summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2008-01-29[TG3]: Use print_macJoe Perches1-7/+6
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[SUNVNET]: Use print_macJoe Perches1-6/+4
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[IPSEC]: Do xfrm_state_check_space before encapsulationHerbert Xu1-12/+6
While merging the IPsec output path I moved the encapsulation output operation to the top of the loop so that it sits outside of the locked section. Unfortunately in doing so it now sits in front of the space check as well which could be a fatal error. This patch rearranges the calls so that the space check happens as the thing on the output path. This patch also fixes an incorrect goto should the encapsulation output fail. Thanks to Kazunori MIYAZAWA for finding this bug. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED optionPatrick McHardy6-11/+124
The NETFILTER_ADVANCED option hides lots of the rather obscure netfilter options when disabled and provides defaults (M) that should allow to run a distribution firewall without further thinking. Defaults to 'y' to avoid breaking current configurations. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: non-power-of-two jhash optimizationsPatrick McHardy4-8/+14
Apply Eric Dumazet's jhash optimizations where applicable. Quoting Eric: Thanks to jhash, hash value uses full 32 bits. Instead of returning hash % size (implying a divide) we return the high 32 bits of the (hash * size) that will give results between [0 and size-1] and same hash distribution. On most cpus, a multiply is less expensive than a divide, by an order of magnitude. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: xt_hashlimit: reduce overhead without IPv6Eric Dumazet1-3/+17
This patch generalizes the (CONFIG_IP6_NF_IPTABLES || CONFIG_IP6_NF_IPTABLES_MODULE) test done in hashlimit_init_dst() to all the xt_hashlimit module. This permits a size reduction of "struct dsthash_dst". This saves memory and cpu for IPV4 only hosts. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: xt_hashlimit: speedup hash_dst()Eric Dumazet1-1/+10
1) Using jhash2() instead of jhash() is a litle bit faster if applicable. 2) Thanks to jhash, hash value uses full 32 bits. Instead of returning hash % size (implying a divide) we return the high 32 bits of the (hash * size) that will give results between [0 and size-1] and same hash distribution. On most cpus, a multiply is less expensive than a divide, by an order of magnitude. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: xt_connlimit: use the new union nf_inet_addrJan Engelhardt2-6/+10
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: Parenthesize macro parametersJan Engelhardt10-16/+19
Parenthesize macro parameters. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: Introduce nf_inet_addressJan Engelhardt10-56/+55
A few netfilter modules provide their own union of IPv4 and IPv6 address storage. Will unify that in this patch series. (1/4): Rename union nf_conntrack_address to union nf_inet_addr and move it to x_tables.h. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: x_tables: use %u format specifiersJan Engelhardt8-8/+8
Use %u format specifiers as ->family is unsigned. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_nat: properly use RCU for ip_nat_decode_sessionPatrick McHardy2-6/+11
We need to use rcu_assign_pointer/rcu_dereference to avoid races. Also remove an obsolete CONFIG_IP_NAT_NEEDED ifdef. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: constify nf_afinfoPatrick McHardy6-13/+13
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: Kill function prototype for non-existing functionPatrick McHardy1-3/+0
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nfnetlink_log: include GID in netlink messagePatrick McHardy2-0/+4
Similar to Maciej Soltysiak's ipt_LOG patch, include GID in addition to UID in netlink message. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nfnetlink_log: use endianness-aware attribute functionsPatrick McHardy1-52/+35
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nfnetlink_{queue,log}: return proper error codes in instance_createPatrick McHardy2-12/+23
Currently we return EINVAL for "instance exists", "allocation failed" and "module unloaded below us", which is completely inapproriate. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nfnetlink_log: remove excessive debuggingPatrick McHardy1-45/+0
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nfnetlink_{queue,log}: return ENOTSUPP for unknown cfg commandsPatrick McHardy2-2/+2
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nfnetlink_log: fix checks in nfulnl_recv_configPatrick McHardy1-22/+27
Similar to the nfnetlink_queue fixes: The peer_pid must be checked in all cases when a logging instance exists, additionally we must check whether an instance exists before attempting to configure it to avoid NULL ptr dereferences. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_log: remove incomprehensible commentPatrick McHardy1-1/+0
Whatever that comment tries to say, I don't get it and it looks like a leftover from the time when RCU wasn't used properly. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_log: constify struct nf_logger and nf_log_packet loginfo argPatrick McHardy7-13/+13
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_log: move logging stuff to seperate headerPatrick McHardy17-55/+74
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_nat: pass manip type instead of hook to nf_nat_setup_infoPatrick McHardy11-44/+25
nf_nat_setup_info gets the hook number and translates that to the manip type to perform. This is a relict from the time when one manip per hook could exist, the exact hook number doesn't matter anymore, its converted to the manip type. Most callers already know what kind of NAT they want to perform, so pass the maniptype in directly. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_nat: sprinkle a few __read_mostlysPatrick McHardy1-4/+5
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_nat: mark NAT protocols constPatrick McHardy8-25/+25
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_nat_proto_gre: add missing module referencePatrick McHardy1-0/+1
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ctnetlink: fix expectation timeout dumpingPatrick McHardy1-2/+5
When the timer is late its timeout might be before the current time, in which case a very large value is dumped. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ctnetlink: use netlink attribute helpersPatrick McHardy7-107/+70
Use NLA_PUT_BE32, nla_get_be32() etc. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETLINK]: Add NLA_PUT_BE16/nla_get_be16()Patrick McHardy1-0/+12
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: nf_conntrack_sctp: add ctnetlink supportPablo Neira Ayuso1-0/+10
This patch adds support for SCTP to ctnetlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ctnetlink: add support for secmarkPablo Neira Ayuso4-1/+31
This patch adds support for James Morris' connsecmark. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ctnetlink: add support for master tuple event notification and ↵Pablo Neira Ayuso1-0/+28
dumping This patch adds support for master tuple event notification and dumping. Conntrackd needs this information to recover related connections appropriately. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ctnetlink: add support for NAT sequence adjustmentsPablo Neira Ayuso4-1/+140
The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see: http://people.netfilter.org/pablo/conntrack-tools/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: xt_TCPMSS: don't allow netfilter --setmss to increase mssBenjamin LaHaise1-2/+5
When terminating DSL connections for an assortment of random customers, I've found it necessary to use iptables to clamp the MSS used for connections to work around the various ICMP blackholes in the greater net. Unfortunately, the current behaviour in Linux is imperfect and actually make things worse, so I'm proposing the following: increasing the MSS in a packet can never be a good thing, so make --set-mss only lower the MSS in a packet. Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing connections from clients (ie web traffic), as it only looks at the PMTU on the destination route, not the source of the packet (the DSL interfaces in question have a 1442 byte MTU while the destination ethernet interface is 1500 -- there are problematic hosts which use a 1300 byte MTU). Reworking that is probably a good idea at some point, but it's more work than this is. Signed-off-by: Benjamin LaHaise <bcrl@kvack.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: add compat supportPatrick McHardy2-58/+721
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: resync get_entries() with ip_tablesPatrick McHardy1-20/+19
Resync get_entries() with ip_tables.c by moving the checks from the setsockopt handler to the function itself. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: move ARPT_SO_GET_INFO handling to seperate functionPatrick McHardy1-42/+46
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: move counter allocation to seperate functionPatrick McHardy1-8/+21
More resyncing with ip_tables.c as preparation for compat support. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: move entry and target checks to seperate functionsPatrick McHardy1-17/+41
Resync with ip_tables.c as preparation for compat support. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: remove ipchains compat hackPatrick McHardy1-4/+0
Remove compatiblity hack copied from ip_tables.c - ipchains didn't even support arp_tables :) Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: use vmalloc_node()Patrick McHardy1-2/+3
Use vmalloc_node() as in ip_tables.c. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: use XT_ALIGNPatrick McHardy1-1/+1
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: arp_tables: remove obsolete standard_check functionPatrick McHardy1-25/+3
The size check is already performed by xt_check_target, no need to do it again. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ip6_tables: use XT_ALIGNPatrick McHardy1-1/+1
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ip_tables: remove ipchains compatibility hackPatrick McHardy1-8/+0
ipchains support has been removed years ago. kill last remains. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ip6_tables: use raw_smp_processor_id() in do_add_counters()Patrick McHardy1-1/+1
Use raw_smp_processor_id() in do_add_counters() as in ip_tables.c. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: ip6_tables: fix stack leagagePatrick McHardy1-1/+1
Fix leakage of local variable on stack. This already got fixed in ip_tables silently by the compat patches. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: {ip,ip6}_tables: fix format stringsPatrick McHardy2-21/+15
Use %zu for sizeof() and remove casts. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-29[NETFILTER]: {ip,ip6}_tables: reformat to eliminate differencesPatrick McHardy2-59/+53
Reformat ip_tables.c and ip6_tables.c in order to eliminate non-functional differences and minimize diff output. This allows to get a view of the real differences using: sed -e 's/IP6T/IPT/g' \ -e 's/IP6/IP/g' \ -e 's/INET6/INET/g' \ -e 's/ip6t/ipt/g' \ -e 's/ip6/ip/g' \ -e 's/ipv6/ip/g' \ -e 's/icmp6/icmp/g' \ net/ipv6/netfilter/ip6_tables.c | \ diff -wup /dev/stdin net/ipv4/netfilter/ip_tables.c Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.0) at 2025-01-24 06:49:36 +0300