linux-stable.git/net/bridge, branch linux-2.6.31.y

netfilter: ebtables: enforce CAP_NET_ADMIN

2010-01-18T18:28:48+00:00

commit dce766af541f6605fa9889892c0280bab31c66ab upstream.

normal users are currently allowed to set/modify ebtables rules.
Restrict it to processes with CAP_NET_ADMIN.

Note that this cannot be reproduced with unmodified ebtables binary
because it uses SOCK_RAW.

Signed-off-by: Florian Westphal 
Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

netfilter: ebt_ulog: fix checkentry return value

2009-10-05T16:32:32+00:00

netfilter: ebt_ulog: fix checkentry return value

Upstream commit 8a56df0a:

Commit 19eda87 (netfilter: change return types of check functions for
Ebtables extensions) broke the ebtables ulog module by missing a return
value conversion.

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

netfilter: bridge: refcount fix

2009-10-05T16:32:31+00:00

netfilter: bridge: refcount fix

Upstream commit f3abc9b9:

commit f216f082b2b37c4943f1e7c393e2786648d48f6f
([NETFILTER]: bridge netfilter: deal with martians correctly)
added a refcount leak on in_dev.

Instead of using in_dev_get(), we can use __in_dev_get_rcu(),
as netfilter hooks are running under rcu_read_lock(), as pointed
by Patrick.

Signed-off-by: Eric Dumazet 
Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

net/bridge: use kobject_put to release kobject in br_add_if error path

2009-07-27T02:20:51+00:00

kobject_init_and_add will alloc memory for kobj->name, so in br_add_if
error path, simply use kobject_del will not free memory for kobj->name.
Fix by using kobject_put instead, kobject_put will internally calls
kobject_del and frees memory for kobj->name.

Signed-off-by: Xiaotian Feng 
Acked-by: Stephen Hemminger 
Signed-off-by: David S. Miller

bridge: Use rcu_barrier() instead of syncronize_net() on unload.

2009-06-26T20:51:32+00:00

When unloading modules that uses call_rcu() callbacks, then we must
use rcu_barrier().  This module uses syncronize_net() which is not
enough to be sure that all callback has been completed.

Acked-by: Paul E. McKenney 
Signed-off-by: Jesper Dangaard Brouer 
Signed-off-by: David S. Miller

bridge: Simplify interface for ATM LANE

2009-06-12T04:03:21+00:00

This patch changes FDB entry check for ATM LANE bridge integration.
There's no point in holding a FDB entry around SKB building.

br_fdb_get()/br_fdb_put() pair are changed into single br_fdb_test_addr()
hook that checks if the addr has FDB entry pointing to other port
to the one the request arrived on.

FDB entry refcounting is removed as it's not used anywhere else.

Signed-off-by: Michał Mirosław 
Acked-by: Stephen Hemminger 
Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

2009-06-11T14:00:49+00:00

netfilter: x_tables: added hook number into match extension parameter structure.

2009-06-04T14:54:42+00:00

Signed-off-by: Evgeniy Polyakov 
Signed-off-by: Patrick McHardy

net: skb->dst accessors

2009-06-03T09:51:04+00:00

Define three accessors to get/set dst attached to a skb

struct dst_entry *skb_dst(const struct sk_buff *skb)

void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)

void skb_dst_drop(struct sk_buff *skb)
This one should replace occurrences of :
dst_release(skb->dst)
skb->dst = NULL;

Delete skb->dst field

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: skb->rtable accessor

2009-06-03T09:51:02+00:00

Define skb_rtable(const struct sk_buff *skb) accessor to get rtable from skb

Delete skb->rtable field

Setting rtable is not allowed, just set dst instead as rtable is an alias.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller