- 28 Jan, 2008 40 commits
-
-
Patrick McHardy authored
Spotted by Pablo Neira Ayuso <pablo@netfilter.org>. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Patrick McHardy authored
Don't take and release the lock once per SCTP chunk, simply hold it the entire time while iterating through the chunks. Signed-off-by:
-
Patrick McHardy authored
The name is misleading, it holds the new connection state, so rename it to "newstate". Also rename "oldsctpstate" to "oldstate" for consistency. Signed-off-by:
-
Patrick McHardy authored
Consolidate error paths and use proper symbolic return value instead of magic values. Signed-off-by:
-
Patrick McHardy authored
Eliminate a few lines over 80 characters by using a local variable to hold the conntrack direction instead of using CTINFO2DIR everywhere. Signed-off-by:
-
Patrick McHardy authored
Reduce the length of some overly long lines by renaming all "conntrack" variables to "ct". Signed-off-by:
-
Patrick McHardy authored
Use unsigned long instead of char for the bitmap and removed lots of casts. Signed-off-by:
-
Patrick McHardy authored
Reindent switch cases properly, get rid of weird constructs like "!(x == y)", put logical operations on the end of the line instead of the next line, get rid of superfluous braces. Signed-off-by:
-
Patrick McHardy authored
Instead of keeping pointers to the timeout values in a table, simply put the timeout values in the table directly. Signed-off-by:
-
Patrick McHardy authored
The TCP and SCTP conntrack state transition tables only holds small numbers, but gcc uses 4 byte per entry for the enum. Switching to an u8 reduces the size from 480 to 120 bytes for TCP and from 576 to 144 bytes for SCTP. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Denys Vlasenko authored
The current TCP RST construction reuses the old packet and can't deal with IP options as a consequence of that. Construct the RST from scratch instead. Signed-off-by:
-
Denys Vlasenko authored
This patch removes inlines except those which are used by packet matching code and thus are performance-critical. Before: $ size */*/*/ip*tables*.o text data bss dec hex filename 6402 500 16 6918 1b06 net/ipv4/netfilter/ip_tables.o 7130 500 16 7646 1dde net/ipv6/netfilter/ip6_tables.o After: $ size */*/*/ip*tables*.o text data bss dec hex filename 6307 500 16 6823 1aa7 net/ipv4/netfilter/ip_tables.o 7010 500 16 7526 1d66 net/ipv6/netfilter/ip6_tables.o Signed-off-by:
Denys Vlasenko <vda.linux@googlemail.com> Signed-off-by:
-
Jan Engelhardt authored
With all the newly introduced features, there is a lot to remove later on after a compatibility grace period of 2 years. Signed-off-by:
Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by:
-
Jan Engelhardt authored
Adds IPv6 support to xt_iprange, making it possible to match on IPv6 address ranges with ip6tables. Signed-off-by:
-
Jan Engelhardt authored
This patch moves ipt_iprange to xt_iprange, in preparation for adding IPv6 support to xt_iprange. Signed-off-by:
-
Jan Engelhardt authored
Updates the MODULE_DESCRIPTION() tags for all Netfilter modules, actually describing what the module does and not just "netfilter XYZ target". Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
In the PACKET_LOOPBACK case, the skb data was always interpreted as IPv4, but that is not valid for IPv6, obviously. Fix this by adding an extra condition to check for AF_INET. Signed-off-by:
-
Jan Engelhardt authored
Introduces the xt_mark match revision 1. It uses fixed types, eventually obsoleting revision 0 some day (uses nonfixed types). Signed-off-by:
-
Jan Engelhardt authored
Introduces the xt_conntrack match revision 1. It uses fixed types, the new nf_inet_addr and comes with IPv6 support, thereby completely superseding xt_state. Signed-off-by:
-
Jan Engelhardt authored
Extend union nf_inet_addr with struct in_addr and in6_addr. Useful because a lot of in-kernel IPv4 and IPv6 functions use in_addr/in6_addr. Signed-off-by:
-
Jan Engelhardt authored
Introduces the xt_connmark match revision 1. It uses fixed types, eventually obsoleting revision 0 some day (uses nonfixed types). (Unfixed types like "unsigned long" do not play well with mixed user-/kernelspace "bitness", e.g. 32/64, as is common on SPARC64, and need extra compat code.) Signed-off-by:
-
Jan Engelhardt authored
Introduces the xt_MARK target revision 2. It uses fixed types, and also uses the more expressive XOR logic. Signed-off-by:
-
Jan Engelhardt authored
Introduces the xt_CONNMARK target revision 1. It uses fixed types, and also uses the more expressive XOR logic. Futhermore, it allows to selectively pick bits from both the ctmark and the nfmark in the SAVE and RESTORE operations. Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Fix incorrect mask value passed to ipv4_change_dsfield/ipv6_change_dsfield. Signed-off-by:
-
Jan Engelhardt authored
This patch changes the behavior of xt_TOS v1 so that the mask value the user supplies means "zero out these bits" rather than "keep these bits". This is more easy on the user, as (I would assume) people keep more bits than zeroing, so, an example: Action: Set bit 0x01. before (&): iptables -j TOS --set-tos 0x01/0xFE after (&~): iptables -j TOS --set-tos 0x01/0x01 This is not too "tragic" with xt_TOS, but where larger fields are used (e.g. proposed xt_MARK v2), `--set-xmar 0x01/0x01` vs. `--set-xmark 0x01/0xFFFFFFFE` really makes a difference. Other target(!) modules, such as xt_TPROXY also use &~ rather than &, so let's get to a common ground. (Since xt_TOS has not yet left the development tree en direction to mainline, the semantic can be changed as proposed without breaking iptables.) Signed-off-by: -
Jan Engelhardt authored
Commit 88c85d81f74f92371745158aebc5cbf490412002 forgot to remove the old ipt_TOS file (whose code has been merged into xt_DSCP). Remove it now. Signed-off-by:
-
Patrick McHardy authored
Most of the netfilter modules are not considered experimental anymore, the only ones I want to keep marked as EXPERIMENTAL are: - TCPOPTSTRIP target, which is brand new. - SANE helper, which is quite new. - CLUSTERIP target, which I believe hasn't had much testing despite being in the kernel for quite a long time. - SCTP match and conntrack protocol, which are a mess and need to be reviewed and cleaned up before I would trust them. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Stephen Hemminger authored
Initialization of the slab cache's should be done when IP is initialized to make sure of available memory, and that code can be marked __init. Signed-off-by:
Stephen Hemminger <stephen.hemminger@vyatta.com> Signed-off-by:
-
Stephen Hemminger authored
Show number of entries in trie, the size field was being set but never used, but it only counted leaves, not all entries. Refactor the two cases in fib_triestat_seq_show into a single routine. Note: the stat structure was being malloc'd but the stack usage isn't so high (288 bytes) that it is worth the additional complexity. Signed-off-by:
-
Eric Dumazet authored
fib_trie_seq_show() uses two helper functions, rtn_scope() and rtn_type() that can write to static storage without locking. Just pass to them a temporary buffer to avoid potential corruption (probably not triggerable but still...) Signed-off-by:
Eric Dumazet <dada1@cosmosbay.com> Signed-off-by:
-
Denis V. Lunev authored
inet_confirm_addr can be called with NULL in_dev from arp_ignore iff scope is RT_SCOPE_LINK. Lets always pass the device and check for RT_SCOPE_LINK scope inside inet_confirm_addr. This let us take network namespace from in_device a need for an additional argument. Signed-off-by:
Denis V. Lunev <den@openvz.org> Signed-off-by:
-
Denis V. Lunev authored
arp_ignore has two arguments: dev & in_dev. dev is used for inet_confirm_addr calling only. inet_confirm_addr, in turn, either gets in_dev from the device passed or iterates over all network devices if the device passed is NULL. It seems logical to directly pass in_dev into inet_confirm_addr. Signed-off-by:
-
Denis V. Lunev authored
Make them static. [ Moved the inline before, instead of after, call sites. -DaveM ] Signed-off-by:
-
Denis V. Lunev authored
No need for this. It is declared in the neighbour.h Signed-off-by:
-
Denis V. Lunev authored
Valid network device is always passed into neigh_param_alloc, so remove extra checking for dev == NULL. Additionally, cleanup bogus netns assignment. Signed-off-by:
Pavel Emelyanov <xemul@openvz.org> Signed-off-by:
-
