Re: [PATCH 1/2] Versioning (aka release) stuff for iptables

[Rusty Russell <rusty@rustcorp.com.au>]

On Sat, 2005-01-01 at 22:56 +0100, Pablo Neira wrote:
> multiport-remove-late-check.patch:
> Remove a checking in kernel space which makes sures that the parameters 
> passed are correct, that's already done in user space where this thing 
> really belongs.

I've rolled this into the other kernel patch, after some thought.  The
previous policy was that iptables should not be able to crash the
kernel, however that means a lot of gratuitous checking in the kernel
that is far more useful if done in userspace (where the error messages
can be more informative).

> multiport_v2.patch:
> the revision 1 of multiport. Actually this merges current mport in the 
> SVN repository to multiport.

I've put this in my patch collection.

> iptables-multiport_v2.patch:
> iptables user space part.

Applied and committed.

> multiport.sim:
> a testsuite to check that new version works fine (incomplete).

I reworked this to be thorough and test one thing at a time, and split
the test into revision 0 things, and revision 1 things.  As a result, I
found a bug in the userspace part (checks protocol, but not that it
isn't inverted), and in the kernel part (--ports only examined
destination ports, not source).

Fixed, and thanks!

> BTW, if you need this. Signed-off-by: Pablo Neira Ayuso <pablo@eurodev.net>

Please read part (11) of Documentation/SubmittingPatches in the kernel
source tree.  If you're fine by that, attach it to future patches.

Thanks!
Rusty.
-- 
A bad analogy is like a leaky screwdriver -- Richard Braakman