linux.git/net/netfilter, branch v2.6.20

[NETFILTER]: nf_conntrack_h323: fix compile error with CONFIG_IPV6=m, CONFIG_NF_CONNTRACK_H323=y

2007-02-03T03:33:52+00:00

Fix this by letting NF_CONNTRACK_H323 depend on (IPV6 || IPV6=n).

Signed-off-by: Adrian Bunk 
Signed-off-by: David S. Miller

[NETFILTER]: ctnetlink: fix compile failure with NF_CONNTRACK_MARK=n

2007-02-03T03:33:11+00:00

  CC      net/netfilter/nf_conntrack_netlink.o
net/netfilter/nf_conntrack_netlink.c: In function 'ctnetlink_conntrack_event':
net/netfilter/nf_conntrack_netlink.c:392: error: 'struct nf_conn' has no member named 'mark'
make[3]: *** [net/netfilter/nf_conntrack_netlink.o] Error 1

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: xt_hashlimit: fix ip6tables dependency

2007-01-31T05:36:09+00:00

IP6_NF_IPTABLES=m, CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y results in a
linker error since ipv6_find_hdr is defined in ip6_tables.c. Fix similar
to Adrian Bunk's H.323 conntrack patch: selecting ip6_tables to be build
as module requires hashlimit to be built as module as well.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: SIP conntrack: fix out of bounds memory access

2007-01-30T22:25:24+00:00

When checking for an @-sign in skp_epaddr_len, make sure not to
run over the packet boundaries.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: SIP conntrack: fix skipping over user info in SIP headers

2007-01-30T22:24:57+00:00

When trying to skip over the username in the Contact header, stop at the
end of the line if no @ is found to avoid mangling following headers.
We don't need to worry about continuation lines because we search inside
a SIP URI.

Fixes Netfilter Bugzilla #532.

Signed-off-by: Lars Immisch 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: xt_connbytes: fix division by zero

2007-01-30T22:24:29+00:00

When the packet counter of a connection is zero a division by zero
occurs in div64_64(). Fix that by using zero as average value, which
is correct as long as the packet counter didn't overflow, at which
point we have lost anyway.

Additionally we're probably going to go back to 64 bit counters
in 2.6.21.

Based on patch from Jonas Berlin ,
with suggestions from KOVACS Krisztian .

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack_pptp: fix NAT setup of expected GRE connections

2007-01-26T09:07:59+00:00

When an expected connection arrives, the NAT helper should be called to
set up NAT similar to the master connection. The PPTP conntrack helper
incorrectly checks whether the _expected_ connection has NAT setup before
calling the NAT helper (which is never the case), instead of checkeing
whether the _master_ connection is NATed.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ctnetlink: fix leak in ctnetlink_create_conntrack error path

2007-01-24T04:25:42+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack_netbios_ns: fix uninitialized member in expectation

2007-01-09T08:30:07+00:00

->helper is uninitialized in the expectation registered by the netbios_ns
helper and it later copied to the expected connection, which causes invalid
memory dereferences when trying to call the helper.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: New connection tracking is not EXPERIMENTAL anymore

2007-01-04T20:16:06+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller