linux.git/include/linux/netfilter/Kbuild, branch v3.2

netfilter: ipt_addrtype: rename to xt_addrtype

2011-03-15T19:16:20+00:00

Followup patch will add ipv6 support.

ipt_addrtype.h is retained for compatibility reasons, but no longer used
by the kernel.

Signed-off-by: Florian Westphal 
Signed-off-by: Patrick McHardy

netfilter: xtables: add device group match

2011-02-02T23:05:43+00:00

Add a new 'devgroup' match to match on the device group of the
incoming and outgoing network device of a packet.

Signed-off-by: Patrick McHardy

netfilter: ipset: install ipset related header files

2011-02-01T17:52:42+00:00

Signed-off-by: Patrick McHardy

netfilter: xtables: remove extraneous header that slipped in

2011-01-20T07:48:15+00:00

Commit 0b8ad87 (netfilter: xtables: add missing header files to export
list) erroneously added this.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: add missing header files to export list

2011-01-18T10:25:02+00:00

Signed-off-by: Jan Engelhardt

netfilter: audit target to record accepted/dropped packets

2011-01-16T17:10:28+00:00

This patch adds a new netfilter target which creates audit records
for packets traversing a certain chain.

It can be used to record packets which are rejected administraively
as follows:

  -N AUDIT_DROP
  -A AUDIT_DROP -j AUDIT --type DROP
  -A AUDIT_DROP -j DROP

a rule which would typically drop or reject a packet would then
invoke the new chain to record packets before dropping them.

  -j AUDIT_DROP

The module is protocol independant and works for iptables, ip6tables
and ebtables.

The following information is logged:
 - netfilter hook
 - packet length
 - incomming/outgoing interface
 - MAC src/dst/proto for ethernet packets
 - src/dst/protocol address for IPv4/IPv6
 - src/dst port for TCP/UDP/UDPLITE
 - icmp type/code

Cc: Patrick McHardy 
Cc: Eric Paris 
Cc: Al Viro 
Signed-off-by: Thomas Graf 
Signed-off-by: Patrick McHardy

include: replace unifdef-y with header-y

2010-08-14T20:26:51+00:00

unifdef-y and header-y has same semantic.
So there is no need to have both.

Drop the unifdef-y variant and sort all lines again

Signed-off-by: Sam Ravnborg

netfilter: add xt_cpu match

2010-07-23T10:59:36+00:00

In some situations a CPU match permits a better spreading of
connections, or select targets only for a given cpu.

With Remote Packet Steering or multiqueue NIC and appropriate IRQ
affinities, we can distribute trafic on available cpus, per session.
(all RX packets for a given flow is handled by a given cpu)

Some legacy applications being not SMP friendly, one way to scale a
server is to run multiple copies of them.

Instead of randomly choosing an instance, we can use the cpu number as a
key so that softirq handler for a whole instance is running on a single
cpu, maximizing cache effects in TCP/UDP stacks.

Using NAT for example, a four ways machine might run four copies of
server application, using a separate listening port for each instance,
but still presenting an unique external port :

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 0 \
        -j REDIRECT --to-port 8080

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 1 \
        -j REDIRECT --to-port 8081

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 2 \
        -j REDIRECT --to-port 8082

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 3 \
        -j REDIRECT --to-port 8083

Signed-off-by: Eric Dumazet 
Signed-off-by: Patrick McHardy

netfilter: xt_ipvs (netfilter matcher for IPVS)

2010-07-23T10:42:58+00:00

This implements the kernel-space side of the netfilter matcher xt_ipvs.

[ minor fixes by Simon Horman  ]
Signed-off-by: Hannes Eder 
Signed-off-by: Simon Horman 
[ Patrick: added xt_ipvs.h to Kbuild ]
Signed-off-by: Patrick McHardy

netfilter: correct CHECKSUM header and export it

2010-07-16T12:08:20+00:00

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Patrick McHardy