aboutsummaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)Author
2008-04-14[NETFILTER]: Add partial checksum validation helperPatrick McHardy
Move the UDP-Lite conntrack checksum validation to a generic helper similar to nf_checksum() and make it fall back to nf_checksum() in case the full packet is to be checksummed and hardware checksums are available. This is to be used by DCCP conntrack, which also needs to verify partial checksums. Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: nf_nat: add UDP-Lite supportPatrick McHardy
Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: nf_nat: remove unused name from struct nf_nat_protocolPatrick McHardy
Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: nf_conntrack_netlink: clean up NAT protocol parsingPatrick McHardy
Move responsibility for setting the IP_NAT_RANGE_PROTO_SPECIFIED flag to the NAT protocol, properly propagate errors and get rid of ugly return value convention. Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: nf_nat: move NAT ctnetlink helpers to nf_nat_proto_commonPatrick McHardy
Move to nf_nat_proto_common and rename to nf_nat_proto_... since they're also used by protocols that don't have port numbers. Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: nf_nat: fix random mode not to overwrite port roverPatrick McHardy
The port rover should not get overwritten when using random mode, otherwise other rules will also use more or less random ports. Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: nf_nat: add helpers for common NAT protocol operationsPatrick McHardy
Add generic ->in_range and ->unique_tuple ops to avoid duplicating them again and again for future NAT modules and save a few bytes of text: net/ipv4/netfilter/nf_nat_proto_tcp.c: tcp_in_range | -62 (removed) tcp_unique_tuple | -259 # 271 -> 12, # inlines: 1 -> 0, size inlines: 7 -> 0 2 functions changed, 321 bytes removed net/ipv4/netfilter/nf_nat_proto_udp.c: udp_in_range | -62 (removed) udp_unique_tuple | -259 # 271 -> 12, # inlines: 1 -> 0, size inlines: 7 -> 0 2 functions changed, 321 bytes removed net/ipv4/netfilter/nf_nat_proto_gre.c: gre_in_range | -62 (removed) 1 function changed, 62 bytes removed vmlinux: 5 functions changed, 704 bytes removed Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: {ip,ip6,arp}_tables: return EAGAIN for invalid SO_GET_ENTRIES sizePatrick McHardy
Rule dumping is performed in two steps: first userspace gets the ruleset size using getsockopt(SO_GET_INFO) and allocates memory, then it calls getsockopt(SO_GET_ENTRIES) to actually dump the ruleset. When another process changes the ruleset in between the sizes from the first getsockopt call doesn't match anymore and the kernel aborts. Unfortunately it returns EAGAIN, as for multiple other possible errors, so userspace can't distinguish this case from real errors. Return EAGAIN so userspace can retry the operation. Fixes (with current iptables SVN version) netfilter bugzilla #104. Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: nf_conntrack_sip: clear address in parse_addr()Patrick McHardy
Some callers pass uninitialized structures, clear the address to make sure later comparisions work properly. Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: Explicitly initialize .priority in arptable_filterJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: remove arpt_(un)register_target indirection macrosJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: remove arpt_target indirection macroJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: remove arpt_table indirection macroJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: annotate rest of nf_nat_* with constJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: annotate rest of nf_conntrack_* with constJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: annotate {arp,ip,ip6,x}tables with constJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: annotate xtables targets with const and remove castsJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: Use non-deprecated __RW_LOCK_UNLOCKED macroRobert P. J. Day
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: bridge netfilter: use non-deprecated __RW_LOCK_UNLOCKED macro.Robert P. J. Day
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: ip_tables: per-netns FILTER/MANGLE/RAW tables for realAlexey Dobriyan
Commit 9335f047fe61587ec82ff12fbb1220bcfdd32006 aka "[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW" added per-netns _view_ of iptables rules. They were shown to user, but ignored by filtering code. Now that it's possible to at least ping loopback, per-netns tables can affect filtering decisions. netns is taken in case of PRE_ROUTING, LOCAL_IN -- from in device, POST_ROUTING, LOCAL_OUT -- from out device, FORWARD -- from in device which should be equal to out device's netns. This code is relatively new, so BUG_ON was plugged. Wrappers were added to a) keep code the same from CONFIG_NET_NS=n users (overwhelming majority), b) consolidate code in one place -- similar changes will be done in ipv6 and arp netfilter code. Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: {ip,ip6}t_LOG: print MARK value in log outputPatrick McHardy
Dump the mark value in log messages similar to nfnetlink_log. This is useful for debugging complex setups where marks are used for routing or traffic classification. Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[NETFILTER]: nf_conntrack: less hairy ifdefs around proc and sysctlAlexey Dobriyan
Patch splits creation of /proc/net/nf_conntrack, /proc/net/stat/nf_conntrack and net.netfilter hierarchy into their own functions with dummy ones if PROC_FS or SYSCTL is not set. Also, remove dead "ret = 0" write while I'm at it. Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru> Signed-off-by: Patrick McHardy <kaber@trash.net>
2008-04-14[SKB]: __skb_append = __skb_queue_after Gerrit Renker
This expresses __skb_append in terms of __skb_queue_after, exploiting that __skb_append(old, new, list) = __skb_queue_after(list, old, new). Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[IPV6] MROUTE: Add stats in multicast routing module method ip6_mr_forward().Rami Rosen
This patches adds a call to increment IPSTATS_MIB_OUTFORWDATAGRAMS when forwarding the packet in ip6_mr_forward() in the IPv6 multicast routing module (net/ipv6/ip6mr.c). Signed-off-by: Rami Rosen <ramirose@gmail.com> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NET]: Sink IPv6 menuoptions into its own submenuJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[IPV6]: Share common code-paths for sticky socket options.YOSHIFUJI Hideaki
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[IPV6] MROUTE: Do not call ipv6_find_idev() directly.YOSHIFUJI Hideaki
Since NETDEV_REGISTER notifier chain is responsible for creating inet6_dev{}, we do not need to call ipv6_find_idev() directly here. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV6]: Make per-net socket lookup.Pavel Emelyanov
The inet6_lookup family of functions requires a net to lookup a socket in, so give a proper one to them. No more things to do for dccpv6, since routing is OK and the ipv4-like transport layer filtering is not done for ipv6. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV6]: Actually create ctl socket on each net and use it.Pavel Emelyanov
Move the call to inet_ctl_sock_create to init callback (and inet_ctl_sock_destroy to exit one) and use proper ctl sock in dccp_v6_ctl_send_reset. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV6]: Move the dccp_v6_ctl_sk on the struct net.Pavel Emelyanov
And replace all its usage with init_net's socket. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV6]: Add dummy per-net operations.Pavel Emelyanov
They will be responsible for ctl socket initialization, but currently they are void. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV6]: Don't pass NULL to ip6_dst_lookup.Pavel Emelyanov
This call uses the sock to get the net to lookup the routing in. With CONFIG_NET_NS this code will OOPS, since the sk ptr is NULL. After looking inside the ip6_dst_lookup and drawing the analogy with respective ipv6 code, it seems, that the dccp ctl socket is a good candidate for the first argument. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV4]: Enable DCCPv4 in net namespaces.Pavel Emelyanov
This enables sockets creation with IPPROTO_DCCP and enables the ip level to pass DCCP packets to the DCCP level. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV4]: Make per-net socket lookup.Pavel Emelyanov
The inet_lookup family of functions requires a net to lookup a socket in, so give a proper one to them. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV4]: Use proper net to route the reset packet.Pavel Emelyanov
The dccp_v4_route_skb used in dccp_v4_ctl_send_reset, currently works with init_net's routing tables - fix it. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV4]: Actually create ctl socket on each net and use it.Pavel Emelyanov
Move the call to inet_ctl_sock_create to init callback (and inet_ctl_sock_destroy to exit one) and use proper ctl sock in dccp_v4_ctl_send_reset. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV4]: Move the dccp_v4_ctl_sk on the struct net.Pavel Emelyanov
And replace all its usage with init_net's socket. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[NETNS][DCCPV4]: Add dummy per-net operations.Pavel Emelyanov
They will be responsible for ctl socket initialization, but currently they are void. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[TCP]: Remove owner from tcp_seq_afinfo.Denis V. Lunev
Move it to tcp_seq_afinfo->seq_fops as should be. Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[TCP]: Place file operations directly into tcp_seq_afinfo.Denis V. Lunev
No need to have separate never-used variable. Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[TCP]: Cleanup /proc/tcp[6] creation/removal.Denis V. Lunev
Replace seq_open with seq_open_net and remove tcp_seq_release completely. seq_release_net will do this job just fine. Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[TCP]: Move seq_ops from tcp_iter_state to tcp_seq_afinfo.Denis V. Lunev
No need to create seq_operations for each instance of 'netstat'. Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[TCP]: No need to check afinfo != NULL in tcp_proc_(un)register.Denis V. Lunev
tcp_proc_register/tcp_proc_unregister are called with a static pointer only. Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[TCP]: Replace struct net on tcp_iter_state with seq_net_private.Denis V. Lunev
Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[INET]: sk_reuse is valboolGerrit Renker
sk_reuse is declared as "unsigned char", but is set as type valbool in net/core/sock.c. There is no other place in net/ where sk->sk_reuse is set to a value > 1, so the test "sk_reuse > 1" can not be true. Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[TIPC]: Improve socket time conversionsAllan Stephens
This patch modifies TIPC's socket code to use standard kernel routines to handle time conversions between jiffies and ms. This ensures proper operation even when HZ isn't 1000. Acknowledgements to Eric Sesterhenn <snakebyte@gmx.de> for identifying this issue and proposing a solution. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-13[TIPC]: Remove redundant socket wait queue initializationAllan Stephens
This patch eliminates re-initialization of the standard socket wait queue used for sleeping in TIPC's socket creation code. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-12Merge branch 'net-2.6.26-misc-20080412b' of ↵David S. Miller
git://git.linux-ipv6.org/gitroot/yoshfuji/linux-2.6-dev
2008-04-12LSM: Make the Labeled IPsec hooks more stack friendlyPaul Moore
The xfrm_get_policy() and xfrm_add_pol_expire() put some rather large structs on the stack to work around the LSM API. This patch attempts to fix that problem by changing the LSM API to require only the relevant "security" pointers instead of the entire SPD entry; we do this for all of the security_xfrm_policy*() functions to keep things consistent. Signed-off-by: Paul Moore <paul.moore@hp.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-04-12[AF_UNIX]: Use SEQ_START_TOKENJoe Perches
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 09:57:43 +0000