Eric Lee / smarc-fsl-linux-kernel

10 May, 2011

1 commit

  • 93bbce1ad   netfilter: revert a2361c8735e07322023aedc36e4938b35af31eb0 ... Browse Code »

    This patch reverts a2361c8735e07322023aedc36e4938b35af31eb0:
    "[PATCH] netfilter: xt_conntrack: warn about use in raw table"

    Florian Wesphal says:
    "... when the packet was sent from the local machine the skb
    already has ->nfct attached, and -m conntrack seems to do
    the right thing."

    Acked-by: Jan Engelhardt
    Reported-by: Florian Wesphal
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

04 Apr, 2011

1 commit

  • 96120d86f   netfilter: xt_conntrack: fix inverted conntrack direction test ... Browse Code »

    --ctdir ORIGINAL matches REPLY packets, and vv:

    userspace sets "invert_flags &= ~XT_CONNTRACK_DIRECTION" in ORIGINAL
    case.

    Thus: (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
    !!(info->invert_flags & XT_CONNTRACK_DIRECTION))

    yields "1 ^ 0", which is true -> returns false.

    Reproducer:
    iptables -I OUTPUT 1 -p tcp --syn -m conntrack --ctdir ORIGINAL

    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

15 Feb, 2011

1 commit

13 Jan, 2011

1 commit

  • b017900aa   netfilter: xt_conntrack: support matching on port ranges ... Browse Code »

    Add a new revision 3 that contains port ranges for all of origsrc,
    origdst, replsrc and repldst. The high ports are appended to the
    original v2 data structure to allow sharing most of the code with
    v1 and v2. Use of the revision specific port matching function is
    made dependant on par->match->revision.

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

08 Jun, 2010

1 commit

  • 5bfddbd46   netfilter: nf_conntrack: IPS_UNTRACKED bit ... Browse Code »

    NOTRACK makes all cpus share a cache line on nf_conntrack_untracked
    twice per packet. This is bad for performance.
    __read_mostly annotation is also a bad choice.

    This patch introduces IPS_UNTRACKED bit so that we can use later a
    per_cpu untrack structure more easily.

    A new helper, nf_ct_untracked_get() returns a pointer to
    nf_conntrack_untracked.

    Another one, nf_ct_untracked_status_or() is used by nf_nat_init() to add
    IPS_NAT_DONE_MASK bits to untracked status.

    nf_ct_is_untracked() prototype is changed to work on a nf_conn pointer.

    Signed-off-by: Eric Dumazet
    Signed-off-by: Patrick McHardy

    Eric Dumazet
     

12 May, 2010

2 commits

25 Mar, 2010

4 commits

18 Mar, 2010

1 commit

23 Nov, 2009

1 commit

  • 3a0429292   netfilter: xtables: fix conntrack match v1 ipt-save output ... Browse Code »

    commit d6d3f08b0fd998b647a05540cedd11a067b72867
    (netfilter: xtables: conntrack match revision 2) does break the
    v1 conntrack match iptables-save output in a subtle way.

    Problem is as follows:

    up = kmalloc(sizeof(*up), GFP_KERNEL);
    [..]
    /*
    * The strategy here is to minimize the overhead of v1 matching,
    * by prebuilding a v2 struct and putting the pointer into the
    * v1 dataspace.
    */
    memcpy(up, info, offsetof(typeof(*info), state_mask));
    [..]
    *(void **)info = up;

    As the v2 struct pointer is saved in the match data space,
    it clobbers the first structure member (->origsrc_addr).

    Because the _v1 match function grabs this pointer and does not actually
    look at the v1 origsrc, run time functionality does not break.
    But iptables -nvL (or iptables-save) cannot know that v1 origsrc_addr
    has been overloaded in this way:

    $ iptables -p tcp -A OUTPUT -m conntrack --ctorigsrc 10.0.0.1 -j ACCEPT
    $ iptables-save
    -A OUTPUT -p tcp -m conntrack --ctorigsrc 128.173.134.206 -j ACCEPT

    (128.173... is the address to the v2 match structure).

    To fix this, we take advantage of the fact that the v1 and v2 structures
    are identical with exception of the last two structure members (u8 in v1,
    u16 in v2).

    We extract them as early as possible and prevent the v2 matching function
    from looking at those two members directly.

    Previously reported by Michel Messerschmidt via Ben Hutchings, also
    see Debian Bug tracker #556587.

    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

10 Aug, 2009

1 commit

29 Jun, 2009

1 commit

  • d6d3f08b0   netfilter: xtables: conntrack match revision 2 ... Browse Code »

    As reported by Philip, the UNTRACKED state bit does not fit within
    the 8-bit state_mask member. Enlarge state_mask and give status_mask
    a few more bits too.

    Reported-by: Philip Craig
    References: http://markmail.org/thread/b7eg6aovfh4agyz7
    Signed-off-by: Jan Engelhardt
    Signed-off-by: Patrick McHardy

    Jan Engelhardt
     

08 Oct, 2008

6 commits

14 Apr, 2008

1 commit

28 Feb, 2008

2 commits

01 Feb, 2008

1 commit

29 Jan, 2008

5 commits

11 Jul, 2007

5 commits

11 May, 2007

1 commit

26 Apr, 2007

1 commit

13 Feb, 2007

1 commit

14 Dec, 2006

1 commit

23 Sep, 2006

1 commit