linux.git/net/ipv6/netfilter, branch v2.6.32

netfilter: ip6t_eui: fix read outside array bounds

2009-08-31T13:30:31+00:00

Use memcmp() instead of open coded comparison that reads one byte past
the intended end.

Based on patch from Roel Kluin 

Signed-off-by: Patrick McHardy

netfilter: nf_conntrack: log packets dropped by helpers

2009-08-25T13:33:08+00:00

Log packets dropped by helpers using the netfilter logging API. This
is useful in combination with nfnetlink_log to analyze those packets
in userspace for debugging.

Signed-off-by: Patrick McHardy

netfilter: xtables: mark initial tables constant

2009-08-24T12:56:30+00:00

The inputted table is never modified, so should be considered const.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: check for standard verdicts in policies

2009-08-10T11:35:31+00:00

This adds the second check that Rusty wanted to have a long time ago. :-)

Base chain policies must have absolute verdicts that cease processing
in the table, otherwise rule execution may continue in an unexpected
spurious fashion (e.g. next chain that follows in memory).

Signed-off-by: Jan Engelhardt

netfilter: xtables: check for unconditionality of policies

2009-08-10T11:35:29+00:00

This adds a check that iptables's original author Rusty set forth in
a FIXME comment.

Underflows in iptables are better known as chain policies, and are
required to be unconditional or there would be a stochastical chance
for the policy rule to be skipped if it does not match. If that were
to happen, rule execution would continue in an unexpected spurious
fashion.

Signed-off-by: Jan Engelhardt

netfilter: xtables: ignore unassigned hooks in check_entry_size_and_hooks

2009-08-10T11:35:28+00:00

The "hook_entry" and "underflow" array contains values even for hooks
not provided, such as PREROUTING in conjunction with the "filter"
table. Usually, the values point to whatever the next rule is. For
the upcoming unconditionality and underflow checking patches however,
we must not inspect that arbitrary rule.

Skipping unassigned hooks seems like a good idea, also because
newinfo->hook_entry and newinfo->underflow will then continue to have
the poison value for detecting abnormalities.

Signed-off-by: Jan Engelhardt

netfilter: xtables: use memcmp in unconditional check

2009-08-10T11:35:27+00:00

Instead of inspecting each u32/char open-coded, clean up and make use
of memcmp. On some arches, memcmp is implemented as assembly or GCC's
__builtin_memcmp which can possibly take advantages of known
alignment.

Signed-off-by: Jan Engelhardt

netfilter: xtables: switch table AFs to nfproto

2009-08-10T11:35:23+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: switch hook PFs to nfproto

2009-08-10T11:35:21+00:00

Signed-off-by: Jan Engelhardt

netfilter: conntrack: switch hook PFs to nfproto

2009-08-10T11:35:20+00:00

Simple substitution to indicate that the fields indeed use the
NFPROTO_ space.

Signed-off-by: Jan Engelhardt