linux-stable.git/net/netfilter/ipset, branch v3.4

netfilter: ipset: fix hash size checking in kernel

2012-05-16T19:38:49+00:00

The hash size must fit both into u32 (jhash) and the max value of
size_t. The missing checking could lead to kernel crash, bug reported
by Seblu.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: ipset: Exceptions support added to hash:net types

2012-03-07T16:40:35+00:00

The "nomatch" keyword and option is added to the hash:*net* types,
by which one can add exception entries to sets. Example:

        ipset create test hash:net
        ipset add test 192.168.0/24
        ipset add test 192.168.0/30 nomatch

In this case the IP addresses from 192.168.0/24 except 192.168.0/30
match the elements of the set.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: use NFPROTO_ constants

2012-03-07T16:40:29+00:00

ipset is actually using NFPROTO values rather than AF (xt_set passes
that along).

Signed-off-by: Jan Engelhardt 
Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netlink: add netlink_dump_control structure for netlink_dump_start()

2012-02-26T19:10:06+00:00

Davem considers that the argument list of this interface is getting
out of control. This patch tries to address this issue following
his proposal:

struct netlink_dump_control c = { .dump = dump, .done = done, ... };

netlink_dump_start(..., &c);

Suggested by David S. Miller.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: ipset: dumping error triggered removing references twice

2012-01-17T09:52:55+00:00

If there was a dumping error in the middle, the set-specific variable was
not zeroed out and thus the 'done' function of the dumping wrongly tried
to release the already released reference of the set. The already released
reference was caught by __ip_set_put and triggered a kernel BUG message.
Reported by Jean-Philippe Menil.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: autoload set type modules safely

2012-01-17T09:52:46+00:00

Jan Engelhardt noticed when userspace requests a set type unknown
to the kernel, it can lead to a loop due to the unsafe type module
loading. The issue is fixed in this patch.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

net:netfilter: use IS_ENABLED

2011-12-16T20:49:52+00:00

Use IS_ENABLED(CONFIG_FOO)
instead of defined(CONFIG_FOO) || defined (CONFIG_FOO_MODULE)

Signed-off-by: Igor Maravić 
Signed-off-by: David S. Miller

ipv6: Add fragment reporting to ipv6_skip_exthdr().

2011-12-03T17:35:10+00:00

While parsing through IPv6 extension headers, fragment headers are
skipped making them invisible to the caller.  This reports the
fragment offset of the last header in order to make it possible to
determine whether the packet is fragmented and, if so whether it is
a first or last fragment.

Signed-off-by: Jesse Gross

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2011-12-02T18:49:21+00:00

net: remove ipv6_addr_copy()

2011-11-22T21:43:32+00:00

C assignment can handle struct in6_addr copying.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller