linux.git/net/ipv4/netfilter, branch v3.0-rc5

netfilter: nf_nat: avoid double seq_adjust for loopback

2011-06-16T15:29:22+00:00

	Avoid double seq adjustment for loopback traffic
because it causes silent repetition of TCP data. One
example is passive FTP with DNAT rule and difference in the
length of IP addresses.

	This patch adds check if packet is sent and
received via loopback device. As the same conntrack is
used both for outgoing and incoming direction, we restrict
seq adjustment to happen only in POSTROUTING.

Signed-off-by: Julian Anastasov 
Signed-off-by: Patrick McHardy

netfilter: fix looped (broad|multi)cast's MAC handling

2011-06-16T15:27:04+00:00

By default, when broadcast or multicast packet are sent from a local
application, they are sent to the interface then looped by the kernel
to other local applications, going throught netfilter hooks in the
process.

These looped packet have their MAC header removed from the skb by the
kernel looping code. This confuse various netfilter's netlink queue,
netlink log and the legacy ip_queue, because they try to extract a
hardware address from these packets, but extracts a part of the IP
header instead.

This patch prevent NFQUEUE, NFLOG and ip_QUEUE to include a MAC header
if there is none in the packet.

Signed-off-by: Nicolas Cavallari 
Signed-off-by: Patrick McHardy

netfilter: ipt_ecn: fix inversion for IP header ECN match

2011-06-16T15:24:55+00:00

Userspace allows to specify inversion for IP header ECN matches, the
kernel silently accepts it, but doesn't invert the match result.

Signed-off-by: Patrick McHardy

netfilter: ipt_ecn: fix protocol check in ecn_mt_check()

2011-06-16T15:24:17+00:00

Check for protocol inversion in ecn_mt_check() and remove the
unnecessary runtime check for IPPROTO_TCP in ecn_mt().

Signed-off-by: Patrick McHardy

netfilter: ip_tables: fix compile with debug

2011-06-16T15:16:37+00:00

Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Patrick McHardy

netfilter: use unsigned variables for packet lengths in ip[6]_queue.

2011-06-05T23:37:16+00:00

Netlink message lengths can't be negative, so use unsigned variables.

Signed-off-by: Dave Jones 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: fix ct refcount leak in l4proto->error()

2011-06-05T23:37:02+00:00

This patch fixes a refcount leak of ct objects that may occur if
l4proto->error() assigns one conntrack object to one skbuff. In
that case, we have to skip further processing in nf_conntrack_in().

With this patch, we can also fix wrong return values (-NF_ACCEPT)
for special cases in ICMP[v6] that should not bump the invalid/error
statistic counters.

Reported-by: Zoltan Menyhart 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat: fix crash in nf_nat_csum

2011-06-05T23:36:46+00:00

Fix crash in nf_nat_csum when mangling packets
in OUTPUT hook where skb->dev is not defined, it is set
later before POSTROUTING. Problem happens for CHECKSUM_NONE.
We can check device from rt but using CHECKSUM_PARTIAL
should be safe (skb_checksum_help).

Signed-off-by: Julian Anastasov 
Signed-off-by: Pablo Neira Ayuso

netfilter: add more values to enum ip_conntrack_info

2011-06-05T23:35:10+00:00

Following error is raised (and other similar ones) :

net/ipv4/netfilter/nf_nat_standalone.c: In function ‘nf_nat_fn’:
net/ipv4/netfilter/nf_nat_standalone.c:119:2: warning: case value ‘4’
not in enumerated type ‘enum ip_conntrack_info’

gcc barfs on adding two enum values and getting a not enumerated
result :

case IP_CT_RELATED+IP_CT_IS_REPLY:

Add missing enum values

Signed-off-by: Eric Dumazet 
CC: David Miller 
Signed-off-by: Pablo Neira Ayuso

inet: constify ip headers and in6_addr

2011-04-22T18:04:14+00:00

Add const qualifiers to structs iphdr, ipv6hdr and in6_addr pointers
where possible, to make code intention more obvious.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller