Adds security context support to ip xfrm policy.
Signed-off-by: Joy Latten <latten@austin.ibm.com>

In the Linux kernel, ipsec policy and SAs can include a
security context to support MAC networking. This feature
is often referred to as "labeled ipsec".

This patchset adds security context support into ip xfrm
such that a security context can be included when
add/delete/display SAs and policies with the ip command.
The user provides the security context when adding
SAs and policies. If a policy or SA contains a security
context, the changes allow the security context to be displayed.

For example,
ip xfrm state
src 10.1.1.6 dst 10.1.1.2
	proto esp spi 0x00000301 reqid 0 mode transport
	replay-window 0
	auth hmac(digest_null) 0x3078
	enc cbc(des3_ede) 0x6970763672656164796c6f676f33646573636263696e3031
	security context root:system_r:unconfined_t:s0

Please  let me know if all is ok with the patchset.
Thanks!!

regards,
Joy
Signed-off-by: Joy Latten <latten@austin.ibm.com>

Add the group keyword to ip link set, which has the following meaning:
If both a group and a device name are pressent, we change the device's
group to the specified one. If only a group is present, then the
operation specified by the rest of the command should apply on an entire
group, not a single device.

So, to set eth0 to the default group, one would use
	ip link set dev eth0 group default

Conversely, to set all the devices in the default group down, use
	ip link set group default down
Signed-off-by: Vlad Dogaru <ddvlad@rosedu.org>

Add the group keyword to ip link set, which has the following meaning:
If both a group and a device name are pressent, we change the device's
group to the specified one. If only a group is present, then the
operation specified by the rest of the command should apply on an entire
group, not a single device.

So, to set eth0 to the default group, one would use
	ip link set dev eth0 group default

Conversely, to set all the devices in the default group down, use
	ip link set group default down
Signed-off-by: Vlad Dogaru <ddvlad@rosedu.org>

User can specify device group to list by using the group keyword:

	ip link show group test

If no group is specified, 0 (default) is implied.
Signed-off-by: Vlad Dogaru <ddvlad@rosedu.org>

Conflicts:
	include/linux/pkt_sched.h

TC commands for CHOKe qdisc

This reverts commit 632110aa.

There seem to be some recent changes in the 802.1Qbh/bg specs which may
result in changes to this patch in the near future. It seems like its best
to ignore this patch for now.
I will re-spin at a later time when the changes in the specs converge.

BTW, Please let me know if I should CC netdev list and others on the
original email. I can resend this email.

Thanks,
Roopa

Resubmitting Scott Feldmans original patch with below changes

- Fix port profile strlen which was off by 1
- Added function to convert IFLA_PORT_RESPONSE codes to string

Add support for IFLA_VF_PORTS.  VF port netlink msg layout is

        [IFLA_NUM_VF]
        [IFLA_VF_PORTS]
                [IFLA_VF_PORT]
                        [IFLA_PORT_*], ...
                [IFLA_VF_PORT]
                        [IFLA_PORT_*], ...
                ...
        [IFLA_PORT_SELF]
                [IFLA_PORT_*], ...

The iproute2 cmd line for link set is now:

Usage: ip link add link DEV [ name ] NAME
                   [ txqueuelen PACKETS ]
                   [ address LLADDR ]
                   [ broadcast LLADDR ]
                   [ mtu MTU ]
                   type TYPE [ ARGS ]
       ip link delete DEV type TYPE [ ARGS ]

       ip link set DEVICE [ { up | down } ]
                          [ arp { on | off } ]
                          [ dynamic { on | off } ]
                          [ multicast { on | off } ]
                          [ allmulticast { on | off } ]
                          [ promisc { on | off } ]
                          [ trailers { on | off } ]
                          [ txqueuelen PACKETS ]
                          [ name NEWNAME ]
                          [ address LLADDR ]
                          [ broadcast LLADDR ]
                          [ mtu MTU ]
                          [ netns PID ]
                          [ alias NAME ]
                          [ port MODE { PROFILE | VSI } ]
                          [ vf NUM [ mac LLADDR ]
                                   [ vlan VLANID [ qos VLAN-QOS ] ]
                                   [ rate TXRATE ]
                                   [ port MODE { PROFILE | VSI } ] ]
       ip link show [ DEVICE ]

TYPE := { vlan | veth | vcan | dummy | ifb | macvlan | can }
MODE := { assoc | preassoc | preassocrr | disassoc }
PROFILE := profile PROFILE
           [ instance UUID ]
           [ host UUID ]
VSI := vsi mgr MGRID type VTID ver VER
       [ instance UUID ]
Signed-off-by: Scott Feldman <scofeldm@cisco.com>
Signed-off-by: Roopa Prabhu <roprabhu@cisco.com>

Use sanitized headers from 2.6.37-rc8

In preparation for adding name hash:
  * add const
  * use same types in cache as ifinfomsg
  * rename idxmap to ll_cache

Avoid initializing the LL map (which involves a costly RTNL dump)
multiple times. This can happen when running in batch mode.
Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>

The default of 16 is too small for users with 10,000 interfaces.

A small typo fix.

This patch adds save and restore commands to "ip route". Save dumps
the RTNL stream to stdout which can then be passed to restore later.
This may be helpful in some normal situations, and will allow C/R to
migrate the routing information in userspace.  Tweaking of the stream
can be done by userspace helpers to convert between versions and adjust
things like device indexes when restoring routes in a different
environment.

By factoring out some of the common bits of print_route() into
filter_nlmsg(), the "save" command can use the same selection logic
as "list," allowing the caller to save only specific routes as
necessary.

The only change since the RFC is the addition of manpage and doc
material.
Signed-off-by: Dan Smith <danms@us.ibm.com>

Add the iproute2 support for the ACT_CSUM action. Can be used as
following, certainly in conjunction with the ACT_PEDIT action (pedit):

 # In order to DNAT (stateless) IPv4 packet from 192.168.1.100 to
 #  0x12345678 (18.52.86.120), and update the IPv4 header checksum and
 #  the UDP checksum (the last one, only if the packet is UDP).
tc filter add eth0 prio 1 protocol ip parent ffff: \
  u32 match ip src 192.168.1.100/32 flowid :1 \
    action pedit munge offset 16 u32 set 0x12345678 \
      pipe csum ip and udp

 # In order to alter destination address of IPv6 TCP packets from fc00::1
 #  and correct the TCP checksum (nothing happened? except maybe for
 #  checksums in the TCP payload ...).
tc filter add eth0 prio 1 protocol ipv6 parent ffff: \
  u32 match ip6 src fc00::1/128 match ip6 protocol 0x06 0xff flowid :1 \
    action pedit munge offset 24 u32 set 0x12345678 \
      pipe csum tcp

The default remains at 10 for backwards compatibility.

For instance:
 # ip addr flush dev eth2
 *** Flush remains incomplete after 10 rounds. ***
 # ip -l 20 addr flush dev eth2
 *** Flush remains incomplete after 20 rounds. ***
 # ip -loops 0 addr flush dev eth2
 #

This is useful for getting rid of large numbers of IP
addresses in scripts.
Signed-off-by: Ben Greear <greearb@candelatech.com>

Add support for 'mode' parameter when creating a macvtap device.
This allows a macvtap device to be created in bridge, private or
the default vepa modes.
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>

-------------------------------------------------------------------
Acked-by: Arnd Bergmann <arnd@arndb.de>

Print directly to the file instead of going through a buffer.
Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>

We can use rxhash to classify the traffic into flows. As rxhash maybe
supplied by NIC or RPS, it is cheaper.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>

Similar to tunnel side: accept dotted-quad and number formats.
Use regular number for printing the key.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>

Print GRE key as a regular number. It is not really an IPv4 address
and this is also how Cisco and Juniper treats GRE keys. Do keep the
parsing of dotted-quad format for backwards compatibility.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>

iptables dropped the xtables_set_revision() function around version 1.4.9,
so set the rev directly ourselves.  This should be compatible back to the
original version m_xt itself is designed for.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

Use the available libraries for mapping from interface index to name
or type. This should speed up display with lots of interfaces

The subdirectory makefiles need Config file to exist.
Therefore create it, then run make clean, then remove it.

Use santized headers from 2.6.36 release

display socket policy direction
Signed-off-by: Ulrich Weber <uweber@astaro.com>

Bug reported where priorities of GRED DP's are ignored.
The option parsing sets opt then memset was clearing these
values.

Le lundi 23 août 2010 à 10:33 -0700, Stephen Hemminger a écrit :

> I think this breaks the wraparound detection code in this command.
>
>

OK lets fix the bug only, before adding 64bit counters capabilities.

Thanks

[PATCH] iproute2: add 64bit arches support to ifstat

ifstat assumes IFLA_STATS fields are "unsigned long", but they are
__u32. This fix is needed to let ifstat run on 64bit arches.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>

In recent kernels, net_device_stats is not exposed and the code
shoulf have used rt_link_statistics.  Also, fix use of sprintf
with user supplied value.

Adds support for RTA_MARK rt attribute added in linux-2.6.36

$ ip route get ADDR mark 4
192.168.20.110 dev eth1  src 192.168.20.108  mark 4
    cache  mtu 1500 advmss 1460 hoplimit 64

$ ip route get 192.168.20.108 from ADDR iif STRING mark 256
local 192.168.20.108 from 192.168.20.110 dev lo  src 192.168.20.108  mark 0x100
    cache <local,src-direct>  iif eth1

$ ip route list cache [ADDR] mark NUMBER

Hexadecimal output if mark >= 16
null marks are not displayed.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>