linux-stable.git/net/netfilter, branch linux-2.6.19.y

[PATCH] NETFILTER: xt_connbytes: fix division by zero

2007-02-05T16:31:45+00:00

When the packet counter of a connection is zero a division by zero
occurs in div64_64(). Fix that by using zero as average value, which
is correct as long as the packet counter didn't overflow, at which
point we have lost anyway.

Additionally we're probably going to go back to 64 bit counters
in 2.6.21.

Based on patch from Jonas Berlin ,
with suggestions from KOVACS Krisztian .

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: ctnetlink: fix leak in ctnetlink_create_conntrack error path

2007-02-05T16:31:41+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: ctnetlink: check for status attribute existence on conntrack creation

2007-02-05T16:31:41+00:00

Check that status flags are available in the netlink message received
to create a new conntrack.

Fixes a crash in ctnetlink_create_conntrack when the CTA_STATUS attribute
is not present.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[NETFILTER]: conntrack: fix refcount leak when finding expectation

2006-11-29T04:59:37+00:00

All users of __{ip,nf}_conntrack_expect_find() don't expect that
it increments the reference count of expectation.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ctnetlink: fix reference count leak

2006-11-29T04:59:36+00:00

When NFA_NEST exceeds the skb size the protocol reference is leaked.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: fix the race on assign helper to new conntrack

2006-11-29T04:59:35+00:00

The found helper cannot be assigned to conntrack after unlocking
nf_conntrack_lock. This tries to find helper to assign again.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nfctnetlink: assign helper to newly created conntrack

2006-11-29T04:59:34+00:00

This fixes the bug which doesn't assign helper to newly created
conntrack via nf_conntrack_netlink.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Use pskb_trim in {ip,ip6,nfnetlink}_queue

2006-11-16T05:18:48+00:00

Based on patch by James D. Nurmi:

I've got some code very dependant on nfnetlink_queue, and turned up a
large number of warns coming from skb_trim.  While it's quite possibly
my code, having not seen it on older kernels made me a bit suspect.

Anyhow, based on some googling I turned up this thread:
http://lkml.org/lkml/2006/8/13/56

And believe the issue to be related, so attached is a small patch to
the kernel -- not sure if this is completely correct, but for anyone
else hitting the WARN_ON(1) in skbuff.h, it might be helpful..

Signed-off-by: James D. Nurmi 

Ported to ip6_queue and nfnetlink_queue and added return value
checks.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nfnetlink_log: fix byteorder of NFULA_SEQ_GLOBAL

2006-11-16T05:18:47+00:00

NFULA_SEQ_GLOBAL should be in network byteorder.

Spotted by Al Viro.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER] bug: skb->protocol is already net-endian

2006-11-05T22:11:29+00:00

htons() is not needed (and no, it's not misspelled ntohs() -
userland expects net-endian here).

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller