linux.git/include/linux/netfilter, branch v2.6.36

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2010-08-24T01:30:30+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
  netfilter: fix CONFIG_COMPAT support
  isdn/avm: fix build when PCMCIA is not enabled
  header: fix broken headers for user space
  e1000e: don't check for alternate MAC addr on parts that don't support it
  e1000e: disable ASPM L1 on 82573
  ll_temac: Fix poll implementation
  netxen: fix a race in netxen_nic_get_stats()
  qlnic: fix a race in qlcnic_get_stats()
  irda: fix a race in irlan_eth_xmit()
  net: sh_eth: remove unused variable
  netxen: update version 4.0.74
  netxen: fix inconsistent lock state
  vlan: Match underlying dev carrier on vlan add
  ibmveth: Fix opps during MTU change on an active device
  ehea: Fix synchronization between HW and SW send queue
  bnx2x: Update bnx2x version to 1.52.53-4
  bnx2x: Fix PHY locking problem
  rds: fix a leak of kernel memory
  netlink: fix compat recvmsg
  netfilter: fix userspace header warning
  ...

header: fix broken headers for user space

2010-08-23T04:15:39+00:00

__packed is only defined in kernel space, so we should use
__attribute__((packed)) for the code shared between kernel and user space.

Two __attribute() annotations are replaced with __attribute__() too.

Signed-off-by: Changli Gao 
Signed-off-by: David S. Miller

netfilter: fix userspace header warning

2010-08-19T06:34:26+00:00

"make headers_check" issued the following warning:

  CHECK   include/linux/netfilter (64 files)
usr/include/linux/netfilter/xt_ipvs.h:19: found __[us]{8,16,32,64} type without #include 

Fix this by as suggested including linux/types.h.

Signed-off-by: Sam Ravnborg 
Signed-off-by: David S. Miller

include: replace unifdef-y with header-y

2010-08-14T20:26:51+00:00

unifdef-y and header-y has same semantic.
So there is no need to have both.

Drop the unifdef-y variant and sort all lines again

Signed-off-by: Sam Ravnborg

xt_quota: report initial quota value instead of current value to userspace

2010-07-23T12:07:47+00:00

We should copy the initial value to userspace for iptables-save and
to allow removal of specific quota rules.

Signed-off-by: Changli Gao 
Signed-off-by: Patrick McHardy

netfilter: add xt_cpu match

2010-07-23T10:59:36+00:00

In some situations a CPU match permits a better spreading of
connections, or select targets only for a given cpu.

With Remote Packet Steering or multiqueue NIC and appropriate IRQ
affinities, we can distribute trafic on available cpus, per session.
(all RX packets for a given flow is handled by a given cpu)

Some legacy applications being not SMP friendly, one way to scale a
server is to run multiple copies of them.

Instead of randomly choosing an instance, we can use the cpu number as a
key so that softirq handler for a whole instance is running on a single
cpu, maximizing cache effects in TCP/UDP stacks.

Using NAT for example, a four ways machine might run four copies of
server application, using a separate listening port for each instance,
but still presenting an unique external port :

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 0 \
        -j REDIRECT --to-port 8080

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 1 \
        -j REDIRECT --to-port 8081

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 2 \
        -j REDIRECT --to-port 8082

iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 3 \
        -j REDIRECT --to-port 8083

Signed-off-by: Eric Dumazet 
Signed-off-by: Patrick McHardy

netfilter: xt_ipvs (netfilter matcher for IPVS)

2010-07-23T10:42:58+00:00

This implements the kernel-space side of the netfilter matcher xt_ipvs.

[ minor fixes by Simon Horman  ]
Signed-off-by: Hannes Eder 
Signed-off-by: Simon Horman 
[ Patrick: added xt_ipvs.h to Kbuild ]
Signed-off-by: Patrick McHardy

netfilter: correct CHECKSUM header and export it

2010-07-16T12:08:20+00:00

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Patrick McHardy

netfilter: add CHECKSUM target

2010-07-15T15:20:46+00:00

This adds a `CHECKSUM' target, which can be used in the iptables mangle
table.

You can use this target to compute and fill in the checksum in
a packet that lacks a checksum.  This is particularly useful,
if you need to work around old applications such as dhcp clients,
that do not work well with checksum offloads, but don't want to
disable checksum offload in your device.

The problem happens in the field with virtualized applications.
For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Typical expected use (helps old dhclient binary running in a VM):
iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
	-j CHECKSUM --checksum-fill

Includes fixes by Jan Engelhardt 

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Patrick McHardy

nfnetlink_log: do not expose NFULNL_COPY_DISABLED to user-space

2010-07-15T09:27:41+00:00

This patch moves NFULNL_COPY_PACKET definition from
linux/netfilter/nfnetlink_log.h to net/netfilter/nfnetlink_log.h
since this copy mode is only for internal use.

I have also changed the value from 0x03 to 0xff. Thus, we avoid
a gap from user-space that may confuse users if we add new
copy modes in the future.

This change was introduced in:
http://www.spinics.net/lists/netfilter-devel/msg13535.html

Since this change is not included in any stable Linux kernel,
I think it's safe to make this change now. Anyway, this copy
mode does not make any sense from user-space, so this patch
should not break any existing setup.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy