linux-stable.git/include/linux/netfilter, branch linux-2.6.14.y

[NETFILTER]: Use only 32bit counters for CONNTRACK_ACCT

2005-10-11T04:21:10+00:00

Initially we used 64bit counters for conntrack-based accounting, since we
had no event mechanism to tell userspace that our counters are about to
overflow.  With nfnetlink_conntrack, we now have such a event mechanism and
thus can save 16bytes per connection.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] ctnetlink: add one nesting level for TCP state

2005-10-11T03:55:49+00:00

To keep consistency, the TCP private protocol information is nested
attributes under CTA_PROTOINFO_TCP. This way the sequence of attributes to
access the TCP state information looks like here below:

CTA_PROTOINFO
CTA_PROTOINFO_TCP
CTA_PROTOINFO_TCP_STATE

instead of:

CTA_PROTOINFO
CTA_PROTOINFO_TCP_STATE

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] nfnetlink: use highest bit of nfa_type to indicate nested TLV

2005-10-11T03:52:19+00:00

As Henrik Nordstrom pointed out, all our efforts with "split endian" (i.e.
host byte order tags, net byte order values) are useless, unless a parser
can determine whether an attribute is nested or not.

This patch steals the highest bit of nfattr.nfa_type to indicate whether
the data payload contains a nested nfattr (1) or not (0).

This will break userspace compatibility, but luckily no kernel with
nfnetlink was released so far.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETLINK]: Convert netlink users to use group numbers instead of bitmasks

2005-08-29T23:00:54+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: introduce and use aligned_u64 data type

2005-08-29T22:57:59+00:00

As proposed by Andi Kleen, this is required esp. for x86_64 architecture,
where 64bit code needs 8byte aligned 64bit data types, but 32bit userspace
apps will only align to 4bytes.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: add correct bridging support to nfnetlink_{queue,log}

2005-08-29T22:51:15+00:00

This patch adds support for passing the real 'physical' device ifindex
down to userspace via nfnetlink_log and nfnetlink_queue.

This feature basically obsoletes net/bridge/netfilter/ebt_ulog.c, and
it is likely ebt_ulog.c will die with one of the next couple of
patches.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: don't use nested attributes for conntrack_expect

2005-08-29T22:40:09+00:00

We used to use nested nfattr structures for ip_conntrack_expect.  This is
bogus, since ip_conntrack and ip_conntrack_expect are communicated in
different netlink message types.  both should be encoded at the top level
attributes, no extra nesting required.  This patch addresses the issue.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: attribute count is an attribute of message type, not subsytem

2005-08-29T22:39:14+00:00

Prior to this patch, every nfnetlink subsystem had to specify it's
attribute count.  However, in reality the attribute count depends on
the message type within the subsystem, not the subsystem itself.  This
patch moves 'attr_count' from 'struct nfnetlink_subsys' into
nfnl_callback to fix this.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: Add new "nfnetlink_log" userspace packet logging facility

2005-08-29T22:38:12+00:00

This is a generic (layer3 independent) version of what ipt_ULOG is already
doing for IPv4 today.  ipt_ULOG, ebt_ulog and finally also ip[6]t_LOG will
be deprecated by this mechanism in the long term.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: Add refcounting and /proc/net/netfilter interface to nfnetlink_queue

2005-08-29T22:38:01+00:00

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller