linux.git/net/ipv4/netfilter.c, branch v2.6.28

netfilter: netns: fix {ip,6}_route_me_harder() in netns

2008-10-08T09:35:03+00:00

Take netns from skb->dst->dev. It should be safe because, they are called
from LOCAL_OUT hook where dst is valid (though, I'm not exactly sure about
IPVS and queueing packets to userspace).

[Patrick: its safe everywhere since they already expect skb->dst to be set]

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy

ipv4: Make Netfilter's ip_route_me_harder() non-local address compatible

2008-10-01T14:44:42+00:00

Netfilter's ip_route_me_harder() tries to re-route packets either
generated or re-routed by Netfilter. This patch changes
ip_route_me_harder() to handle packets from non-locally-bound sockets
with IP_TRANSPARENT set as local and to set the appropriate flowi
flags when re-doing the routing lookup.

Signed-off-by: KOVACS Krisztian 
Signed-off-by: David S. Miller

[NETFILTER]: Add partial checksum validation helper

2008-04-14T09:15:49+00:00

Move the UDP-Lite conntrack checksum validation to a generic helper
similar to nf_checksum() and make it fall back to nf_checksum()
in case the full packet is to be checksummed and hardware checksums
are available. This is to be used by DCCP conntrack, which also
needs to verify partial checksums.

Signed-off-by: Patrick McHardy

[NETNS]: Add namespace parameter to ip_route_output_key.

2008-01-28T23:11:07+00:00

Needed to propagate it down to the ip_route_output_flow.

Signed-off-by: Denis V. Lunev 
Signed-off-by: David S. Miller

[NETFILTER]: kill nf_sysctl.c

2008-01-28T23:02:40+00:00

Since there now is generic support for shared sysctl paths, the only
remains are the net/netfilter and net/ipv4/netfilter paths. Move them
to net/netfilter/core.c and net/ipv4/netfilter.c and kill nf_sysctl.c.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETNS]: Add netns parameter to inet_(dev_)add_type.

2008-01-28T23:01:27+00:00

The patch extends the inet_addr_type and inet_dev_addr_type with the
network namespace pointer. That allows to access the different tables
relatively to the network namespace.

The modification of the signature function is reported in all the
callers of the inet_addr_type using the pointer to the well known
init_net.

Acked-by: Benjamin Thery 
Acked-by: Daniel Lezcano 
Signed-off-by: Eric W. Biederman 
Signed-off-by: David S. Miller

[NETFILTER]: constify nf_afinfo

2008-01-28T22:59:05+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_queue: move list_head/skb/id to struct nf_info

2008-01-28T22:56:14+00:00

Move common fields for queue management to struct nf_info and rename it
to struct nf_queue_entry. The avoids one allocation/free per packet and
simplifies the code a bit.

Alternatively we could add some private room at the tail, but since
all current users use identical structs this seems easier.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_queue: move queueing related functions/struct to seperate header

2008-01-28T22:56:10+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_ct_h323: remove ipv6 module dependency

2008-01-28T22:56:05+00:00

nf_conntrack_h323 needs ip6_route_output for the call forwarding filter.
Add a ->route function to nf_afinfo and use that to avoid pulling in the
ipv6 module.

Fix the #ifdef for the IPv6 code while I'm at it - the IPv6 support is
only needed when IPv6 conntrack is enabled.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller