linux.git/include/linux/netfilter_ipv4, branch v2.6.14

[NETFILTER] ctnetlink: allow userspace to change TCP state

2005-10-11T04:23:28+00:00

This patch adds the ability of changing the state a TCP connection. I know
that this must be used with care but it's required to provide a complete
conntrack creation via conntrack_netlink. So I'll document this aspect on
the upcoming docs.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: Use only 32bit counters for CONNTRACK_ACCT

2005-10-11T04:21:10+00:00

Initially we used 64bit counters for conntrack-based accounting, since we
had no event mechanism to tell userspace that our counters are about to
overflow.  With nfnetlink_conntrack, we now have such a event mechanism and
thus can save 16bytes per connection.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: Add missing include to ip_conntrack_tuple.h

2005-10-11T03:54:01+00:00

Without this #include, __be16 is not defined and userspace programs
will break.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] nat: remove bogus structure member

2005-10-11T03:52:36+00:00

When 'rustynat' was merged in 2.6.12, the use of the "helper" pointer of
struct ipt_nat_info was obsoleted, but the pointer not removed from the
struct.

This patch removes the pointer, thereby yet again shrinking struct
ip_conntrack.

Discovered-by: Rusty Russell 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: Fix invalid module autoloading by splitting iptable_nat

2005-09-26T22:25:11+00:00

When you've enabled conntrack and NAT as a module (standard case in all
distributions), and you've also enabled the new conntrack netlink
interface, loading ip_conntrack_netlink.ko will auto-load iptable_nat.ko.
This causes a huge performance penalty, since for every packet you iterate
the nat code, even if you don't want it.

This patch splits iptable_nat.ko into the NAT core (ip_nat.ko) and the
iptables frontend (iptable_nat.ko).  Threfore, ip_conntrack_netlink.ko will
only pull ip_nat.ko, but not the frontend.  ip_nat.ko will "only" allocate
some resources, but not affect runtime performance.

This separation is also a nice step in anticipation of new packet filters
(nf-hipac, ipset, pkttables) being able to use the NAT core.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] Fix conntrack event cache deadlock/oops

2005-09-23T06:46:57+00:00

This patch fixes a number of bugs.  It cannot be reasonably split up in
multiple fixes, since all bugs interact with each other and affect the same
function:

Bug #1:
The event cache code cannot be called while a lock is held.  Therefore, the
call to ip_conntrack_event_cache() within ip_ct_refresh_acct() needs to be
moved outside of the locked section.  This fixes a number of 2.6.14-rcX
oops and deadlock reports.

Bug #2:
We used to call ct_add_counters() for unconfirmed connections without
holding a lock.  Since the add operations are not atomic, we could race
with another CPU.

Bug #3:
ip_ct_refresh_acct() lost REFRESH events in some cases where refresh
(and the corresponding event) are desired, but no accounting shall be
performed.  Both, evenst and accounting implicitly depended on the skb
parameter bein non-null.   We now re-introduce a non-accounting
"ip_ct_refresh()" variant to explicitly state the desired behaviour.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] remove unneeded structure definition from conntrack helper

2005-09-23T06:45:44+00:00

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] Fix sparse endian warnings in pptp helper

2005-09-23T06:45:24+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: Rename misnamed function

2005-09-19T22:35:31+00:00

Both __ip_conntrack_expect_find and ip_conntrack_expect_find_get take
a reference to the expectation, the difference is that callers of
__ip_conntrack_expect_find must hold ip_conntrack_lock.

Signed-off-by: Patrick McHardy 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: Add new PPTP conntrack and NAT helper

2005-09-19T22:33:08+00:00

This new "version 3" PPTP conntrack/nat helper is finally ready for
mainline inclusion.  Special thanks to lots of last-minute bugfixing
by Patric McHardy.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller