linux-stable.git/net/netfilter/Makefile, branch v3.9

netfilter: x_tables: add xt_bpf match

2013-01-21T11:20:19+00:00

Support arbitrary linux socket filter (BPF) programs as x_tables
match rules. This allows for very expressive filters, and on
platforms with BPF JIT appears competitive with traditional
hardcoded iptables rules using the u32 match.

The size of the filter has been artificially limited to 64
instructions maximum to avoid bloating the size of each rule
using this new match.

Signed-off-by: Willem de Bruijn 
Signed-off-by: Pablo Neira Ayuso

netfilter: add connlabel conntrack extension

2013-01-17T23:28:15+00:00

similar to connmarks, except labels are bit-based; i.e.
all labels may be attached to a flow at the same time.

Up to 128 labels are supported.  Supporting more labels
is possible, but requires increasing the ct offset delta
from u8 to u16 type due to increased extension sizes.

Mapping of bit-identifier to label name is done in userspace.

The extension is enabled at run-time once "-m connlabel" netfilter
rules are added.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: combine ipt_REDIRECT and ip6t_REDIRECT

2012-09-21T10:12:05+00:00

Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_REDIRECT becomes a compat option; IP6_NF_TARGET_REDIRECT
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: combine ipt_NETMAP and ip6t_NETMAP

2012-09-21T10:11:08+00:00

Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_NETMAP becomes a compat option; IP6_NF_TARGET_NETMAP
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: fix crash during boot if NAT has been compiled built-in

2012-09-05T16:35:51+00:00

(c7232c9 netfilter: add protocol independent NAT core) introduced a
problem that leads to crashing during boot due to NULL pointer
dereference. It seems that xt_nat calls xt_register_target() before
xt_init():

net/netfilter/x_tables.c:static struct xt_af *xt; is NULL and we crash on
xt_register_target(struct xt_target *target)
{
        u_int8_t af = target->family;
        int ret;

        ret = mutex_lock_interruptible(&xt[af].mutex);
...

Fix this by changing the linking order, to make sure that x_tables
comes before xt_nat.

Reported-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: remove xt_NOTRACK

2012-09-03T11:36:40+00:00

It was scheduled to be removed for a long time.

Cc: Pablo Neira Ayuso 
Cc: Patrick McHardy 
Cc: "David S. Miller" 
Cc: netfilter@vger.kernel.org
Signed-off-by: Cong Wang 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat: support IPv6 in TFTP NAT helper

2012-08-30T01:00:24+00:00

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy

netfilter: nf_nat: support IPv6 in IRC NAT helper

2012-08-30T01:00:23+00:00

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy

netfilter: nf_nat: support IPv6 in SIP NAT helper

2012-08-30T01:00:22+00:00

Add IPv6 support to the SIP NAT helper. There are no functional differences
to IPv4 NAT, just different formats for addresses.

Signed-off-by: Patrick McHardy

netfilter: nf_nat: support IPv6 in amanda NAT helper

2012-08-30T01:00:21+00:00

Signed-off-by: Patrick McHardy