linux.git/net/ipv4/netfilter, branch v2.6.20

[NETFILTER]: ctnetlink: fix compile failure with NF_CONNTRACK_MARK=n

2007-02-03T03:33:11+00:00

  CC      net/netfilter/nf_conntrack_netlink.o
net/netfilter/nf_conntrack_netlink.c: In function 'ctnetlink_conntrack_event':
net/netfilter/nf_conntrack_netlink.c:392: error: 'struct nf_conn' has no member named 'mark'
make[3]: *** [net/netfilter/nf_conntrack_netlink.o] Error 1

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: SIP conntrack: fix out of bounds memory access

2007-01-30T22:25:24+00:00

When checking for an @-sign in skp_epaddr_len, make sure not to
run over the packet boundaries.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: SIP conntrack: fix skipping over user info in SIP headers

2007-01-30T22:24:57+00:00

When trying to skip over the username in the Contact header, stop at the
end of the line if no @ is found to avoid mangling following headers.
We don't need to worry about continuation lines because we search inside
a SIP URI.

Fixes Netfilter Bugzilla #532.

Signed-off-by: Lars Immisch 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_nat_pptp: fix expectation removal

2007-01-26T09:07:30+00:00

When removing the expectation for the opposite direction, the PPTP NAT
helper initializes the tuple for lookup with the addresses of the
opposite direction, which makes the lookup fail.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_nat: fix ICMP translation with statically linked conntrack

2007-01-26T09:06:47+00:00

When nf_nat/nf_conntrack_ipv4 are linked statically, nf_nat is initialized
before nf_conntrack_ipv4, which makes the nf_ct_l3proto_find_get(AF_INET)
call during nf_nat initialization return the generic l3proto instead of
the AF_INET specific one. This breaks ICMP error translation since the
generic protocol always initializes the IPs in the tuple to 0.

Change the linking order and put nf_conntrack_ipv4 first.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ctnetlink: fix leak in ctnetlink_create_conntrack error path

2007-01-24T04:25:42+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_nat: fix hanging connections when loading the NAT module

2007-01-09T22:33:49+00:00

When loading the NAT module, existing connection tracking entries don't
have room for NAT information allocated and packets are dropped, causing
hanging connections. They really should be entered into the NAT table
as NULL mappings, but the current allocation scheme doesn't allow this.

For now simply accept those packets to avoid the hanging connections.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_nat: fix MASQUERADE crash on device down

2007-01-04T20:16:54+00:00

Check the return value of nfct_nat() in device_cmp(), we might very well
have non NAT conntrack entries as well (Netfilter bugzilla #528).

Signed-off-by: Martin Josefsson 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: New connection tracking is not EXPERIMENTAL anymore

2007-01-04T20:16:06+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: compat offsets size change

2007-01-04T20:14:41+00:00

Used by compat code offsets of entries should be 'unsigned int' as entries
array size has this dimension.

Signed-off-by: Dmitry Mishin 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller