linux.git/net/ipv4/netfilter, branch v2.6.31

netfilter: tcp conntrack: fix unacknowledged data detection with NAT

2009-06-29T12:07:56+00:00

When NAT helpers change the TCP packet size, the highest seen sequence
number needs to be corrected. This is currently only done upwards, when
the packet size is reduced the sequence number is unchanged. This causes
TCP conntrack to falsely detect unacknowledged data and decrease the
timeout.

Fix by updating the highest seen sequence number in both directions after
packet mangling.

Tested-by: Krzysztof Piotr Oledzki 
Signed-off-by: Patrick McHardy

netfilter: ip_tables: fix build error

2009-06-11T23:53:09+00:00

Fix build error introduced by commit bb70dfa5 (netfilter: xtables:
consolidate comefrom debug cast access):

net/ipv4/netfilter/ip_tables.c: In function 'ipt_do_table':
net/ipv4/netfilter/ip_tables.c:421: error: 'comefrom' undeclared (first use in this function)
net/ipv4/netfilter/ip_tables.c:421: error: (Each undeclared identifier is reported only once
net/ipv4/netfilter/ip_tables.c:421: error: for each function it appears in.)

Signed-off-by: Patrick McHardy

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

2009-06-11T14:00:49+00:00

netfilter: Fix extra semi-colon in skb_walk_frags() changes.

2009-06-10T01:05:28+00:00

Noticed by Jesper Dangaard Brouer

Signed-off-by: David S. Miller

netfilter: Use frag list abstraction interfaces.

2009-06-09T07:23:58+00:00

Signed-off-by: David S. Miller

netfilter: nf_ct_icmp: keep the ICMP ct entries longer

2009-06-08T13:53:43+00:00

Current conntrack code kills the ICMP conntrack entry as soon as
the first reply is received. This is incorrect, as we then see only
the first ICMP echo reply out of several possible duplicates as
ESTABLISHED, while the rest will be INVALID. Also this unnecessarily
increases the conntrackd traffic on H-A firewalls.

Make all the ICMP conntrack entries (including the replied ones)
last for the default of nf_conntrack_icmp{,v6}_timeout seconds.

Signed-off-by: Jan "Yenya" Kasprzak 
Signed-off-by: Patrick McHardy

netfilter: ipt_MASQUERADE: remove redundant rwlock

2009-06-05T11:26:21+00:00

The lock "protects" an assignment and a comparision of an integer.
When the caller of device_cmp() evaluates the result, nat->masq_index
may already have been changed (regardless if the lock is there or not).

So, the lock either has to be held during nf_ct_iterate_cleanup(),
or can be removed.

This does the latter.

Signed-off-by: Florian Westphal 
Signed-off-by: Patrick McHardy

netfilter: x_tables: added hook number into match extension parameter structure.

2009-06-04T14:54:42+00:00

Signed-off-by: Evgeniy Polyakov 
Signed-off-by: Patrick McHardy

net: skb->dst accessors

2009-06-03T09:51:04+00:00

Define three accessors to get/set dst attached to a skb

struct dst_entry *skb_dst(const struct sk_buff *skb)

void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)

void skb_dst_drop(struct sk_buff *skb)
This one should replace occurrences of :
dst_release(skb->dst)
skb->dst = NULL;

Delete skb->dst field

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: skb->rtable accessor

2009-06-03T09:51:02+00:00

Define skb_rtable(const struct sk_buff *skb) accessor to get rtable from skb

Delete skb->rtable field

Setting rtable is not allowed, just set dst instead as rtable is an alias.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller