linux-stable.git/net/ipv6/netfilter, branch linux-2.6.28.y

netfilter: {ip, ip6, arp}_tables: fix incorrect loop detection

2009-05-02T17:56:47+00:00

upstream commit: 1f9352ae2253a97b07b34dcf16ffa3b4ca12c558

Commit e1b4b9f ([NETFILTER]: {ip,ip6,arp}_tables: fix exponential worst-case
search for loops) introduced a regression in the loop detection algorithm,
causing sporadic incorrectly detected loops.

When a chain has already been visited during the check, it is treated as
having a standard target containing a RETURN verdict directly at the
beginning in order to not check it again. The real target of the first
rule is then incorrectly treated as STANDARD target and checked not to
contain invalid verdicts.

Fix by making sure the rule does actually contain a standard target.

Based on patch by Francis Dupont 
Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

netfilter: fix tuple inversion for Node information request

2009-02-17T17:29:03+00:00

netfilter: fix tuple inversion for Node information request

Upstream commit: a51f42f3c

The patch fixes a typo in the inverse mapping of Node Information
request. Following draft-ietf-ipngwg-icmp-name-lookups-09, "Querier"
sends a type 139 (ICMPV6_NI_QUERY) packet to "Responder" which answer
with a type 140 (ICMPV6_NI_REPLY) packet.

Signed-off-by: Eric Leblond 
Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

netfilter: nf_conntrack: fix ICMP/ICMPv6 timeout sysctls on big-endian

2009-01-25T00:41:45+00:00

Upstream commit 71320af:

An old bug crept back into the ICMP/ICMPv6 conntrack protocols: the timeout
values are defined as unsigned longs, the sysctl's maxsize is set to
sizeof(unsigned int). Use unsigned int for the timeout values as in the
other conntrack protocols.

Reported-by: Jean-Mickael Guerin 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

netfilter: xtables: provide invoked family value to extensions

2008-10-08T09:35:20+00:00

By passing in the family through which extensions were invoked, a bit
of data space can be reclaimed. The "family" member will be added to
the parameter structures and the check functions be adjusted.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (6/6)

2008-10-08T09:35:19+00:00

This patch does this for target extensions' destroy functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (5/6)

2008-10-08T09:35:19+00:00

This patch does this for target extensions' checkentry functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (4/6)

2008-10-08T09:35:19+00:00

This patch does this for target extensions' target functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (3/6)

2008-10-08T09:35:19+00:00

This patch does this for match extensions' destroy functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (2/6)

2008-10-08T09:35:18+00:00

This patch does this for match extensions' checkentry functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (1/6)

2008-10-08T09:35:18+00:00

The function signatures for Xtables extensions have grown over time.
It involves a lot of typing/replication, and also a bit of stack space
even if they are not used. Realize an NFWS2008 idea and pack them into
structs. The skb remains outside of the struct so gcc can continue to
apply its optimizations.

This patch does this for match extensions' match functions.

A few ambiguities have also been addressed. The "offset" parameter for
example has been renamed to "fragoff" (there are so many different
offsets already) and "protoff" to "thoff" (there is more than just one
protocol here, so clarify).

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy