linux.git/net/ipv4/netfilter, branch v2.6.22-rc4

[NETFILTER]: nf_nat_h323: call set_h225_addr instead of set_h225_addr_hook

2007-05-24T23:44:40+00:00

They're the same.

Signed-off-by: Jing Min Zhao 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack_ftp: fix newline sequence number calculation

2007-05-24T23:41:50+00:00

When the packet size is changed by the FTP NAT helper, the connection
tracking helper adjusts the sequence number of the newline character
by the size difference. This is wrong because NAT sequence number
adjustment happens after helpers are called, so the unadjusted number
is compared to the already adjusted one.

Based on report by YU, Haitao 

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack_ipv4: fix incorrect #ifdef config name

2007-05-19T21:24:16+00:00

The option is named CONFIG_NF_NAT not CONFIG_IP_NF_NAT. Remove the ifdef
completely since helpers also expect defragmented packet even without
NAT.

Noticed by Robert P. J. Day 

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: iptable_raw: ignore short packets sent by SOCK_RAW sockets

2007-05-11T06:47:59+00:00

iptables matches and targets expect packets to have at least a full
IP header and a valid header length. Ignore packets sent through
raw sockets for which this isn't true as in the other tables.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: iptable_{filter,mangle}: more descriptive "happy cracking" message

2007-05-11T06:47:59+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_nat: remove unused argument of function allocating binding

2007-05-11T06:47:44+00:00

nf_nat_rule_find, alloc_null_binding and alloc_null_binding_confirmed
do not use the argument 'info', which is actually ct->nat.info.
If they are necessary to access it again, we can use the argument 'ct'
instead.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Clean up table initialization

2007-05-11T06:47:43+00:00

- move arp_tables initial table structure definitions to arp_tables.h
  similar to ip_tables and ip6_tables

- use C99 initializers

- use initializer macros where possible

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: sip: Fix RTP address NAT

2007-05-03T10:35:31+00:00

I needed to use this recently to talk to a Cisco server.  In my case
I only did SNAT while the Cisco server used a different address for
RTP traffic than the one for SIP.  I discovered that nf_nat_sip NATed
the RTP address to the SIP one which was unnecessary but OK.  However,
in doing so it did not DNAT the destination address on the RTP traffic
to the Cisco back to the original RTP address.

This patch corrects this by noting down the RTP address and using it
when the expectation fires.

Signed-off-by: Herbert Xu 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT

2007-05-03T10:34:42+00:00

While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack
and nat modules to a 2.4.32 kernel I noticed that the gre_key function
returns a wrong pointer to the GRE key of a version 0 packet thus
corrupting the packet payload.

The intended behaviour for GREv0 packets is to act like
nf_conntrack_proto_generic/nf_nat_proto_unknown so I have ripped the
offending functions (not used anymore) and modified the
nf_nat_proto_gre modules to not touch version 0 (non PPTP) packets.

Signed-off-by: Jorge Boncompte 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ipt_DNAT: accept port randomization option

2007-05-03T10:34:03+00:00

Also accept the --random option for DNAT to allow randomly selecting a
destination port from the given range.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller