng 
Signed-off-by: Pablo Neira Ayuso

bridge: netfilter: use PTR_RET instead of IS_ERR + PTR_ERR

2013-03-15T10:03:56+00:00

This uses PTR_RET instead of IS_ERR and PTR_ERR in order to increase
readability.

Signed-off-by: Silviu-Mihai Popescu 
Signed-off-by: Pablo Neira Ayuso

net: remove redundant check for timer pending state before del_timer

2013-02-04T18:26:49+00:00

As in del_timer() there has already placed a timer_pending() function
to check whether the timer to be deleted is pending or not, it's
unnecessary to check timer pending state again before del_timer() is
called.

Signed-off-by: Ying Xue 
Cc: Eric Dumazet 
Signed-off-by: David S. Miller