linux-stable.git/net/netfilter/ipset, branch v3.7

netfilter: ipset: fix netiface set name overflow

2012-11-24T22:48:23+00:00

attribute is copied to IFNAMSIZ-size stack variable,
but IFNAMSIZ is smaller than IPSET_MAXNAMELEN.

Fortunately nfnetlink needs CAP_NET_ADMIN.

Signed-off-by: Florian Westphal 
Acked-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Fix range bug in hash:ip,port,net

2012-11-21T22:49:02+00:00

Due to the missing ininitalization at adding/deleting entries, when
a plain_ip,port,net element was the object, multiple elements were
added/deleted instead. The bug came from the missing dangling
default initialization.

The error-prone default initialization is corrected in all hash:* types.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Support to match elements marked with "nomatch"

2012-09-22T20:44:34+00:00

Exceptions can now be matched and we can branch according to the
possible cases:

a. match in the set if the element is not flagged as "nomatch"
b. match in the set if the element is flagged with "nomatch"
c. no match

i.e.

iptables ... -m set --match-set ... -j ...
iptables ... -m set --match-set ... --nomatch-entries -j ...
...

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Coding style fixes

2012-09-22T20:44:29+00:00

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Include supported revisions in module description

2012-09-22T20:44:24+00:00

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Add /0 network support to hash:net,iface type

2012-09-22T20:44:15+00:00

Now it is possible to setup a single hash:net,iface type of set and
a single ip6?tables match which covers all egress/ingress filtering.

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Check and reject crazy /0 input parameters

2012-09-21T19:51:34+00:00

bitmap:ip and bitmap:ip,mac type did not reject such a crazy range
when created and using such a set results in a kernel crash.
The hash types just silently ignored such parameters.

Reject invalid /0 input parameters explicitely.

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Fix sparse warnings "incorrect type in assignment"

2012-09-21T19:51:22+00:00

Signed-off-by: Jozsef Kadlecsik

netlink: Rename pid to portid to avoid confusion

2012-09-10T19:30:41+00:00

It is a frequent mistake to confuse the netlink port identifier with a
process identifier.  Try to reduce this confusion by renaming fields
that hold port identifiers portid instead of pid.

I have carefully avoided changing the structures exported to
userspace to avoid changing the userspace API.

I have successfully built an allyesconfig kernel with this change.

Signed-off-by: "Eric W. Biederman" 
Acked-by: Stephen Hemminger 
Signed-off-by: David S. Miller

netfilter: ipset: fix crash if IPSET_CMD_NONE command is sent

2012-06-29T11:04:04+00:00

This patch fixes a crash if that ipset command is sent over nfnetlink.

Signed-off-by: Tomasz Bursztyka 
Acked-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso