linux.git/net/ipv4/netfilter, branch v2.6.28

netfilter: update rwlock initialization for nat_table

2008-12-15T08:19:14+00:00

    
The commit e099a173573ce1ba171092aee7bb3c72ea686e59
(netfilter: netns nat: per-netns NAT table) renamed the
nat_table from __nat_table to nat_table without updating the
__RW_LOCK_UNLOCKED(__nat_table.lock).

Signed-off-by: Steven Rostedt 
Signed-off-by: David S. Miller

netfilter: snmp nat leaks memory in case of failure

2008-10-20T10:33:24+00:00

Signed-off-by: Ilpo Järvinen 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ctnetlink: remove bogus module dependency between ctnetlink and nf_nat

2008-10-14T18:58:31+00:00

This patch removes the module dependency between ctnetlink and
nf_nat by means of an indirect call that is initialized when
nf_nat is loaded. Now, nf_conntrack_netlink only requires
nf_conntrack and nfnetlink.

This patch puts nfnetlink_parse_nat_setup_hook into the
nf_conntrack_core to avoid dependencies between ctnetlink,
nf_conntrack_ipv4 and nf_conntrack_ipv6.

This patch also introduces the function ctnetlink_change_nat
that is only invoked from the creation path. Actually, the
nat handling cannot be invoked from the update path since
this is not allowed. By introducing this function, we remove
the useless nat handling in the update path and we avoid
deadlock-prone code.

This patch also adds the required EAGAIN logic for nfnetlink.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: restore lost #ifdef guarding defrag exception

2008-10-14T18:56:59+00:00

Nir Tzachar  reported a warning when sending
fragments over loopback with NAT:

[ 6658.338121] WARNING: at net/ipv4/netfilter/nf_nat_standalone.c:89 nf_nat_fn+0x33/0x155()

The reason is that defragmentation is skipped for already tracked connections.
This is wrong in combination with NAT and ip_conntrack actually had some ifdefs
to avoid this behaviour when NAT is compiled in.

The entire "optimization" may seem a bit silly, for now simply restoring the
lost #ifdef is the easiest solution until we can come up with something better.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: xtables: provide invoked family value to extensions

2008-10-08T09:35:20+00:00

By passing in the family through which extensions were invoked, a bit
of data space can be reclaimed. The "family" member will be added to
the parameter structures and the check functions be adjusted.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (6/6)

2008-10-08T09:35:19+00:00

This patch does this for target extensions' destroy functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (5/6)

2008-10-08T09:35:19+00:00

This patch does this for target extensions' checkentry functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (4/6)

2008-10-08T09:35:19+00:00

This patch does this for target extensions' target functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (3/6)

2008-10-08T09:35:19+00:00

This patch does this for match extensions' destroy functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: move extension arguments into compound structure (2/6)

2008-10-08T09:35:18+00:00

This patch does this for match extensions' checkentry functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy