1. 22 Aug, 2016 1 commit
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: add quota expression · 3d2f30a1
      Pablo Neira Ayuso authored
      This patch adds the quota expression. This new stateful expression
      integrate easily into the dynset expression to build 'hashquota' flow
      tables.
      
      Arguably, we could use instead "counter bytes > 1000" instead, but this
      approach has several problems:
      
      1) We only support for one single stateful expression in dynamic set
         definitions, and the expression above is a composite of two
         expressions: get counter + comparison.
      
      2) We would need to restore the packed counter representation (that we
         used to have) based on seqlock to synchronize this, since per-cpu is
         not suitable for this.
      
      So instead of bloating the counter expression back with the seqlock
      representation and extending the existing set infrastructure to make it
      more complex for the composite described above, let's follow the more
      simple approach of adding a quota expression that we can plug into our
      existing infrastructure.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      3d2f30a1
  2. 18 Aug, 2016 1 commit
  3. 17 Aug, 2016 1 commit
  4. 13 Aug, 2016 1 commit
    • Pablo Neira Ayuso's avatar
      netfilter: remove ip_conntrack* sysctl compat code · adf05168
      Pablo Neira Ayuso authored
      This backward compatibility has been around for more than ten years,
      since Yasuyuki Kozakai introduced IPv6 in conntrack. These days, we have
      alternate /proc/net/nf_conntrack* entries, the ctnetlink interface and
      the conntrack utility got adopted by many people in the user community
      according to what I observed on the netfilter user mailing list.
      
      So let's get rid of this.
      
      Note that nf_conntrack_htable_size and unsigned int nf_conntrack_max do
      not need to be exported as symbol anymore.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      adf05168
  5. 12 Aug, 2016 1 commit
  6. 11 Aug, 2016 29 commits
  7. 10 Aug, 2016 2 commits
  8. 09 Aug, 2016 4 commits