linux.git/net/ipv6/netfilter, branch v2.6.21.7

[NETFILTER]: nf_conntrack_ipv6: fix incorrect classification of IPv6 fragments as ESTABLISHED

2007-03-08T00:08:01+00:00

The individual fragments of a packet reassembled by conntrack have the
conntrack reference from the reassembled packet attached, but nfctinfo
is not copied. This leaves it initialized to 0, which unfortunately is
the value of IP_CT_ESTABLISHED.

The result is that all IPv6 fragments are tracked as ESTABLISHED,
allowing them to bypass a usual ruleset which accepts ESTABLISHED
packets early.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack/nf_nat: fix incorrect config ifdefs

2007-03-05T21:25:19+00:00

The nf_conntrack_netlink config option is named CONFIG_NF_CT_NETLINK,
but multiple files use CONFIG_IP_NF_CONNTRACK_NETLINK or
CONFIG_NF_CONNTRACK_NETLINK for ifdefs.

Fix this and reformat all CONFIG_NF_CT_NETLINK ifdefs to only use a line.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[PATCH] sysctl: remove insert_at_head from register_sysctl

2007-02-14T16:09:59+00:00

The semantic effect of insert_at_head is that it would allow new registered
sysctl entries to override existing sysctl entries of the same name.  Which is
pain for caching and the proc interface never implemented.

I have done an audit and discovered that none of the current users of
register_sysctl care as (excpet for directories) they do not register
duplicate sysctl entries.

So this patch simply removes the support for overriding existing entries in
the sys_sysctl interface since no one uses it or cares and it makes future
enhancments harder.

Signed-off-by: Eric W. Biederman 
Acked-by: Ralf Baechle 
Acked-by: Martin Schwidefsky 
Cc: Russell King 
Cc: David Howells 
Cc: "Luck, Tony" 
Cc: Ralf Baechle 
Cc: Paul Mackerras 
Cc: Martin Schwidefsky 
Cc: Andi Kleen 
Cc: Jens Axboe 
Cc: Corey Minyard 
Cc: Neil Brown 
Cc: "John W. Linville" 
Cc: James Bottomley 
Cc: Jan Kara 
Cc: Trond Myklebust 
Cc: Mark Fasheh 
Cc: David Chinner 
Cc: "David S. Miller" 
Cc: Patrick McHardy 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] remove many unneeded #includes of sched.h

2007-02-14T16:09:54+00:00

After Al Viro (finally) succeeded in removing the sched.h #include in module.h
recently, it makes sense again to remove other superfluous sched.h includes.
There are quite a lot of files which include it but don't actually need
anything defined in there.  Presumably these includes were once needed for
macros that used to live in sched.h, but moved to other header files in the
course of cleaning it up.

To ease the pain, this time I did not fiddle with any header files and only
removed #includes from .c-files, which tend to cause less trouble.

Compile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,
arm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,
allmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all
configs in arch/arm/configs on arm.  I also checked that no new warnings were
introduced by the patch (actually, some warnings are removed that were emitted
by unnecessarily included header files).

Signed-off-by: Tim Schmielau 
Acked-by: Russell King 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[NETFILTER]: ip6t_mh: drop piggyback payload packet on MH packets

2007-02-12T19:16:17+00:00

Regarding RFC3775, MH payload proto field should be IPPROTO_NONE. Otherwise
it must be discarded (and the receiver should send ICMP error).

We assume filter should drop such piggyback everytime to disallow slipping
through firewall rules, even the final receiver will discard it.

Signed-off-by: Masahide NAKAMURA 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Kconfig: improve dependency handling

2007-02-12T19:15:02+00:00

Instead of depending on internally needed options and letting users
figure out what is needed, select them when needed:

- IP_NF_IPTABLES, IP_NF_ARPTABLES and IP6_NF_IPTABLES select
  NETFILTER_XTABLES

- NETFILTER_XT_TARGET_CONNMARK, NETFILTER_XT_MATCH_CONNMARK and
  IP_NF_TARGET_CLUSTERIP select NF_CONNTRACK_MARK

- NETFILTER_XT_MATCH_CONNBYTES selects NF_CT_ACCT

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: fix invalid conntrack statistics RCU assumption

2007-02-12T19:13:43+00:00

NF_CT_STAT_INC assumes rcu_read_lock in nf_hook_slow disables
preemption as well, making it legal to use __get_cpu_var without
disabling preemption manually. The assumption is not correct anymore
with preemptable RCU, additionally we need to protect against softirqs
when not holding nf_conntrack_lock.

Add NF_CT_STAT_INC_ATOMIC macro, which disables local softirqs,
and use where necessary.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: properly use RCU API for nf_ct_protos/nf_ct_l3protos arrays

2007-02-12T19:12:57+00:00

Replace preempt_{enable,disable} based RCU by proper use of the
RCU API and add missing rcu_read_lock/rcu_read_unlock calls in
all paths not obviously only used within packet process context
(nfnetlink_conntrack).
  
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_log: minor cleanups

2007-02-12T19:11:55+00:00

- rename nf_logging to nf_loggers since its an array of registered loggers

- rename nf_log_unregister_logger() to nf_log_unregister() to make it
  symetrical to nf_log_register() and convert all users

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NET] IPV6: Fix whitespace errors.

2007-02-11T07:19:42+00:00

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller