- 14 Apr, 2008 40 commits
-
-
Patrick McHardy authored
Signed-off-by:Patrick McHardy <kaber@trash.net>
-
Patrick McHardy authored
Add DCCP conntrack helper. Thanks to Gerrit Renker <gerrit@erg.abdn.ac.uk> for review and testing. Signed-off-by: -
Patrick McHardy authored
Move the UDP-Lite conntrack checksum validation to a generic helper similar to nf_checksum() and make it fall back to nf_checksum() in case the full packet is to be checksummed and hardware checksums are available. This is to be used by DCCP conntrack, which also needs to verify partial checksums. Signed-off-by: -
Patrick McHardy authored
Signed-off-by: -
Patrick McHardy authored
Signed-off-by: -
Patrick McHardy authored
Move responsibility for setting the IP_NAT_RANGE_PROTO_SPECIFIED flag to the NAT protocol, properly propagate errors and get rid of ugly return value convention. Signed-off-by: -
Patrick McHardy authored
Move to nf_nat_proto_common and rename to nf_nat_proto_... since they're also used by protocols that don't have port numbers. Signed-off-by: -
Patrick McHardy authored
The port rover should not get overwritten when using random mode, otherwise other rules will also use more or less random ports. Signed-off-by: -
Patrick McHardy authored
Add generic ->in_range and ->unique_tuple ops to avoid duplicating them again and again for future NAT modules and save a few bytes of text: net/ipv4/netfilter/nf_nat_proto_tcp.c: tcp_in_range | -62 (removed) tcp_unique_tuple | -259 # 271 -> 12, # inlines: 1 -> 0, size inlines: 7 -> 0 2 functions changed, 321 bytes removed net/ipv4/netfilter/nf_nat_proto_udp.c: udp_in_range | -62 (removed) udp_unique_tuple | -259 # 271 -> 12, # inlines: 1 -> 0, size inlines: 7 -> 0 2 functions changed, 321 bytes removed net/ipv4/netfilter/nf_nat_proto_gre.c: gre_in_range | -62 (removed) 1 function changed, 62 bytes removed vmlinux: 5 functions changed, 704 bytes removed Signed-off-by: -
Patrick McHardy authored
Rule dumping is performed in two steps: first userspace gets the ruleset size using getsockopt(SO_GET_INFO) and allocates memory, then it calls getsockopt(SO_GET_ENTRIES) to actually dump the ruleset. When another process changes the ruleset in between the sizes from the first getsockopt call doesn't match anymore and the kernel aborts. Unfortunately it returns EAGAIN, as for multiple other possible errors, so userspace can't distinguish this case from real errors. Return EAGAIN so userspace can retry the operation. Fixes (with current iptables SVN version) netfilter bugzilla #104. Signed-off-by: -
Patrick McHardy authored
Some callers pass uninitialized structures, clear the address to make sure later comparisions work properly. Signed-off-by: -
Jan Engelhardt authored
Signed-off-by:
Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
The use of xt_sctp.h flagged up -Wshadow warnings in userspace, which prompted me to look at it and clean it up. Basic operations have been directly replaced by library calls (memcpy, memset is both available in the kernel and userspace, and usually faster than a self-made loop). The is_set and is_clear functions now use a processing time shortcut, too. Signed-off-by:
-
Robert P. J. Day authored
Signed-off-by:
Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by:
-
Robert P. J. Day authored
Signed-off-by:
-
Alexey Dobriyan authored
Commit 9335f047 aka "[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW" added per-netns _view_ of iptables rules. They were shown to user, but ignored by filtering code. Now that it's possible to at least ping loopback, per-netns tables can affect filtering decisions. netns is taken in case of PRE_ROUTING, LOCAL_IN -- from in device, POST_ROUTING, LOCAL_OUT -- from out device, FORWARD -- from in device which should be equal to out device's netns. This code is relatively new, so BUG_ON was plugged. Wrappers were added to a) keep code the same from CONFIG_NET_NS=n users (overwhelming majority), b) consolidate code in one place -- similar changes will be done in ipv6 and arp netfilter code. Signed-off-by:
Alexey Dobriyan <adobriyan@sw.ru> Signed-off-by:
-
Patrick McHardy authored
Dump the mark value in log messages similar to nfnetlink_log. This is useful for debugging complex setups where marks are used for routing or traffic classification. Signed-off-by: -
Alexey Dobriyan authored
Patch splits creation of /proc/net/nf_conntrack, /proc/net/stat/nf_conntrack and net.netfilter hierarchy into their own functions with dummy ones if PROC_FS or SYSCTL is not set. Also, remove dead "ret = 0" write while I'm at it. Signed-off-by:
-
Gerrit Renker authored
This expresses __skb_queue_tail() in terms of __skb_insert(), using __skb_insert_before() as auxiliary function. Signed-off-by:
Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Gerrit Renker authored
This expresses __skb_append in terms of __skb_queue_after, exploiting that __skb_append(old, new, list) = __skb_queue_after(list, old, new). Signed-off-by:
-
Gerrit Renker authored
By reordering, __skb_queue_after() is expressed in terms of __skb_insert(). Signed-off-by:
-
Gerrit Renker authored
By rearranging the order of declarations, __skb_dequeue() is expressed in terms of * skb_peek() and * __skb_unlink(), thus in effect mirroring the analogue implementation of __skb_dequeue_tail(). Signed-off-by:
-
Rami Rosen authored
This patches adds a call to increment IPSTATS_MIB_OUTFORWDATAGRAMS when forwarding the packet in ip6_mr_forward() in the IPv6 multicast routing module (net/ipv6/ip6mr.c). Signed-off-by:
Rami Rosen <ramirose@gmail.com> Signed-off-by:
YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
YOSHIFUJI Hideaki authored
Signed-off-by:
-
YOSHIFUJI Hideaki authored
Since NETDEV_REGISTER notifier chain is responsible for creating inet6_dev{}, we do not need to call ipv6_find_idev() directly here. Signed-off-by: -
Pavel Emelyanov authored
The inet6_lookup family of functions requires a net to lookup a socket in, so give a proper one to them. No more things to do for dccpv6, since routing is OK and the ipv4-like transport layer filtering is not done for ipv6. Signed-off-by:
Pavel Emelyanov <xemul@openvz.org> Signed-off-by:
-
Pavel Emelyanov authored
Move the call to inet_ctl_sock_create to init callback (and inet_ctl_sock_destroy to exit one) and use proper ctl sock in dccp_v6_ctl_send_reset. Signed-off-by:
Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by:
-
Pavel Emelyanov authored
And replace all its usage with init_net's socket. Signed-off-by:
-
Pavel Emelyanov authored
They will be responsible for ctl socket initialization, but currently they are void. Signed-off-by:
-
Pavel Emelyanov authored
This call uses the sock to get the net to lookup the routing in. With CONFIG_NET_NS this code will OOPS, since the sk ptr is NULL. After looking inside the ip6_dst_lookup and drawing the analogy with respective ipv6 code, it seems, that the dccp ctl socket is a good candidate for the first argument. Signed-off-by:
-
Pavel Emelyanov authored
This enables sockets creation with IPPROTO_DCCP and enables the ip level to pass DCCP packets to the DCCP level. Signed-off-by:
-
Pavel Emelyanov authored
The inet_lookup family of functions requires a net to lookup a socket in, so give a proper one to them. Signed-off-by:
-
