linux/include/net/netfilter, branch v2.6.26

netfilter: nf_nat: fix RCU races

2008-06-17T22:51:47Z

Fix three ct_extend/NAT extension related races: - When cleaning up the extension area and removing it from the bysource hash, the nat->ct pointer must not be set to NULL since it may still be used in a RCU read side - When replacing a NAT extension area in the bysource hash, the nat->ct pointer must be assigned before performing the replacement - When reallocating extension storage in ct_extend, the old memory must not be freed immediately since it may still be used by a RCU read side Possibly fixes https://bugzilla.redhat.com/show_bug.cgi?id=449315 and/or http://bugzilla.kernel.org/show_bug.cgi?id=10875 Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

netfilter: nf_conntrack: padding breaks conntrack hash on ARM

2008-04-29T10:35:10Z

commit 0794935e "[NETFILTER]: nf_conntrack: optimize hash_conntrack()" results in ARM platforms hashing uninitialised padding. This padding doesn't exist on other architectures. Fix this by replacing NF_CT_TUPLE_U_BLANK() with memset() to ensure everything is initialised. There were only 4 bytes that NF_CT_TUPLE_U_BLANK() wasn't clearing anyway (or 12 bytes on ARM). Signed-off-by: Philip Craig Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: replace NF_CT_DUMP_TUPLE macro indrection by function call

2008-04-14T09:15:54Z

Directly call IPv4 and IPv6 variants where the address family is easily known. Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy

[NETFILTER]: nf_nat: use bool type in nf_nat_proto

2008-04-14T09:15:53Z

Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy

[NETFILTER]: nf_conntrack: use bool type in struct nf_conntrack_tuple.h

2008-04-14T09:15:53Z

Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy

[NETFILTER]: nf_conntrack: use bool type in struct nf_conntrack_l4proto

2008-04-14T09:15:53Z

Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy

[NETFILTER]: nf_conntrack: use bool type in struct nf_conntrack_l3proto

2008-04-14T09:15:52Z

Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy

[NETFILTER]: Remove unused callbacks in nf_conntrack_l3proto

2008-04-14T09:15:52Z

These functions are never called. Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy

[NETFILTER]: nf_conntrack: add tuplehash l3num/protonum accessors

2008-04-14T09:15:52Z

Add accessors for l3num and protonum and get rid of some overly long expressions. Signed-off-by: Patrick McHardy

[NETFILTER]: nf_nat: kill helper and seq_adjust hooks

2008-04-14T09:15:52Z

Connection tracking helpers (specifically FTP) need to be called before NAT sequence numbers adjustments are performed to be able to compare them against previously seen ones. We've introduced two new hooks around 2.6.11 to maintain this ordering when NAT modules were changed to get called from conntrack helpers directly. The cost of netfilter hooks is quite high and sequence number adjustments are only rarely needed however. Add a RCU-protected sequence number adjustment function pointer and call it from IPv4 conntrack after calling the helper. Signed-off-by: Patrick McHardy