- 28 Jan, 2008 40 commits
-
-
Patrick McHardy authored
nf_conntrack_h323 needs ip6_route_output for the call forwarding filter. Add a ->route function to nf_afinfo and use that to avoid pulling in the ipv6 module. Fix the #ifdef for the IPv6 code while I'm at it - the IPv6 support is only needed when IPv6 conntrack is enabled. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Patrick McHardy authored
Switch from ipv6_find_hdr to ipv6_skip_exthdr to avoid pulling in ip6_tables and ipv6 when only using it for IPv4. Signed-off-by:
-
Maciej Soltysiak authored
Log GID in addition to UID Signed-off-by:
Maciej Soltysiak <maciej.soltysiak@ae.poznan.pl> Signed-off-by:
-
Patrick McHardy authored
Add rate estimator match. The rate estimator match can match on estimated rates by the RATEEST target. It supports matching on absolute bps/pps values, comparing two rate estimators and matching on the difference between two rate estimators. This is what I use to route outgoing data connections from a FTP server over two lines based on the available bandwidth: # estimate outgoing rates iptables -t mangle -A POSTROUTING -o eth0 -j RATEEST --rateest-name eth0 \ --rateest-interval 250ms \ --rateest-ewma 0.5s iptables -t mangle -A POSTROUTING -o ppp0 -j RATEEST --rateest-name ppp0 \ --rateest-interval 250ms \ --rateest-ewma 0.5s # mark based on available bandwidth iptables -t mangle -A BALANCE -m state --state NEW \ -m helper --helper ftp \ -m rateest --rateest-delta \ --rateest1 eth0 \ --rateest-bps1 2.5mbit \ --rateest-gt \ --rateest2 ppp0 \ --rateest-bps2 2mbit \ -j CONNMARK --set-mark 0x1 iptables -t mangle -A BALANCE -m state --state NEW \ -m helper --helper ftp \ -m rateest --rateest-delta \ --rateest1 ppp0 \ --rateest-bps1 2mbit \ --rateest-gt \ --rateest2 eth0 \ --rateest-bps2 2.5mbit \ -j CONNMARK --set-mark 0x2 iptables -t mangle -A BALANCE -j CONNMARK --restore-mark Signed-off-by: -
Patrick McHardy authored
Add new rate estimator target (using gen_estimator). In combination with the rateest match (next patch) this can be used for load-based multipath routing. Signed-off-by:
-
Patrick McHardy authored
Remove the ipt_SAME target as scheduled in feature-removal-schedule. Signed-off-by:
-
Jan Engelhardt authored
Extends the xt_DSCP target by xt_TOS v1 to add support for selectively setting and flipping any bit in the IPv4 TOS and IPv6 Priority fields. (ipt_TOS and xt_DSCP only accepted a limited range of possible values.) Signed-off-by:
Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by:
-
Jan Engelhardt authored
Extends the xt_dscp match by xt_tos v1 to add support for selectively matching any bit in the IPv4 TOS and IPv6 Priority fields. (ipt_tos and xt_dscp only accepted a limited range of possible values.) Signed-off-by:
-
Jan Engelhardt authored
Merge ipt_TOS into xt_DSCP. Merge ipt_TOS (tos v0 target) into xt_DSCP. They both modify the same field in the IPv4 header, so it seems reasonable to keep them in one piece. This is part two of the implicit 4-patch series to move tos to xtables and extend it by IPv6. Signed-off-by:
-
Jan Engelhardt authored
Merge ipt_tos into xt_dscp. Merge ipt_tos (tos v0 match) into xt_dscp. They both match on the same field in the IPv4 header, so it seems reasonable to keep them in one piece. This is part one of the implicit 4-patch series to move tos to xtables and extend it by IPv6. Signed-off-by:
-
Jan Engelhardt authored
Constify include/net/dsfield.h Signed-off-by:
-
Jan Engelhardt authored
Unify netfilter match kconfig descriptions Consistently use lowercase for matches in kconfig one-line descriptions and name the match module. Signed-off-by:
-
Laszlo Attila Toth authored
Addrtype match has a new revision (1), which lets address type checking limited to the interface the current packet belongs to. Either incoming or outgoing interface can be used depending on the current hook. In the FORWARD hook two maches should be used if both interfaces have to be checked. The new structure is ipt_addrtype_info_v1. Revision 0 lets older userspace programs use the match as earlier. ipt_addrtype_info is used. Signed-off-by:
Laszlo Attila Toth <panther@balabit.hu> Signed-off-by:
-
Laszlo Attila Toth authored
Address type search can be limited to an interface by inet_dev_addr_type function. Signed-off-by:
-
Jan Engelhardt authored
xt_owner merges ipt_owner and ip6t_owner, and adds a flag to match on socket (non-)existence. Signed-off-by:
-
Patrick McHardy authored
We're not multiplying the size with the number of CPUs anymore, so the check is obsolete. Signed-off-by:
-
Eric Dumazet authored
Instead of using a big array of NR_CPUS entries, we can compute the size needed at runtime, using nr_cpu_ids This should save some ram (especially on David's machines where NR_CPUS=4096 : 32 KB can be saved per table, and 64KB for dynamically allocated ones (because of slab/slub alignements) ) In particular, the 'bootstrap' tables are not any more static (in data section) but on stack as their size is now very small. This also should reduce the size used on stack in compat functions (get_info() declares an automatic variable, that could be bigger than kernel stack size for big NR_CPUS) Signed-off-by:
Eric Dumazet <dada1@cosmosbay.com> Signed-off-by:
-
Jan Engelhardt authored
Give all Netfilter modules consistent and unique symbol names. Signed-off-by:
-
Li Zefan authored
Signed-off-by:
Li Zefan <lizf@cn.fujitsu.com> Signed-off-by:
-
Sven Schnelle authored
Signed-off-by:
Sven Schnelle <svens@bitebene.org> Signed-off-by:
Jan Engelhardt <jengelh@gmx.de> Signed-off-by:
-
Denis V. Lunev authored
This patch speedups compilation when net_namespace.h is changed. Signed-off-by:
Denis V. Lunev <den@openvz.org> Acked-by:
"Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by:
-
Patrick McHardy authored
Fix large number of checkpatch errors. Signed-off-by:
-
Herbert Xu authored
When merging the input paths of IPsec I accidentally left a hard-coded AF_INET for the state lookup call. This broke IPv6 obviously. This patch fixes by getting the input callers to specify the family through skb->cb. Credit goes to Kazunori Miyazawa for diagnosing this and providing an initial patch. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Wang Chen authored
System calls should be USER. So change the BH to USER for UDP*_INC_STATS_BH(). Signed-off-by:
Wang Chen <wangchen@cn.fujitsu.com> Signed-off-by:
-
Wang Chen authored
Since we have macro IS_UDPLITE, we can use it. Signed-off-by:
-
Wang Chen authored
Thanks dave, herbert, gerrit, andi and other people for your discussion about this problem. UdpInDatagrams can be confusing because it counts packets that might be dropped later. Move UdpInDatagrams into recvmsg() as allowed by the RFC. Signed-off-by:
-
Ilpo Järvinen authored
Pointing to the next skb is necessary to avoid referencing already SACKed skbs which will soon be on a separate list. Signed-off-by:
Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by:
-
Ilpo Järvinen authored
Signed-off-by:
-
Ilpo Järvinen authored
Signed-off-by:
-
Ilpo Järvinen authored
Signed-off-by:
-
Ilpo Järvinen authored
Signed-off-by:
-
Ilpo Järvinen authored
Lines won't be that long and it's compiler's job to optimize them. Signed-off-by:
-
Ilpo Järvinen authored
They better be valid when call to write_queue functions is made once things that follow are going in. Signed-off-by:
-
Ilpo Järvinen authored
Signed-off-by:
-
Ilpo Järvinen authored
Bogus seqno compares just mislead, the code is identical for both sides of the seqno compare (and was even executed just once because of return in between). Signed-off-by:
-
Ilpo Järvinen authored
To get there, highest_sack must have advanced. When it advances, a new skb is SACKed, which already sets that FLAG. Besides, the original purpose of it has puzzled me, never understood why LOST bit setting of retransmitted skb is marked with FLAG_DATA_SACKED. Signed-off-by:
-
Ilpo Järvinen authored
Usually those skbs will have L set, not counting them as lost retransmissions is misleading. Signed-off-by:
-
Pavel Emelyanov authored
This looks very much like the patch for ipv4's devinet. This is also intended to help us with the net namespaces and saves the ipv6.ko size by ~320 bytes. The difference from the first version is just the patch offsets, that changed due to changes in the patch #2. Signed-off-by:
Pavel Emelyanov <xemul@openvz.org> Signed-off-by:
-
Pavel Emelyanov authored
Currently this call is (ab)used similar to devinet one - it registers sysctls for devices and for the "default" confs, while the "all" sysctls are registered separately. But unlike its devinet brother, the passed inet6_device is needed. The fix is to make a __addrconf_sysctl_register(), which registers sysctls for all "devices" we need, including "default" and "all" :) The original addrconf_sysctl_register() calls the introduced function, passing the inet6_device, device name and ifindex (to be used as procname and ctl_name) into it. Thanks to Herbert again for pointing out, that we can shrink the argument list to 1 :) Signed-off-by:
-
Pavel Emelyanov authored
This looks very much like the patch for neighbors. The path is also located on the stack and is prepared inside the function. This time, the call to the registering function is guarded with the RTNL lock, but I decided to keep it on the stack not to litter the devinet.c file with unneeded names and to make it look similar to the neighbors code. This is also intended to help us with the net namespaces and saves the vmlinux size as well - this time by more than 670 bytes. The difference from the first version is just the patch offsets, that changed due to changes in the patch #2. Signed-off-by:
-
