linux-stable.git/net/ipv4/netfilter, branch v3.7 Linux kernel stable tree netfilter: nf_nat: don't check for port change on ICMP tuples 2012-10-28T21:43:34+00:00 Ulrich Weber ulrich.weber@sophos.com 2012-10-25T05:34:45+00:00 38fe36a248ec3228f8e6507955d7ceb0432d2000 ICMP tuples have id in src and type/code in dst. So comparing src.u.all with dst.u.all will always fail here and ip_xfrm_me_harder() is called for every ICMP packet, even if there was no NAT. Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
ICMP tuples have id in src and type/code in dst.
So comparing src.u.all with dst.u.all will always fail here
and ip_xfrm_me_harder() is called for every ICMP packet,
even if there was no NAT.

Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: combine ipt_REDIRECT and ip6t_REDIRECT 2012-09-21T10:12:05+00:00 Jan Engelhardt jengelh@inai.de 2012-09-21T09:41:34+00:00 2cbc78a29e76a2e92c172651204f3117491877d2 Combine more modules since the actual code is so small anyway that the kmod metadata and the module in its loaded state totally outweighs the combined actual code size. IP_NF_TARGET_REDIRECT becomes a compat option; IP6_NF_TARGET_REDIRECT is completely eliminated since it has not see a release yet. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_REDIRECT becomes a compat option; IP6_NF_TARGET_REDIRECT
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: combine ipt_NETMAP and ip6t_NETMAP 2012-09-21T10:11:08+00:00 Jan Engelhardt jengelh@inai.de 2012-09-21T09:37:59+00:00 b3d54b3e406b5d6ac391590bf7524e887e8e13c3 Combine more modules since the actual code is so small anyway that the kmod metadata and the module in its loaded state totally outweighs the combined actual code size. IP_NF_TARGET_NETMAP becomes a compat option; IP6_NF_TARGET_NETMAP is completely eliminated since it has not see a release yet. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> 
Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_NETMAP becomes a compat option; IP6_NF_TARGET_NETMAP
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
netlink: hide struct module parameter in netlink_kernel_create 2012-09-08T22:46:30+00:00 Pablo Neira Ayuso pablo@netfilter.org 2012-09-08T02:53:54+00:00 9f00d9776bc5beb92e8bfc884a7e96ddc5589e2e This patch defines netlink_kernel_create as a wrapper function of __netlink_kernel_create to hide the struct module *me parameter (which seems to be THIS_MODULE in all existing netlink subsystems). Suggested by David S. Miller. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net> 
This patch defines netlink_kernel_create as a wrapper function of
__netlink_kernel_create to hide the struct module *me parameter
(which seems to be THIS_MODULE in all existing netlink subsystems).

Suggested by David S. Miller.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
netfilter: nf_nat: support IPv6 in TFTP NAT helper 2012-08-30T01:00:24+00:00 Pablo Neira Ayuso pablo@netfilter.org 2012-08-26T17:14:29+00:00 320ff567f299ed3f0a2d53906e632a1b0eda5599 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net> 
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
netfilter: nf_nat: support IPv6 in IRC NAT helper 2012-08-30T01:00:23+00:00 Pablo Neira Ayuso pablo@netfilter.org 2012-08-26T17:14:27+00:00 5901b6be885e2c9a30fd94803b846b3d33e351dd Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net> 
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
netfilter: nf_nat: support IPv6 in SIP NAT helper 2012-08-30T01:00:22+00:00 Patrick McHardy kaber@trash.net 2012-08-26T17:14:25+00:00 9a664821068739dbc8eac13770e28167b46a0c0f Add IPv6 support to the SIP NAT helper. There are no functional differences to IPv4 NAT, just different formats for addresses. Signed-off-by: Patrick McHardy <kaber@trash.net> 
Add IPv6 support to the SIP NAT helper. There are no functional differences
to IPv4 NAT, just different formats for addresses.

Signed-off-by: Patrick McHardy <kaber@trash.net>
netfilter: nf_nat: support IPv6 in amanda NAT helper 2012-08-30T01:00:21+00:00 Patrick McHardy kaber@trash.net 2012-08-26T17:14:22+00:00 ee6eb96673704225164f0ba7462e1973ce10885c Signed-off-by: Patrick McHardy <kaber@trash.net> 
Signed-off-by: Patrick McHardy <kaber@trash.net>
netfilter: nf_nat: support IPv6 in FTP NAT helper 2012-08-30T01:00:20+00:00 Patrick McHardy kaber@trash.net 2012-08-26T17:14:20+00:00 d33cbeeb1a46a7dc82fe9f53e40a742ce0c67c79 Signed-off-by: Patrick McHardy <kaber@trash.net> 
Signed-off-by: Patrick McHardy <kaber@trash.net>
netfilter: ip6tables: add MASQUERADE target 2012-08-30T01:00:18+00:00 Patrick McHardy kaber@trash.net 2012-08-26T17:14:14+00:00 b3f644fc8232ca761da0b5c5ccb6f30b423c4302 Signed-off-by: Patrick McHardy <kaber@trash.net> 
Signed-off-by: Patrick McHardy <kaber@trash.net>