linux.git/net/ipv6/netfilter, branch v3.7-rc2

nf_defrag_ipv6: fix oops on module unloading

2012-09-27T22:14:55+00:00

fix copy-paste error introduced in linux-next commit
"ipv6: add a new namespace for nf_conntrack_reasm"

Signed-off-by: Konstantin Khlebnikov 
Cc: Amerigo Wang 
Cc: David S. Miller 
Acked-by: Cong Wang 
Signed-off-by: David S. Miller

netfilter: combine ipt_REDIRECT and ip6t_REDIRECT

2012-09-21T10:12:05+00:00

Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_REDIRECT becomes a compat option; IP6_NF_TARGET_REDIRECT
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: combine ipt_NETMAP and ip6t_NETMAP

2012-09-21T10:11:08+00:00

Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_NETMAP becomes a compat option; IP6_NF_TARGET_NETMAP
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: fix IPv6 NAT dependencies in Kconfig

2012-09-21T09:33:19+00:00

* NF_NAT_IPV6 requires IP6_NF_IPTABLES

* IP6_NF_TARGET_MASQUERADE, IP6_NF_TARGET_NETMAP, IP6_NF_TARGET_REDIRECT
  and IP6_NF_TARGET_NPT require NF_NAT_IPV6.

This change just mirrors what IPv4 does in Kconfig, for consistency.

Reported-by: Randy Dunlap 
Signed-off-by: Pablo Neira Ayuso

ipv6: unify fragment thresh handling code

2012-09-19T21:23:28+00:00

Cc: Herbert Xu 
Cc: Michal Kubeček 
Cc: David Miller 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

ipv6: unify conntrack reassembly expire code with standard one

2012-09-19T21:23:28+00:00

Two years ago, Shan Wei tried to fix this:
http://patchwork.ozlabs.org/patch/43905/

The problem is that RFC2460 requires an ICMP Time
Exceeded -- Fragment Reassembly Time Exceeded message should be
sent to the source of that fragment, if the defragmentation
times out.

"
   If insufficient fragments are received to complete reassembly of a
   packet within 60 seconds of the reception of the first-arriving
   fragment of that packet, reassembly of that packet must be
   abandoned and all the fragments that have been received for that
   packet must be discarded.  If the first fragment (i.e., the one
   with a Fragment Offset of zero) has been received, an ICMP Time
   Exceeded -- Fragment Reassembly Time Exceeded message should be
   sent to the source of that fragment.
"

As Herbert suggested, we could actually use the standard IPv6
reassembly code which follows RFC2460.

With this patch applied, I can see ICMP Time Exceeded sent
from the receiver when the sender sent out 3/4 fragmented
IPv6 UDP packet.

Cc: Herbert Xu 
Cc: Michal Kubeček 
Cc: David Miller 
Cc: Hideaki YOSHIFUJI 
Cc: Patrick McHardy 
Cc: Pablo Neira Ayuso 
Cc: netfilter-devel@vger.kernel.org
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

ipv6: add a new namespace for nf_conntrack_reasm

2012-09-19T21:23:28+00:00

As pointed by Michal, it is necessary to add a new
namespace for nf_conntrack_reasm code, this prepares
for the second patch.

Cc: Herbert Xu 
Cc: Michal Kubeček 
Cc: David Miller 
Cc: Patrick McHardy 
Cc: Pablo Neira Ayuso 
Cc: netfilter-devel@vger.kernel.org
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

netfilter: ipv6: using csum_ipv6_magic requires net/ip6_checksum.h

2012-09-05T21:46:06+00:00

Fixes this build error:

net/ipv6/netfilter/nf_nat_l3proto_ipv6.c: In function 'nf_nat_ipv6_csum_recalc':
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c:144:4: error: implicit declaration of function 'csum_ipv6_magic' [-Werror=implicit-function-declaration]

Signed-off-by: Stephen Rothwell 
Signed-off-by: David S. Miller

netfilter: ip6tables: add stateless IPv6-to-IPv6 Network Prefix Translation target

2012-08-30T01:00:25+00:00

Signed-off-by: Patrick McHardy

netfilter: ip6tables: add NETMAP target

2012-08-30T01:00:19+00:00

Signed-off-by: Patrick McHardy