linux-stable.git/net/ipv6/netfilter, branch v3.16.3

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2014-05-31T00:54:47+00:00

Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

This small patchset contains three accumulated Netfilter/IPVS updates,
they are:

1) Refactorize common NAT code by encapsulating it into a helper
   function, similarly to what we do in other conntrack extensions,
   from Florian Westphal.

2) A minor format string mismatch fix for IPVS, from Masanari Iida.

3) Add quota support to the netfilter accounting infrastructure, now
   you can add quotas to accounting objects via the nfnetlink interface
   and use them from iptables. You can also listen to quota
   notifications from userspace. This enhancement from Mathieu Poirier.
====================

Signed-off-by: David S. Miller

net: rename local_df to ignore_df

2014-05-12T18:03:41+00:00

As suggested by several people, rename local_df to ignore_df,
since it means "ignore df bit if it is set".

Cc: Maciej Żenczykowski 
Cc: Florian Westphal 
Cc: David S. Miller 
Cc: Eric Dumazet 
Signed-off-by: Cong Wang 
Acked-by: Maciej Żenczykowski 
Signed-off-by: David S. Miller

netfilter: add helper for adding nat extension

2014-04-29T18:56:22+00:00

Reduce copy-past a bit by adding a common helper.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

net: ipv6: more places need LOOPBACK_IFINDEX for flowi6_iif

2014-04-28T18:47:03+00:00

To properly match iif in ip rules we have to provide
LOOPBACK_IFINDEX in flowi6_iif, not 0. Some ip6mr_fib_lookup
and fib6_rule_lookup callers need such fix.

Signed-off-by: Julian Anastasov 
Signed-off-by: David S. Miller

netfilter: Can't fail and free after table replacement

2014-04-05T15:46:22+00:00

All xtables variants suffer from the defect that the copy_to_user()
to copy the counters to user memory may fail after the table has
already been exchanged and thus exposed. Return an error at this
point will result in freeing the already exposed table. Any
subsequent packet processing will result in a kernel panic.

We can't copy the counters before exposing the new tables as we
want provide the counter state after the old table has been
unhooked. Therefore convert this into a silent error.

Cc: Florian Westphal 
Signed-off-by: Thomas Graf 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add reject module for NFPROTO_INET

2014-02-06T08:44:18+00:00

Add a reject module for NFPROTO_INET. It does nothing but dispatch
to the AF-specific modules based on the hook family.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts

2014-02-06T08:44:10+00:00

Currently the nft_reject module depends on symbols from ipv6. This is
wrong since no generic module should force IPv6 support to be loaded.
Split up the module into AF-specific and a generic part.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix error path in the init functions

2014-01-09T22:25:48+00:00

We have to unregister chain type if this fails to register netns.

Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain()

2014-01-09T19:17:16+00:00

We don't encode argument types into function names and since besides
nft_do_chain() there are only AF-specific versions, there is no risk
of confusion.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: minor nf_chain_type cleanups

2014-01-09T19:17:15+00:00

Minor nf_chain_type cleanups:

- reorder struct to plug a hoe
- rename struct module member to "owner" for consistency
- rename nf_hookfn array to "hooks" for consistency
- reorder initializers for better readability

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso