Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/gi…

…t/pablo/nf-next

Pablo Neira Ayuso says:

====================
The following patchset contains a small batch of Netfilter
updates for your net-next tree, they are:

* Three patches that provide more accurate error reporting to
  user-space, instead of -EPERM, in IPv4/IPv6 netfilter re-routing
  code and NAT, from Patrick McHardy.

* Update copyright statements in Netfilter filters of
  Patrick McHardy, from himself.

* Add Kconfig dependency on the raw/mangle tables to the
  rpfilter, from Florian Westphal.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information...
commit 95a06161e6b903ad5b96285cb57c8df3b7c8ad34 2 parents bb5b052 + d37d696
davem330 authored April 19, 2013

Showing 47 changed files with 122 additions and 40 deletions. Show diff stats Hide diff stats

  1. 15  net/ipv4/netfilter.c
  2. 2  net/ipv4/netfilter/Kconfig
  3. 1  net/ipv4/netfilter/arp_tables.c
  4. 1  net/ipv4/netfilter/ip_tables.c
  5. 1  net/ipv4/netfilter/ipt_ULOG.c
  6. 9  net/ipv4/netfilter/iptable_mangle.c
  7. 23  net/ipv4/netfilter/iptable_nat.c
  8. 1  net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
  9. 1  net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
  10. 1  net/ipv4/netfilter/nf_conntrack_proto_icmp.c
  11. 1  net/ipv4/netfilter/nf_nat_h323.c
  12. 2  net/ipv4/netfilter/nf_nat_pptp.c
  13. 2  net/ipv4/netfilter/nf_nat_proto_gre.c
  14. 2  net/ipv4/netfilter/nf_nat_snmp_basic.c
  15. 12  net/ipv6/netfilter.c
  16. 2  net/ipv6/netfilter/Kconfig
  17. 1  net/ipv6/netfilter/ip6_tables.c
  18. 2  net/ipv6/netfilter/ip6t_REJECT.c
  19. 9  net/ipv6/netfilter/ip6table_mangle.c
  20. 23  net/ipv6/netfilter/ip6table_nat.c
  21. 1  net/netfilter/core.c
  22. 1  net/netfilter/nf_conntrack_amanda.c
  23. 1  net/netfilter/nf_conntrack_core.c
  24. 8  net/netfilter/nf_conntrack_ecache.c
  25. 1  net/netfilter/nf_conntrack_expect.c
  26. 1  net/netfilter/nf_conntrack_ftp.c
  27. 1  net/netfilter/nf_conntrack_h323_main.c
  28. 1  net/netfilter/nf_conntrack_helper.c
  29. 1  net/netfilter/nf_conntrack_irc.c
  30. 2  net/netfilter/nf_conntrack_pptp.c
  31. 1  net/netfilter/nf_conntrack_proto.c
  32. 1  net/netfilter/nf_conntrack_proto_gre.c
  33. 3  net/netfilter/nf_conntrack_proto_sctp.c
  34. 2  net/netfilter/nf_conntrack_proto_tcp.c
  35. 1  net/netfilter/nf_conntrack_proto_udp.c
  36. 1  net/netfilter/nf_conntrack_standalone.c
  37. 2  net/netfilter/nf_conntrack_tftp.c
  38. 1  net/netfilter/nf_nat_amanda.c
  39. 9  net/netfilter/nf_nat_core.c
  40. 1  net/netfilter/nf_nat_helper.c
  41. 5  net/netfilter/nf_queue.c
  42. 1  net/netfilter/nfnetlink_log.c
  43. 1  net/netfilter/x_tables.c
  44. 1  net/netfilter/xt_TCPMSS.c
  45. 1  net/netfilter/xt_conntrack.c
  46. 1  net/netfilter/xt_hashlimit.c
  47. 1  net/netfilter/xt_limit.c
15  net/ipv4/netfilter.c
... ...
@@ -1,4 +1,9 @@
1  
-/* IPv4 specific functions of netfilter core */
  1
+/*
  2
+ * IPv4 specific functions of netfilter core
  3
+ *
  4
+ * Rusty Russell (C) 2000 -- This code is GPL.
  5
+ * Patrick McHardy (C) 2006-2012
  6
+ */
2 7
 #include <linux/kernel.h>
3 8
 #include <linux/netfilter.h>
4 9
 #include <linux/netfilter_ipv4.h>
@@ -40,14 +45,14 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned int addr_type)
40 45
 	fl4.flowi4_flags = flags;
41 46
 	rt = ip_route_output_key(net, &fl4);
42 47
 	if (IS_ERR(rt))
43  
-		return -1;
  48
+		return PTR_ERR(rt);
44 49
 
45 50
 	/* Drop old route. */
46 51
 	skb_dst_drop(skb);
47 52
 	skb_dst_set(skb, &rt->dst);
48 53
 
49 54
 	if (skb_dst(skb)->error)
50  
-		return -1;
  55
+		return skb_dst(skb)->error;
51 56
 
52 57
 #ifdef CONFIG_XFRM
53 58
 	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
@@ -56,7 +61,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned int addr_type)
56 61
 		skb_dst_set(skb, NULL);
57 62
 		dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), skb->sk, 0);
58 63
 		if (IS_ERR(dst))
59  
-			return -1;
  64
+			return PTR_ERR(dst);;
60 65
 		skb_dst_set(skb, dst);
61 66
 	}
62 67
 #endif
@@ -66,7 +71,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned int addr_type)
66 71
 	if (skb_headroom(skb) < hh_len &&
67 72
 	    pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
68 73
 				0, GFP_ATOMIC))
69  
-		return -1;
  74
+		return -ENOMEM;
70 75
 
71 76
 	return 0;
72 77
 }
2  net/ipv4/netfilter/Kconfig
@@ -71,7 +71,7 @@ config IP_NF_MATCH_ECN
71 71
 
72 72
 config IP_NF_MATCH_RPFILTER
73 73
 	tristate '"rpfilter" reverse path filter match support'
74  
-	depends on NETFILTER_ADVANCED
  74
+	depends on NETFILTER_ADVANCED && (IP_NF_MANGLE || IP_NF_RAW)
75 75
 	---help---
76 76
 	  This option allows you to match packets whose replies would
77 77
 	  go out via the interface the packet came in.
1  net/ipv4/netfilter/arp_tables.c
@@ -6,6 +6,7 @@
6 6
  * Some ARP specific bits are:
7 7
  *
8 8
  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
  9
+ * Copyright (C) 2006-2009 Patrick McHardy <kaber@trash.net>
9 10
  *
10 11
  */
11 12
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
1  net/ipv4/netfilter/ip_tables.c
@@ -3,6 +3,7 @@
3 3
  *
4 4
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 5
  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
  6
+ * Copyright (C) 2006-2010 Patrick McHardy <kaber@trash.net>
6 7
  *
7 8
  * This program is free software; you can redistribute it and/or modify
8 9
  * it under the terms of the GNU General Public License version 2 as
1  net/ipv4/netfilter/ipt_ULOG.c
@@ -4,6 +4,7 @@
4 4
  * (C) 2000-2004 by Harald Welte <laforge@netfilter.org>
5 5
  * (C) 1999-2001 Paul `Rusty' Russell
6 6
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  7
+ * (C) 2005-2007 Patrick McHardy <kaber@trash.net>
7 8
  *
8 9
  * This program is free software; you can redistribute it and/or modify
9 10
  * it under the terms of the GNU General Public License version 2 as
9  net/ipv4/netfilter/iptable_mangle.c
@@ -44,6 +44,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct net_device *out)
44 44
 	u_int8_t tos;
45 45
 	__be32 saddr, daddr;
46 46
 	u_int32_t mark;
  47
+	int err;
47 48
 
48 49
 	/* root is playing with raw sockets. */
49 50
 	if (skb->len < sizeof(struct iphdr) ||
@@ -66,9 +67,11 @@ ipt_mangle_out(struct sk_buff *skb, const struct net_device *out)
66 67
 		if (iph->saddr != saddr ||
67 68
 		    iph->daddr != daddr ||
68 69
 		    skb->mark != mark ||
69  
-		    iph->tos != tos)
70  
-			if (ip_route_me_harder(skb, RTN_UNSPEC))
71  
-				ret = NF_DROP;
  70
+		    iph->tos != tos) {
  71
+			err = ip_route_me_harder(skb, RTN_UNSPEC);
  72
+			if (err < 0)
  73
+				ret = NF_DROP_ERR(err);
  74
+		}
72 75
 	}
73 76
 
74 77
 	return ret;
23  net/ipv4/netfilter/iptable_nat.c
@@ -176,6 +176,7 @@ nf_nat_ipv4_out(unsigned int hooknum,
176 176
 #ifdef CONFIG_XFRM
177 177
 	const struct nf_conn *ct;
178 178
 	enum ip_conntrack_info ctinfo;
  179
+	int err;
179 180
 #endif
180 181
 	unsigned int ret;
181 182
 
@@ -195,9 +196,11 @@ nf_nat_ipv4_out(unsigned int hooknum,
195 196
 		     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
196 197
 		    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
197 198
 		     ct->tuplehash[dir].tuple.src.u.all !=
198  
-		     ct->tuplehash[!dir].tuple.dst.u.all))
199  
-			if (nf_xfrm_me_harder(skb, AF_INET) < 0)
200  
-				ret = NF_DROP;
  199
+		     ct->tuplehash[!dir].tuple.dst.u.all)) {
  200
+			err = nf_xfrm_me_harder(skb, AF_INET);
  201
+			if (err < 0)
  202
+				ret = NF_DROP_ERR(err);
  203
+		}
201 204
 	}
202 205
 #endif
203 206
 	return ret;
@@ -213,6 +216,7 @@ nf_nat_ipv4_local_fn(unsigned int hooknum,
213 216
 	const struct nf_conn *ct;
214 217
 	enum ip_conntrack_info ctinfo;
215 218
 	unsigned int ret;
  219
+	int err;
216 220
 
217 221
 	/* root is playing with raw sockets. */
218 222
 	if (skb->len < sizeof(struct iphdr) ||
@@ -226,16 +230,19 @@ nf_nat_ipv4_local_fn(unsigned int hooknum,
226 230
 
227 231
 		if (ct->tuplehash[dir].tuple.dst.u3.ip !=
228 232
 		    ct->tuplehash[!dir].tuple.src.u3.ip) {
229  
-			if (ip_route_me_harder(skb, RTN_UNSPEC))
230  
-				ret = NF_DROP;
  233
+			err = ip_route_me_harder(skb, RTN_UNSPEC);
  234
+			if (err < 0)
  235
+				ret = NF_DROP_ERR(err);
231 236
 		}
232 237
 #ifdef CONFIG_XFRM
233 238
 		else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
234 239
 			 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
235 240
 			 ct->tuplehash[dir].tuple.dst.u.all !=
236  
-			 ct->tuplehash[!dir].tuple.src.u.all)
237  
-			if (nf_xfrm_me_harder(skb, AF_INET) < 0)
238  
-				ret = NF_DROP;
  241
+			 ct->tuplehash[!dir].tuple.src.u.all) {
  242
+			err = nf_xfrm_me_harder(skb, AF_INET);
  243
+			if (err < 0)
  244
+				ret = NF_DROP_ERR(err);
  245
+		}
239 246
 #endif
240 247
 	}
241 248
 	return ret;
1  net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
... ...
@@ -1,6 +1,7 @@
1 1
 
2 2
 /* (C) 1999-2001 Paul `Rusty' Russell
3 3
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  4
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
4 5
  *
5 6
  * This program is free software; you can redistribute it and/or modify
6 7
  * it under the terms of the GNU General Public License version 2 as
1  net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -2,6 +2,7 @@
2 2
  *
3 3
  * (C) 1999-2001 Paul `Rusty' Russell
4 4
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
  5
+ * (C) 2006-2010 Patrick McHardy <kaber@trash.net>
5 6
  *
6 7
  * This program is free software; you can redistribute it and/or modify
7 8
  * it under the terms of the GNU General Public License version 2 as
1  net/ipv4/netfilter/nf_conntrack_proto_icmp.c
... ...
@@ -1,5 +1,6 @@
1 1
 /* (C) 1999-2001 Paul `Rusty' Russell
2 2
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3
+ * (C) 2006-2010 Patrick McHardy <kaber@trash.net>
3 4
  *
4 5
  * This program is free software; you can redistribute it and/or modify
5 6
  * it under the terms of the GNU General Public License version 2 as
1  net/ipv4/netfilter/nf_nat_h323.c
@@ -2,6 +2,7 @@
2 2
  * H.323 extension for NAT alteration.
3 3
  *
4 4
  * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
  5
+ * Copyright (c) 2006-2012 Patrick McHardy <kaber@trash.net>
5 6
  *
6 7
  * This source code is licensed under General Public License version 2.
7 8
  *
2  net/ipv4/netfilter/nf_nat_pptp.c
@@ -13,6 +13,8 @@
13 13
  *
14 14
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
15 15
  *
  16
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  17
+ *
16 18
  * TODO: - NAT to a unique tuple, not to TCP source port
17 19
  * 	   (needs netfilter tuple reservation)
18 20
  */
2  net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -21,6 +21,8 @@
21 21
  *
22 22
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
23 23
  *
  24
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  25
+ *
24 26
  */
25 27
 
26 28
 #include <linux/module.h>
2  net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -38,6 +38,8 @@
38 38
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
39 39
  *
40 40
  * Author: James Morris <jmorris@intercode.com.au>
  41
+ *
  42
+ * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
41 43
  */
42 44
 #include <linux/module.h>
43 45
 #include <linux/moduleparam.h>
12  net/ipv6/netfilter.c
... ...
@@ -1,3 +1,9 @@
  1
+/*
  2
+ * IPv6 specific functions of netfilter core
  3
+ *
  4
+ * Rusty Russell (C) 2000 -- This code is GPL.
  5
+ * Patrick McHardy (C) 2006-2012
  6
+ */
1 7
 #include <linux/kernel.h>
2 8
 #include <linux/init.h>
3 9
 #include <linux/ipv6.h>
@@ -29,7 +35,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
29 35
 		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
30 36
 		LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
31 37
 		dst_release(dst);
32  
-		return -EINVAL;
  38
+		return dst->error;
33 39
 	}
34 40
 
35 41
 	/* Drop old route. */
@@ -43,7 +49,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
43 49
 		skb_dst_set(skb, NULL);
44 50
 		dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0);
45 51
 		if (IS_ERR(dst))
46  
-			return -1;
  52
+			return PTR_ERR(dst);
47 53
 		skb_dst_set(skb, dst);
48 54
 	}
49 55
 #endif
@@ -53,7 +59,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
53 59
 	if (skb_headroom(skb) < hh_len &&
54 60
 	    pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
55 61
 			     0, GFP_ATOMIC))
56  
-		return -1;
  62
+		return -ENOMEM;
57 63
 
58 64
 	return 0;
59 65
 }
2  net/ipv6/netfilter/Kconfig
@@ -105,7 +105,7 @@ config IP6_NF_MATCH_MH
105 105
 
106 106
 config IP6_NF_MATCH_RPFILTER
107 107
 	tristate '"rpfilter" reverse path filter match support'
108  
-	depends on NETFILTER_ADVANCED
  108
+	depends on NETFILTER_ADVANCED && (IP6_NF_MANGLE || IP6_NF_RAW)
109 109
 	---help---
110 110
 	  This option allows you to match packets whose replies would
111 111
 	  go out via the interface the packet came in.
1  net/ipv6/netfilter/ip6_tables.c
@@ -3,6 +3,7 @@
3 3
  *
4 4
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 5
  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
  6
+ * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
6 7
  *
7 8
  * This program is free software; you can redistribute it and/or modify
8 9
  * it under the terms of the GNU General Public License version 2 as
2  net/ipv6/netfilter/ip6t_REJECT.c
@@ -7,6 +7,8 @@
7 7
  * Authors:
8 8
  *	Yasuyuki Kozakai	<yasuyuki.kozakai@toshiba.co.jp>
9 9
  *
  10
+ * Copyright (c) 2005-2007 Patrick McHardy <kaber@trash.net>
  11
+ *
10 12
  * Based on net/ipv4/netfilter/ipt_REJECT.c
11 13
  *
12 14
  * This program is free software; you can redistribute it and/or
9  net/ipv6/netfilter/ip6table_mangle.c
@@ -38,7 +38,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
38 38
 	struct in6_addr saddr, daddr;
39 39
 	u_int8_t hop_limit;
40 40
 	u_int32_t flowlabel, mark;
41  
-
  41
+	int err;
42 42
 #if 0
43 43
 	/* root is playing with raw sockets. */
44 44
 	if (skb->len < sizeof(struct iphdr) ||
@@ -65,8 +65,11 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
65 65
 	     !ipv6_addr_equal(&ipv6_hdr(skb)->daddr, &daddr) ||
66 66
 	     skb->mark != mark ||
67 67
 	     ipv6_hdr(skb)->hop_limit != hop_limit ||
68  
-	     flowlabel != *((u_int32_t *)ipv6_hdr(skb))))
69  
-		return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
  68
+	     flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) {
  69
+		err = ip6_route_me_harder(skb);
  70
+		if (err < 0)
  71
+			ret = NF_DROP_ERR(err);
  72
+	}
70 73
 
71 74
 	return ret;
72 75
 }
23  net/ipv6/netfilter/ip6table_nat.c
@@ -179,6 +179,7 @@ nf_nat_ipv6_out(unsigned int hooknum,
179 179
 #ifdef CONFIG_XFRM
180 180
 	const struct nf_conn *ct;
181 181
 	enum ip_conntrack_info ctinfo;
  182
+	int err;
182 183
 #endif
183 184
 	unsigned int ret;
184 185
 
@@ -197,9 +198,11 @@ nf_nat_ipv6_out(unsigned int hooknum,
197 198
 				      &ct->tuplehash[!dir].tuple.dst.u3) ||
198 199
 		    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
199 200
 		     ct->tuplehash[dir].tuple.src.u.all !=
200  
-		     ct->tuplehash[!dir].tuple.dst.u.all))
201  
-			if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
202  
-				ret = NF_DROP;
  201
+		     ct->tuplehash[!dir].tuple.dst.u.all)) {
  202
+			err = nf_xfrm_me_harder(skb, AF_INET6);
  203
+			if (err < 0)
  204
+				ret = NF_DROP_ERR(err);
  205
+		}
203 206
 	}
204 207
 #endif
205 208
 	return ret;
@@ -215,6 +218,7 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
215 218
 	const struct nf_conn *ct;
216 219
 	enum ip_conntrack_info ctinfo;
217 220
 	unsigned int ret;
  221
+	int err;
218 222
 
219 223
 	/* root is playing with raw sockets. */
220 224
 	if (skb->len < sizeof(struct ipv6hdr))
@@ -227,16 +231,19 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
227 231
 
228 232
 		if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
229 233
 				      &ct->tuplehash[!dir].tuple.src.u3)) {
230  
-			if (ip6_route_me_harder(skb))
231  
-				ret = NF_DROP;
  234
+			err = ip6_route_me_harder(skb);
  235
+			if (err < 0)
  236
+				ret = NF_DROP_ERR(err);
232 237
 		}
233 238
 #ifdef CONFIG_XFRM
234 239
 		else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
235 240
 			 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
236 241
 			 ct->tuplehash[dir].tuple.dst.u.all !=
237  
-			 ct->tuplehash[!dir].tuple.src.u.all)
238  
-			if (nf_xfrm_me_harder(skb, AF_INET6))
239  
-				ret = NF_DROP;
  242
+			 ct->tuplehash[!dir].tuple.src.u.all) {
  243
+			err = nf_xfrm_me_harder(skb, AF_INET6);
  244
+			if (err < 0)
  245
+				ret = NF_DROP_ERR(err);
  246
+		}
240 247
 #endif
241 248
 	}
242 249
 	return ret;
1  net/netfilter/core.c
@@ -5,6 +5,7 @@
5 5
  * way.
6 6
  *
7 7
  * Rusty Russell (C)2000 -- This code is GPL.
  8
+ * Patrick McHardy (c) 2006-2012
8 9
  */
9 10
 #include <linux/kernel.h>
10 11
 #include <linux/netfilter.h>
1  net/netfilter/nf_conntrack_amanda.c
@@ -2,6 +2,7 @@
2 2
  *
3 3
  * (C) 2002 by Brian J. Murrell <netfilter@interlinx.bc.ca>
4 4
  * based on HW's ip_conntrack_irc.c as well as other modules
  5
+ * (C) 2006 Patrick McHardy <kaber@trash.net>
5 6
  *
6 7
  * This program is free software; you can redistribute it and/or
7 8
  * modify it under the terms of the GNU General Public License
1  net/netfilter/nf_conntrack_core.c
@@ -5,6 +5,7 @@
5 5
 /* (C) 1999-2001 Paul `Rusty' Russell
6 6
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
7 7
  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  8
+ * (C) 2005-2012 Patrick McHardy <kaber@trash.net>
8 9
  *
9 10
  * This program is free software; you can redistribute it and/or modify
10 11
  * it under the terms of the GNU General Public License version 2 as
8  net/netfilter/nf_conntrack_ecache.c
... ...
@@ -1,8 +1,10 @@
1 1
 /* Event cache for netfilter. */
2 2
 
3  
-/* (C) 1999-2001 Paul `Rusty' Russell
4  
- * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
5  
- * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  3
+/*
  4
+ * (C) 2005 Harald Welte <laforge@gnumonks.org>
  5
+ * (C) 2005 Patrick McHardy <kaber@trash.net>
  6
+ * (C) 2005-2006 Netfilter Core Team <coreteam@netfilter.org>
  7
+ * (C) 2005 USAGI/WIDE Project <http://www.linux-ipv6.org>
6 8
  *
7 9
  * This program is free software; you can redistribute it and/or modify
8 10
  * it under the terms of the GNU General Public License version 2 as
1  net/netfilter/nf_conntrack_expect.c
@@ -3,6 +3,7 @@
3 3
 /* (C) 1999-2001 Paul `Rusty' Russell
4 4
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
5 5
  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  6
+ * (c) 2005-2012 Patrick McHardy <kaber@trash.net>
6 7
  *
7 8
  * This program is free software; you can redistribute it and/or modify
8 9
  * it under the terms of the GNU General Public License version 2 as
1  net/netfilter/nf_conntrack_ftp.c
@@ -3,6 +3,7 @@
3 3
 /* (C) 1999-2001 Paul `Rusty' Russell
4 4
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
5 5
  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  6
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
6 7
  *
7 8
  * This program is free software; you can redistribute it and/or modify
8 9
  * it under the terms of the GNU General Public License version 2 as
1  net/netfilter/nf_conntrack_h323_main.c
@@ -2,6 +2,7 @@
2 2
  * H.323 connection tracking helper
3 3
  *
4 4
  * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
  5
+ * Copyright (c) 2006-2012 Patrick McHardy <kaber@trash.net>
5 6
  *
6 7
  * This source code is licensed under General Public License version 2.
7 8
  *
1  net/netfilter/nf_conntrack_helper.c
@@ -3,6 +3,7 @@
3 3
 /* (C) 1999-2001 Paul `Rusty' Russell
4 4
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
5 5
  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  6
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
6 7
  *
7 8
  * This program is free software; you can redistribute it and/or modify
8 9
  * it under the terms of the GNU General Public License version 2 as
1  net/netfilter/nf_conntrack_irc.c
... ...
@@ -1,6 +1,7 @@
1 1
 /* IRC extension for IP connection tracking, Version 1.21
2 2
  * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
3 3
  * based on RR's ip_conntrack_ftp.c
  4
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
4 5
  *
5 6
  * This program is free software; you can redistribute it and/or
6 7
  * modify it under the terms of the GNU General Public License
2  net/netfilter/nf_conntrack_pptp.c
@@ -11,6 +11,8 @@
11 11
  *
12 12
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
13 13
  *
  14
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  15
+ *
14 16
  * Limitations:
15 17
  * 	 - We blindly assume that control connections are always
16 18
  * 	   established in PNS->PAC direction.  This is a violation
1  net/netfilter/nf_conntrack_proto.c
@@ -3,6 +3,7 @@
3 3
 /* (C) 1999-2001 Paul `Rusty' Russell
4 4
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
5 5
  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  6
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
6 7
  *
7 8
  * This program is free software; you can redistribute it and/or modify
8 9
  * it under the terms of the GNU General Public License version 2 as
1  net/netfilter/nf_conntrack_proto_gre.c
@@ -21,6 +21,7 @@
21 21
  *
22 22
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
23 23
  *
  24
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
24 25
  */
25 26
 
26 27
 #include <linux/module.h>
3  net/netfilter/nf_conntrack_proto_sctp.c
... ...
@@ -1,6 +1,9 @@
1 1
 /*
2 2
  * Connection tracking protocol helper module for SCTP.
3 3
  *
  4
+ * Copyright (c) 2004 Kiran Kumar Immidi <immidi_kiran@yahoo.com>
  5
+ * Copyright (c) 2004-2012 Patrick McHardy <kaber@trash.net>
  6
+ *
4 7
  * SCTP is defined in RFC 2960. References to various sections in this code
5 8
  * are to this RFC.
6 9
  *
2  net/netfilter/nf_conntrack_proto_tcp.c
... ...
@@ -1,5 +1,7 @@
1 1
 /* (C) 1999-2001 Paul `Rusty' Russell
2 2
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3
+ * (C) 2002-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  4
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
3 5
  *
4 6
  * This program is free software; you can redistribute it and/or modify
5 7
  * it under the terms of the GNU General Public License version 2 as
1  net/netfilter/nf_conntrack_proto_udp.c
... ...
@@ -1,5 +1,6 @@
1 1
 /* (C) 1999-2001 Paul `Rusty' Russell
2 2
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
3 4
  *
4 5
  * This program is free software; you can redistribute it and/or modify
5 6
  * it under the terms of the GNU General Public License version 2 as
1  net/netfilter/nf_conntrack_standalone.c
... ...
@@ -1,5 +1,6 @@
1 1
 /* (C) 1999-2001 Paul `Rusty' Russell
2 2
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3
+ * (C) 2005-2012 Patrick McHardy <kaber@trash.net>
3 4
  *
4 5
  * This program is free software; you can redistribute it and/or modify
5 6
  * it under the terms of the GNU General Public License version 2 as
2  net/netfilter/nf_conntrack_tftp.c
... ...
@@ -1,5 +1,5 @@
1 1
 /* (C) 2001-2002 Magnus Boden <mb@ozaba.mine.nu>
2  
- *
  2
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
3 3
  * This program is free software; you can redistribute it and/or modify
4 4
  * it under the terms of the GNU General Public License version 2 as
5 5
  * published by the Free Software Foundation.
1  net/netfilter/nf_nat_amanda.c
... ...
@@ -1,6 +1,7 @@
1 1
 /* Amanda extension for TCP NAT alteration.
2 2
  * (C) 2002 by Brian J. Murrell <netfilter@interlinx.bc.ca>
3 3
  * based on a copy of HW's ip_nat_irc.c as well as other modules
  4
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
4 5
  *
5 6
  * This program is free software; you can redistribute it and/or
6 7
  * modify it under the terms of the GNU General Public License
9  net/netfilter/nf_nat_core.c
@@ -87,9 +87,10 @@ int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family)
87 87
 	struct flowi fl;
88 88
 	unsigned int hh_len;
89 89
 	struct dst_entry *dst;
  90
+	int err;
90 91
 
91  
-	if (xfrm_decode_session(skb, &fl, family) < 0)
92  
-		return -1;
  92
+	err = xfrm_decode_session(skb, &fl, family);
  93
+		return err;
93 94
 
94 95
 	dst = skb_dst(skb);
95 96
 	if (dst->xfrm)
@@ -98,7 +99,7 @@ int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family)
98 99
 
99 100
 	dst = xfrm_lookup(dev_net(dst->dev), dst, &fl, skb->sk, 0);
100 101
 	if (IS_ERR(dst))
101  
-		return -1;
  102
+		return PTR_ERR(dst);
102 103
 
103 104
 	skb_dst_drop(skb);
104 105
 	skb_dst_set(skb, dst);
@@ -107,7 +108,7 @@ int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family)
107 108
 	hh_len = skb_dst(skb)->dev->hard_header_len;
108 109
 	if (skb_headroom(skb) < hh_len &&
109 110
 	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
110  
-		return -1;
  111
+		return -ENOMEM;
111 112
 	return 0;
112 113
 }
113 114
 EXPORT_SYMBOL(nf_xfrm_me_harder);
1  net/netfilter/nf_nat_helper.c
@@ -2,6 +2,7 @@
2 2
  *
3 3
  * (C) 2000-2002 Harald Welte <laforge@netfilter.org>
4 4
  * (C) 2003-2006 Netfilter Core Team <coreteam@netfilter.org>
  5
+ * (C) 2007-2012 Patrick McHardy <kaber@trash.net>
5 6
  *
6 7
  * This program is free software; you can redistribute it and/or modify
7 8
  * it under the terms of the GNU General Public License version 2 as
5  net/netfilter/nf_queue.c
... ...
@@ -1,3 +1,8 @@
  1
+/*
  2
+ * Rusty Russell (C)2000 -- This code is GPL.
  3
+ * Patrick McHardy (c) 2006-2012
  4
+ */
  5
+
1 6
 #include <linux/kernel.h>
2 7
 #include <linux/slab.h>
3 8
 #include <linux/init.h>
1  net/netfilter/nfnetlink_log.c
@@ -3,6 +3,7 @@
1  net/netfilter/x_tables.c
@@ -2,6 +2,7 @@
2 2
  * x_tables core - Backend for {ip,ip6,arp}_tables
3 3
  *
4 4
  * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
  5
+ * Copyright (C) 2006-2012 Patrick McHardy <kaber@trash.net>
5 6
  *
6 7
  * Based on existing ip_tables code which is
7 8
  *   Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
1  net/netfilter/xt_TCPMSS.c
@@ -2,6 +2,7 @@
2 2
  * This is a module which is used for setting the MSS option in TCP packets.
3 3
  *
4 4
  * Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
  5
+ * Copyright (C) 2007 Patrick McHardy <kaber@trash.net>
5 6
  *
6 7
  * This program is free software; you can redistribute it and/or modify
7 8
  * it under the terms of the GNU General Public License version 2 as
1  net/netfilter/xt_conntrack.c
@@ -3,6 +3,7 @@
3 3
  *	information. (Superset of Rusty's minimalistic state match.)
4 4
  *
5 5
  *	(C) 2001  Marc Boucher (marc@mbsi.ca).
  6
+ *	(C) 2006-2012 Patrick McHardy <kaber@trash.net>
6 7
  *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
7 8
  *
8 9
  *	This program is free software; you can redistribute it and/or modify
1  net/netfilter/xt_hashlimit.c
@@ -3,6 +3,7 @@
3 3
  *	separately for each hashbucket (sourceip/sourceport/dstip/dstport)
4 4
  *
5 5
  *	(C) 2003-2004 by Harald Welte <laforge@netfilter.org>
  6
+ *	(C) 2006-2012 Patrick McHardy <kaber@trash.net>
6 7
  *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
7 8
  *
8 9
  * Development of this code was funded by Astaro AG, http://www.astaro.com/
1  net/netfilter/xt_limit.c
... ...
@@ -1,5 +1,6 @@
1 1
 /* (C) 1999 Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr>
2 2
  * (C) 1999 Hervé Eychenne <eychenne@info.enserb.u-bordeaux.fr>
  3
+ * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
3 4
  *
4 5
  * This program is free software; you can redistribute it and/or modify
5 6
  * it under the terms of the GNU General Public License version 2 as

0 notes on commit 95a0616

Please sign in to comment.
Something went wrong with that request. Please try again.