From: Greg Kroah-Hartman Date: Fri, 7 Nov 2008 22:44:10 +0000 (-0800) Subject: more .26 patches X-Git-Tag: v2.6.25.20~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2c8b2d6ca375441d1230f27ea2f827d9c959f9cc;p=thirdparty%2Fkernel%2Fstable-queue.git more .26 patches --- diff --git a/queue-2.6.26/netfilter-restore-lost-ifdef-guarding-defrag-exception.patch b/queue-2.6.26/netfilter-restore-lost-ifdef-guarding-defrag-exception.patch new file mode 100644 index 00000000000..91839dda6d7 --- /dev/null +++ b/queue-2.6.26/netfilter-restore-lost-ifdef-guarding-defrag-exception.patch @@ -0,0 +1,48 @@ +From kaber@trash.net Thu Oct 23 13:16:48 2008 +From: Patrick McHardy +Date: Wed, 22 Oct 2008 19:41:31 +0200 (MEST) +Subject: netfilter: restore lost ifdef guarding defrag exception +To: stable@kernel.org +Cc: netfilter-devel@vger.kernel.org, Patrick McHardy , davem@davemloft.net +Message-ID: <20081022174130.21341.48347.sendpatchset@x2.localnet> + +From: Patrick McHardy + +netfilter: restore lost #ifdef guarding defrag exception + +Upstream commit 38f7ac3eb: + +Nir Tzachar reported a warning when sending +fragments over loopback with NAT: + +[ 6658.338121] WARNING: at net/ipv4/netfilter/nf_nat_standalone.c:89 nf_nat_fn+0x33/0x155() + +The reason is that defragmentation is skipped for already tracked connections. +This is wrong in combination with NAT and ip_conntrack actually had some ifdefs +to avoid this behaviour when NAT is compiled in. + +The entire "optimization" may seem a bit silly, for now simply restoring the +lost #ifdef is the easiest solution until we can come up with something better. + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c ++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +@@ -150,10 +150,12 @@ static unsigned int ipv4_conntrack_defra + const struct net_device *out, + int (*okfn)(struct sk_buff *)) + { ++#if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE) + /* Previously seen (loopback)? Ignore. Do this before + fragment check. */ + if (skb->nfct) + return NF_ACCEPT; ++#endif + + /* Gather fragments. */ + if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { diff --git a/queue-2.6.26/netfilter-snmp-nat-leaks-memory-in-case-of-failure.patch b/queue-2.6.26/netfilter-snmp-nat-leaks-memory-in-case-of-failure.patch new file mode 100644 index 00000000000..615be252c53 --- /dev/null +++ b/queue-2.6.26/netfilter-snmp-nat-leaks-memory-in-case-of-failure.patch @@ -0,0 +1,31 @@ +From kaber@trash.net Thu Oct 23 13:16:08 2008 +From: Ilpo Järvinen +Date: Wed, 22 Oct 2008 19:41:29 +0200 (MEST) +Subject: netfilter: snmp nat leaks memory in case of failure +To: stable@kernel.org +Cc: netfilter-devel@vger.kernel.org, Patrick McHardy , davem@davemloft.net +Message-ID: <20081022174129.21341.93881.sendpatchset@x2.localnet> + +From: Ilpo Järvinen + +netfilter: snmp nat leaks memory in case of failure + +Upstream commit 311670f3e: + +Signed-off-by: Ilpo Jarvinen +Signed-off-by: Patrick McHardy + +--- + net/ipv4/netfilter/nf_nat_snmp_basic.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c ++++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c +@@ -742,6 +742,7 @@ static unsigned char snmp_object_decode( + *obj = kmalloc(sizeof(struct snmp_object) + len, + GFP_ATOMIC); + if (*obj == NULL) { ++ kfree(p); + kfree(id); + if (net_ratelimit()) + printk("OOM in bsalg (%d)\n", __LINE__); diff --git a/queue-2.6.26/netfilter-xt_iprange-fix-range-inversion-match.patch b/queue-2.6.26/netfilter-xt_iprange-fix-range-inversion-match.patch new file mode 100644 index 00000000000..e8999a578da --- /dev/null +++ b/queue-2.6.26/netfilter-xt_iprange-fix-range-inversion-match.patch @@ -0,0 +1,63 @@ +From kaber@trash.net Thu Oct 23 13:14:58 2008 +From: Alexey Dobriyan +Date: Wed, 22 Oct 2008 19:41:28 +0200 (MEST) +Subject: netfilter: xt_iprange: fix range inversion match +To: stable@kernel.org +Cc: netfilter-devel@vger.kernel.org, Patrick McHardy , davem@davemloft.net +Message-ID: <20081022174128.21341.79877.sendpatchset@x2.localnet> + + +From: Alexey Dobriyan + +netfilter: xt_iprange: fix range inversion match + +Upstream commit 6def1eb48: + +Inverted IPv4 v1 and IPv6 v0 matches don't match anything since 2.6.25-rc1! + +Signed-off-by: Alexey Dobriyan +Acked-by: Jan Engelhardt +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/xt_iprange.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/netfilter/xt_iprange.c ++++ b/net/netfilter/xt_iprange.c +@@ -67,7 +67,7 @@ iprange_mt4(const struct sk_buff *skb, c + if (info->flags & IPRANGE_SRC) { + m = ntohl(iph->saddr) < ntohl(info->src_min.ip); + m |= ntohl(iph->saddr) > ntohl(info->src_max.ip); +- m ^= info->flags & IPRANGE_SRC_INV; ++ m ^= !!(info->flags & IPRANGE_SRC_INV); + if (m) { + pr_debug("src IP " NIPQUAD_FMT " NOT in range %s" + NIPQUAD_FMT "-" NIPQUAD_FMT "\n", +@@ -81,7 +81,7 @@ iprange_mt4(const struct sk_buff *skb, c + if (info->flags & IPRANGE_DST) { + m = ntohl(iph->daddr) < ntohl(info->dst_min.ip); + m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip); +- m ^= info->flags & IPRANGE_DST_INV; ++ m ^= !!(info->flags & IPRANGE_DST_INV); + if (m) { + pr_debug("dst IP " NIPQUAD_FMT " NOT in range %s" + NIPQUAD_FMT "-" NIPQUAD_FMT "\n", +@@ -123,14 +123,14 @@ iprange_mt6(const struct sk_buff *skb, c + if (info->flags & IPRANGE_SRC) { + m = iprange_ipv6_sub(&iph->saddr, &info->src_min.in6) < 0; + m |= iprange_ipv6_sub(&iph->saddr, &info->src_max.in6) > 0; +- m ^= info->flags & IPRANGE_SRC_INV; ++ m ^= !!(info->flags & IPRANGE_SRC_INV); + if (m) + return false; + } + if (info->flags & IPRANGE_DST) { + m = iprange_ipv6_sub(&iph->daddr, &info->dst_min.in6) < 0; + m |= iprange_ipv6_sub(&iph->daddr, &info->dst_max.in6) > 0; +- m ^= info->flags & IPRANGE_DST_INV; ++ m ^= !!(info->flags & IPRANGE_DST_INV); + if (m) + return false; + } diff --git a/queue-2.6.26/series b/queue-2.6.26/series index 034eab96320..63de353c5c1 100644 --- a/queue-2.6.26/series +++ b/queue-2.6.26/series @@ -18,3 +18,6 @@ scx200_i2c-add-missing-class-parameter.patch 0002-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch acpi-video-fix-brightness-allocation.patch acpi-dock-avoid-check-_sta-method.patch +netfilter-xt_iprange-fix-range-inversion-match.patch +netfilter-snmp-nat-leaks-memory-in-case-of-failure.patch +netfilter-restore-lost-ifdef-guarding-defrag-exception.patch