linux.git/include/linux/netfilter, branch v2.6.27

netfilter: nf_conntrack_tcp: decrease timeouts while data in unacknowledged

2008-07-31T07:38:01+00:00

In order to time out dead connections quicker, keep track of outstanding data
and cap the timeout.

Suggested by Herbert Xu.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nfnetlink_log: send complete hardware header

2008-07-21T17:11:00+00:00

This patch adds some fields to NFLOG to be able to send the complete
hardware header with all necessary informations.
It sends to userspace:
 * the type of hardware link
 * the lenght of hardware header
 * the hardware header

Signed-off-by: Eric Leblond 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: accounting rework: ct_extend + 64bit counters (v4)

2008-07-21T17:10:58+00:00

Initially netfilter has had 64bit counters for conntrack-based accounting, but
it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are
still required, for example for "connbytes" extension. However, 64bit counters
waste a lot of memory and it was not possible to enable/disable it runtime.

This patch:
 - reimplements accounting with respect to the extension infrastructure,
 - makes one global version of seq_print_acct() instead of two seq_print_counters(),
 - makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n),
 - makes it possible to enable/disable it at runtime by sysctl or sysfs,
 - extends counters from 32bit to 64bit,
 - renames ip_conntrack_counter -> nf_conn_counter,
 - enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT),
 - set initial accounting enable state based on CONFIG_NF_CT_ACCT
 - removes buggy IPCT_COUNTER_FILLING event handling.

If accounting is enabled newly created connections get additional acct extend.
Old connections are not changed as it is not possible to add a ct_extend area
to confirmed conntrack. Accounting is performed for all connections with
acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct".

Signed-off-by: Krzysztof Piotr Oledzki 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: fix string extension for case insensitive pattern matching

2008-07-08T09:38:56+00:00

The flag XT_STRING_FLAG_IGNORECASE indicates case insensitive string
matching. netfilter can find cmd.exe, Cmd.exe, cMd.exe and etc easily.

A new revision 1 was added, in the meantime invert of xt_string_info
was moved into flags as a flag. If revision is 1, The flag
XT_STRING_FLAG_INVERT indicates invert matching.

Signed-off-by: Joonwoo Park 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ctnetlink: add full support for SCTP to ctnetlink

2008-06-09T22:56:39+00:00

This patch adds full support for SCTP to ctnetlink. This includes three
new attributes: state, original vtag and reply vtag.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nf_conntrack_sip: restrict RTP expect flushing on error to last request

2008-05-08T08:15:21+00:00

Some Inovaphone PBXs exhibit very stange behaviour: when dialing for
example "123", the device sends INVITE requests for "1", "12" and
"123" back to back.  The first requests will elicit error responses
from the receiver, causing the SIP helper to flush the RTP
expectations even though we might still see a positive response.

Note the sequence number of the last INVITE request that contained a
media description and only flush the expectations when receiving a
negative response for that sequence number.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: add DCCP protocol support

2008-04-14T09:15:49+00:00

Add DCCP conntrack helper. Thanks to Gerrit Renker 
for review and testing.

Signed-off-by: Patrick McHardy

[NETFILTER]: annotate {arp,ip,ip6,x}tables with const

2008-04-14T09:15:35+00:00

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

[NETFILTER]: xt_sctp: simplify xt_sctp.h

2008-04-14T07:56:04+00:00

The use of xt_sctp.h flagged up -Wshadow warnings in userspace, which
prompted me to look at it and clean it up. Basic operations have been
directly replaced by library calls (memcpy, memset is both available
in the kernel and userspace, and usually faster than a self-made
loop). The is_set and is_clear functions now use a processing time
shortcut, too.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

[NETFILTER]: nf_conntrack_sip: RTP routing optimization

2008-03-26T03:26:43+00:00

Optimize call routing between NATed endpoints: when an external
registrar sends a media description that contains an existing RTP
expectation from a different SNATed connection, the gatekeeper
is trying to route the call directly between the two endpoints.

We assume both endpoints can reach each other directly and
"un-NAT" the addresses, which makes the media stream go between
the two endpoints directly.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller