1. 13 Nov, 2016 2 commits
  2. 10 Nov, 2016 22 commits
  3. 09 Nov, 2016 5 commits
    • Arnd Bergmann's avatar
      netfilter: conntrack: fix NF_REPEAT handling · 56a62e22
      Arnd Bergmann authored
      gcc correctly identified a theoretical uninitialized variable use:
      
      net/netfilter/nf_conntrack_core.c: In function 'nf_conntrack_in':
      net/netfilter/nf_conntrack_core.c:1125:14: error: 'l4proto' may be used uninitialized in this function [-Werror=maybe-uninitialized]
      
      This could only happen when we 'goto out' before looking up l4proto,
      and then enter the retry, implying that l3proto->get_l4proto()
      returned NF_REPEAT. This does not currently get returned in any
      code path and probably won't ever happen, but is not good to
      rely on.
      
      Moving the repeat handling up a little should have the same
      behavior as today but avoids the warning by making that case
      impossible to enter.
      
      [ I have mangled this original patch to remove the check for tmpl, we
        should inconditionally jump back to the repeat label in case we hit
        NF_REPEAT instead. I have also moved the comment that explains this
        where it belongs. --pablo ]
      
      Fixes: 08733a0c ("netfilter: handle NF_REPEAT from nf_conntrack_in()")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      56a62e22
    • Arnd Bergmann's avatar
      udp: provide udp{4,6}_lib_lookup for nf_socket_ipv{4,6} · 30f58158
      Arnd Bergmann authored
      Since commit ca065d0c ("udp: no longer use SLAB_DESTROY_BY_RCU")
      the udp6_lib_lookup and udp4_lib_lookup functions are only
      provided when it is actually possible to call them.
      
      However, moving the callers now caused a link error:
      
      net/built-in.o: In function `nf_sk_lookup_slow_v6':
      (.text+0x131a39): undefined reference to `udp6_lib_lookup'
      net/ipv4/netfilter/nf_socket_ipv4.o: In function `nf_sk_lookup_slow_v4':
      nf_socket_ipv4.c:(.text.nf_sk_lookup_slow_v4+0x114): undefined reference to `udp4_lib_lookup'
      
      This extends the #ifdef so we also provide the functions when
      CONFIG_NF_SOCKET_IPV4 or CONFIG_NF_SOCKET_IPV6, respectively
      are set.
      
      Fixes: 8db4c5be ("netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      30f58158
    • Davide Caratti's avatar
      netfilter: conntrack: simplify init/uninit of L4 protocol trackers · 0e54d217
      Davide Caratti authored
      modify registration and deregistration of layer-4 protocol trackers to
      facilitate inclusion of new elements into the current list of builtin
      protocols. Both builtin (TCP, UDP, ICMP) and non-builtin (DCCP, GRE, SCTP,
      UDPlite) layer-4 protocol trackers usually register/deregister themselves
      using consecutive calls to nf_ct_l4proto_{,pernet}_{,un}register(...).
      This sequence is interrupted and rolled back in case of error; in order to
      simplify addition of builtin protocols, the input of the above functions
      has been modified to allow registering/unregistering multiple protocols.
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      0e54d217
    • Liping Zhang's avatar
      netfilter: nf_tables: simplify the basic expressions' init routine · 4e24877e
      Liping Zhang authored
      Some basic expressions are built into nf_tables.ko, such as nft_cmp,
      nft_lookup, nft_range and so on. But these basic expressions' init
      routine is a little ugly, too many goto errX labels, and we forget
      to call nft_range_module_exit in the exit routine, although it is
      harmless.
      
      Acctually, the init and exit routines of these basic expressions
      are same, i.e. do nft_register_expr in the init routine and do
      nft_unregister_expr in the exit routine.
      
      So it's better to arrange them into an array and deal with them
      together.
      Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4e24877e
    • Pablo Neira Ayuso's avatar
      netfilter: nft_hash: get random bytes if seed is not specified · f86dab3a
      Pablo Neira Ayuso authored
      If the user doesn't specify a seed, generate one at configuration time.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      f86dab3a
  4. 03 Nov, 2016 10 commits
  5. 02 Nov, 2016 1 commit