summaryrefslogtreecommitdiffstats
path: root/net/netfilter
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: xtables: make use of caller family rather than target familyJan Engelhardt2010-03-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Supplement to aa5fa3185791aac71c9172d4fda3e8729164b5d1. The semantic patch for this change is: // <smpl> @@ struct xt_target_param *par; @@ -par->target->family +par->family @@ struct xt_tgchk_param *par; @@ -par->target->family +par->family @@ struct xt_tgdtor_param *par; @@ -par->target->family +par->family // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xt extensions: use pr_<level>Jan Engelhardt2010-03-1821-107/+88Star
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: replace custom duprintf with pr_debugJan Engelhardt2010-03-185-59/+32Star
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: do not print any messages on ENOMEMJan Engelhardt2010-03-183-12/+4Star
| | | | | | | | | ENOMEM is a very obvious error code (cf. EINVAL), so I think we do not really need a warning message. Not to mention that if the allocation fails, the user is most likely going to get a stack trace from slab already. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: make use of caller family rather than match familyJan Engelhardt2010-03-185-14/+14
| | | | | | | | The matches can have .family = NFPROTO_UNSPEC, and though that is not the case for the touched modules, it seems better to just use the nfproto from the caller. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: resort osf kconfig textJan Engelhardt2010-03-181-13/+13
| | | | | | | Restore alphabetical ordering of the list and put the xt_osf option into its 'right' place again. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: limit xt_mac to ethernet devicesJan Engelhardt2010-03-181-0/+3
| | | | | | | | I do not see a point of allowing the MAC module to work with devices that don't possibly have one, e.g. various tunnel interfaces such as tun and sit. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: clean up xt_mac match routineJan Engelhardt2010-03-181-8/+10
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: do without explicit XT_ALIGNJan Engelhardt2010-03-182-2/+2
| | | | | | | XT_ALIGN is already applied on matchsize/targetsize in x_tables.c, so it is not strictly needed in the extensions. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of ../nf-2.6Patrick McHardy2010-03-181-2/+8
|\
| * netfilter: net/netfilter/ipvs/ip_vs_ftp.c: Remove use of NIPQUADJoe Perches2010-03-151-2/+8
| | | | | | | | | | | | | | | | | | | | | | NIPQUAD has very few uses left. Remove this use and make the code have the identical form of the only other use of "%u,%u,%u,%u,%u,%u" in net/ipv4/netfilter/nf_nat_ftp.c Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: remove unused headers in net/netfilter/nfnetlink.cZhitong Wang2010-03-171-3/+0Star
| | | | | | | | | | | | | | Remove unused headers in net/netfilter/nfnetlink.c Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: xt_recent: check for unsupported user space flagsTim Gardner2010-03-171-0/+5
| | | | | | | | | | Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: xt_recent: add an entry reaperTim Gardner2010-03-171-1/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | One of the problems with the way xt_recent is implemented is that there is no efficient way to remove expired entries. Of course, one can write a rule '-m recent --remove', but you have to know beforehand which entry to delete. This commit adds reaper logic which checks the head of the LRU list when a rule is invoked that has a '--seconds' value and XT_RECENT_REAP set. If an entry ceases to accumulate time stamps, then it will eventually bubble to the top of the LRU list where it is then reaped. Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: xt_recent: remove old proc directoryJan Engelhardt2010-03-172-112/+0Star
| | | | | | | | | | | | The compat option was introduced in October 2008. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: xt_recent: update descriptionJan Engelhardt2010-03-171-1/+1
| | | | | | | | | | | | It had IPv6 for quite a while already :-) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: update my email addressJan Engelhardt2010-03-177-10/+6Star
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: xtables: merge xt_CONNMARK into xt_connmarkJan Engelhardt2010-03-174-135/+104Star
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: xtables: merge xt_MARK into xt_markJan Engelhardt2010-03-174-77/+65Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two arguments for combining the two: - xt_mark is pretty useless without xt_MARK - the actual code is so small anyway that the kmod metadata and the module in its loaded state totally outweighs the combined actual code size. i586-before: -rw-r--r-- 1 jengelh users 3821 Feb 10 01:01 xt_MARK.ko -rw-r--r-- 1 jengelh users 2592 Feb 10 00:04 xt_MARK.o -rw-r--r-- 1 jengelh users 3274 Feb 10 01:01 xt_mark.ko -rw-r--r-- 1 jengelh users 2108 Feb 10 00:05 xt_mark.o text data bss dec hex filename 354 264 0 618 26a xt_MARK.o 223 176 0 399 18f xt_mark.o And the runtime size is like 14 KB. i586-after: -rw-r--r-- 1 jengelh users 3264 Feb 18 17:28 xt_mark.o Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: xtables: add comment markers to Xtables KconfigJan Engelhardt2010-03-171-0/+6
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: xt_NFQUEUE: consolidate v4/v6 targets into oneJan Engelhardt2010-03-171-28/+12Star
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: xt_CT: par->family is an nfprotoJan Engelhardt2010-03-171-2/+2
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | Merge branch 'for-next' into for-linusJiri Kosina2010-03-082-3/+3
|\ \ | |/ |/| | | | | | | | | | | | | Conflicts: Documentation/filesystems/proc.txt arch/arm/mach-u300/include/mach/debug-macro.S drivers/net/qlge/qlge_ethtool.c drivers/net/qlge/qlge_main.c drivers/net/typhoon.c
| * tree-wide: Assorted spelling fixesDaniel Mack2010-02-092-3/+3
| | | | | | | | | | | | | | | | | | | | | | In particular, several occurances of funny versions of 'success', 'unknown', 'therefore', 'acknowledge', 'argument', 'achieve', 'address', 'beginning', 'desirable', 'separate' and 'necessary' are fixed. Signed-off-by: Daniel Mack <daniel@caiaq.de> Cc: Joe Perches <joe@perches.com> Cc: Junio C Hamano <gitster@pobox.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | Merge branch 'master' of ↵David S. Miller2010-02-262-24/+22Star
|\ \ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * | netfilter: nfnetlink_log: fix silly refcount leakAlexey Dobriyan2010-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quick fix for memory/module refcount leak. Reference count of listener instance never reaches 0. Start/stop of ulogd2 is enough to trigger this bug! Now, refcounting there looks very fishy in particular this code: if (!try_module_get(THIS_MODULE)) { ... and creation of listener instance with refcount 2, so it may very well be ripped and redone. :-) Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | IPVS: ip_vs_lblcr: use list headASimon Horman2010-02-261-23/+21Star
| | | | | | | | | | | | | | | | | | | | | Use list_head rather than a custom list implementation. Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | Merge branch 'master' of ↵David S. Miller2010-02-252-6/+10
|\| | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * | netfilter: xtables: replace XT_MATCH_ITERATE macroJan Engelhardt2010-02-241-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | The macro is replaced by a list.h-like foreach loop. This makes the code more inspectable. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xt_recent: fix false matchTim Gardner2010-02-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | A rule with a zero hit_count will always match. Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Cc: stable@kernel.org Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xt_recent: fix buffer overflowTim Gardner2010-02-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | e->index overflows e->stamps[] every ip_pkt_list_tot packets. Consider the case when ip_pkt_list_tot==1; the first packet received is stored in e->stamps[0] and e->index is initialized to 1. The next received packet timestamp is then stored at e->stamps[1] in recent_entry_update(), a buffer overflow because the maximum e->stamps[] index is 0. Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Cc: stable@kernel.org Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | Merge branch 'master' of ↵David S. Miller2010-02-192-12/+12
|\| | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * | netfilter: nf_queue: fix NF_STOLEN skb leakEric Dumazet2010-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 3bc38712e3a6e059 (handle NF_STOP and unknown verdicts in nf_reinject) was a partial fix to packet leaks. If user asks NF_STOLEN status, we must free the skb as well. Reported-by: Afi Gjermund <afigjermund@gmail.com> Signed-off-by: Eric DUmazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: ctnetlink: fix creation of conntrack with helpersPablo Neira Ayuso2010-02-191-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a bug that triggers an assertion if you create a conntrack entry with a helper and netfilter debugging is enabled. Basically, we hit the assertion because the confirmation flag is set before the conntrack extensions are added. To fix this, we move the extension addition before the aforementioned flag is set. This patch also removes the possibility of setting a helper for existing conntracks. This operation would also trigger the assertion since we are not allowed to add new extensions for existing conntracks. We know noone that could benefit from this operation sanely. Thanks to Eric Dumazet for initial posting a preliminary patch to address this issue. Reported-by: David Ramblewski <David.Ramblewski@atosorigin.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | | ipv6: drop unused "dev" arg of icmpv6_send()Alexey Dobriyan2010-02-182-8/+7Star
|/ / | | | | | | | | | | | | Dunno, what was the idea, it wasn't used for a long time. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipvs: SCTP Trasport Loadbalancing SupportVenkata Mohan Reddy2010-02-187-11/+1264
| | | | | | | | | | | | | | | | | | | | | | Enhance IPVS to load balance SCTP transport protocol packets. This is done based on the SCTP rfc 4960. All possible control chunks have been taken care. The state machine used in this code looks some what lengthy. I tried to make the state machine easy to understand. Signed-off-by: Venkata Mohan Reddy Koppula <mohanreddykv@gmail.com> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | xt_hashlimit: fix lockingEric Dumazet2010-02-171-4/+0Star
| | | | | | | | | | | | | | | | | | | | Commit 2eff25c18c3d332d3c4dd98f2ac9b7114e9771b0 (netfilter: xt_hashlimit: fix race condition and simplify locking) added a mutex deadlock : htable_create() is called with hashlimit_mutex already locked Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netfilter: CONFIG_COMPAT: allow delta to exceed 32767Florian Westphal2010-02-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | with 32 bit userland and 64 bit kernels, it is unlikely but possible that insertion of new rules fails even tough there are only about 2000 iptables rules. This happens because the compat delta is using a short int. Easily reproducible via "iptables -m limit" ; after about 2050 rules inserting new ones fails with -ELOOP. Note that compat_delta included 2 bytes of padding on x86_64, so structure size remains the same. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: ctnetlink: add zone supportPatrick McHardy2010-02-151-19/+73
| | | | | | | | | | | | Parse and dump the conntrack zone in ctnetlink. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: nf_conntrack: add support for "conntrack zones"Patrick McHardy2010-02-1510-54/+147
| | | | | | | | | | | | | | | | | | | | | | | | | | Normally, each connection needs a unique identity. Conntrack zones allow to specify a numerical zone using the CT target, connections in different zones can use the same identity. Example: iptables -t raw -A PREROUTING -i veth0 -j CT --zone 1 iptables -t raw -A OUTPUT -o veth1 -j CT --zone 1 Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: nf_conntrack: pass template to l4proto ->error() handlerPatrick McHardy2010-02-155-7/+9
| | | | | | | | | | | | | | The error handlers might need the template to get the conntrack zone introduced in the next patches to perform a conntrack lookup. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: xtables: constify args in compat copying functionsJan Engelhardt2010-02-153-8/+8
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: xtables: print details on size mismatchJan Engelhardt2010-02-151-2/+6
| | | | | | | | | | | | | | Print which revision has been used and which size are which (kernel/user) for easier debugging. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | netfilter: xt_recent: inform user when hitcount is too largeJan Engelhardt2010-02-151-2/+6
| | | | | | | | | | | | | | | | | | It is one of these things that iptables cannot catch and which can cause "Invalid argument" to be printed. Without a hint in dmesg, it is not going to be helpful. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: don't use INIT_RCU_HEAD()Alexey Dobriyan2010-02-123-3/+0Star
| | | | | | | | | | | | | | | | call_rcu() will unconditionally reinitialize RCU head anyway. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: nf_conntrack_sip: add T.38 FAX supportPatrick McHardy2010-02-111-5/+23
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: nf_nat_sip: add TCP supportPatrick McHardy2010-02-111-0/+10
| | | | | | | | | | | | Add support for mangling TCP SIP packets. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: nf_conntrack_sip: add TCP supportPatrick McHardy2010-02-111-29/+176
| | | | | | | | | | | | | | | | | | | | Add TCP support, which is mandated by RFC3261 for all SIP elements. SIP over TCP is similar to UDP, except that messages are delimited by Content-Length: headers and multiple messages may appear in one packet. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: nf_conntrack_sip: pass data offset to NAT functionsPatrick McHardy2010-02-111-38/+44
| | | | | | | | | | | | | | | | | | | | When using TCP multiple SIP messages might be present in a single packet. A following patch will parse them by setting the dptr to the beginning of each message. The NAT helper needs to reload the dptr value after mangling the packet however, so it needs to know the offset of the message to the beginning of the packet. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netfilter: nf_conntrack_sip: fix ct_sip_parse_request() REGISTER request parsingPatrick McHardy2010-02-111-3/+4
| | | | | | | | | | | | | | | | | | | | When requests are parsed, the "sip:" part of the SIP URI should be skipped. Usually this doesn't matter because address parsing skips forward until after the username part, but in case REGISTER requests it doesn't contain a username and the address can not be parsed. Signed-off-by: Patrick McHardy <kaber@trash.net>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-10 04:50:30 +0200