Use O_EXCL so that we only create and mount a new network namespace
if there is no chance an existing network namespace is present.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

If libc has setns present use that version instead of
rolling the syscall wrapper by hand.

Dan McGee found the following compile error:

    gcc -D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -I../include
    -DRESOLVE_HOSTNAMES -DLIBDIR=\"/usr/lib/\"   -c -o ipnetns.o ipnetns.c
    ipnetns.c:31:12: error: static declaration of ‘setns’ follows non-static
    declaration
    /usr/include/bits/sched.h:93:12: note: previous declaration of ‘setns’
    was here
    make[1]: *** [ipnetns.o] Error 1
Reported-by: Dan McGee <dan@archlinux.org>
Tested-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

Update the automatically generated sanitized headers

On Arch Linux, we still install the iptables shared libraries in
/usr/lib/iptables/, even though the main library is installed to
/usr/lib/libxtables.so. This change checks all available locations to
correctly find the iptables library directory.
Signed-off-by: Dan McGee <dan@archlinux.org>

when specifiying filters without 'protocol' keyword, tc will
default to 'protocol all'.

Unfortunately, this missed a byte-ordering conversion.

This hasn't been updated since 2006.

and make type table const.

Document 'divisor' option and mention that external classifiers can be used.

Extra bracket

$ ip route help 2>&1 | grep monitor
ip route { add | del | change | append | replace | monitor } ROUTE
$ ip route monitor
Command "monitor" is unknown, try "ip route help".

(I guess what was really intended is "ip monitor route", so just remove
the argument from the help output.)

Originally reported by martin f krafft at http://bugs.debian.org/537681

While at it, also drop all non-existant (route,link,netns) monitor
arguments from the ip(8) man page.
Signed-off-by: Andreas Henriksson <andreas@fatal.se>

The "ip monitor" command does properly decode the "preferred" and
"valid" lifetime records in router advertisements from netlink
messages.

Basic configuration support for QFQ.
Still need to add manual page.

redo.

The goal of this code change is to implement a mechanism such that it is
simple to work with a kernel that is using multiple network namespaces
at once.

This comes in handy for interacting with vpns where there may be rfc1918
address overlaps, and different policies default routes, name servers
and the like.

Configuration specific to a network namespace that would ordinarily be
stored under /etc/ is stored under /etc/netns/<name>.  For example if
the dns server configuration is different for your vpn you would create
a file /etc/netns/myvpn/resolv.conf.

File descriptors that can be used to manipulate a network namespace can
be created by opening /var/run/netns/<NAME>.

This adds the following commands to iproute.
ip netns add NAME
ip netns delete NAME
ip netns monitor
ip netns list
ip netns exec NAME cmd ....
ip link set DEV netns NAME

ip netns exec exists to cater the vast majority of programs that only
know how to operate in a single network namespace.  ip netns exec
changes the default network namespace, creates a new mount namespace,
remounts /sys and bind mounts netns specific configuration files to
their standard locations.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

getline() returns -1 on EOF, need to not loose that by forcing
result to size_t (unsigned).

Reported-by: Petr Sabata

iptables/xtables apparently changed API again.... Now you need to pass
and extra parameter (orig_opts) which was not needed before.

Sprinkle some lovely pre-processor magic to be compatible with both older
and new versions. In the beginning of times XTABLES_VERSION_CODE didn't
exist. Then it was (0x10000 * major + 0x100 * minor + patch) when it was
first introduced (according to git), but now it's at 6...
Don't know what official iptables releases has defined it to over time.
Lets just hope none of the older versions with is has the define
higher then 6 is still around.... so only the "current" versioning
scheme is supported.... lets see how long this lasts now.

For the API change in xtables, see:
http://git.netfilter.org/cgi-bin/gitweb.cgi?p=iptables.git;a=commitdiff;h=600f38db82548a683775fd89b6e136673e924097Signed-off-by: Andreas Henriksson <andreas@fatal.se>

This patch removes unreachable, useless code.
Signed-off-by: Petr Sabata <contyk@redhat.com>

The ip(8) man page and the "ip xfrm [ XFRM-OBJECT ] help" command output
are updated to include missing options, fix errors, and improve grammar.
There are no functional changes made.

The documentation for the ip command has many different meanings for the
same formatting symbols (which really needs to be fixed). This patch makes
consistent use of brackets [ ] to indicate optional parameters, pipes | to
mean "OR", braces { } to group things together, and dashes - instead of
underscores _ inside of parameter names. The parameters are listed in the
order in which they are parsed in the source code.

There are several parameters and options that are still not mentioned or
need to be described more thoroughly in the "COMMAND SYNTAX" section of
the ip(8) man page. I would appreciate help from the developers with this.
Signed-off-by: David Ward <david.ward@ll.mit.edu>

Signed-off-by: Gilles Espinasse <g.esp@free.fr>

Don't ignore readlink failure.

Fixes following error. We currently provide garbage data to kernel, that
can abort the validation process or produce unexpected results.

$ ss -a autobound
State      Recv-Q Send-Q      Local Address:Port          Peer Address:Port
TCPDIAG answers: Invalid argument

After patch:

$ misc/ss -a autobound
State      Recv-Q Send-Q      Local Address:Port          Peer Address:Port
LISTEN     0      128                     *:44624                    *:*
ESTAB      0      0            192.168.1.21:47141        74.125.79.109:imaps
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>

Problem reported by Peter Lebbing on Debian.
The decode of source and destination port filters in pretty print
mode was backwards.

Eric Dumazet a écrit :
> We currently use an expensive ioctl() to get device txqueuelen, while
> rtnetlink gave it to us for free. This patch speeds up ip link operation
> when many devices are registered.
>

Here is a 2nd version od this patch, not displaying "qlen 0" useless info

[PATCH iproute2] ip: Support IFLA_TXQLEN in ip link show command

We currently use an expensive ioctl() to get device txqueuelen, while
rtnetlink gave it to us for free. This patch speeds up ip link operation
when many devices are registered.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>

This changes mqprio input format to be more user friendly.

Old usage,

 # ./tc/tc qdisc add dev eth3 root mqprio help
Usage: ... mqprio [num_tc NUMBER] [map P0 P1...]
                  [offset txq0 txq1 ...] [count cnt0 cnt1 ...] [hw 1|0]

New usage,

 # ./tc/tc qdisc add dev eth3 root mqprio help
Usage: ... mqprio [num_tc NUMBER] [map P0 P1 ...]
                  [queues count1@offset1 count2@offset2 ...] [hw 1|0]
Suggested-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: John Fastabend <john.r.fastabend@intel.com>

Conflicts:
	include/linux/xfrm.h
	ip/iplink.c

Now that headers are sanitized, use the define.

parse flag XFRM_POLICY_ICMP
Signed-off-by: Ulrich Weber <uweber@astaro.com>

Change url's and describe current kernel header values.

Add mqprio qdisc support. Output matches the following,

qdisc mq 0: dev eth1 root
qdisc mq 0: dev eth2 root
qdisc mqprio 8001: dev eth3 root  tc 8 map 0 1 2 3 4 5 6 7 1 1 1 1 1 1 1 1
             queues:(0:7) (8:15) (16:23) (24:31) (32:39) (40:47) (48:55) (56:63)

And usage is,

Usage: ... mclass [num_tc NUMBER] [map P0 P1...]
                  [offset txq0 txq1 ...] [count cnt0 cnt1 ...] [hw 1|0]
Signed-off-by: John Fastabend <john.r.fastabend@intel.com>