kernel: merge regression fixes for the netfilter patches to the 3.1 kernel patches...

SVN-Revision: 28734

diff --git a/target/linux/generic/patches-3.1/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/patches-3.1/610-netfilter_match_bypass_default_checks.patch
index 4760c8ad85e5c229f6d2df156461de7d9ddf60a2..51c9e0999ba1b718e39b9e99726f12f2e1943859 100644 (file)
--- a/target/linux/generic/patches-3.1/610-netfilter_match_bypass_default_checks.patch
+++ b/target/linux/generic/patches-3.1/610-netfilter_match_bypass_default_checks.patch
@@ -20,7 +20,7 @@
        if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
                  IPT_INV_SRCIP) ||
            FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
-@@ -134,6 +137,26 @@ ip_packet_match(const struct iphdr *ip,
+@@ -134,6 +137,29 @@ ip_packet_match(const struct iphdr *ip,
        return true;
  }
  
@@ -38,6 +38,9 @@
 +      if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
 +              return;
 +
++      if (ip->smsk.s_addr || ip->dmsk.s_addr)
++              return;
++
 +      if (ip->proto)
 +              return;
 +
@@ -47,7 +50,7 @@
  static bool
  ip_checkentry(const struct ipt_ip *ip)
  {
-@@ -561,7 +584,7 @@ static void cleanup_match(struct xt_entr
+@@ -561,7 +587,7 @@ static void cleanup_match(struct xt_entr
  }
  
  static int
@@ -56,7 +59,7 @@
  {
        const struct xt_entry_target *t;
  
-@@ -570,6 +593,8 @@ check_entry(const struct ipt_entry *e, c
+@@ -570,6 +596,8 @@ check_entry(const struct ipt_entry *e, c
                return -EINVAL;
        }
  
@@ -65,7 +68,7 @@
        if (e->target_offset + sizeof(struct xt_entry_target) >
            e->next_offset)
                return -EINVAL;
-@@ -931,6 +956,7 @@ copy_entries_to_user(unsigned int total_
+@@ -931,6 +959,7 @@ copy_entries_to_user(unsigned int total_
        const struct xt_table_info *private = table->private;
        int ret = 0;
        const void *loc_cpu_entry;
@@ -73,7 +76,7 @@
  
        counters = alloc_counters(table);
        if (IS_ERR(counters))
-@@ -961,6 +987,14 @@ copy_entries_to_user(unsigned int total_
+@@ -961,6 +990,14 @@ copy_entries_to_user(unsigned int total_
                        ret = -EFAULT;
                        goto free_counters;
                }

diff --git a/target/linux/generic/patches-3.1/611-netfilter_match_bypass_default_table.patch b/target/linux/generic/patches-3.1/611-netfilter_match_bypass_default_table.patch
index 113f1401232ff02ae5f386c8a0193b2abc80797a..3cf0e5a32d9f21a5e5d38da41e5d70e09e918f95 100644 (file)
--- a/target/linux/generic/patches-3.1/611-netfilter_match_bypass_default_table.patch
+++ b/target/linux/generic/patches-3.1/611-netfilter_match_bypass_default_table.patch
@@ -1,6 +1,6 @@
 --- a/net/ipv4/netfilter/ip_tables.c
 +++ b/net/ipv4/netfilter/ip_tables.c
-@@ -307,6 +307,33 @@ struct ipt_entry *ipt_next_entry(const s
+@@ -310,6 +310,33 @@ struct ipt_entry *ipt_next_entry(const s
        return (void *)entry + entry->next_offset;
  }
  
@@ -34,7 +34,7 @@
  /* Returns one of the generic firewall policies, like NF_ACCEPT. */
  unsigned int
  ipt_do_table(struct sk_buff *skb,
-@@ -331,6 +358,25 @@ ipt_do_table(struct sk_buff *skb,
+@@ -334,6 +361,25 @@ ipt_do_table(struct sk_buff *skb,
        ip = ip_hdr(skb);
        indev = in ? in->name : nulldevname;
        outdev = out ? out->name : nulldevname;
@@ -60,7 +60,7 @@
        /* We handle fragments by dealing with the first fragment as
         * if it was a normal packet.  All other fragments are treated
         * normally, except that they will NEVER match rules that ask
-@@ -345,18 +391,6 @@ ipt_do_table(struct sk_buff *skb,
+@@ -348,18 +394,6 @@ ipt_do_table(struct sk_buff *skb,
        acpar.family  = NFPROTO_IPV4;
        acpar.hooknum = hook;
  

diff --git a/target/linux/generic/patches-3.1/612-netfilter_match_reduce_memory_access.patch b/target/linux/generic/patches-3.1/612-netfilter_match_reduce_memory_access.patch
index 817b37efd15b55934e25cf111ae5b375324dbf87..f506165e1d3639f3c1c2cc88753cc0ddb529f5be 100644 (file)
--- a/target/linux/generic/patches-3.1/612-netfilter_match_reduce_memory_access.patch
+++ b/target/linux/generic/patches-3.1/612-netfilter_match_reduce_memory_access.patch
@@ -9,7 +9,7 @@
 +                (ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
                  IPT_INV_SRCIP) ||
 -          FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
-+          FWINV(ipinfo->smsk.s_addr &&
++          FWINV(ipinfo->dmsk.s_addr &&
 +                (ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
                  IPT_INV_DSTIP)) {
                dprintf("Source or dest mismatch.\n");