Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

10 files changed, 74 insertions, 86 deletions

diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 4c7a18abcaff..db4d5725cce8 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -499,8 +499,7 @@ ipq_rcv_nl_event(struct notifier_block *this,
 {
         struct netlink_notify *n = ptr;
 
-        if (event == NETLINK_URELEASE &&
-            n->protocol == NETLINK_IP6_FW && n->pid) {
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_IP6_FW) {
                 write_lock_bh(&queue_lock);
                 if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
                         __ipq_reset();
@@ -625,7 +624,7 @@ cleanup_netlink_notifier:
 static void __exit ip6_queue_fini(void)
 {
         nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
+
         ipq_flush(NULL, 0);
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index cc9f8ef303fd..480d7f8c9802 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -105,9 +105,9 @@ ip6_packet_match(const struct sk_buff *skb,
 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
 
         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
-                                       &ip6info->src), IP6T_INV_SRCIP)
-            || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
-                                          &ip6info->dst), IP6T_INV_DSTIP)) {
+                                       &ip6info->src), IP6T_INV_SRCIP) ||
+            FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
+                                       &ip6info->dst), IP6T_INV_DSTIP)) {
                 dprintf("Source or dest mismatch.\n");
 /*
                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
@@ -277,11 +277,11 @@ get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
         } else if (s == e) {
                 (*rulenum)++;
 
-                if (s->target_offset == sizeof(struct ip6t_entry)
-                   && strcmp(t->target.u.kernel.target->name,
-                             IP6T_STANDARD_TARGET) == 0
-                   && t->verdict < 0
-                   && unconditional(&s->ipv6)) {
+                if (s->target_offset == sizeof(struct ip6t_entry) &&
+                    strcmp(t->target.u.kernel.target->name,
+                           IP6T_STANDARD_TARGET) == 0 &&
+                    t->verdict < 0 &&
+                    unconditional(&s->ipv6)) {
                         /* Tail of chains: STANDARD target (return/policy) */
                         *comment = *chainname == hookname
                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
@@ -418,8 +418,8 @@ ip6t_do_table(struct sk_buff *skb,
                                 back = get_entry(table_base, back->comefrom);
                                 continue;
                         }
-                        if (table_base + v != ip6t_next_entry(e)
-                            && !(e->ipv6.flags & IP6T_F_GOTO)) {
+                        if (table_base + v != ip6t_next_entry(e) &&
+                            !(e->ipv6.flags & IP6T_F_GOTO)) {
                                 /* Save old back ptr in next entry */
                                 struct ip6t_entry *next = ip6t_next_entry(e);
                                 next->comefrom = (void *)back - table_base;
@@ -505,11 +505,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ip6t_entry)
-                            && (strcmp(t->target.u.user.name,
-                                       IP6T_STANDARD_TARGET) == 0)
-                            && t->verdict < 0
-                            && unconditional(&e->ipv6)) || visited) {
+                        if ((e->target_offset == sizeof(struct ip6t_entry) &&
+                             (strcmp(t->target.u.user.name,
+                                     IP6T_STANDARD_TARGET) == 0) &&
+                             t->verdict < 0 &&
+                             unconditional(&e->ipv6)) || visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -556,8 +556,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                 int newpos = t->verdict;
 
                                 if (strcmp(t->target.u.user.name,
-                                           IP6T_STANDARD_TARGET) == 0
-                                    && newpos >= 0) {
+                                           IP6T_STANDARD_TARGET) == 0 &&
+                                    newpos >= 0) {
                                         if (newpos > newinfo->size -
                                                 sizeof(struct ip6t_entry)) {
                                                 duprintf("mark_source_chains: "
@@ -767,8 +767,8 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
 {
         unsigned int h;
 
-        if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0
-            || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -1584,8 +1584,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
         int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0
-            || (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 7018cac4fddc..b285fdf19050 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -249,8 +249,8 @@ static void dump_packet(const struct nf_loginfo *info,
                 /* Max length: 11 "URGP=65535 " */
                 printk("URGP=%u ", ntohs(th->urg_ptr));
 
-                if ((logflags & IP6T_LOG_TCPOPT)
-                    && th->doff * 4 > sizeof(struct tcphdr)) {
+                if ((logflags & IP6T_LOG_TCPOPT) &&
+                    th->doff * 4 > sizeof(struct tcphdr)) {
                         u_int8_t _opt[60 - sizeof(struct tcphdr)];
                         const u_int8_t *op;
                         unsigned int i;
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 5a7f00cd15ce..8311ca31816a 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -223,8 +223,8 @@ static bool reject_tg6_check(const struct xt_tgchk_param *par)
                 return false;
         } else if (rejinfo->with == IP6T_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
-                if (e->ipv6.proto != IPPROTO_TCP
-                    || (e->ipv6.invflags & XT_INV_PROTO)) {
+                if (e->ipv6.proto != IPPROTO_TCP ||
+                    (e->ipv6.invflags & XT_INV_PROTO)) {
                         printk("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
                         return false;
                 }
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 3a82f24746b9..ac0b7c629d78 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -77,17 +77,14 @@ static bool ah_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                  ahinfo->hdrres, ah->reserved,
                  !(ahinfo->hdrres && ah->reserved));
 
-        return (ah != NULL)
-               &&
-               spi_match(ahinfo->spis[0], ahinfo->spis[1],
-                         ntohl(ah->spi),
-                         !!(ahinfo->invflags & IP6T_AH_INV_SPI))
-               &&
-               (!ahinfo->hdrlen ||
-                (ahinfo->hdrlen == hdrlen) ^
-                !!(ahinfo->invflags & IP6T_AH_INV_LEN))
-               &&
-               !(ahinfo->hdrres && ah->reserved);
+        return (ah != NULL) &&
+                spi_match(ahinfo->spis[0], ahinfo->spis[1],
+                          ntohl(ah->spi),
+                          !!(ahinfo->invflags & IP6T_AH_INV_SPI)) &&
+                (!ahinfo->hdrlen ||
+                 (ahinfo->hdrlen == hdrlen) ^
+                 !!(ahinfo->invflags & IP6T_AH_INV_LEN)) &&
+                !(ahinfo->hdrres && ah->reserved);
 }
 
 static bool ah_mt6_check(const struct xt_mtchk_param *par)
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 673aa0a5084e..7b91c2598ed5 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -70,41 +70,36 @@ frag_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
         pr_debug("res %02X %02X%04X %02X ",
                  fraginfo->flags & IP6T_FRAG_RES, fh->reserved,
                  ntohs(fh->frag_off) & 0x6,
-                 !((fraginfo->flags & IP6T_FRAG_RES)
-                   && (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
+                 !((fraginfo->flags & IP6T_FRAG_RES) &&
+                   (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
         pr_debug("first %02X %02X %02X ",
                  fraginfo->flags & IP6T_FRAG_FST,
                  ntohs(fh->frag_off) & ~0x7,
-                 !((fraginfo->flags & IP6T_FRAG_FST)
-                   && (ntohs(fh->frag_off) & ~0x7)));
+                 !((fraginfo->flags & IP6T_FRAG_FST) &&
+                   (ntohs(fh->frag_off) & ~0x7)));
         pr_debug("mf %02X %02X %02X ",
                  fraginfo->flags & IP6T_FRAG_MF,
                  ntohs(fh->frag_off) & IP6_MF,
-                 !((fraginfo->flags & IP6T_FRAG_MF)
-                   && !((ntohs(fh->frag_off) & IP6_MF))));
+                 !((fraginfo->flags & IP6T_FRAG_MF) &&
+                   !((ntohs(fh->frag_off) & IP6_MF))));
         pr_debug("last %02X %02X %02X\n",
                  fraginfo->flags & IP6T_FRAG_NMF,
                  ntohs(fh->frag_off) & IP6_MF,
-                 !((fraginfo->flags & IP6T_FRAG_NMF)
-                   && (ntohs(fh->frag_off) & IP6_MF)));
-
-        return (fh != NULL)
-               &&
-               id_match(fraginfo->ids[0], fraginfo->ids[1],
-                        ntohl(fh->identification),
-                        !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_RES)
-                 && (fh->reserved || (ntohs(fh->frag_off) & 0x6)))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_FST)
-                 && (ntohs(fh->frag_off) & ~0x7))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_MF)
-                 && !(ntohs(fh->frag_off) & IP6_MF))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_NMF)
-                 && (ntohs(fh->frag_off) & IP6_MF));
+                 !((fraginfo->flags & IP6T_FRAG_NMF) &&
+                   (ntohs(fh->frag_off) & IP6_MF)));
+
+        return (fh != NULL) &&
+                id_match(fraginfo->ids[0], fraginfo->ids[1],
+                         ntohl(fh->identification),
+                         !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) &&
+                !((fraginfo->flags & IP6T_FRAG_RES) &&
+                  (fh->reserved || (ntohs(fh->frag_off) & 0x6))) &&
+                !((fraginfo->flags & IP6T_FRAG_FST) &&
+                  (ntohs(fh->frag_off) & ~0x7)) &&
+                !((fraginfo->flags & IP6T_FRAG_MF) &&
+                  !(ntohs(fh->frag_off) & IP6_MF)) &&
+                !((fraginfo->flags & IP6T_FRAG_NMF) &&
+                  (ntohs(fh->frag_off) & IP6_MF));
 }
 
 static bool frag_mt6_check(const struct xt_mtchk_param *par)
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 356b8d6f6baa..b77307fc8743 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -92,16 +92,13 @@ static bool rt_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                  !((rtinfo->flags & IP6T_RT_RES) &&
                    (((const struct rt0_hdr *)rh)->reserved)));
 
-        ret = (rh != NULL)
-              &&
+        ret = (rh != NULL) &&
               (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
                               rh->segments_left,
-                              !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
-              &&
+                              !!(rtinfo->invflags & IP6T_RT_INV_SGS))) &&
               (!(rtinfo->flags & IP6T_RT_LEN) ||
                ((rtinfo->hdrlen == hdrlen) ^
-                !!(rtinfo->invflags & IP6T_RT_INV_LEN)))
-              &&
+                !!(rtinfo->invflags & IP6T_RT_INV_LEN))) &&
               (!(rtinfo->flags & IP6T_RT_TYP) ||
                ((rtinfo->rt_type == rh->type) ^
                 !!(rtinfo->invflags & IP6T_RT_INV_TYP)));
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 6f4383ad86f9..ad378efd0eb8 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -79,8 +79,8 @@ ip6t_local_out_hook(unsigned int hook,
 {
 #if 0
         /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                 if (net_ratelimit())
                         printk("ip6t_hook: happy cracking.\n");
                 return NF_ACCEPT;
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 0ad91433ed61..a929c19d30e3 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -102,8 +102,8 @@ ip6t_local_out_hook(unsigned int hook,
 
 #if 0
         /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                 if (net_ratelimit())
                         printk("ip6t_hook: happy cracking.\n");
                 return NF_ACCEPT;
@@ -122,11 +122,11 @@ ip6t_local_out_hook(unsigned int hook,
         ret = ip6t_do_table(skb, hook, in, out,
                             dev_net(out)->ipv6.ip6table_mangle);
 
-        if (ret != NF_DROP && ret != NF_STOLEN
-                && (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
-                    || memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr))
-                    || skb->mark != mark
-                    || ipv6_hdr(skb)->hop_limit != hop_limit))
+        if (ret != NF_DROP && ret != NF_STOLEN &&
+            (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
+             memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
+             skb->mark != mark ||
+             ipv6_hdr(skb)->hop_limit != hop_limit))
                 return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
 
         return ret;
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 642dcb127bab..0f3df45718ac 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -244,18 +244,18 @@ static const struct nla_policy icmpv6_nla_policy[CTA_PROTO_MAX+1] = {
 static int icmpv6_nlattr_to_tuple(struct nlattr *tb[],
                                 struct nf_conntrack_tuple *tuple)
 {
-        if (!tb[CTA_PROTO_ICMPV6_TYPE]
-            || !tb[CTA_PROTO_ICMPV6_CODE]
-            || !tb[CTA_PROTO_ICMPV6_ID])
+        if (!tb[CTA_PROTO_ICMPV6_TYPE] ||
+            !tb[CTA_PROTO_ICMPV6_CODE] ||
+            !tb[CTA_PROTO_ICMPV6_ID])
                 return -EINVAL;
 
         tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMPV6_TYPE]);
         tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMPV6_CODE]);
         tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMPV6_ID]);
 
-        if (tuple->dst.u.icmp.type < 128
-            || tuple->dst.u.icmp.type - 128 >= sizeof(invmap)
-            || !invmap[tuple->dst.u.icmp.type - 128])
+        if (tuple->dst.u.icmp.type < 128 ||
+            tuple->dst.u.icmp.type - 128 >= sizeof(invmap) ||
+            !invmap[tuple->dst.u.icmp.type - 128])
                 return -EINVAL;
 
         return 0;