27 Dec, 2007
1 commit
-
Some users do "modprobe ip_conntrack hashsize=...". Since we have the
module aliases this loads nf_conntrack_ipv4 and nf_conntrack, the
hashsize parameter is unknown for nf_conntrack_ipv4 however and makes
it fail.Allow to specify hashsize= for both nf_conntrack and nf_conntrack_ipv4.
Note: the nf_conntrack message in the ringbuffer will display an
incorrect hashsize since nf_conntrack is first pulled in as a
dependency and calculates the size itself, then it gets changed
through a call to nf_conntrack_set_hashsize().Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
21 Dec, 2007
1 commit
-
Signed-off-by: Joe Perches
Signed-off-by: David S. Miller
15 Dec, 2007
3 commits
-
In order to avoid jiffies wraparound and its effect, special care must
be taken
when doing comparisons ...Signed-off-by: Eric Dumazet
Acked-by: Patrick McHardy
Signed-off-by: David S. Miller -
When copying entries to user, the kernel makes two passes through the
data, first copying all the entries, then fixing up names and counters.
On the second pass it copies the kernel and match data from userspace
to the kernel again to find the corresponding structures, expecting
that kernel pointers contained in the data are still valid.This is obviously broken, fix by avoiding the second pass completely
and fixing names and counters while dumping the ruleset, using the
kernel-internal data structures.Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
This patch is a fix. It sets IPS_EXPECTED for related conntracks.
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
30 Nov, 2007
2 commits
-
Fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK
When xt_CONNMARK is used outside the mangle table and the user specified
"--restore-mark", the connmark_tg_check() function will (correctly)
error out, but (incorrectly) forgets to release the L3 conntrack module.
Same for xt_CONNSECMARK.Fix is to move the call to acquire the L3 module after the basic
constraint checks.Signed-off-by: Jan Engelhardt
Signed-off-by: Patrick McHardy
Signed-off-by: Herbert Xu -
ipv6_skip_exthdr() returns -1 for invalid packets. don't WARN_ON
that.Signed-off-by: Patrick McHardy
Signed-off-by: Herbert Xu
16 Nov, 2007
2 commits
-
Reported by Chuck Ebbert as:
https://bugzilla.redhat.com/show_bug.cgi?id=259501#c14
This routine is called each time hash should be replaced, nf_conn has
extension list which contains pointers to connection tracking users
(like nat, which is right now the only such user), so when replace takes
place it should copy own extensions. Loop above checks for own
extension, but tries to move higer-layer one, which can lead to above
oops.Signed-off-by: Evgeniy Polyakov
Signed-off-by: David S. Miller -
It should pass opt to the ->get/->set functions, not ops.
Tested-by: Luca Tettamanti
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
13 Nov, 2007
2 commits
-
It is not correct to assume one can get nsec from a ktime directly by
using .tv64 field.Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller -
Both lookup the nf_sockopt_ops object to call the get/set callbacks
from, but they perform it in a completely similar way.Introduce the helper for finding the ops.
Signed-off-by: Pavel Emelyanov
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
07 Nov, 2007
3 commits
-
Code is using knowledge that nf_sockopt_ops::list list_head is first
field in structure by using casts. Switch to list_for_each_entry()
itetators while I am at it.Signed-off-by: Alexey Dobriyan
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Sort matches and targets in the NF makefiles.
Signed-off-by: Jan Engelhardt
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Transfer all my copyright over to our company.
Signed-off-by: Jan Engelhardt
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
31 Oct, 2007
1 commit
-
Fix links to files in Documentation/* in various Kconfig files
Signed-off-by: Dirk Hohndel
Signed-off-by: Linus Torvalds
30 Oct, 2007
1 commit
-
This allocation is expected to fail and we handle it by fallback to vmalloc().
So don't scare people with nasty messages like
http://bugzilla.kernel.org/show_bug.cgi?id=9190Signed-off-by: Andrew Morton
Signed-off-by: David S. Miller
20 Oct, 2007
3 commits
-
Signed-off-by: Adrian Bunk
-
Fix the various misspellings of "system", controller", "interrupt" and
"[un]necessary".Signed-off-by: Robert P. J. Day
Signed-off-by: Adrian Bunk -
remove asm/bitops.h includes
including asm/bitops directly may cause compile errors. don't include it
and include linux/bitops instead. next patch will deny including asm header
directly.Cc: Adrian Bunk
Signed-off-by: Jiri Slaby
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
19 Oct, 2007
2 commits
-
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (51 commits)
[IPV6]: Fix again the fl6_sock_lookup() fixed locking
[NETFILTER]: nf_conntrack_tcp: fix connection reopening fix
[IPV6]: Fix race in ipv6_flowlabel_opt() when inserting two labels
[IPV6]: Lost locking in fl6_sock_lookup
[IPV6]: Lost locking when inserting a flowlabel in ipv6_fl_list
[NETFILTER]: xt_sctp: fix mistake to pass a pointer where array is required
[NET]: Fix OOPS due to missing check in dev_parse_header().
[TCP]: Remove lost_retrans zero seqno special cases
[NET]: fix carrier-on bug?
[NET]: Fix uninitialised variable in ip_frag_reasm()
[IPSEC]: Rename mode to outer_mode and add inner_mode
[IPSEC]: Disallow combinations of RO and AH/ESP/IPCOMP
[IPSEC]: Use the top IPv4 route's peer instead of the bottom
[IPSEC]: Store afinfo pointer in xfrm_mode
[IPSEC]: Add missing BEET checks
[IPSEC]: Move type and mode map into xfrm_state.c
[IPSEC]: Fix length check in xfrm_parse_spi
[IPSEC]: Move ip_summed zapping out of xfrm6_rcv_spi
[IPSEC]: Get nexthdr from caller in xfrm6_rcv_spi
[IPSEC]: Move tunnel parsing for IPv4 out of xfrm4_input
... -
No one has bothered to set strategy routine for the the netfilter sysctls that
return jiffies to be sysctl_jiffies.So it appears the sys_sysctl path is unused and untested, so this patch
removes the binary sysctl numbers.Which fixes the netfilter oops in 2.6.23-rc2-mm2 for me.
Signed-off-by: Eric W. Biederman
Cc: Patrick McHardy
Cc: "David S. Miller"
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
18 Oct, 2007
2 commits
-
If one side aborts an established connection, the entry still lingers
for 10s in conntrack for the late packets. Allow to open up the
connection again for the party which sent the RST packet.Signed-off-by: Jozsef Kadlecsik
Tested-by: Krzysztof Piotr Oledzki
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Macros like SCTP_CHUNKMAP_XXX(chukmap) require chukmap to be an array,
but match_packet() passes a pointer to these macros. Also remove the
ELEMCOUNT macro and fix a bug in SCTP_CHUNKMAP_COPY.Signed-off-by: Li Zefan
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
16 Oct, 2007
3 commits
-
With all the users of the double pointers removed, this patch mops up by
finally replacing all occurances of sk_buff ** in the netfilter API by
sk_buff *.Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller -
This patch replaces unnecessary uses of skb_copy, pskb_copy and
skb_realloc_headroom by functions such as skb_make_writable and
pskb_expand_head.This allows us to remove the double pointers later.
Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller -
Now that all callers of netfilter can guarantee that the skb is not shared,
we no longer have to copy the skb in skb_make_writable.Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller
12 Oct, 2007
2 commits
-
The patch will add MODULE_ALIAS("ip6t_") where missing,
otherwise you will getip6tables: No chain/target/match by that name
when xt_ is not already loaded.
Signed-off-by: Jan Engelhardt
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
With your description I could reproduce the bug and actually you were
completely right: the code above is incorrect. Somehow I was able to
misread RFC1122 and mixed the roles :-(:When a connection is >>closed actively<>accept<< a new SYN from the remote TCP to
reopen the connection directly from TIME-WAIT state, if it:
[...]The fix is as follows: if the receiver initiated an active close, then the
sender may reopen the connection - otherwise try to figure out if we hold
a dead connection.Signed-off-by: Jozsef Kadlecsik
Tested-by: Krzysztof Piotr Oledzki
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
11 Oct, 2007
12 commits
-
This patch make processing netlink user -> kernel messages synchronious.
This change was inspired by the talk with Alexey Kuznetsov about current
netlink messages processing. He says that he was badly wrong when introduced
asynchronious user -> kernel communication.The call netlink_unicast is the only path to send message to the kernel
netlink socket. But, unfortunately, it is also used to send data to the
user.Before this change the user message has been attached to the socket queue
and sk->sk_data_ready was called. The process has been blocked until all
pending messages were processed. The bad thing is that this processing
may occur in the arbitrary process context.This patch changes nlk->data_ready callback to get 1 skb and force packet
processing right in the netlink_unicast.Kernel -> user path in netlink_unicast remains untouched.
EINTR processing for in netlink_run_queue was changed. It forces rtnl_lock
drop, but the process remains in the cycle until the message will be fully
processed. So, there is no need to use this kludges now.Signed-off-by: Denis V. Lunev
Acked-by: Alexey Kuznetsov
Signed-off-by: David S. Miller -
The code in netfilter/nfnetlink.c and in ./net/netlink/genetlink.c looks
like outdated copy/paste from rtnetlink.c. Push them into sync with the
original.Changes from v1:
- deleted comment in nfnetlink_rcv_msg by request of Patrick McHardySigned-off-by: Denis V. Lunev
Acked-by: Patrick McHardy
Signed-off-by: David S. Miller -
Just switch to the consolidated calls.
ipt_recent() has to initialize the private, so use
the __seq_open_private() helper.Signed-off-by: Pavel Emelyanov
Signed-off-by: David S. Miller -
This is ipt_time from POM-ng enhanced by the following:
* xtables/ipv6 support
* second granularity for daytime
* day-of-month support (for example "match on the 15th of each month")
* match against UTC or local timezoneSigned-off-by: Jan Engelhardt
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Fix timeout (one second is 1 * HZ) and convert max packet copy length
to #defined constant.Signed-off-by: Michal Miroslaw
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Fix memory leak on instance_create() while module is being unloaded.
Signed-off-by: Michal Miroslaw
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Fix function definition style to match other functions in nfnetlink_log.c.
Signed-off-by: Michal Miroslaw
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
If queue is filled to its threshold, then flush it right away instead
of waiting for timer or next packet.Signed-off-by: Michal Miroslaw
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Kill some cut'n'paste effect.
Just after __nfulnl_send() returning, inst->skb is always NULL.Signed-off-by: Michal Miroslaw
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
This patch adds support to relate a connection to an existing master
connection. This patch is used by conntrackd to correctly replicate
related connections.Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Similar to the conntrack ID, the per-expectation ID is not needed
anymore, kill it.Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Remove the per-conntrack ID, its not necessary anymore for dumping.
For compatiblity reasons we send the address of the conntrack to
userspace as ID.Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
