Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says:

====================
The following patchset contains a small batch of Netfilter
updates for your net-next tree, they are:

* Three patches that provide more accurate error reporting to
  user-space, instead of -EPERM, in IPv4/IPv6 netfilter re-routing
  code and NAT, from Patrick McHardy.

* Update copyright statements in Netfilter filters of
  Patrick McHardy, from himself.

* Add Kconfig dependency on the raw/mangle tables to the
  rpfilter, from Florian Westphal.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

6 files changed, 34 insertions, 15 deletions

diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 429089cb073d..72836f40b730 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -1,3 +1,9 @@
+/*
+ * IPv6 specific functions of netfilter core
+ *
+ * Rusty Russell (C) 2000 -- This code is GPL.
+ * Patrick McHardy (C) 2006-2012
+ */
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/ipv6.h>
@@ -29,7 +35,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
                 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
                 LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
                 dst_release(dst);
-                return -EINVAL;
+                return dst->error;
         }
 
         /* Drop old route. */
@@ -43,7 +49,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
                 skb_dst_set(skb, NULL);
                 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0);
                 if (IS_ERR(dst))
-                        return -1;
+                        return PTR_ERR(dst);
                 skb_dst_set(skb, dst);
         }
 #endif
@@ -53,7 +59,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
         if (skb_headroom(skb) < hh_len &&
             pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
                              0, GFP_ATOMIC))
-                return -1;
+                return -ENOMEM;
 
         return 0;
 }
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index c72532a60d88..4433ab40e7de 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -105,7 +105,7 @@ config IP6_NF_MATCH_MH
 
 config IP6_NF_MATCH_RPFILTER
         tristate '"rpfilter" reverse path filter match support'
-        depends on NETFILTER_ADVANCED
+        depends on NETFILTER_ADVANCED && (IP6_NF_MANGLE || IP6_NF_RAW)
         ---help---
           This option allows you to match packets whose replies would
           go out via the interface the packet came in.
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 8861b1ef420e..44400c216dc6 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -3,6 +3,7 @@
  *
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
+ * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index ed3b427b2841..70f9abc0efe9 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -7,6 +7,8 @@
  * Authors:
  *      Yasuyuki Kozakai        <yasuyuki.kozakai@toshiba.co.jp>
  *
+ * Copyright (c) 2005-2007 Patrick McHardy <kaber@trash.net>
+ *
  * Based on net/ipv4/netfilter/ipt_REJECT.c
  *
  * This program is free software; you can redistribute it and/or
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 6134a1ebfb1b..e075399d8b72 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -38,7 +38,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
         struct in6_addr saddr, daddr;
         u_int8_t hop_limit;
         u_int32_t flowlabel, mark;
-
+        int err;
 #if 0
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
@@ -65,8 +65,11 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
              !ipv6_addr_equal(&ipv6_hdr(skb)->daddr, &daddr) ||
              skb->mark != mark ||
              ipv6_hdr(skb)->hop_limit != hop_limit ||
-             flowlabel != *((u_int32_t *)ipv6_hdr(skb))))
-                return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
+             flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) {
+                err = ip6_route_me_harder(skb);
+                if (err < 0)
+                        ret = NF_DROP_ERR(err);
+        }
 
         return ret;
 }
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index e0e788d25b14..6383f90efda8 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -179,6 +179,7 @@ nf_nat_ipv6_out(unsigned int hooknum,
 #ifdef CONFIG_XFRM
         const struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
+        int err;
 #endif
         unsigned int ret;
 
@@ -197,9 +198,11 @@ nf_nat_ipv6_out(unsigned int hooknum,
                                       &ct->tuplehash[!dir].tuple.dst.u3) ||
                     (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
                      ct->tuplehash[dir].tuple.src.u.all !=
-                     ct->tuplehash[!dir].tuple.dst.u.all))
-                        if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
-                                ret = NF_DROP;
+                     ct->tuplehash[!dir].tuple.dst.u.all)) {
+                        err = nf_xfrm_me_harder(skb, AF_INET6);
+                        if (err < 0)
+                                ret = NF_DROP_ERR(err);
+                }
         }
 #endif
         return ret;
@@ -215,6 +218,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
         const struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         unsigned int ret;
+        int err;
 
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct ipv6hdr))
@@ -227,16 +231,19 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
 
                 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
                                       &ct->tuplehash[!dir].tuple.src.u3)) {
-                        if (ip6_route_me_harder(skb))
-                                ret = NF_DROP;
+                        err = ip6_route_me_harder(skb);
+                        if (err < 0)
+                                ret = NF_DROP_ERR(err);
                 }
 #ifdef CONFIG_XFRM
                 else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
                          ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
                          ct->tuplehash[dir].tuple.dst.u.all !=
-                         ct->tuplehash[!dir].tuple.src.u.all)
-                        if (nf_xfrm_me_harder(skb, AF_INET6))
-                                ret = NF_DROP;
+                         ct->tuplehash[!dir].tuple.src.u.all) {
+                        err = nf_xfrm_me_harder(skb, AF_INET6);
+                        if (err < 0)
+                                ret = NF_DROP_ERR(err);
+                }
 #endif
         }
         return ret;