1. 08 Oct, 2013 2 commits
  2. 07 Oct, 2013 7 commits
  3. 04 Oct, 2013 1 commit
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · d639feaa
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      The following patchset contains Netfilter updates for your net-next tree,
      mostly ipset improvements and enhancements features, they are:
      
      * Don't call ip_nest_end needlessly in the error path from me, suggested
        by Pablo Neira Ayuso, from Jozsef Kadlecsik.
      
      * Fixed sparse warnings about shadowed variable and missing rcu annotation
        and fix of "may be used uninitialized" warnings, also from Jozsef.
      
      * Renamed simple macro names to avoid namespace issues, reported by David
        Laight, again from Jozsef.
      
      * Use fix sized type for timeout in the extension part, and cosmetic
        ordering of matches and targets separatedly in xt_set.c, from Jozsef.
      
      * Support package fragments for IPv4 protos without ports from Anders K.
        Pedersen. For example this allows a hash:ip,port ipset containing the
        entry 192.168.0.1,gre:0 to match all package fragments for PPTP VPN
        tunnels to/from the host. Without this patch only the first package
        fragment (with fragment offset 0) was matched.
      
      * Introduced a new operation to get both setname and family, from Jozsef.
        ip[6]tables set match and SET target need to know the family of the set
        in order to reject adding rules which refer to a set with a non-mathcing
        family. Currently such rules are silently accepted and then ignored
        instead of generating an error message to the user.
      
      * Reworked extensions support in ipset types from Jozsef. The approach of
        defining structures with all variations is not manageable as the
        number of extensions grows. Therefore a blob for the extensions is
        introduced, somewhat similar to conntrack. The support of extensions
        which need a per data destroy function is added as well.
      
      * When an element timed out in a list:set type of set, the garbage
        collector skipped the checking of the next element. So the purging
        was delayed to the next run of the gc, fixed by Jozsef.
      
      * A small Kconfig fix: NETFILTER_NETLINK cannot be selected and
        ipset requires it.
      
      * hash:net,net type from Oliver Smith. The type provides the ability to
        store pairs of subnets in a set.
      
      * Comment for ipset entries from Oliver Smith. This makes possible to
        annotate entries in a set with comments, for example:
      
        ipset n foo hash:net,net comment
        ipset a foo 10.0.0.0/21,192.168.1.0/24 comment "office nets A and B"
      
      * Fix of hash types resizing with comment extension from Jozsef.
      
      * Fix of new extensions for list:set type when an element is added
        into a slot from where another element was pushed away from Jozsef.
      
      * Introduction of a common function for the listing of the element
        extensions from Jozsef.
      
      * Net namespace support for ipset from Vitaly Lavrov.
      
      * hash:net,port,net type from Oliver Smith, which makes possible
        to store the triples of two subnets and a protocol, port pair in
        a set.
      
      * Get xt_TCPMSS working with net namespace, by Gao feng.
      
      * Use the proper net netnamespace to allocate skbs, also by Gao feng.
      
      * A couple of cleanups for the conntrack SIP helper, by Holger
        Eitzenberger.
      
      * Extend cttimeout to allow setting default conntrack timeouts via
        nfnetlink, so we can get rid of all our sysctl/proc interfaces in
        the future for timeout tuning, from me.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d639feaa
  4. 03 Oct, 2013 30 commits