linux-stable.git/include/linux/netfilter_ipv4.h, branch v3.2.16

headers, netfilter: Add missing #include for userland

2011-08-26T16:02:50+00:00

Various headers use INT_MIN and INT_MAX, which are defined for
userland in .

Signed-off-by: Ben Hutchings 
Acked-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ip_tables: add iptables security table for mandatory access control rules

2008-06-09T22:57:24+00:00

The following patch implements a new "security" table for iptables, so
that MAC (SELinux etc.) networking rules can be managed separately to
standard DAC rules.

This is to help with distro integration of the new secmark-based
network controls, per various previous discussions.

The need for a separate table arises from the fact that existing tools
and usage of iptables will likely clash with centralized MAC policy
management.

The SECMARK and CONNSECMARK targets will still be valid in the mangle
table to prevent breakage of existing users.

Signed-off-by: James Morris 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_nat: kill helper and seq_adjust hooks

2008-04-14T09:15:52+00:00

Connection tracking helpers (specifically FTP) need to be called
before NAT sequence numbers adjustments are performed to be able
to compare them against previously seen ones. We've introduced
two new hooks around 2.6.11 to maintain this ordering when NAT
modules were changed to get called from conntrack helpers directly.

The cost of netfilter hooks is quite high and sequence number
adjustments are only rarely needed however. Add a RCU-protected
sequence number adjustment function pointer and call it from
IPv4 conntrack after calling the helper.

Signed-off-by: Patrick McHardy

[NETFILTER]: Introduce NF_INET_ hook values

2008-01-28T22:53:55+00:00

The IPv4 and IPv6 hook values are identical, yet some code tries to figure
out the "correct" value by looking at the address family. Introduce NF_INET_*
values for both IPv4 and IPv6. The old values are kept in a #ifndef __KERNEL__
section for userspace compatibility.

Signed-off-by: Patrick McHardy 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

[NETFILTER]: Replace sk_buff ** with sk_buff *

2007-10-15T19:26:29+00:00

With all the users of the double pointers removed, this patch mops up by
finally replacing all occurances of sk_buff ** in the netfilter API by
sk_buff *.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[NETFILTER]: bridge-netfilter: remove deferred hooks

2006-12-14T00:54:25+00:00

Remove the deferred hooks and all related code as scheduled in
feature-removal-schedule.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NET]: Annotate __skb_checksum_complete() and friends.

2006-12-03T05:23:38+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller

[NETFILTER]: add type parameter to ip_route_me_harder

2006-10-04T07:30:54+00:00

By adding a type parameter to ip_route_me_harder() the
expensive call to inet_addr_type() can be avoided in some cases.
A followup patch where ip_route_me_harder() is called from within
ip_vs_out() is one such example.

Signed-off-By: Simon Horman 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

Don't include linux/config.h from anywhere else in include/

2006-04-26T11:56:16+00:00

Signed-off-by: David Woodhouse

[NETFILTER]: Add address family specific checksum helpers

2006-04-10T05:25:41+00:00

Add checksum operation which takes care of verifying the checksum and
dealing with HW checksum errors and avoids multiple checksum
operations by setting ip_summed to CHECKSUM_UNNECESSARY after
successful verification.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller