linux.git/net/ipv4/netfilter, branch v2.6.27

nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization

2008-08-19T04:32:32+00:00

Use incoming network tuple as seed for NAT port randomization.
This avoids concerns of leaking net_random() bits, and also gives better
port distribution. Don't have NAT server, compile tested only.

Signed-off-by: Stephen Hemminger 

[ added missing EXPORT_SYMBOL_GPL ]

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ipt_addrtype: Fix matching of inverted destination address type

2008-08-19T04:29:57+00:00

This patch fixes matching of inverted destination address type.

Signed-off-by: Anders Grafström 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ipt_recent: fix race between recent_mt_destroy and proc manipulations

2008-07-31T07:38:31+00:00

The thing is that recent_mt_destroy first flushes the entries
from table with the recent_table_flush and only *after* this
removes the proc file, corresponding to that table.

Thus, if we manage to write to this file the '+XXX' command we
will leak some entries. If we manage to write there a 'clean'
command we'll race in two recent_table_flush flows, since the
recent_mt_destroy calls this outside the recent_lock.

The proper solution as I see it is to remove the proc file first
and then go on with flushing the table. This flushing becomes
safe w/o the lock, since the table is already inaccessible from
the outside.

Signed-off-by: Pavel Emelyanov 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

net: use the common ascii hex helpers

2008-07-30T23:30:15+00:00

Signed-off-by: Harvey Harrison 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

netfilter: arptables in netns for real

2008-07-27T00:48:59+00:00

IN, FORWARD -- grab netns from in device, OUT -- from out device.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ip{,6}tables_security: fix future section mismatch

2008-07-27T00:48:38+00:00

Currently not visible, because NET_NS is mutually exclusive with SYSFS
which is required by SECURITY.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: make security table depend on NETFILTER_ADVANCED

2008-07-23T23:42:42+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nf_nat_sip: c= is optional for session

2008-07-21T17:11:02+00:00

According to RFC2327, the connection information is optional
in the session description since it can be specified in the
media description instead.

My provider does exactly that and does not provide any connection
information in the session description.  As a result the new
kernel drops all invite responses.

This patch makes it optional as documented.

Signed-off-by: Herbert Xu 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: accounting rework: ct_extend + 64bit counters (v4)

2008-07-21T17:10:58+00:00

Initially netfilter has had 64bit counters for conntrack-based accounting, but
it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are
still required, for example for "connbytes" extension. However, 64bit counters
waste a lot of memory and it was not possible to enable/disable it runtime.

This patch:
 - reimplements accounting with respect to the extension infrastructure,
 - makes one global version of seq_print_acct() instead of two seq_print_counters(),
 - makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n),
 - makes it possible to enable/disable it at runtime by sysctl or sysfs,
 - extends counters from 32bit to 64bit,
 - renames ip_conntrack_counter -> nf_conn_counter,
 - enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT),
 - set initial accounting enable state based on CONFIG_NF_CT_ACCT
 - removes buggy IPCT_COUNTER_FILLING event handling.

If accounting is enabled newly created connections get additional acct extend.
Old connections are not changed as it is not possible to add a ct_extend area
to confirmed conntrack. Accounting is performed for all connections with
acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct".

Signed-off-by: Krzysztof Piotr Oledzki 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nf_nat_core: eliminate useless find_appropriate_src for IP_NAT_RANGE_PROTO_RANDOM

2008-07-21T17:10:57+00:00

Signed-off-by: Changli Gao 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller