linux.git/net/netfilter, branch v3.5-rc2

Merge branch 'for-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

2012-05-23T00:37:47+00:00

Pull percpu updates from Tejun Heo:
 "Contains Alex Shi's three patches to remove percpu_xxx() which overlap
  with this_cpu_xxx().  There shouldn't be any functional change."

* 'for-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
  percpu: remove percpu_xxx() functions
  x86: replace percpu_xxx funcs with this_cpu_xxx
  net: replace percpu_xxx funcs with this_cpu_xxx or __this_cpu_xxx

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-05-17T02:17:37+00:00

netfilter: nf_ct_h323: fix usage of MODULE_ALIAS_NFCT_HELPER

2012-05-16T23:00:05+00:00

ctnetlink uses the aliases that are created by MODULE_ALIAS_NFCT_HELPER
to auto-load the module based on the helper name. Thus, we have to use
RAS, Q.931 and H.245, not H.323.

Signed-off-by: Pablo Neira Ayuso

netfilter: xt_CT: remove redundant header include

2012-05-16T23:00:02+00:00

nf_conntrack_l4proto.h is included twice.

Signed-off-by: Eldad Zack 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: fix timeout value overflow bug

2012-05-16T22:56:41+00:00

Large timeout parameters could result wrong timeout values due to
an overflow at msec to jiffies conversion (reported by Andreas Herz)

[ This patch was mangled by Pablo Neira Ayuso since David Laight and
  Eric Dumazet noticed that we were using hardcoded 1000 instead of
  MSEC_PER_SEC to calculate the timeout ]

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_ct_tcp: extend log message for invalid ignored packets

2012-05-16T22:56:38+00:00

Extend log message if packets are ignored to include the TCP state, ie.
replace:

[ 3968.070196] nf_ct_tcp: invalid packet ignored IN= OUT= SRC=...

by:

[ 3968.070196] nf_ct_tcp: invalid packet ignored in state ESTABLISHED IN= OUT= SRC=...

This information is useful to know in what state we were while ignoring the
packet.

Signed-off-by: Pablo Neira Ayuso 
Acked-by: Jozsef Kadlecsik

netfilter: xt_HMARK: modulus is expensive for hash calculation

2012-05-16T22:56:35+00:00

Use:

((u64)(HASH_VAL * HASH_SIZE)) >> 32

as suggested by David S. Miller.

Signed-off-by: Pablo Neira Ayuso

netfilter: xt_HMARK: potential NULL dereference in get_inner_hdr()

2012-05-16T22:56:33+00:00

There is a typo in the error checking and "&&" was used instead of "||".
If skb_header_pointer() returns NULL then it leads to a NULL
dereference.

Signed-off-by: Dan Carpenter 
Acked-by: Hans Schillstrom 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_hashlimit: use _ALL macro to reject unknown flag bits

2012-05-16T22:56:31+00:00

David Miller says:
     The canonical way to validate if the set bits are in a valid
     range is to have a "_ALL" macro, and test:
     if (val & ~XT_HASHLIMIT_ALL)
         goto err;"

make it so.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: fix hash size checking in kernel

2012-05-16T19:38:49+00:00

The hash size must fit both into u32 (jhash) and the max value of
size_t. The missing checking could lead to kernel crash, bug reported
by Seblu.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller