diff options
author | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-02-12 23:34:17 (GMT) |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-02-12 23:34:17 (GMT) |
commit | 89697f1d715e20fff0361cca79efd5a371623af7 (patch) | |
tree | d64d279f6805fd3d5fb53f059cbe7ea1ae348592 /net/ipv6 | |
parent | fd19e44f449f7e2e58d42d7bb6813e2292c38fba (diff) | |
parent | 13fcfbb0675bf87da694f55dec11cada489a205c (diff) | |
download | linux-fsl-qoriq-89697f1d715e20fff0361cca79efd5a371623af7.tar.xz |
Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (25 commits)
[XFRM]: Fix OOPSes in xfrm_audit_log().
[TCP]: cleanup of htcp (resend)
[TCP]: Use read mostly for CUBIC parameters.
[NETFILTER]: nf_conntrack_tcp: make sysctl variables static
[NETFILTER]: ip6t_mh: drop piggyback payload packet on MH packets
[NETFILTER]: Fix whitespace errors
[NETFILTER]: Kconfig: improve dependency handling
[NETFILTER]: xt_mac/xt_CLASSIFY: use IPv6 hook names for IPv6 registration
[NETFILTER]: nf_conntrack: change nf_conntrack_l[34]proto_unregister to void
[NETFILTER]: nf_conntrack: properly use RCU for nf_conntrack_destroyed callback
[NETFILTER]: ip_conntrack: properly use RCU for ip_conntrack_destroyed callback
[NETFILTER]: nf_conntrack: fix invalid conntrack statistics RCU assumption
[NETFILTER]: ip_conntrack: fix invalid conntrack statistics RCU assumption
[NETFILTER]: nf_conntrack: properly use RCU API for nf_ct_protos/nf_ct_l3protos arrays
[NETFILTER]: ip_conntrack: properly use RCU API for ip_ct_protos array
[NETFILTER]: nf_nat: properly use RCU API for nf_nat_protos array
[NETFILTER]: ip_nat: properly use RCU API for ip_nat_protos array
[NETFILTER]: nf_log: minor cleanups
[NETFILTER]: nf_log: switch logger registration/unregistration to mutex
[NETFILTER]: nf_log: make nf_log_unregister_pf return void
...
Diffstat (limited to 'net/ipv6')
-rw-r--r-- | net/ipv6/netfilter/Kconfig | 3 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6t_LOG.c | 2 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6t_mh.c | 7 | ||||
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 4 | ||||
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 1 |
5 files changed, 13 insertions, 4 deletions
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig index cd549ae..da07e9a 100644 --- a/net/ipv6/netfilter/Kconfig +++ b/net/ipv6/netfilter/Kconfig @@ -42,7 +42,8 @@ config IP6_NF_QUEUE config IP6_NF_IPTABLES tristate "IP6 tables support (required for filtering)" - depends on INET && IPV6 && EXPERIMENTAL && NETFILTER_XTABLES + depends on INET && IPV6 && EXPERIMENTAL + select NETFILTER_XTABLES help ip6tables is a general, extensible packet identification framework. Currently only the packet filtering and packet mangling subsystem diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c index dc9ec93..afaa039 100644 --- a/net/ipv6/netfilter/ip6t_LOG.c +++ b/net/ipv6/netfilter/ip6t_LOG.c @@ -501,7 +501,7 @@ static int __init ip6t_log_init(void) static void __exit ip6t_log_fini(void) { - nf_log_unregister_logger(&ip6t_logger); + nf_log_unregister(&ip6t_logger); xt_unregister_target(&ip6t_log_reg); } diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c index 2c7efc6..c2a9098 100644 --- a/net/ipv6/netfilter/ip6t_mh.c +++ b/net/ipv6/netfilter/ip6t_mh.c @@ -66,6 +66,13 @@ match(const struct sk_buff *skb, return 0; } + if (mh->ip6mh_proto != IPPROTO_NONE) { + duprintf("Dropping invalid MH Payload Proto: %u\n", + mh->ip6mh_proto); + *hotdrop = 1; + return 0; + } + return type_match(mhinfo->types[0], mhinfo->types[1], mh->ip6mh_type, !!(mhinfo->invflags & IP6T_MH_INV_TYPE)); } diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c index a2353ed..4b7be4b 100644 --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c @@ -154,8 +154,8 @@ ipv6_prepare(struct sk_buff **pskb, unsigned int hooknum, unsigned int *dataoff, */ if ((protoff < 0) || (protoff > (*pskb)->len)) { DEBUGP("ip6_conntrack_core: can't find proto in pkt\n"); - NF_CT_STAT_INC(error); - NF_CT_STAT_INC(invalid); + NF_CT_STAT_INC_ATOMIC(error); + NF_CT_STAT_INC_ATOMIC(invalid); return -NF_ACCEPT; } diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c index b08622c..19bdb7c 100644 --- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c @@ -182,6 +182,7 @@ icmpv6_error_message(struct sk_buff *skb, return -NF_ACCEPT; } + /* rcu_read_lock()ed by nf_hook_slow */ inproto = __nf_ct_l4proto_find(PF_INET6, inprotonum); /* Are they talking about one of our connections? */ |