- 26 Apr, 2007 40 commits
-
-
Pablo Neira Ayuso authored
Use nfattr_parse to parse attributes, this patch also modifies the default behaviour since unknown attributes will be ignored instead of returning EINVAL. This ensure backward compatibility: new libraries with new attributes and old kernels can work. Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Pablo Neira Ayuso authored
This patch let userspace programs set the IP_CT_TCP_BE_LIBERAL flag to force the pickup of established connections. Signed-off-by:
-
Willy Tarreau authored
The PUSH flag is accepted with every other valid combination. Let's get it out of the tcp_valid_flags table and reduce the number of combinations we have to handle. This does not significantly reduce the table size however (8 bytes). Signed-off-by:
Willy Tarreau <w@1wt.eu> Signed-off-by:
-
Willy Tarreau authored
This combination has been encountered on an IBM AS/400 in response to packets sent to a closed session. There is no particular reason to mark it invalid. Signed-off-by:
-
Yasuyuki Kozakai authored
This unifies the codes to copy netfilter related datas. Before copying, nf_copy() puts original members in destination skb. Signed-off-by:
Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Signed-off-by:
-
Yasuyuki Kozakai authored
This unifies the codes to copy netfilter related datas. Note that __nf_copy() assumes destination skb doesn't have any netfilter related members. Signed-off-by:
-
Sami Farin authored
Now it uses jhash, but using jhash2 would be around 3-4 times faster (on P4). Signed-off-by:
Sami Farin <safari-netfilter@safari.iki.fi> Signed-off-by:
-
Patrick McHardy authored
Use const to avoid forcing users to cast const data. Signed-off-by:
-
Pablo Neira Ayuso authored
Signed-off-by:
-
Pablo Neira Ayuso authored
Signed-off-by:
-
Pablo Neira Ayuso authored
subsys_table is initialized to NULL, therefore just returns NULL in case that it is not set. Signed-off-by:
-
Pablo Neira Ayuso authored
Remove nfnetlink_check_attributes duplicates message size and callback id checks. nfnetlink_find_client and nfnetlink_rcv_msg already do such checks. Signed-off-by:
-
Pablo Neira Ayuso authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
The retrying after an allocation failure is not necessary anymore since we're holding the mutex the entire time, for the same reason the double allocation race can't happen anymore. Signed-off-by:
-
Patrick McHardy authored
Now that we don't use nf_conntrack_lock anymore but a single mutex for all protocol handling, no need to release and grab it again for sysctl registration. Signed-off-by:
-
Patrick McHardy authored
Remove ugly special-casing of nf_conntrack_l4proto_generic, all it wants is its sysctl tables registered, so do that explicitly in an init function and move the remaining protocol initialization and cleanup code to nf_conntrack_proto.c as well. Signed-off-by:
-
Patrick McHardy authored
The protocol lookups done by nf_conntrack are already protected by RCU, there is no need to keep taking nf_conntrack_lock for registration and unregistration. Switch to a mutex. Signed-off-by:
-
Patrick McHardy authored
Remove the obsolete IPv4 only connection tracking/NAT as scheduled in feature-removal-schedule. Signed-off-by:
-
Tobias Klauser authored
Remove xt_proto_prefix array which duplicates xt_prefix and change all users of xt_proto_prefix to xt_prefix. Signed-off-by:
Tobias Klauser <tklauser@distanz.ch> Signed-off-by:
-
David S. Miller authored
Signed-off-by: -
Arnaldo Carvalho de Melo authored
For the places where we need a pointer to the transport header, it is still legal to touch skb->h.raw directly if just adding to, subtracting from or setting it to another layer header. Signed-off-by:
Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
Arnaldo Carvalho de Melo authored
These are a bit more subtle, they are of this type: - skb->h.raw = payload; __skb_pull(skb, payload - skb->data); + skb_reset_transport_header(skb); __skb_pull results in: skb->data = skb->data + payload - skb->data; skb->data = payload; So after __skb_pull we have skb->data pointing to payload and we can just call skb_reset_transport_header(skb), that will do: skb->h.raw = payload; The others are similar, allowing us to get rid of some more cases where a pointer was being attributed to the layer headers. Signed-off-by: -
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
Arnaldo Carvalho de Melo authored
The ip_hdrlen() buddy, created to reduce the number of skb->h.th-> uses and to avoid the longer, open coded equivalent. Ditched a no-op in bnx2 in the process. I wonder if we should have a BUG_ON(skb->h.th->doff < 5) in tcp_optlen()... Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
Arnaldo Carvalho de Melo authored
For consistency with all the other skb->h.raw accessors. Signed-off-by:
-
Arnaldo Carvalho de Melo authored
For consistency with all the other skb->h.raw accessors. Signed-off-by:
-
Arnaldo Carvalho de Melo authored
For the cases where the transport header is being set to a offset from skb->data. Signed-off-by:
-
Arnaldo Carvalho de Melo authored
For the quite common 'skb->h.raw - skb->data' sequence. Signed-off-by:
-
Arnaldo Carvalho de Melo authored
For the common, open coded 'skb->h.raw = skb->data' operation, so that we can later turn skb->h.raw into a offset, reducing the size of struct sk_buff in 64bit land while possibly keeping it as a pointer on 32bit. This one touches just the most simple cases: skb->h.raw = skb->data; skb->h.raw = {skb_push|[__]skb_pull}() The next ones will handle the slightly more "complex" cases. Signed-off-by: -
Arnaldo Carvalho de Melo authored
Now the skb->nh union has just one member, .raw, i.e. it is just like the skb->mac union, strange, no? I'm just leaving it like that till the transport layer is done with, when we'll rename skb->mac.raw to skb->mac_header (or ->mac_header_offset?), ditto for ->{h,nh}. Signed-off-by: -
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
