linux-stable.git/net/ipv6/netfilter, branch v3.5

net: Convert net_ratelimit uses to net__ratelimited

2012-05-15T17:45:03+00:00

Standardize the net core ratelimited logging functions.

Coalesce formats, align arguments.
Change a printk then vprintk sequence to use printf extension %pV.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09T10:53:47+00:00

This patch adds the flags parameter to ipv6_find_hdr. This flags
allows us to:

* know if this is a fragment.
* stop at the AH header, so the information contained in that header
  can be used for some specific packet handling.

This patch also adds the offset parameter for inspection of one
inner IPv6 header that is contained in error messages.

Signed-off-by: Hans Schillstrom 
Signed-off-by: Pablo Neira Ayuso

netfilter: remove ip_queue support

2012-05-08T18:25:42+00:00

This patch removes ip_queue support which was marked as obsolete
years ago. The nfnetlink_queue modules provides more advanced
user-space packet queueing mechanism.

This patch also removes capability code included in SELinux that
refers to ip_queue. Otherwise, we break compilation.

Several warning has been sent regarding this to the mailing list
in the past month without anyone rising the hand to stop this
with some strong argument.

Signed-off-by: Pablo Neira Ayuso

net: Convert all sysctl registrations to register_net_sysctl

2012-04-21T01:22:30+00:00

This results in code with less boiler plate that is a bit easier
to read.

Additionally stops us from using compatibility code in the sysctl
core, hastening the day when the compatibility code can be removed.

Signed-off-by: Eric W. Biederman 
Acked-by: Pavel Emelyanov 
Signed-off-by: David S. Miller

net: Move all of the network sysctls without a namespace into init_net.

2012-04-21T01:21:17+00:00

This makes it clearer which sysctls are relative to your current network
namespace.

This makes it a little less error prone by not exposing sysctls for the
initial network namespace in other namespaces.

This is the same way we handle all of our other network interfaces to
userspace and I can't honestly remember why we didn't do this for
sysctls right from the start.

Signed-off-by: Eric W. Biederman 
Acked-by: Pavel Emelyanov 
Signed-off-by: David S. Miller

net: cleanup unsigned to unsigned int

2012-04-15T16:44:40+00:00

Use of "unsigned int" is preferred to bare "unsigned" in net tree.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-04-12T23:41:23+00:00

netfilter: ip6_tables: ip6t_ext_hdr is now static inline

2012-04-09T14:29:34+00:00

We may hit this in xt_LOG:

net/built-in.o:xt_LOG.c:function dump_ipv6_packet:
	error: undefined reference to 'ip6t_ext_hdr'

happens with these config options:

CONFIG_NETFILTER_XT_TARGET_LOG=y
CONFIG_IP6_NF_IPTABLES=m

ip6t_ext_hdr is fairly small and it is called in the packet path.
Make it static inline.

Reported-by: Simon Kirby 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipv6: Stop using NLA_PUT*().

2012-04-02T08:33:43+00:00

These macros contain a hidden goto, and are thus extremely error
prone and make code hard to audit.

Signed-off-by: David S. Miller

netfilter: remove forward module param confusion.

2012-03-23T02:36:17+00:00

It used to be an int, and it got changed to a bool parameter at least
7 years ago.  It happens that NF_ACCEPT and NF_DROP are 0 and 1, so
this works, but it's unclear, and the check that it's in range is not
required.

Reported-by: Dan Carpenter 
Signed-off-by: Rusty Russell 
Signed-off-by: David S. Miller