linux.git/net/ipv4/netfilter, branch v2.6.16

[NETFILTER]: arp_tables: fix NULL pointer dereference

2006-03-13T04:40:43+00:00

The check is wrong and lets NULL-ptrs slip through since !IS_ERR(NULL)
is true.

Coverity #190

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER] ip_queue: Fix wrong skb->len == nlmsg_len assumption

2006-03-07T22:56:12+00:00

The size of the skb carrying the netlink message is not
equivalent to the length of the actual netlink message
due to padding. ip_queue matches the length of the payload
against the original packet size to determine if packet
mangling is desired, due to the above wrong assumption
arbitary packets may not be mangled depening on their
original size.

Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller

[NETFILTER]: Restore {ipt,ip6t,ebt}_LOG compatibility

2006-02-27T21:04:17+00:00

The nfnetlink_log infrastructure changes broke compatiblity of the LOG
targets. They currently use whatever log backend was registered first,
which means that if ipt_ULOG was loaded first, no messages will be printed
to the ring buffer anymore.

Restore compatiblity by using the old log functions by default and only use
the nf_log backend if the user explicitly said so.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix outgoing redirects to loopback

2006-02-20T06:29:47+00:00

When redirecting an outgoing packet to loopback, it keeps the original
conntrack reference and information from the outgoing path, which
falsely triggers the check for DNAT on input and the dst_entry is
released to trigger rerouting. ip_route_input refuses to route the
packet because it has a local source address and it is dropped.

Look at the packet itself to dermine if it was NATed. Also fix a
missing inversion that causes unneccesary xfrm lookups.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix NAT PMTUD problems

2006-02-20T06:26:40+00:00

ICMP errors are only SNATed when their source matches the source of the
connection they are related to, otherwise the source address is not
changed. This creates problems with ICMP frag. required messages
originating from a router behind the NAT, if private IPs are used the
packet has a good change of getting dropped on the path to its destination.

Always NAT ICMP errors similar to the original connection.

Based on report by Al Viro.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: move registration of __nf_ct_attach

2006-02-15T23:22:21+00:00

Move registration of __nf_ct_attach to nf_conntrack_core to make it usable
for IPv6 connection tracking as well.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix xfrm lookup after SNAT

2006-02-15T09:34:23+00:00

To find out if a packet needs to be handled by IPsec after SNAT, packets
are currently rerouted in POST_ROUTING and a new xfrm lookup is done. This
breaks SNAT of non-unicast packets to non-local addresses because the
packet is routed as incoming packet and no neighbour entry is bound to the
dst_entry. In general, it seems to be a bad idea to replace the dst_entry
after the packet was already sent to the output routine because its state
might not match what's expected.

This patch changes the xfrm lookup in POST_ROUTING to re-use the original
dst_entry without routing the packet again. This means no policy routing
can be used for transport mode transforms (which keep the original route)
when packets are SNATed to match the policy, but it looks like the best
we can do for now.

Signed-off-by: Patrick McHardy 
Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[NETFILTER]: Fix check whether dst_entry needs to be released after NAT

2006-02-05T07:51:29+00:00

After DNAT the original dst_entry needs to be released if present
so the packet doesn't skip input routing with its new address. The
current check for DNAT in ip_nat_in is reversed and checks for SNAT.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Prepare {ipt,ip6t}_policy match for x_tables unification

2006-02-05T07:51:28+00:00

The IPv4 and IPv6 version of the policy match are identical besides address
comparison and the data structure used for userspace communication. Unify
the data structures to break compatiblity now (before it is released), so
we can port it to x_tables in 2.6.17.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Check policy length in policy match strict mode

2006-02-05T07:51:26+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller