- 08 Oct, 2008 40 commits
-
-
Jan Engelhardt authored
Usually -EINVAL is used when checkentry fails (see *_tables). Signed-off-by:
Jan Engelhardt <jengelh@medozas.de> Signed-off-by:
Patrick McHardy <kaber@trash.net>
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Ebtables ORs (1 << NF_BR_NUMHOOKS) into the hook mask to indicate that the extension was called from a base chain. So this also needs to be present in the extensions' ->hooks. Signed-off-by:
-
Jan Engelhardt authored
It is a mask, and masks are most useful in hex. Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
The function signatures will be changed to match those of Xtables, and the datalen argument will be gone. ebt_among unfortunately relies on it, so we need to obtain it somehow. Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
Jan Engelhardt authored
Signed-off-by:
-
KOVACS Krisztian authored
Add basic usage instructions to Documentation/networking. Signed-off-by:
KOVACS Krisztian <hidden@sch.bme.hu> Signed-off-by:
-
KOVACS Krisztian authored
The TPROXY target implements redirection of non-local TCP/UDP traffic to local sockets. Additionally, it's possible to manipulate the packet mark if and only if a socket has been found. (We need this because we cannot use multiple targets in the same iptables rule.) Signed-off-by:
-
KOVACS Krisztian authored
Add iptables 'socket' match, which matches packets for which a TCP/UDP socket lookup succeeds. Signed-off-by:
-
KOVACS Krisztian authored
The iptables tproxy core is a module that contains the common routines used by various tproxy related modules (TPROXY target and socket match) Signed-off-by:
-
KOVACS Krisztian authored
Netfilter connection tracking requires all IPv4 packets to be defragmented. Both the socket match and the TPROXY target depend on this functionality, so this patch separates the Netfilter IPv4 defrag hooks into a separate module. Signed-off-by:
-
Alexey Dobriyan authored
From kernel perspective, allow entrance in nf_hook_slow(). Stuff which uses nf_register_hook/nf_register_hooks, but otherwise not netns-ready: DECnet netfilter ipt_CLUSTERIP nf_nat_standalone.c together with XFRM (?) IPVS several individual match modules (like hashlimit) ctnetlink NOTRACK all sorts of queueing and reporting to userspace L3 and L4 protocol sysctls, bridge sysctls probably something else Anyway critical mass has been achieved, there is no reason to hide netfilter any longer. From userspace perspective, allow to manipulate all sorts of iptables/ip6tables/arptables rules. Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Same story as with iptable_filter, iptables_raw tables. Signed-off-by:
-
Alexey Dobriyan authored
First, allow entry in notifier hook. Second, start conntrack cleanup in netns to which netdevice belongs. Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
* make keymap list per-netns * per-netns keymal lock (not strictly necessary) * flush keymap at netns stop and module unload. Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Add init_net checks to not remove kmem_caches twice and so on. Refactor functions to split code which should be executed only for init_net into one place. ip_ct_attach and ip_ct_destroy assignments remain separate, because they're separate stages in setup and teardown. NOTE: NOTRACK code is in for-every-net part. It will be made per-netns after we decidce how to do it correctly. Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Note, sysctl table is always duplicated, this is simpler and less special-cased. Signed-off-by:
-
Alexey Dobriyan authored
Show correct conntrack count, while I'm at it. Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Heh, last minute proof-reading of this patch made me think, that this is actually unneeded, simply because "ct" pointers will be different for different conntracks in different netns, just like they are different in one netns. Not so sure anymore. [Patrick: pointers will be different, flushing can only be done while inactive though and thus it needs to be per netns] Signed-off-by:
-
Alexey Dobriyan authored
This is cleaner, we already know conntrack to which event is relevant. Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
