linux.git/net/ipv6/netfilter, branch v2.6.27

netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion

2008-09-24T22:53:39+00:00

The current code ignores rules for internal options in HBH/DST options
header in packet processing if 'Not strict' mode is specified (which is not
implemented). Clearly it is not expected by user.

Kernel should reject HBH/DST rule insertion with 'Not strict' mode
in the first place.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ip{,6}tables_security: fix future section mismatch

2008-07-27T00:48:38+00:00

Currently not visible, because NET_NS is mutually exclusive with SYSFS
which is required by SECURITY.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

net: convert BUG_TRAP to generic WARN_ON

2008-07-26T04:43:18+00:00

Removes legacy reinvent-the-wheel type thing. The generic
machinery integrates much better to automated debugging aids
such as kerneloops.org (and others), and is unambiguous due to
better naming. Non-intuively BUG_TRAP() is actually equal to
WARN_ON() rather than BUG_ON() though some might actually be
promoted to BUG_ON() but I left that to future.

I could make at least one BUILD_BUG_ON conversion.

Signed-off-by: Ilpo Järvinen 
Signed-off-by: David S. Miller

netfilter: make security table depend on NETFILTER_ADVANCED

2008-07-23T23:42:42+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netns: Use net_eq() to compare net-namespaces for optimization.

2008-07-20T05:34:43+00:00

Without CONFIG_NET_NS, namespace is always &init_net.
Compiler will be able to omit namespace comparisons with this patch.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

netfilter: ip6table_filter in netns for real

2008-07-08T09:36:18+00:00

One still needs to remove checks in nf_hook_slow() and nf_sockopt_find()
to test this, though.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: use correct namespace in ip6table_security

2008-07-08T09:34:52+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2008-06-28T08:19:40+00:00

Conflicts:

	drivers/net/wireless/iwlwifi/iwl4965-base.c

inet fragments: fix race between inet_frag_find and inet_frag_secret_rebuild

2008-06-28T03:06:08+00:00

The problem is that while we work w/o the inet_frags.lock even
read-locked the secret rebuild timer may occur (on another CPU, since
BHs are still disabled in the inet_frag_find) and change the rnd seed
for ipv4/6 fragments.

It was caused by my patch fd9e63544cac30a34c951f0ec958038f0529e244
([INET]: Omit double hash calculations in xxx_frag_intern) late 
in the 2.6.24 kernel, so this should probably be queued to -stable.

Signed-off-by: Pavel Emelyanov 
Signed-off-by: David S. Miller

netfilter: ip6table_mangle: don't reroute in LOCAL_IN

2008-06-24T20:30:45+00:00

Rerouting should only happen in LOCAL_OUT, in INPUT its useless
since the packet has already chosen its final destination.

Noticed by Alexey Dobriyan .

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller