linux-stable.git/net/ipv6/netfilter, branch linux-3.8.y

netfilter: ip6t_NPT: Fix translation for non-multiple of 32 prefix lengths

2013-05-11T20:53:56+00:00

commit 906b1c394d0906a154fbdc904ca506bceb515756 upstream.

The bitmask used for the prefix mangling was being calculated
incorrectly, leading to the wrong part of the address being replaced
when the prefix length wasn't a multiple of 32.

Signed-off-by: Matthias Schiffer 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too

2013-05-11T20:53:56+00:00

commit f83a7ea2075ca896f2dbf07672bac9cf3682ff74 upstream.

Alex Efros reported rpfilter module doesn't match following packets:
IN=br.qemu SRC=192.168.2.1 DST=192.168.2.255 [ .. ]
(netfilter bugzilla #814).

Problem is that network stack arranges for the locally generated broadcasts
to appear on the interface they were sent out, so the IFF_LOOPBACK check
doesn't trigger.

As -m rpfilter is restricted to PREROUTING, we can check for existing
rtable instead, it catches locally-generated broad/multicast case, too.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

inet: limit length of fragment queue hash table bucket lists

2013-03-28T19:17:23+00:00

[ Upstream commit 5a3da1fe9561828d0ca7eca664b16ec2b9bf0055 ]

This patch introduces a constant limit of the fragment queue hash
table bucket list lengths. Currently the limit 128 is choosen somewhat
arbitrary and just ensures that we can fill up the fragment cache with
empty packets up to the default ip_frag_high_thresh limits. It should
just protect from list iteration eating considerable amounts of cpu.

If we reach the maximum length in one hash bucket a warning is printed.
This is implemented on the caller side of inet_frag_find to distinguish
between the different users of inet_fragment.c.

I dropped the out of memory warning in the ipv4 fragment lookup path,
because we already get a warning by the slab allocator.

Cc: Eric Dumazet 
Cc: Jesper Dangaard Brouer 
Signed-off-by: Hannes Frederic Sowa 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

netfilter: ip6t_NPT: Ensure to check lower part of prefixes are zero

2013-02-07T17:40:27+00:00

RFC 6296 points that address bits that are not part of the prefix
has to be zeroed.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: Pablo Neira Ayuso

netfilter: ip6t_NPT: Fix prefix mangling

2013-02-07T17:40:26+00:00

Make sure only the bits that are part of the prefix are mangled.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: Pablo Neira Ayuso

netfilter: ip6t_NPT: Fix adjustment calculation

2013-02-07T17:37:41+00:00

Cast __wsum from/to __sum16 is wrong.  Instead, apply appropriate
conversion function: csum_unfold() or csum_fold().

[ The original patch has been modified to undo the final ~ that
  csum_fold returns. We only need to fold the 32-bit word that
  results from the checksum calculation into a 16-bit to ensure
  that the original subnet is restored appropriately. Spotted by
  Ulrich Weber. ]

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: Pablo Neira Ayuso

netfilter: ip6t_NPT: fix IPv6 NTP checksum calculation

2013-01-04T19:03:02+00:00

csum16_add() has a broken carry detection, should be:
sum += sum < (__force u16)b;

Instead of fixing csum16_add, remove the custom checksum
functions and use the generic csum_add/csum_sub ones.

Signed-off-by: Ulrich Weber 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_ct_reasm: fix conntrack reassembly expire code

2012-12-16T22:41:25+00:00

Commit b836c99fd6c9 (ipv6: unify conntrack reassembly expire
code with standard one) use the standard IPv6 reassembly
code(ip6_expire_frag_queue) to handle conntrack reassembly expire.

In ip6_expire_frag_queue, it invoke dev_get_by_index_rcu to get
which device received this expired packet.so we must save ifindex
when NF_conntrack get this packet.

With this patch applied, I can see ICMP Time Exceeded sent
from the receiver when the sender sent out 1/2 fragmented
IPv6 packet.

Signed-off-by: Haibo Xi 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack_ipv6: fix comment for packets without data

2012-12-16T22:28:31+00:00

Remove ambiguity of double negation.

Signed-off-by: Florent Fourcot 
Acked-by: Rick Jones 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat: Also handle non-ESTABLISHED routing changes in MASQUERADE

2012-12-16T22:28:30+00:00

Since (a0ecb85 netfilter: nf_nat: Handle routing changes in MASQUERADE
target), the MASQUERADE target handles routing changes which affect
the output interface of a connection, but only for ESTABLISHED
connections.  It is also possible for NEW connections which
already have a conntrack entry to be affected by routing changes.

This adds a check to drop entries in the NEW+conntrack state
when the oif has changed.

Signed-off-by: Andrew Collins 
Acked-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso