aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* netfilter: bridge-netfilter: update a comment in br_forward.c about ↵Bart De Schuymer2010-04-13
| | | | | | | | | ip_fragment() ip_refrag isn't used anymore in the bridge-netfilter code Signed-off-by: Bart De Schuymer <bdschuym@pandora.be> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: bridge-netfilter: cleanup br_netfilter.cBart De Schuymer2010-04-13
| | | | | | | | | | | bridge-netfilter: cleanup br_netfilter.c - remove some of the graffiti at the head of br_netfilter.c - remove __br_dnat_complain() - remove KERN_INFO messages when CONFIG_NETFILTER_DEBUG is defined Signed-off-by: Bart De Schuymer <bdschuym@pandora.be> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: fix some coding styles and remove moduleparam.hZhitong Wang2010-04-13
| | | | | | | Fix some coding styles and remove moduleparam.h Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting ↵Alexey Dobriyan2010-04-13
| | | | | | | | | | | | | | | | | | | __ALIGN_KERNEL() XT_ALIGN() was rewritten through ALIGN() by commit 42107f5009da223daa800d6da6904d77297ae829 "netfilter: xtables: symmetric COMPAT_XT_ALIGN definition". ALIGN() is not exported in userspace headers, which created compile problem for tc(8) and will create problem for iptables(8). We can't export generic looking name ALIGN() but we can export less generic __ALIGN_KERNEL() (suggested by Ben Hutchings). Google knows nothing about __ALIGN_KERNEL(). COMPAT_XT_ALIGN() changed for symmetry. Reported-by: Andreas Henriksson <andreas@fatal.se> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xt_LED: add refcounts to LED targetAdam Nielsen2010-04-09
| | | | | | | | Add reference counting to the netfilter LED target, to fix errors when multiple rules point to the same target ("LED trigger already exists"). Signed-off-by: Adam Nielsen <a.nielsen@shikadi.net> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: remove invalid rcu_dereference() callsPatrick McHardy2010-04-09
| | | | | | | | | | | | | | The CONFIG_PROVE_RCU option discovered a few invalid uses of rcu_dereference() in netfilter. In all these cases, the code code intends to check whether a pointer is already assigned when performing registration or whether the assigned pointer matches when performing unregistration. The entire registration/ unregistration is protected by a mutex, so we don't need the rcu_dereference() calls. Reported-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Tested-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: only do skb_checksum_help on CHECKSUM_PARTIAL in nfnetlink_queueHerbert Xu2010-04-08
| | | | | | | | | As we will set ip_summed to CHECKSUM_NONE when necessary in nfqnl_mangle, there is no need to zap CHECKSUM_COMPLETE in nfqnl_build_packet_message. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: only do skb_checksum_help on CHECKSUM_PARTIAL in ip6_queueHerbert Xu2010-04-08
| | | | | | | | | As we will set ip_summed to CHECKSUM_NONE when necessary in ipq_mangle_ipv6, there is no need to zap CHECKSUM_COMPLETE in ipq_build_packet_message. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: only do skb_checksum_help on CHECKSUM_PARTIAL in ip_queueHerbert Xu2010-04-08
| | | | | | | | | | While doing yet another audit on ip_summed I noticed ip_queue calling skb_checksum_help unnecessarily. As we will set ip_summed to CHECKSUM_NONE when necessary in ipq_mangle_ipv4, there is no need to zap CHECKSUM_COMPLETE in ipq_build_packet_message. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* IPVS: fix potential stack overflow with overly long protocol namesPatrick McHardy2010-04-08
| | | | | | | | | | | | When protocols use very long names, the sprintf calls might overflow the on-stack buffer. No protocol in the kernel does this however. Print the protocol name in the pr_debug statement directly to avoid this. Based on patch by Zhitong Wang <zhitong.wangzt@alibaba-inc.com> Acked-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xt_hashlimit: RCU conversionEric Dumazet2010-04-01
| | | | | | | | | | | | | | xt_hashlimit uses a central lock per hash table and suffers from contention on some workloads. (Multiqueue NIC or if RPS is enabled) After RCU conversion, central lock is only used when a writer wants to add or delete an entry. For 'readers', updating an existing entry, they use an individual lock per entry. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: CLUSTERIP: clusterip_seq_stop() fixEric Dumazet2010-04-01
| | | | | | | | If clusterip_seq_start() memory allocation fails, we crash later in clusterip_seq_start(), trying to kfree(ERR_PTR(-ENOMEM)) Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ctnetlink: compute message size properlyJiri Pirko2010-04-01
| | | | | | | | Message size should be dependent on the presence of an accounting extension, not on CONFIG_NF_CT_ACCT definition. Signed-off-by: Jiri Pirko <jpirko@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: merge registration structure to NFPROTO_UNSPECJan Engelhardt2010-03-25
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: remove xt_string revision 0Jan Engelhardt2010-03-25
| | | | | | | Superseded by xt_string revision 1 (linux v2.6.26-rc8-1127-g4ad3f26, iptables 1.4.2-rc1). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: remove xt_multiport revision 0Jan Engelhardt2010-03-25
| | | | | | | Superseded by xt_multiport revision 1 (introduction already predates linux.git). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: remove xt_hashlimit revision 0Jan Engelhardt2010-03-25
| | | | | | | Superseded by xt_hashlimit revision 1 (linux v2.6.24-6212-g09e410d, iptables 1.4.1-rc1). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: shorten up return clauseJan Engelhardt2010-03-25
| | | | | | | The return value of nf_ct_l3proto_get can directly be returned even in the case of success. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: slightly better error reportingJan Engelhardt2010-03-25
| | | | | | | | | When extended status codes are available, such as ENOMEM on failed allocations, or subsequent functions (e.g. nf_ct_get_l3proto), passing them up to userspace seems like a good idea compared to just always EINVAL. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: change targets to return error codeJan Engelhardt2010-03-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Part of the transition of done by this semantic patch: // <smpl> @ rule1 @ struct xt_target ops; identifier check; @@ ops.checkentry = check; @@ identifier rule1.check; @@ check(...) { <... -return true; +return 0; ...> } @@ identifier rule1.check; @@ check(...) { <... -return false; +return -EINVAL; ...> } // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: change matches to return error codeJan Engelhardt2010-03-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following semantic patch does part of the transformation: // <smpl> @ rule1 @ struct xt_match ops; identifier check; @@ ops.checkentry = check; @@ identifier rule1.check; @@ check(...) { <... -return true; +return 0; ...> } @@ identifier rule1.check; @@ check(...) { <... -return false; +return -EINVAL; ...> } // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: change xt_target.checkentry return typeJan Engelhardt2010-03-25
| | | | | | | | | | | | | | | | | | | | Restore function signatures from bool to int so that we can report memory allocation failures or similar using -ENOMEM rather than always having to pass -EINVAL back. // <smpl> @@ type bool; identifier check, par; @@ -bool check +int check (struct xt_tgchk_param *par) { ... } // </smpl> Minus the change it does to xt_ct_find_proto. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: change xt_match.checkentry return typeJan Engelhardt2010-03-25
| | | | | | | | | | | | | | | | | | | | | | Restore function signatures from bool to int so that we can report memory allocation failures or similar using -ENOMEM rather than always having to pass -EINVAL back. This semantic patch may not be too precise (checking for functions that use xt_mtchk_param rather than functions referenced by xt_match.checkentry), but reviewed, it produced the intended result. // <smpl> @@ type bool; identifier check, par; @@ -bool check +int check (struct xt_mtchk_param *par) { ... } // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: untangle spaghetti if clauses in checkentryJan Engelhardt2010-03-25
| | | | | | | As I'm changing the return values soon, I want to have a clear visual path. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: ipvs: use NFPROTO values for NF_HOOK invocationJan Engelhardt2010-03-25
| | | | | | | | | | | | | | | | | | | | | Semantic patch: // <smpl> @@ @@ IP_VS_XMIT( -PF_INET6, +NFPROTO_IPV6, ...) @@ @@ IP_VS_XMIT( -PF_INET, +NFPROTO_IPV4, ...) // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: decnet: use NFPROTO values for NF_HOOK invocationJan Engelhardt2010-03-25
| | | | | | | | | | | | | | The semantic patch used was: // <smpl> @@ @@ NF_HOOK( -PF_DECnet, +NFPROTO_DECNET, ...) // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: ipv6: use NFPROTO values for NF_HOOK invocationJan Engelhardt2010-03-25
| | | | | | | | | | | | | | | | | The semantic patch that was used: // <smpl> @@ @@ (NF_HOOK |NF_HOOK_THRESH |nf_hook )( -PF_INET6, +NFPROTO_IPV6, ...) // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: ipv4: use NFPROTO values for NF_HOOK invocationJan Engelhardt2010-03-25
| | | | | | | | | | | | | | | | | The semantic patch that was used: // <smpl> @@ @@ (NF_HOOK |NF_HOOK_COND |nf_hook )( -PF_INET, +NFPROTO_IPV4, ...) // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: bridge: use NFPROTO values for NF_HOOK invocationJan Engelhardt2010-03-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The first argument to NF_HOOK* is an nfproto since quite some time. Commit v2.6.27-2457-gfdc9314 was the first to practically start using the new names. Do that now for the remaining NF_HOOK calls. The semantic patch used was: // <smpl> @@ @@ (NF_HOOK |NF_HOOK_THRESH )( -PF_BRIDGE, +NFPROTO_BRIDGE, ...) @@ @@ NF_HOOK( -PF_INET6, +NFPROTO_IPV6, ...) @@ @@ NF_HOOK( -PF_INET, +NFPROTO_IPV4, ...) // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xt_recent: allow changing ip_list_[ug]id at runtimeJan Engelhardt2010-03-25
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: consolidate code into xt_request_find_matchJan Engelhardt2010-03-25
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: make use of xt_request_find_targetJan Engelhardt2010-03-25
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xt extensions: use pr_<level> (2)Jan Engelhardt2010-03-25
| | | | | | | | | | | Supplement to 1159683ef48469de71dc26f0ee1a9c30d131cf89. Downgrade the log level to INFO for most checkentry messages as they are, IMO, just an extra information to the -EINVAL code that is returned as part of a parameter "constraint violation". Leave errors to real errors, such as being unable to create a LED trigger. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: make use of caller family rather than target familyJan Engelhardt2010-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | Supplement to aa5fa3185791aac71c9172d4fda3e8729164b5d1. The semantic patch for this change is: // <smpl> @@ struct xt_target_param *par; @@ -par->target->family +par->family @@ struct xt_tgchk_param *par; @@ -par->target->family +par->family @@ struct xt_tgdtor_param *par; @@ -par->target->family +par->family // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: remove unused headers in net/ipv4/netfilter/nf_nat_h323.cZhitong Wang2010-03-19
| | | | | | | Remove unused headers in net/ipv4/netfilter/nf_nat_h323.c Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: remove unused headers in net/ipv6/netfilter/ip6t_LOG.cZhitong Wang2010-03-19
| | | | | | | Remove unused headers in net/ipv6/netfilter/ip6t_LOG.c Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xt extensions: use pr_<level>Jan Engelhardt2010-03-18
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: replace custom duprintf with pr_debugJan Engelhardt2010-03-18
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: do not print any messages on ENOMEMJan Engelhardt2010-03-18
| | | | | | | | | ENOMEM is a very obvious error code (cf. EINVAL), so I think we do not really need a warning message. Not to mention that if the allocation fails, the user is most likely going to get a stack trace from slab already. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: reduce holes in struct xt_targetJan Engelhardt2010-03-18
| | | | | | This will save one full padding chunk (8 bytes on x86_64) per target. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: remove almost-unused xt_match_param.data memberJan Engelhardt2010-03-18
| | | | | | | | | | | | | This member is taking up a "long" per match, yet is only used by one module out of the roughly 90 modules, ip6t_hbh. ip6t_hbh can be restructured a little to accomodate for the lack of the .data member. This variant uses checking the par->match address, which should avoid having to add two extra functions, including calls, i.e. (hbh_mt6: call hbhdst_mt6(skb, par, NEXTHDR_OPT), dst_mt6: call hbhdst_mt6(skb, par, NEXTHDR_DEST)) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: update documentation fields of x_tables.hJan Engelhardt2010-03-18
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: make use of caller family rather than match familyJan Engelhardt2010-03-18
| | | | | | | | The matches can have .family = NFPROTO_UNSPEC, and though that is not the case for the touched modules, it seems better to just use the nfproto from the caller. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: resort osf kconfig textJan Engelhardt2010-03-18
| | | | | | | Restore alphabetical ordering of the list and put the xt_osf option into its 'right' place again. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: limit xt_mac to ethernet devicesJan Engelhardt2010-03-18
| | | | | | | | I do not see a point of allowing the MAC module to work with devices that don't possibly have one, e.g. various tunnel interfaces such as tun and sit. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: clean up xt_mac match routineJan Engelhardt2010-03-18
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: do without explicit XT_ALIGNJan Engelhardt2010-03-18
| | | | | | | XT_ALIGN is already applied on matchsize/targetsize in x_tables.c, so it is not strictly needed in the extensions. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of ../nf-2.6Patrick McHardy2010-03-18
|\
| * netfilter: net/netfilter/ipvs/ip_vs_ftp.c: Remove use of NIPQUADJoe Perches2010-03-15
| | | | | | | | | | | | | | | | | | | | | | NIPQUAD has very few uses left. Remove this use and make the code have the identical form of the only other use of "%u,%u,%u,%u,%u,%u" in net/ipv4/netfilter/nf_nat_ftp.c Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: remove stale declaration for ip6_masked_addrcmp()YOSHIFUJI Hideaki2010-03-08
| | | | | | | | | | | | | | | | | | | | | | Commit f2ffd9ee... ("[NETFILTER]: Move ip6_masked_addrcmp to include/net/ipv6.h") replaced ip6_masked_addrcmp() with ipv6_masked_addr_cmp(). Function definition went away. Let's remove its declaration as well in header file. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
generated by cgit v1.2.2 (git 2.25.0) at 2025-03-12 18:20:59 -0400