talos-op-linux/include/linux/netfilter, branch v3.9

netfilter: ipset: hash:net: nomatch flag not excluded on set resize

2013-04-09T19:04:16+00:00

If a resize is triggered the nomatch flag is not excluded at hashing, which leads to the element missed at lookup in the resized set. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso

Merge branch 'master' of git://1984.lsi.us.es/nf

2013-02-26T22:24:26+00:00

Pablo Neira Ayuso says: ==================== The following patchset contains two bugfixes for netfilter/ipset via Jozsef Kadlecsik, they are: * Fix timeout corruption if sets are resized, by Josh Hunt. * Fix bogus error report if the flag nomatch is set, from Jozsef. ==================== Signed-off-by: David S. Miller

netfilter: ipset: timeout values corrupted on set resize

2013-02-21T16:34:47+00:00

If a resize is triggered on a set with timeouts enabled, the timeout values will get corrupted when copying them to the new set. This occured b/c the wrong timeout value is supplied to type_pf_elem_tadd(). This also adds simple debug statement similar to the one in type_pf_resize(). Signed-off-by: Josh Hunt Signed-off-by: Jozsef Kadlecsik

netfilter: nfnetlink: add mutex per subsystem

2013-02-05T03:07:35+00:00

This patch replaces the global lock to one lock per subsystem. The per-subsystem lock avoids that processes operating with different subsystems are synchronized. Signed-off-by: Pablo Neira Ayuso

netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones

2013-01-17T20:12:44+00:00

Most SIP devices use a source port of 5060/udp on SIP requests, so the response automatically comes back to port 5060: phone_ip:5060 -> proxy_ip:5060 REGISTER proxy_ip:5060 -> phone_ip:5060 100 Trying The newer Cisco IP phones, however, use a randomly chosen high source port for the SIP request but expect the response on port 5060: phone_ip:49173 -> proxy_ip:5060 REGISTER proxy_ip:5060 -> phone_ip:5060 100 Trying Standard Linux NAT, with or without nf_nat_sip, will send the reply back to port 49173, not 5060: phone_ip:49173 -> proxy_ip:5060 REGISTER proxy_ip:5060 -> phone_ip:49173 100 Trying But the phone is not listening on 49173, so it will never see the reply. This patch modifies nf_*_sip to work around this quirk by extracting the SIP response port from the Via: header, iff the source IP in the packet header matches the source IP in the SIP request. Signed-off-by: Kevin Cernekee Acked-by: Eric Dumazet Cc: Patrick McHardy Signed-off-by: Pablo Neira Ayuso

UAPI: Remove empty non-UAPI Kbuild files

2012-10-17T11:31:15+00:00

Remove non-UAPI Kbuild files that have become empty as a result of UAPI disintegration. They used to have only header-y lines in them and those have now moved to the Kbuild files in the corresponding uapi/ directories. Possibly these should not be removed but rather have a comment inserted to say they are intentionally left blank. This would make it easier to add generated header lines in future without having to restore the infrastructure. Note that at this point not all the UAPI disintegration parts have been merged, so it is likely that more empty Kbuild files will turn up. It is probably necessary to make the files non-empty to prevent the patch program from automatically deleting them when it reduces them to nothing. Signed-off-by: David Howells

UAPI: (Scripted) Disintegrate include/linux/netfilter/ipset

2012-10-09T08:48:55+00:00

Signed-off-by: David Howells Acked-by: Arnd Bergmann Acked-by: Thomas Gleixner Acked-by: Michael Kerrisk Acked-by: Paul E. McKenney Acked-by: Dave Jones

UAPI: (Scripted) Disintegrate include/linux/netfilter

2012-10-09T08:48:54+00:00

Signed-off-by: David Howells Acked-by: Arnd Bergmann Acked-by: Thomas Gleixner Acked-by: Michael Kerrisk Acked-by: Paul E. McKenney Acked-by: Dave Jones

Merge tag 'uapi-prep-20121002' of git://git.infradead.org/users/dhowells/linux-headers

2012-10-03T20:45:43+00:00

Pull preparatory patches for user API disintegration from David Howells: "The patches herein prepare for the extraction of the Userspace API bits from the various header files named in the Kbuild files. New subdirectories are created under either include/uapi/ or arch/x/include/uapi/ that correspond to the subdirectory containing that file under include/ or arch/x/include/. The new subdirs under the uapi/ directory are populated with Kbuild files that mostly do nothing at this time. Further patches will disintegrate the headers in each original directory and fill in the Kbuild files as they do it. These patches also: (1) fix up #inclusions of "foo.h" rather than . (2) Remove some redundant #includes from the DRM code. (3) Make the kernel build infrastructure handle Kbuild files both in the old places and the new UAPI place that both specify headers to be exported. (4) Fix some kernel tools that #include kernel headers during their build. I have compile tested this with allyesconfig against x86_64, allmodconfig against i386 and a scattering of additional defconfigs of other arches. Prepared for main script Signed-off-by: David Howells Acked-by: Arnd Bergmann Acked-by: Thomas Gleixner Acked-by: Michael Kerrisk Acked-by: Paul E. McKenney Acked-by: Dave Jones Acked-by: H. Peter Anvin " * tag 'uapi-prep-20121002' of git://git.infradead.org/users/dhowells/linux-headers: UAPI: Plumb the UAPI Kbuilds into the user header installation and checking UAPI: x86: Differentiate the generated UAPI and internal headers UAPI: Remove the objhdr-y export list UAPI: Move linux/version.h UAPI: Set up uapi/asm/Kbuild.asm UAPI: x86: Fix insn_sanity build failure after UAPI split UAPI: x86: Fix the test_get_len tool UAPI: (Scripted) Set up UAPI Kbuild files UAPI: Partition the header include path sets and add uapi/ header directories UAPI: (Scripted) Convert #include "..." to #include in kernel system headers UAPI: (Scripted) Convert #include "..." to #include in drivers/gpu/ UAPI: (Scripted) Remove redundant DRM UAPI header #inclusions from drivers/gpu/. UAPI: Refer to the DRM UAPI headers with <...> and from certain headers only

UAPI: (Scripted) Convert #include "..." to #include in kernel system headers

2012-10-02T17:01:25+00:00

Convert #include "..." to #include in kernel system headers. Signed-off-by: David Howells Acked-by: Arnd Bergmann Acked-by: Thomas Gleixner Acked-by: Paul E. McKenney Acked-by: Dave Jones