1. 26 Aug, 2016 2 commits
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion · c016c7e4
      Pablo Neira Ayuso authored
      If the NLM_F_EXCL flag is set, then new elements that clash with an
      existing one return EEXIST. In case you try to add an element whose
      data area differs from what we have, then this returns EBUSY. If no
      flag is specified at all, then this returns success to userspace.
      
      This patch also update the set insert operation so we can fetch the
      existing element that clashes with the one you want to add, we need
      this to make sure the element data doesn't differ.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      c016c7e4
    • Pablo Neira Ayuso's avatar
      rhashtable: add rhashtable_lookup_get_insert_key() · 5ca8cc5b
      Pablo Neira Ayuso authored
      This patch modifies __rhashtable_insert_fast() so it returns the
      existing object that clashes with the one that you want to insert.
      In case the object is successfully inserted, NULL is returned.
      Otherwise, you get an error via ERR_PTR().
      
      This patch adapts the existing callers of __rhashtable_insert_fast()
      so they handle this new logic, and it adds a new
      rhashtable_lookup_get_insert_key() interface to fetch this existing
      object.
      
      nf_tables needs this change to improve handling of EEXIST cases via
      honoring the NLM_F_EXCL flag and by checking if the data part of the
      mapping matches what we have.
      
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Thomas Graf <tgraf@suug.ch>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      5ca8cc5b
  2. 23 Aug, 2016 3 commits
  3. 22 Aug, 2016 4 commits
  4. 18 Aug, 2016 1 commit
  5. 17 Aug, 2016 1 commit
  6. 13 Aug, 2016 1 commit
    • Pablo Neira Ayuso's avatar
      netfilter: remove ip_conntrack* sysctl compat code · adf05168
      Pablo Neira Ayuso authored
      This backward compatibility has been around for more than ten years,
      since Yasuyuki Kozakai introduced IPv6 in conntrack. These days, we have
      alternate /proc/net/nf_conntrack* entries, the ctnetlink interface and
      the conntrack utility got adopted by many people in the user community
      according to what I observed on the netfilter user mailing list.
      
      So let's get rid of this.
      
      Note that nf_conntrack_htable_size and unsigned int nf_conntrack_max do
      not need to be exported as symbol anymore.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      adf05168
  7. 12 Aug, 2016 1 commit
  8. 11 Aug, 2016 27 commits