linux.git/net/ipv6/netfilter, branch v2.6.20

[NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments

2007-01-09T22:32:41+00:00

When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER] IPV6: Fix dependencies.

2006-12-18T05:59:18+00:00

Although the menu dependencies in net/ipv6/netfilter/Kconfig
guard the entries in that file from the Kconfig GUI, this does
not prevent them from being selected still via "make oldconfig"
when IPV6 etc. is disabled.

So add explicit dependencies.

Signed-off-by: David S. Miller

[NETFILTER]: {ip,ip6,arp}_tables: fix exponential worst-case search for loops

2006-12-14T00:48:23+00:00

If we come to node we'd already marked as seen and it's not a part of path
(i.e. we don't have a loop right there), we already know that it isn't a
part of any loop, so we don't need to revisit it.

That speeds the things up if some chain is refered to from several places
and kills O(exp(table size)) worst-case behaviour (without sleeping,
at that, so if you manage to self-LART that way, you are SOL for a long
time)...

Signed-off-by: Al Viro 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix {ip,ip6,arp}_tables hook validation

2006-12-07T02:39:02+00:00

Commit 590bdf7fd2292b47c428111cb1360e312eff207e introduced a regression
in match/target hook validation. mark_source_chains builds a bitmask
for each rule representing the hooks it can be reached from, which is
then used by the matches and targets to make sure they are only called
from valid hooks. The patch moved the match/target specific validation
before the mark_source_chains call, at which point the mask is always zero.

This patch returns back to the old order and moves the standard checks
to mark_source_chains. This allows to get rid of a special case for
standard targets as a nice side-effect.

Signed-off-by: Dmitry Mishin 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Mark old IPv4-only connection tracking scheduled for removal

2006-12-03T06:11:01+00:00

Also remove the references to "new connection tracking" from Kconfig.
After some short stabilization period of the new connection tracking
helpers/NAT code the old one will be removed.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: endian annotations

2006-12-03T06:05:08+00:00

Resync with Al Viro's ip_conntrack annotations and fix a missed
spot in ip_nat_proto_icmp.c.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix PROC_FS=n warnings

2006-12-03T05:31:34+00:00

Fix some unused function/variable warnings.

Signed-off-by: Patrick McHardy

[NETFILTER]: x_tables: add NFLOG target

2006-12-03T05:31:31+00:00

Add new NFLOG target to allow use of nfnetlink_log for both IPv4 and IPv6.
Currently we have two (unsupported by userspace) hacks in the LOG and ULOG
targets to optionally call to the nflog API. They lack a few features,
namely the IPv4 and IPv6 LOG targets can not specify a number of arguments
related to nfnetlink_log, while the ULOG target is only available for IPv4.
Remove those hacks and add a clean way to use nfnetlink_log.

Signed-off-by: Patrick McHardy

[NETFILTER]: nf_conntrack: move conntrack protocol sysctls to individual modules

2006-12-03T05:31:18+00:00

Signed-off-by: Patrick McHardy

[NETFILTER]: nf_conntrack: move extern declaration to header files

2006-12-03T05:31:16+00:00

Using extern in a C file is a bad idea because the compiler can't
catch type errors.

Signed-off-by: Patrick McHardy