linux/net/ipv6/netfilter, branch v3.15

net: ipv6: more places need LOOPBACK_IFINDEX for flowi6_iif

2014-04-28T18:47:03Z

To properly match iif in ip rules we have to provide LOOPBACK_IFINDEX in flowi6_iif, not 0. Some ip6mr_fib_lookup and fib6_rule_lookup callers need such fix. Signed-off-by: Julian Anastasov Signed-off-by: David S. Miller

netfilter: Can't fail and free after table replacement

2014-04-05T15:46:22Z

All xtables variants suffer from the defect that the copy_to_user() to copy the counters to user memory may fail after the table has already been exchanged and thus exposed. Return an error at this point will result in freeing the already exposed table. Any subsequent packet processing will result in a kernel panic. We can't copy the counters before exposing the new tables as we want provide the counter state after the old table has been unhooked. Therefore convert this into a silent error. Cc: Florian Westphal Signed-off-by: Thomas Graf Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add reject module for NFPROTO_INET

2014-02-06T08:44:18Z

Add a reject module for NFPROTO_INET. It does nothing but dispatch to the AF-specific modules based on the hook family. Signed-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso

netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts

2014-02-06T08:44:10Z

Currently the nft_reject module depends on symbols from ipv6. This is wrong since no generic module should force IPv6 support to be loaded. Split up the module into AF-specific and a generic part. Signed-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: fix error path in the init functions

2014-01-09T22:25:48Z

We have to unregister chain type if this fails to register netns. Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain()

2014-01-09T19:17:16Z

We don't encode argument types into function names and since besides nft_do_chain() there are only AF-specific versions, there is no risk of confusion. Signed-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: minor nf_chain_type cleanups

2014-01-09T19:17:15Z

Minor nf_chain_type cleanups: - reorder struct to plug a hoe - rename struct module member to "owner" for consistency - rename nf_hookfn array to "hooks" for consistency - reorder initializers for better readability Signed-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: constify chain type definitions and pointers

2014-01-09T19:17:15Z

Signed-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add missing module references to chain types

2014-01-09T19:17:14Z

In some cases we neither take a reference to the AF info nor to the chain type, allowing the module to be unloaded while in use. Signed-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso

netfilter: nf_tables: add "inet" table for IPv4/IPv6

2014-01-07T22:57:25Z

This patch adds a new table family and a new filter chain that you can use to attach IPv4 and IPv6 rules. This should help to simplify rule-set maintainance in dual-stack setups. Signed-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso