linux-stable.git/net/ipv4/netfilter, branch v3.14

netfilter: nf_nat_snmp_basic: fix duplicates in if/else branches

2014-02-14T10:37:36+00:00

The solution was found by Patrick in 2.4 kernel sources.

Cc: Patrick McHardy 
Signed-off-by: Francois-Xavier Le Bail 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add reject module for NFPROTO_INET

2014-02-06T08:44:18+00:00

Add a reject module for NFPROTO_INET. It does nothing but dispatch
to the AF-specific modules based on the hook family.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts

2014-02-06T08:44:10+00:00

Currently the nft_reject module depends on symbols from ipv6. This is
wrong since no generic module should force IPv6 support to be loaded.
Split up the module into AF-specific and a generic part.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report()

2014-02-05T16:46:05+00:00

Similar bug fixed in SIP module in 3f509c6 ("netfilter: nf_nat_sip: fix
incorrect handling of EBUSY for RTCP expectation").

BUG: unable to handle kernel paging request at 00100104
IP: [] nf_ct_unlink_expect_report+0x57/0xf0 [nf_conntrack]
...
Call Trace:
  [] ? del_timer+0x48/0x70
  [] nf_ct_remove_expectations+0x47/0x60 [nf_conntrack]
  [] nf_ct_delete_from_lists+0x59/0x90 [nf_conntrack]
  [] death_by_timeout+0x14e/0x1c0 [nf_conntrack]
  [] ? nf_conntrack_set_hashsize+0x190/0x190 [nf_conntrack]
  [] call_timer_fn+0x1d/0x80
  [] run_timer_softirq+0x18e/0x1a0
  [] ? nf_conntrack_set_hashsize+0x190/0x190 [nf_conntrack]
  [] __do_softirq+0xa3/0x170
  [] ? __local_bh_enable+0x70/0x70
  
  [] ? irq_exit+0x67/0xa0
  [] ? do_IRQ+0x46/0xb0
  [] ? clockevents_notify+0x35/0x110
  [] ? common_interrupt+0x2c/0x40
  [] ? cpuidle_enter_state+0x41/0xf0
  [] ? cpuidle_idle_call+0x8b/0x100
  [] ? arch_cpu_idle+0x8/0x30
  [] ? cpu_idle_loop+0x4b/0x140
  [] ? cpu_startup_entry+0x18/0x20
  [] ? rest_init+0x5d/0x70
  [] ? start_kernel+0x2ec/0x2f2
  [] ? repair_env_string+0x5b/0x5b
  [] ? i386_start_kernel+0x33/0x35

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix error path in the init functions

2014-01-09T22:25:48+00:00

We have to unregister chain type if this fails to register netns.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain()

2014-01-09T19:17:16+00:00

We don't encode argument types into function names and since besides
nft_do_chain() there are only AF-specific versions, there is no risk
of confusion.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: minor nf_chain_type cleanups

2014-01-09T19:17:15+00:00

Minor nf_chain_type cleanups:

- reorder struct to plug a hoe
- rename struct module member to "owner" for consistency
- rename nf_hookfn array to "hooks" for consistency
- reorder initializers for better readability

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: constify chain type definitions and pointers

2014-01-09T19:17:15+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add missing module references to chain types

2014-01-09T19:17:14+00:00

In some cases we neither take a reference to the AF info nor to the
chain type, allowing the module to be unloaded while in use.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add "inet" table for IPv4/IPv6

2014-01-07T22:57:25+00:00

This patch adds a new table family and a new filter chain that you can
use to attach IPv4 and IPv6 rules. This should help to simplify
rule-set maintainance in dual-stack setups.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso