linux.git/net/ipv4/netfilter/Makefile, branch v3.5

netfilter: remove ip_queue support

2012-05-08T18:25:42+00:00

This patch removes ip_queue support which was marked as obsolete
years ago. The nfnetlink_queue modules provides more advanced
user-space packet queueing mechanism.

This patch also removes capability code included in SELinux that
refers to ip_queue. Otherwise, we break compilation.

Several warning has been sent regarding this to the mailing list
in the past month without anyone rising the hand to stop this
with some strong argument.

Signed-off-by: Pablo Neira Ayuso

netfilter: merge ipt_LOG and ip6_LOG into xt_LOG

2012-03-07T16:40:49+00:00

ipt_LOG and ip6_LOG have a lot of common code, merge them
to reduce duplicate code.

Signed-off-by: Richard Weinberger 
Signed-off-by: Pablo Neira Ayuso

netfilter: xtables: move ipt_ecn to xt_ecn

2011-12-27T19:31:31+00:00

Prepare the ECN match for augmentation by an IPv6 counterpart. Since
no symbol dependencies to ipv6.ko are added, having a single ecn match
module is the more so welcome.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Pablo Neira Ayuso

netfilter: add ipv4 reverse path filter match

2011-12-04T21:43:37+00:00

This tries to do the same thing as fib_validate_source(), but differs
in several aspects.

The most important difference is that the reverse path filter built into
fib_validate_source uses the oif as iif when performing the reverse
lookup.  We do not do this, as the oif is not yet known by the time the
PREROUTING hook is invoked.

We can't wait until FORWARD chain because by the time FORWARD is invoked
ipv4 forward path may have already sent icmp messages is response
to to-be-discarded-via-rpfilter packets.

To avoid the such an additional lookup in PREROUTING, Patrick McHardy
suggested to attach the path information directly in the match
(i.e., just do what the standard ipv4 path does a bit earlier in PREROUTING).

This works, but it also has a few caveats. Most importantly, when using
marks in PREROUTING to re-route traffic based on the nfmark, -m rpfilter
would have to be used after the nfmark has been set; otherwise the nfmark
would have no effect (because the route is already attached).

Another problem would be interaction with -j TPROXY, as this target sets an
nfmark and uses ACCEPT instead of continue, i.e. such a version of
-m rpfilter cannot be used for the initial to-be-intercepted packets.

In case in turns out that the oif is required, we can add Patricks
suggestion with a new match option (e.g. --rpf-use-oif) to keep ruleset
compatibility.

Another difference to current builtin ipv4 rpfilter is that packets subject to ipsec
transformation are not automatically excluded. If you want this, simply
combine -m rpfilter with the policy match.

Packets arriving on loopback interfaces always match.

Signed-off-by: Florian Westphal 
Acked-by: David S. Miller 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipt_addrtype: rename to xt_addrtype

2011-03-15T19:16:20+00:00

Followup patch will add ipv6 support.

ipt_addrtype.h is retained for compatibility reasons, but no longer used
by the kernel.

Signed-off-by: Florian Westphal 
Signed-off-by: Patrick McHardy

Net: ipv4: netfilter: Makefile: Remove deprecated kbuild goal definitions

2010-11-22T16:16:11+00:00

Changed Makefile to use -y instead of -objs
because -objs is deprecated and not mentioned in
Documentation/kbuild/makefiles.txt.

Signed-off-by: Tracey Dent 
Signed-off-by: David S. Miller

netfilter: Combine ipt_ttl and ip6t_hl source

2009-02-18T17:39:31+00:00

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: Combine ipt_TTL and ip6t_HL source

2009-02-18T17:38:40+00:00

Suggested by: James King 

Similarly to commit c9fd49680954714473d6cbd2546d6ff120f96840, merge
TTL and HL. Since HL does not depend on any IPv6-specific function,
no new module dependencies would arise.

With slight adjustments to the Kconfig help text.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: split netfilter IPv4 defragmentation into a separate module

2008-10-08T09:35:12+00:00

Netfilter connection tracking requires all IPv4 packets to be defragmented.
Both the socket match and the TPROXY target depend on this functionality, so
this patch separates the Netfilter IPv4 defrag hooks into a separate module.

Signed-off-by: KOVACS Krisztian 
Signed-off-by: Patrick McHardy

netfilter: rename ipt_recent to xt_recent

2008-10-08T09:35:00+00:00

Like with other modules (such as ipt_state), ipt_recent.h is changed
to forward definitions to (IOW include) xt_recent.h, and xt_recent.c
is changed to use the new constant names.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy