linux.git/net/netfilter, branch v3.17-rc7

netfilter: add explicit Kconfig for NETFILTER_XT_NAT

2014-09-06T00:23:31+00:00

Paul Bolle reports that 'select NETFILTER_XT_NAT' from the IPV4 and IPV6
NAT tables becomes noop since there is no Kconfig switch for it. Add the
Kconfig switch to resolve this problem.

Fixes: 8993cf8 netfilter: move NAT Kconfig switches out of the iptables scope
Reported-by: Paul Bolle 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: NETFILTER_XT_TARGET_LOG selects NF_LOG_*

2014-09-01T11:46:31+00:00

CONFIG_NETFILTER_XT_TARGET_LOG is not selected anymore when jumping
from 3.16 to 3.17-rc1 if you don't set on the new NF_LOG_IPV4 and
NF_LOG_IPV6 switches.

Change this to select the three new symbols NF_LOG_COMMON, NF_LOG_IPV4
and NF_LOG_IPV6 instead, so NETFILTER_XT_TARGET_LOG remains enabled
when moving from old to new kernels.

Reported-by: Rafał Miłecki 
Signed-off-by: Pablo Neira Ayuso

ipvs: fix ipv6 hook registration for local replies

2014-08-28T01:52:37+00:00

commit fc604767613b6d2036cdc35b660bc39451040a47
("ipvs: changes for local real server") from 2.6.37
introduced DNAT support to local real server but the
IPv6 LOCAL_OUT handler ip_vs_local_reply6() is
registered incorrectly as IPv4 hook causing any outgoing
IPv4 traffic to be dropped depending on the IP header values.

Chris tracked down the problem to CONFIG_IP_VS_IPV6=y
Bug report: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1349768

Reported-by: Chris J Arges 
Tested-by: Chris J Arges 
Signed-off-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: properly declare tunnel encapsulation

2014-08-27T05:31:56+00:00

The tunneling method should properly use tunnel encapsulation.
Fixes problem with CHECKSUM_PARTIAL packets when TCP/UDP csum
offload is supported.

Thanks to Alex Gartrell for reporting the problem, providing
solution and for all suggestions.

Reported-by: Alex Gartrell 
Signed-off-by: Julian Anastasov 
Signed-off-by: Alex Gartrell 
Signed-off-by: Simon Horman

netfilter: HAVE_JUMP_LABEL instead of CONFIG_JUMP_LABEL

2014-08-25T08:45:28+00:00

Use HAVE_JUMP_LABEL as elsewhere in the kernel to ensure
that the toolchain has the required support in addition to
CONFIG_JUMP_LABEL being set.

Signed-off-by: Zhouyi Zhou 
Reviewed-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: nat expression must select CONFIG_NF_NAT

2014-08-19T19:42:45+00:00

This enables the netfilter NAT engine in first place, otherwise
you cannot ever select the nf_tables nat expression if iptables
is not selected.

Reported-by: Matteo Croce 
Signed-off-by: Pablo Neira Ayuso

netfilter: x_tables: allow to use default cgroup match

2014-08-19T19:38:55+00:00

There's actually no good reason why we cannot use cgroup id 0,
so lets just remove this artificial barrier.

Reported-by: Alexey Perevalov 
Signed-off-by: Daniel Borkmann 
Tested-by: Alexey Perevalov 
Signed-off-by: Pablo Neira Ayuso

netfilter: move NAT Kconfig switches out of the iptables scope

2014-08-18T19:55:54+00:00

Currently, the NAT configs depend on iptables and ip6tables. However,
users should be capable of enabling NAT for nft without having to
switch on iptables.

Fix this by adding new specific IP_NF_NAT and IP6_NF_NAT config
switches for iptables and ip6tables NAT support. I have also moved
the original NF_NAT_IPV4 and NF_NAT_IPV6 configs out of the scope
of iptables to make them independent of it.

This patch also adds NETFILTER_XT_NAT which selects the xt_nat
combo that provides snat/dnat for iptables. We cannot use NF_NAT
anymore since nf_tables can select this.

Reported-by: Matteo Croce 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix error return code

2014-08-08T14:47:29+00:00

Convert a zero return value on error to a negative one, as returned
elsewhere in the function.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// 
@@
identifier ret; expression e1,e2;
@@
(
if (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}
// 

Signed-off-by: Julia Lawall 
Signed-off-by: Pablo Neira Ayuso

netfilter: don't use mutex_lock_interruptible()

2014-08-08T14:47:23+00:00

Eric Dumazet reports that getsockopt() or setsockopt() sometimes
returns -EINTR instead of -ENOPROTOOPT, causing headaches to
application developers.

This patch replaces all the mutex_lock_interruptible() by mutex_lock()
in the netfilter tree, as there is no reason we should sleep for a
long time there.

Reported-by: Eric Dumazet 
Suggested-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso 
Acked-by: Julian Anastasov