- 28 Jan, 2008 40 commits
-
-
Patrick McHardy authored
Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Similar to Maciej Soltysiak's ipt_LOG patch, include GID in addition to UID in netlink message. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Currently we return EINVAL for "instance exists", "allocation failed" and "module unloaded below us", which is completely inapproriate. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Similar to the nfnetlink_queue fixes: The peer_pid must be checked in all cases when a logging instance exists, additionally we must check whether an instance exists before attempting to configure it to avoid NULL ptr dereferences. Signed-off-by:
-
Patrick McHardy authored
Whatever that comment tries to say, I don't get it and it looks like a leftover from the time when RCU wasn't used properly. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
nf_nat_setup_info gets the hook number and translates that to the manip type to perform. This is a relict from the time when one manip per hook could exist, the exact hook number doesn't matter anymore, its converted to the manip type. Most callers already know what kind of NAT they want to perform, so pass the maniptype in directly. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
When the timer is late its timeout might be before the current time, in which case a very large value is dumped. Signed-off-by:
-
Patrick McHardy authored
Use NLA_PUT_BE32, nla_get_be32() etc. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Pablo Neira Ayuso authored
This patch adds support for SCTP to ctnetlink. Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
-
Pablo Neira Ayuso authored
This patch adds support for James Morris' connsecmark. Signed-off-by:
-
Pablo Neira Ayuso authored
This patch adds support for master tuple event notification and dumping. Conntrackd needs this information to recover related connections appropriately. Signed-off-by:
-
Pablo Neira Ayuso authored
The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see: http://people.netfilter.org/pablo/conntrack-tools/Signed-off-by:
-
Benjamin LaHaise authored
When terminating DSL connections for an assortment of random customers, I've found it necessary to use iptables to clamp the MSS used for connections to work around the various ICMP blackholes in the greater net. Unfortunately, the current behaviour in Linux is imperfect and actually make things worse, so I'm proposing the following: increasing the MSS in a packet can never be a good thing, so make --set-mss only lower the MSS in a packet. Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing connections from clients (ie web traffic), as it only looks at the PMTU on the destination route, not the source of the packet (the DSL interfaces in question have a 1442 byte MTU while the destination ethernet interface is 1500 -- there are problematic hosts which use a 1300 byte MTU). Reworking that is probably a good idea at some point, but it's more work than this is. Signed-off-by:
Benjamin LaHaise <bcrl@kvack.org> Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Resync get_entries() with ip_tables.c by moving the checks from the setsockopt handler to the function itself. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
More resyncing with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Resync with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Remove compatiblity hack copied from ip_tables.c - ipchains didn't even support arp_tables :) Signed-off-by:
-
Patrick McHardy authored
Use vmalloc_node() as in ip_tables.c. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
The size check is already performed by xt_check_target, no need to do it again. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
ipchains support has been removed years ago. kill last remains. Signed-off-by:
-
Patrick McHardy authored
Use raw_smp_processor_id() in do_add_counters() as in ip_tables.c. Signed-off-by:
-
Patrick McHardy authored
Fix leakage of local variable on stack. This already got fixed in ip_tables silently by the compat patches. Signed-off-by:
-
Patrick McHardy authored
Use %zu for sizeof() and remove casts. Signed-off-by:
-
Patrick McHardy authored
Reformat ip_tables.c and ip6_tables.c in order to eliminate non-functional differences and minimize diff output. This allows to get a view of the real differences using: sed -e 's/IP6T/IPT/g' \ -e 's/IP6/IP/g' \ -e 's/INET6/INET/g' \ -e 's/ip6t/ipt/g' \ -e 's/ip6/ip/g' \ -e 's/ipv6/ip/g' \ -e 's/icmp6/icmp/g' \ net/ipv6/netfilter/ip6_tables.c | \ diff -wup /dev/stdin net/ipv4/netfilter/ip_tables.c Signed-off-by: -
Patrick McHardy authored
Old userspace doesn't support revision 1, especially for IPv6, which is only available in the SVN snapshot. Add compat support for revision 0. Signed-off-by:
-
Patrick McHardy authored
The current netfilter SVN version includes support for this, so enable it in the kernel as well. Signed-off-by:
-
