linux.git/net/decnet/netfilter, branch v2.6.31

[NETNS]: Consolidate kernel netlink socket destruction.

2008-01-28T23:08:07+00:00

Create a specific helper for netlink kernel socket disposal. This just
let the code look better and provides a ground for proper disposal
inside a namespace.

Signed-off-by: Denis V. Lunev 
Tested-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option

2008-01-28T22:59:12+00:00

The NETFILTER_ADVANCED option hides lots of the rather obscure netfilter
options when disabled and provides defaults (M) that should allow to
run a distribution firewall without further thinking.

Defaults to 'y' to avoid breaking current configurations.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Mark hooks __read_mostly

2008-01-28T22:56:07+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Replace sk_buff ** with sk_buff *

2007-10-15T19:26:29+00:00

With all the users of the double pointers removed, this patch mops up by
finally replacing all occurances of sk_buff ** in the netfilter API by
sk_buff *.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[NET]: make netlink user -> kernel interface synchronious

2007-10-11T04:15:29+00:00

This patch make processing netlink user -> kernel messages synchronious.
This change was inspired by the talk with Alexey Kuznetsov about current
netlink messages processing. He says that he was badly wrong when introduced 
asynchronious user -> kernel communication.

The call netlink_unicast is the only path to send message to the kernel
netlink socket. But, unfortunately, it is also used to send data to the
user.

Before this change the user message has been attached to the socket queue
and sk->sk_data_ready was called. The process has been blocked until all
pending messages were processed. The bad thing is that this processing
may occur in the arbitrary process context.

This patch changes nlk->data_ready callback to get 1 skb and force packet
processing right in the netlink_unicast.

Kernel -> user path in netlink_unicast remains untouched.

EINTR processing for in netlink_run_queue was changed. It forces rtnl_lock
drop, but the process remains in the cycle until the message will be fully
processed. So, there is no need to use this kludges now.

Signed-off-by: Denis V. Lunev 
Acked-by: Alexey Kuznetsov 
Signed-off-by: David S. Miller

[NET]: Support multiple network namespaces with netlink

2007-10-10T23:49:09+00:00

Each netlink socket will live in exactly one network namespace,
this includes the controlling kernel sockets.

This patch updates all of the existing netlink protocols
to only support the initial network namespace.  Request
by clients in other namespaces will get -ECONREFUSED.
As they would if the kernel did not have the support for
that netlink protocol compiled in.

As each netlink protocol is updated to be multiple network
namespace safe it can register multiple kernel sockets
to acquire a presence in the rest of the network namespaces.

The implementation in af_netlink is a simple filter implementation
at hash table insertion and hash table look up time.

Signed-off-by: Eric W. Biederman 
Signed-off-by: David S. Miller

[NETLINK]: Switch cb_lock spinlock to mutex and allow to override it

2007-04-26T05:29:03+00:00

Switch cb_lock to mutex and allow netlink kernel users to override it
with a subsystem specific mutex for consistent locking in dump callbacks.
All netlink_dump_start users have been audited not to rely on any
side-effects of the previously used spinlock.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[SK_BUFF]: Some more conversions to skb_copy_from_linear_data

2007-04-26T05:28:30+00:00

Signed-off-by: Arnaldo Carvalho de Melo

[NETLINK]: Introduce nlmsg_hdr() helper

2007-04-26T05:26:34+00:00

For the common "(struct nlmsghdr *)skb->data" sequence, so that we reduce the
number of direct accesses to skb->data and for consistency with all the other
cast skb member helpers.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

[SK_BUFF]: Convert skb->tail to sk_buff_data_t

2007-04-26T05:26:28+00:00

So that it is also an offset from skb->head, reduces its size from 8 to 4 bytes
on 64bit architectures, allowing us to combine the 4 bytes hole left by the
layer headers conversion, reducing struct sk_buff size to 256 bytes, i.e. 4
64byte cachelines, and since the sk_buff slab cache is SLAB_HWCACHE_ALIGN...
:-)

Many calculations that previously required that skb->{transport,network,
mac}_header be first converted to a pointer now can be done directly, being
meaningful as offsets or pointers.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller