- 28 Jan, 2008 40 commits
-
-
Patrick McHardy authored
When the timer is late its timeout might be before the current time, in which case a very large value is dumped. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Patrick McHardy authored
Use NLA_PUT_BE32, nla_get_be32() etc. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Pablo Neira Ayuso authored
This patch adds support for SCTP to ctnetlink. Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
-
Pablo Neira Ayuso authored
This patch adds support for James Morris' connsecmark. Signed-off-by:
-
Pablo Neira Ayuso authored
This patch adds support for master tuple event notification and dumping. Conntrackd needs this information to recover related connections appropriately. Signed-off-by:
-
Pablo Neira Ayuso authored
The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see: http://people.netfilter.org/pablo/conntrack-tools/Signed-off-by:
-
Benjamin LaHaise authored
When terminating DSL connections for an assortment of random customers, I've found it necessary to use iptables to clamp the MSS used for connections to work around the various ICMP blackholes in the greater net. Unfortunately, the current behaviour in Linux is imperfect and actually make things worse, so I'm proposing the following: increasing the MSS in a packet can never be a good thing, so make --set-mss only lower the MSS in a packet. Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing connections from clients (ie web traffic), as it only looks at the PMTU on the destination route, not the source of the packet (the DSL interfaces in question have a 1442 byte MTU while the destination ethernet interface is 1500 -- there are problematic hosts which use a 1300 byte MTU). Reworking that is probably a good idea at some point, but it's more work than this is. Signed-off-by:
Benjamin LaHaise <bcrl@kvack.org> Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Resync get_entries() with ip_tables.c by moving the checks from the setsockopt handler to the function itself. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
More resyncing with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Resync with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Remove compatiblity hack copied from ip_tables.c - ipchains didn't even support arp_tables :) Signed-off-by:
-
Patrick McHardy authored
Use vmalloc_node() as in ip_tables.c. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
The size check is already performed by xt_check_target, no need to do it again. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
ipchains support has been removed years ago. kill last remains. Signed-off-by:
-
Patrick McHardy authored
Use raw_smp_processor_id() in do_add_counters() as in ip_tables.c. Signed-off-by:
-
Patrick McHardy authored
Fix leakage of local variable on stack. This already got fixed in ip_tables silently by the compat patches. Signed-off-by:
-
Patrick McHardy authored
Use %zu for sizeof() and remove casts. Signed-off-by:
-
Patrick McHardy authored
Reformat ip_tables.c and ip6_tables.c in order to eliminate non-functional differences and minimize diff output. This allows to get a view of the real differences using: sed -e 's/IP6T/IPT/g' \ -e 's/IP6/IP/g' \ -e 's/INET6/INET/g' \ -e 's/ip6t/ipt/g' \ -e 's/ip6/ip/g' \ -e 's/ipv6/ip/g' \ -e 's/icmp6/icmp/g' \ net/ipv6/netfilter/ip6_tables.c | \ diff -wup /dev/stdin net/ipv4/netfilter/ip_tables.c Signed-off-by: -
Patrick McHardy authored
Old userspace doesn't support revision 1, especially for IPv6, which is only available in the SVN snapshot. Add compat support for revision 0. Signed-off-by:
-
Patrick McHardy authored
The current netfilter SVN version includes support for this, so enable it in the kernel as well. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Resync get_entries() with ip_tables.c by moving the checks from the setsockopt handler to the function itself. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
More resyncing with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Consistently use vmalloc_node for all counter allocations. Signed-off-by:
-
Patrick McHardy authored
Resync with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Its needed by ip6_tables and arp_tables as well. Signed-off-by:
-
Patrick McHardy authored
Use compat types and compat iterators when dealing with compat entries for clarity. This doesn't actually make a difference for ip_tables, but is needed for ip6_tables and arp_tables. Signed-off-by:
-
Patrick McHardy authored
Account for size differences when dumping entries or calculating the entry positions. This doesn't actually make any difference for IPv4 since the structures have the same size, but its logically correct and needed for IPv6. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Make xt_compat_match_from_user return an int to make it usable in the *tables iterator macros and kill a now unnecessary wrapper function. Signed-off-by:
-
Patrick McHardy authored
The compat code has some very odd formating, clean it up before porting it to ip6_tables. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
