linux.git/net/netfilter/xt_socket.c, branch v2.6.37

netfilter: xt_socket: Make tproto signed in socket_mt6_v1().

2010-10-28T19:59:53+00:00

Otherwise error indications from ipv6_find_hdr() won't be noticed.

This required making the protocol argument to extract_icmp6_fields()
signed too.

Reported-by: Geert Uytterhoeven 
Signed-off-by: David S. Miller

netfilter: fix module dependency issues with IPv6 defragmentation, ip6tables and xt_TPROXY

2010-10-25T20:58:36+00:00

One of the previous tproxy related patches split IPv6 defragmentation and
connection tracking, but did not correctly add Kconfig stanzas to handle the
new dependencies correctly. This patch fixes that by making the config options
mirror the setup we have for IPv4: a distinct config option for defragmentation
that is automatically selected by both connection tracking and
xt_TPROXY/xt_socket.

The patch also changes the #ifdefs enclosing IPv6 specific code in xt_socket
and xt_TPROXY: we only compile these in case we have ip6tables support enabled.

Signed-off-by: KOVACS Krisztian 
Signed-off-by: David S. Miller

tproxy: added IPv6 support to the socket match

2010-10-21T14:19:42+00:00

The ICMP extraction bits were contributed by Harry Mason.

Signed-off-by: Balazs Scheidler 
Signed-off-by: KOVACS Krisztian 
Signed-off-by: Patrick McHardy

tproxy: kick out TIME_WAIT sockets in case a new connection comes in with the same tuple

2010-10-21T10:45:14+00:00

Without tproxy redirections an incoming SYN kicks out conflicting
TIME_WAIT sockets, in order to handle clients that reuse ports
within the TIME_WAIT period.

The same mechanism didn't work in case TProxy is involved in finding
the proper socket, as the time_wait processing code looked up the
listening socket assuming that the listener addr/port matches those
of the established connection.

This is not the case with TProxy as the listener addr/port is possibly
changed with the tproxy rule.

Signed-off-by: Balazs Scheidler 
Signed-off-by: KOVACS Krisztian 
Signed-off-by: Patrick McHardy

netfilter: nf_conntrack: IPS_UNTRACKED bit

2010-06-08T14:09:52+00:00

NOTRACK makes all cpus share a cache line on nf_conntrack_untracked
twice per packet. This is bad for performance.
__read_mostly annotation is also a bad choice.

This patch introduces IPS_UNTRACKED bit so that we can use later a
per_cpu untrack structure more easily.

A new helper, nf_ct_untracked_get() returns a pointer to
nf_conntrack_untracked.

Another one, nf_ct_untracked_status_or() is used by nf_nat_init() to add
IPS_NAT_DONE_MASK bits to untracked status.

nf_ct_is_untracked() prototype is changed to work on a nf_conn pointer.

Signed-off-by: Eric Dumazet 
Signed-off-by: Patrick McHardy

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11T16:33:37+00:00

In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt

netfilter: xtables: substitute temporary defines by final name

2010-05-11T16:31:17+00:00

Signed-off-by: Jan Engelhardt

netfilter: xt extensions: use pr_ (2)

2010-03-25T14:00:04+00:00

Supplement to 1159683ef48469de71dc26f0ee1a9c30d131cf89.

Downgrade the log level to INFO for most checkentry messages as they
are, IMO, just an extra information to the -EINVAL code that is
returned as part of a parameter "constraint violation". Leave errors
to real errors, such as being unable to create a LED trigger.

Signed-off-by: Jan Engelhardt

netfilter: xt_socket: make module available for INPUT chain

2009-10-29T14:35:10+00:00

This should make it possible to test for the existence of local
sockets in the INPUT path.

References: http://marc.info/?l=netfilter-devel&m=125380481517129&w=2

Signed-off-by: Jan Engelhardt 
Signed-off-by: Balazs Scheidler 
Signed-off-by: Patrick McHardy

inet: rename some inet_sock fields

2009-10-19T01:52:53+00:00

In order to have better cache layouts of struct sock (separate zones
for rx/tx paths), we need this preliminary patch.

Goal is to transfert fields used at lookup time in the first
read-mostly cache line (inside struct sock_common) and move sk_refcnt
to a separate cache line (only written by rx path)

This patch adds inet_ prefix to daddr, rcv_saddr, dport, num, saddr,
sport and id fields. This allows a future patch to define these
fields as macros, like sk_refcnt, without name clashes.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller