summaryrefslogtreecommitdiffstats
path: root/net/netfilter
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: xt_limit: have r->cost != 0 case workJan Engelhardt2012-09-261-4/+4
| | | | | | | | | | | Commit v2.6.19-rc1~1272^2~41 tells us that r->cost != 0 can happen when a running state is saved to userspace and then reinstated from there. Make sure that private xt_limit area is initialized with correct values. Otherwise, random matchings due to use of uninitialized memory. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: log: Fix log-level processingJoe Perches2012-09-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | auto75914331@hushmail.com reports that iptables does not correctly output the KERN_<level>. $IPTABLES -A RULE_0_in -j LOG --log-level notice --log-prefix "DENY in: " result with linux 3.6-rc5 Sep 12 06:37:29 xxxxx kernel: <5>DENY in: IN=eth0 OUT= MAC=....... result with linux 3.5.3 and older: Sep 9 10:43:01 xxxxx kernel: DENY in: IN=eth0 OUT= MAC...... commit 04d2c8c83d0 ("printk: convert the format for KERN_<LEVEL> to a 2 byte pattern") updated the syslog header style but did not update netfilter uses. Do so. Use KERN_SOH and string concatenation instead of "%c" KERN_SOH_ASCII as suggested by Eric Dumazet. Signed-off-by: Joe Perches <joe@perches.com> cc: auto75914331@hushmail.com Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: Validate the sequence number of dataless ACK packets as wellJozsef Kadlecsik2012-09-091-8/+2Star
| | | | | | | | | | | We spare nothing by not validating the sequence number of dataless ACK packets and enabling it makes harder off-path attacks. See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel, http://arxiv.org/abs/1201.2074 Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: Mark SYN/ACK packets as invalid from original directionJozsef Kadlecsik2012-09-091-11/+8Star
| | | | | | | | | | | | Clients should not send such packets. By accepting them, we open up a hole by wich ephemeral ports can be discovered in an off-path attack. See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel, http://arxiv.org/abs/1201.2074 Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: take care of timewait socketsEric Dumazet2012-09-062-22/+25
| | | | | | | | | | | | | | | Sami Farin reported crashes in xt_LOG because it assumes skb->sk is a full blown socket. Since (41063e9 ipv4: Early TCP socket demux), we can have skb->sk pointing to a timewait socket. Same fix is needed in nfnetlink_log. Diagnosed-by: Florian Westphal <fw@strlen.de> Reported-by: Sami Farin <hvtaifwkbgefbaei@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nf_conntrack: fix racy timer handling with reliable eventsPablo Neira Ayuso2012-08-311-5/+11
| | | | | | | | | | | | | | | | | Existing code assumes that del_timer returns true for alive conntrack entries. However, this is not true if reliable events are enabled. In that case, del_timer may return true for entries that were just inserted in the dying list. Note that packets / ctnetlink may hold references to conntrack entries that were just inserted to such list. This patch fixes the issue by adding an independent timer for event delivery. This increases the size of the ecache extension. Still we can revisit this later and use variable size extensions to allocate this area on demand. Tested-by: Oliver Smith <olipro@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nfnetlink_log: fix error return code in init pathJulia Lawall2012-08-301-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Initialize return variable before exiting on an error path. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> ( if@p1 (\(ret < 0\|ret != 0\)) { ... return ret; } | ret@p1 = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: ctnetlink: fix error return code in init pathJulia Lawall2012-08-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Initialize return variable before exiting on an error path. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> ( if@p1 (\(ret < 0\|ret != 0\)) { ... return ret; } | ret@p1 = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ipvs: fix error return codeJulia Lawall2012-08-301-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Initialize return variable before exiting on an error path. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> ( if@p1 (\(ret < 0\|ret != 0\)) { ... return ret; } | ret@p1 = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Acked-by: Simon Horman <horms@verge.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nfnetlink_log: fix NLA_PUT macro removal bugPatrick McHardy2012-08-201-1/+1
| | | | | | | | | | | Commit 1db20a52 (nfnetlink_log: Stop using NLA_PUT*().) incorrectly converted a NLA_PUT_BE16 macro to nla_put_be32() in nfnetlink_log: - NLA_PUT_BE16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)); + if (nla_put_be32(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge git://1984.lsi.us.es/nfDavid S. Miller2012-08-203-44/+84
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pable Neira Ayuso says: ==================== The following five patches contain fixes for 3.6-rc, they are: * Two fixes for message parsing in the SIP conntrack helper, from Patrick McHardy. * One fix for the SIP helper introduced in the user-space cthelper infrastructure, from Patrick McHardy. * fix missing appropriate locking while modifying one conntrack entry from the nfqueue integration code, from myself. * fix possible access to uninitiliazed timer in the nf_conntrack expectation infrastructure, from myself. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * netfilter: nf_ct_expect: fix possible access to uninitialized timerPablo Neira Ayuso2012-08-161-23/+6Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In __nf_ct_expect_check, the function refresh_timer returns 1 if a matching expectation is found and its timer is successfully refreshed. This results in nf_ct_expect_related returning 0. Note that at this point: - the passed expectation is not inserted in the expectation table and its timer was not initialized, since we have refreshed one matching/existing expectation. - nf_ct_expect_alloc uses kmem_cache_alloc, so the expectation timer is in some undefined state just after the allocation, until it is appropriately initialized. This can be a problem for the SIP helper during the expectation addition: ... if (nf_ct_expect_related(rtp_exp) == 0) { if (nf_ct_expect_related(rtcp_exp) != 0) nf_ct_unexpect_related(rtp_exp); ... Note that nf_ct_expect_related(rtp_exp) may return 0 for the timer refresh case that is detailed above. Then, if nf_ct_unexpect_related(rtcp_exp) returns != 0, nf_ct_unexpect_related(rtp_exp) is called, which does: spin_lock_bh(&nf_conntrack_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); } spin_unlock_bh(&nf_conntrack_lock); Note that del_timer always returns false if the timer has been initialized. However, the timer was not initialized since setup_timer was not called, therefore, the expectation timer remains in some undefined state. If I'm not missing anything, this may lead to the removal an unexistent expectation. To fix this, the optimization that allows refreshing an expectation is removed. Now nf_conntrack_expect_related looks more consistent to me since it always add the expectation in case that it returns success. Thanks to Patrick McHardy for participating in the discussion of this patch. I think this may be the source of the problem described by: http://marc.info/?l=netfilter-devel&m=134073514719421&w=2 Reported-by: Rafal Fitt <rafalf@aplusc.com.pl> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: ctnetlink: fix missing locking while changing conntrack from nfqueuePablo Neira Ayuso2012-08-141-1/+6
| | | | | | | | | | | | | | | | | | Since 9cb017665 netfilter: add glue code to integrate nfnetlink_queue and ctnetlink, we can modify the conntrack entry via nfnl_queue. However, the change of the conntrack entry via nfnetlink_queue requires appropriate locking to avoid concurrent updates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: nf_ct_sip: fix IPv6 address parsingPatrick McHardy2012-08-101-17/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Within SIP messages IPv6 addresses are enclosed in square brackets in most cases, with the exception of the "received=" header parameter. Currently the helper fails to parse enclosed addresses. This patch: - changes the SIP address parsing function to enforce square brackets when required, and accept them when not required but present, as recommended by RFC 5118. - adds a new SDP address parsing function that never accepts square brackets since SDP doesn't use them. With these changes, the SIP helper correctly parses all test messages from RFC 5118 (Session Initiation Protocol (SIP) Torture Test Messages for Internet Protocol Version 6 (IPv6)). Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: nf_ct_sip: fix helper namePatrick McHardy2012-08-101-3/+2Star
| | | | | | | | | | | | | | | | | | | | | | Commit 3a8fc53a (netfilter: nf_ct_helper: allocate 16 bytes for the helper and policy names) introduced a bug in the SIP helper, the helper name is sprinted to the sip_names array instead of instead of into the helper structure. This breaks the helper match and the /proc/net/nf_conntrack_expect output. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)Mathias Krause2012-08-161-0/+1
|/ | | | | | | | | | | | | | If at least one of CONFIG_IP_VS_PROTO_TCP or CONFIG_IP_VS_PROTO_UDP is not set, __ip_vs_get_timeouts() does not fully initialize the structure that gets copied to userland and that for leaks up to 12 bytes of kernel stack. Add an explicit memset(0) before passing the structure to __ip_vs_get_timeouts() to avoid the info leak. Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Wensong Zhang <wensong@linux-vs.org> Cc: Simon Horman <horms@verge.net.au> Cc: Julian Anastasov <ja@ssi.bg> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2012-07-191-2/+3
|\ | | | | | | | | Conflicts: drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
| * ipvs: fix oops in ip_vs_dst_event on rmmodJulian Anastasov2012-07-171-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | After commit 39f618b4fd95ae243d940ec64c961009c74e3333 (3.4) "ipvs: reset ipvs pointer in netns" we can oops in ip_vs_dst_event on rmmod ip_vs because ip_vs_control_cleanup is called after the ipvs_core_ops subsys is unregistered and net->ipvs is NULL. Fix it by exiting early from ip_vs_dst_event if ipvs is NULL. It is safe because all services and dests for the net are already freed. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | net: Pass optional SKB and SK arguments to dst_ops->{update_pmtu,redirect}()David S. Miller2012-07-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will be used so that we can compose a full flow key. Even though we have a route in this context, we need more. In the future the routes will be without destination address, source address, etc. keying. One ipv4 route will cover entire subnets, etc. In this environment we have to have a way to possess persistent storage for redirects and PMTU information. This persistent storage will exist in the FIB tables, and that's why we'll need to be able to rebuild a full lookup flow key here. Using that flow key will do a fib_lookup() and create/update the persistent entry. Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2012-07-111-1/+3
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: net/batman-adv/bridge_loop_avoidance.c net/batman-adv/bridge_loop_avoidance.h net/batman-adv/soft-interface.c net/mac80211/mlme.c With merge help from Antonio Quartulli (batman-adv) and Stephen Rothwell (drivers/net/usb/qmi_wwan.c). The net/mac80211/mlme.c conflict seemed easy enough, accounting for a conversion to some new tracing macros. Signed-off-by: David S. Miller <davem@davemloft.net>
| * netfilter: ipset: timeout fixing bug broke SET target special timeout valueJozsef Kadlecsik2012-07-091-1/+3
| | | | | | | | | | | | | | | | | | The patch "127f559 netfilter: ipset: fix timeout value overflow bug" broke the SET target when no timeout was specified. Reported-by: Jean-Philippe Menil <jean-philippe.menil@univ-nantes.fr> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | net: Fix (nearly-)kernel-doc comments for various functionsBen Hutchings2012-07-111-2/+2
| | | | | | | | | | | | | | | | Fix incorrect start markers, wrapped summary lines, missing section breaks, incorrect separators, and some name mismatches. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'master' of git://1984.lsi.us.es/nf-nextDavid S. Miller2012-07-0811-243/+483
|\ \
| * | netfilter: nfnetlink_queue: do not allow to set unsupported flag bitsKrishna Kumar2012-07-041-0/+5
| | | | | | | | | | | | | | | | | | | | | Allow setting of only supported flag bits in queue->flags. Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nfnetlink: check callbacks before using those in nfnetlink_rcv_msgTomasz Bursztyka2012-07-041-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | nfnetlink_rcv_msg() might call a NULL callback which will cause NULL pointer dereference. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_ct_tcp: missing per-net support for cttimeoutPablo Neira Ayuso2012-07-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds missing per-net support for the cttimeout infrastructure to TCP. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Gao feng <gaofeng@cn.fujitsu.com>
| * | netfilter: nf_conntrack: generalize nf_ct_l4proto_netPablo Neira Ayuso2012-07-044-16/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch generalizes nf_ct_l4proto_net by splitting it into chunks and moving the corresponding protocol part to where it really belongs to. To clarify, note that we follow two different approaches to support per-net depending if it's built-in or run-time loadable protocol tracker. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Gao feng <gaofeng@cn.fujitsu.com>
| * | netfilter: nf_ct_dccp: add dccp_kmemdup_sysctl_table functionGao feng2012-06-271-24/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is a cleanup. It adds dccp_kmemdup_sysctl_table to split code into smaller chunks. Yet it prepares introduction of nf_conntrack_proto_*_sysctl.c. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_ct_generic: add generic_kmemdup_sysctl_table functionGao feng2012-06-271-8/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is a cleanup. It adds generic_kmemdup_sysctl_table to split code into smaller chunks. Yet it prepares introduction of nf_conntrack_proto_*_sysctl.c. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_ct_sctp: merge sctpv[4,6]_net_init into sctp_net_initGao feng2012-06-271-43/+22Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge sctpv4_net_init and sctpv6_net_init into sctp_net_init to remove redundant code now that we have the u_int16_t proto parameter. And use nf_proto_net.users to identify if it's the first time we use the nf_proto_net, in that case, we initialize i Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_ct_udplite: add udplite_kmemdup_sysctl_table functionGao feng2012-06-271-17/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This cleans up nf_conntrack_l4proto_udplite[4,6] and it prepares the moving of the sysctl code to nf_conntrack_proto_*_sysctl.c to reduce the ifdef pollution. And use nf_proto_net.users to identify if it's the first time we use the nf_proto_net, in that case, we initialize it. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_ct_udp: merge udpv[4,6]_net_init into udp_net_initGao feng2012-06-271-42/+23Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge udpv4_net_init and udpv6_net_init into udp_net_init to remove redundant code now that we have the u_int16_t proto parameter. And use nf_proto_net.users to identify if it's the first time we use the nf_proto_net, in that case, we initialize it. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_ct_tcp: merge tcpv[4,6]_net_init into tcp_net_initGao feng2012-06-271-50/+21Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge tcpv4_net_init and tcpv6_net_init into tcp_net_init to remove redundant code now that we have the u_int16_t proto parameter. And use nf_proto_net.users to identify if it's the first time we use the nf_proto_net, in that case, we initialize it. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_conntrack: fix memory leak if sysctl registration failsGao feng2012-06-271-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In nf_ct_l4proto_register_sysctl, if l4proto sysctl registration fails, we have to make sure that we release the compat sysctl table. This can happen if TCP has been registered compat for IPv4, and IPv6 compat registration fails. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_conntrack: use l4proto->users as refcount for per-net dataGao feng2012-06-271-30/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, nf_proto_net's l4proto->users meaning is quite confusing since it depends on the compilation tweaks. To resolve this, we cleanup this code to regard it as the refcount for l4proto's per-net data, since there may be two l4protos use the same per-net data. Thus, we increment pn->users when nf_conntrack_l4proto_register successfully, and decrement it for nf_conntrack_l4_unregister case. The users refcnt is not required form layer 3 protocol trackers. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_conntrack: add nf_ct_kfree_compat_sysctl_tableGao feng2012-06-271-2/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is a cleanup. It adds nf_ct_kfree_compat_sysctl_table to release l4proto's compat sysctl table and set the compat sysctl table point to NULL. This new function will be used by follow-up patches. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_conntrack: prepare l4proto->init_net cleanupGao feng2012-06-278-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | l4proto->init contain quite redundant code. We can simplify this by adding a new parameter l3proto. This patch prepares that code simplification. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: nf_conntrack: fix nf_conntrack_l3proto_registerGao feng2012-06-271-13/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before commit 2c352f444ccfa966a1aa4fd8e9ee29381c467448 (netfilter: nf_conntrack: prepare namespace support for l4 protocol trackers), we register sysctl before register protocol tracker. Thus, if sysctl is registration fails, the protocol tracker will not be registered. After that commit, if sysctl registration fails, protocol registration still remains, so we leave things in intermediate state. To fix this, this patch registers sysctl before protocols. And if protocol registration fail, sysctl is unregistered. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: ctnetlink: add new messages to obtain statisticsPablo Neira Ayuso2012-06-271-1/+226
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following messages to ctnetlink: IPCTNL_MSG_CT_GET_STATS_CPU IPCTNL_MSG_CT_GET_STATS IPCTNL_MSG_EXP_GET_STATS_CPU To display connection tracking system per-cpu and global statistics. This provides a replacement for the following /proc interfaces: /proc/net/stat/nf_conntrack /proc/sys/net/netfilter/nf_conntrack_count Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2012-07-054-36/+26Star
|\ \ \ | | |/ | |/|
| * | netfilter: nfnetlink: fix missing rcu_read_unlock in nfnetlink_rcv_msgTomasz Bursztyka2012-06-291-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Bug added in commit 6b75e3e8d664a9a (netfilter: nfnetlink: add RCU in nfnetlink_rcv_msg()) Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: ipset: fix crash if IPSET_CMD_NONE command is sentTomasz Bursztyka2012-06-291-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a crash if that ipset command is sent over nfnetlink. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: ipvs: fix dst leak in __ip_vs_addr_is_local_v6Eric Dumazet2012-06-251-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After call to ip6_route_output() we must release dst or we leak it. Also should test dst->error, as ip6_route_output() never returns NULL. Use boolean while we are at it. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netfilter: ipset: fix interface comparision in hash-netiface setsFlorian Westphal2012-06-251-28/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ifname_compare() assumes that skb->dev is zero-padded, e.g 'eth1\0\0\0\0\0...'. This isn't always the case. e1000 driver does strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1); in e1000_probe(), so once device is registered dev->name memory contains 'eth1\0:0:3\0\0\0' (or something like that), which makes eth1 compare fail. Use plain strcmp() instead. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | netlink: add nlk->netlink_bind hook for module auto-loadingPablo Neira Ayuso2012-06-301-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a hook in the binding path of netlink. This is used by ctnetlink to allow module autoloading for the case in which one user executes: conntrack -E So far, this resulted in nfnetlink loaded, but not nf_conntrack_netlink. I have received in the past many complains on this behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | netlink: add netlink_kernel_cfg parameter to netlink_kernel_createPablo Neira Ayuso2012-06-301-2/+5
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following structure: struct netlink_kernel_cfg { unsigned int groups; void (*input)(struct sk_buff *skb); struct mutex *cb_mutex; }; That can be passed to netlink_kernel_create to set optional configurations for netlink kernel sockets. I've populated this structure by looking for NULL and zero parameters at the existing code. The remaining parameters that always need to be set are still left in the original interface. That includes optional parameters for the netlink socket creation. This allows easy extensibility of this interface in the future. This patch also adapts all callers to use this new interface. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netfilter: nfnetlink_queue_core: Move away from NLMSG_PUT().David S. Miller2012-06-271-9/+13
| | | | | | | | | | | | And use nlmsg_data() while we're here too. Signed-off-by: David S. Miller <davem@davemloft.net>
* | netfilter: nfnetlink_log: Move away from NLMSG_PUT().David S. Miller2012-06-271-13/+16
| | | | | | | | | | | | And use nlmsg_data() while we're here too. Signed-off-by: David S. Miller <davem@davemloft.net>
* | netfilter: ctnetlink: fix compilation with NF_CONNTRACK_EVENTS=nPablo Neira Ayuso2012-06-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes compilation with NF_CONNTRACK_EVENTS=n and NETFILTER_NETLINK_QUEUE_CT=y. I'm leaving all those static inline functions that calculate the size of the event message out of the ifdef area of NF_CONNTRACK_EVENTS since they will not be included by gcc in case they are unused. Reported-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netfilter: nfnetlink_queue: fix sparse warning due to missing includePablo Neira Ayuso2012-06-231-0/+1
| | | | | | | | | | | | This patch fixes a sparse warning due to missing include header file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-12 13:09:32 +0200