linux.git/net/ipv4/netfilter, branch v2.6.24

[NETFILTER]: nf_conntrack_ipv4: fix module parameter compatibility

2007-12-27T03:36:33+00:00

Some users do "modprobe ip_conntrack hashsize=...". Since we have the
module aliases this loads nf_conntrack_ipv4 and nf_conntrack, the
hashsize parameter is unknown for nf_conntrack_ipv4 however and makes
it fail.

Allow to specify hashsize= for both nf_conntrack and nf_conntrack_ipv4.

Note: the nf_conntrack message in the ringbuffer will display an
incorrect hashsize since nf_conntrack is first pulled in as a
dependency and calculates the size itself, then it gets changed
through a call to nf_conntrack_set_hashsize().

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER] ipv4: Spelling fixes

2007-12-20T22:05:03+00:00

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

[NETFILTER]: ip_tables: fix compat copy race

2007-12-14T21:54:35+00:00

When copying entries to user, the kernel makes two passes through the
data, first copying all the entries, then fixing up names and counters.
On the second pass it copies the kernel and match data from userspace
to the kernel again to find the corresponding structures, expecting
that kernel pointers contained in the data are still valid.

This is obviously broken, fix by avoiding the second pass completely
and fixing names and counters while dumping the ruleset, using the
kernel-internal data structures.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix kernel panic with REDIRECT target.

2007-11-20T12:27:35+00:00

When connection tracking entry (nf_conn) is about to copy itself it can
have some of its extension users (like nat) as being already freed and
thus not required to be copied.

Actually looking at this function I suspect it was copied from
nf_nat_setup_info() and thus bug was introduced.

Report and testing from David .

[ Patrick McHardy states:

	I now understand whats happening:

	- new connection is allocated without helper
	- connection is REDIRECTed to localhost
	- nf_nat_setup_info adds NAT extension, but doesn't initialize it yet
	- nf_conntrack_alter_reply performs a helper lookup based on the
	   new tuple, finds the SIP helper and allocates a helper extension,
	   causing reallocation because of too little space
	- nf_nat_move_storage is called with the uninitialized nat extension

	So your fix is entirely correct, thanks a lot :)  ]

Signed-off-by: Evgeniy Polyakov 
Acked-by: Patrick McHardy 
Signed-off-by: David S. Miller

[IPV4]: Add missing "space"

2007-11-20T07:46:29+00:00

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

[NETFILTER]: nf_nat: fix memset error

2007-11-13T10:57:16+00:00

The size passing to memset is the size of a pointer.

Signed-off-by: Li Zefan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: remove unneeded rcu_dereference() calls

2007-11-07T12:08:23+00:00

As noticed by Paul McKenney, the rcu_dereference calls in the init path
of NAT modules are unneeded, remove them.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Clean up Makefile

2007-11-07T12:08:22+00:00

Sort matches and targets in the NF makefiles.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ip{,6}_queue: convert to seq_file interface

2007-11-07T12:08:20+00:00

I plan to kill ->get_info which means killing proc_net_create().

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

Kbuild/doc: fix links to Documentation files

2007-10-30T21:26:30+00:00

Fix links to files in Documentation/* in various Kconfig files

Signed-off-by: Dirk Hohndel 
Signed-off-by: Linus Torvalds