summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* pkt_sched: Rename PSCHED_US2NS and PSCHED_NS2USJarek Poplawski2009-06-153-8/+8
| | | | | | | | Let's use TICKS instead of US, so PSCHED_TICKS2NS and PSCHED_NS2TICKS (like in PSCHED_TICKS_PER_SEC already) to avoid misleading. Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ipv4: Fix fib_trie rebalancingJarek Poplawski2009-06-151-10/+37
| | | | | | | | | | | | | | | | | | While doing trie_rebalance(): resize(), inflate(), halve() RCU free tnodes before updating their parents. It depends on RCU delaying the real destruction, but if RCU readers start after call_rcu() and before parent update they could access freed memory. It is currently prevented with preempt_disable() on the update side, but it's not safe, except maybe classic RCU, plus it conflicts with memory allocations with GFP_KERNEL flag used from these functions. This patch explicitly delays freeing of tnodes by adding them to the list, which is flushed after the update is finished. Reported-by: Yan Zheng <zheng.yan@oracle.com> Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Bluetooth: Fix issue with uninitialized nsh.type in DTL-1 driverMarcel Holtmann2009-06-141-0/+2
| | | | | | | | | | | | The current build shows a warning with the DTL-1 driver: CC [M] drivers/bluetooth/dtl1_cs.o drivers/bluetooth/dtl1_cs.c: In function ‘dtl1_hci_send_frame’: drivers/bluetooth/dtl1_cs.c:396: warning: ‘nsh.type’ may be used uninitialized in this function Fix this by adding a proper error for unknown packet types. Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: Fix Kconfig issue with RFKILL integrationMarcel Holtmann2009-06-141-1/+2
| | | | | | | | | Since the re-write of the RFKILL subsystem it is no longer good to just select RFKILL, but it is important to add a proper depends on rule. Based on a report by Alexander Beregalov <a.beregalov@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* PIM-SM: namespace changesTom Goff2009-06-142-20/+29
| | | | | | | | | | | | | | | | IPv4: - make PIM register vifs netns local - set the netns when a PIM register vif is created - make PIM available in all network namespaces (if CONFIG_IP_PIMSM_V2) by adding the protocol handler when multicast routing is initialized IPv6: - make PIM register vifs netns local - make PIM available in all network namespaces (if CONFIG_IPV6_PIMSM_V2) by adding the protocol handler when multicast routing is initialized Signed-off-by: Tom Goff <thomas.goff@boeing.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ipv4: update ARPD help textTimo Teräs2009-06-141-22/+13
| | | | | | | | | | | | Removed the statements about ARP cache size as this config option does not affect it. The cache size is controlled by neigh_table gc thresholds. Remove also expiremental and obsolete markings as the API originally intended for arp caching is useful for implementing ARP-like protocols (e.g. NHRP) in user space and has been there for a long enough time. Signed-off-by: Timo Teras <timo.teras@iki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: use a deferred timer in rt_check_expireEric Dumazet2009-06-141-3/+8
| | | | | | | | | | | | | | | | For the sake of power saver lovers, use a deferrable timer to fire rt_check_expire() As some big routers cache equilibrium depends on garbage collection done in time, we take into account elapsed time between two rt_check_expire() invocations to adjust the amount of slots we have to check. Based on an initial idea and patch from Tero Kristo Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Tero Kristo <tero.kristo@nokia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ieee802154: fix kconfig bool/tristate muckupRandy Dunlap2009-06-141-1/+1
| | | | | | | | | | | | | | | | | | | menuconfig IEEE802154_DRIVERS is a bool that depends on tristate IEEE802154. If the IEEE802154 symbol is 'm', the bool becomes 'y'. This allows tristate symbols under IEEE802154_DRIVERS to be configured as 'y' and cause build problems. Changing the menuconfig bool to a tristate fixes this. drivers/built-in.o: In function `fake_scan_req': fakehard.c:(.text+0x46d625): undefined reference to `ieee802154_nl_scan_confirm' drivers/built-in.o: In function `fake_disassoc_req': fakehard.c:(.text+0x46d66f): undefined reference to `ieee802154_nl_disassoc_confirm' drivers/built-in.o: In function `fake_assoc_req': fakehard.c:(.text+0x46d6be): undefined reference to `ieee802154_nl_assoc_confirm' Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Acked-by: Sergey Lapin <slapin@ossfans.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: initialization reworkStephen Hemminger2009-06-141-37/+30
| | | | | | | | Need to rework how bonding devices are initialized to make it more amenable to creating bonding devices via netlink. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: use is_zero_ether_addrStephen Hemminger2009-06-141-2/+2
| | | | | | | | Remove bogus non-portable possibly unaligned way of testing for zero addres.. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: network device names are case sensativeStephen Hemminger2009-06-142-53/+57
| | | | | | | | | | | | | The bonding device acts unlike all other Linux network device functions in that it ignores case of device names. The developer must have come from windows! Cleanup the management of names and use standard routines where possible. Flag places where bonding device still doesn't work right with network namespaces. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: elminate bad refcount codeStephen Hemminger2009-06-141-21/+0
| | | | | | | | | The "expected_refcount" stuff in bonding sysfs module is a mistake. Sysfs does proper refcounting, and it is okay to remove a bond device that has some user process holding the file open. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: fix style issuesStephen Hemminger2009-06-142-497/+460
| | | | | | | | | Resolve some of the complaints from checkpatch, and remove "magic emacs format" comments, and useless MODULE_SUPPORTED_DEVICE(). But should not change actual code. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: fix destructorStephen Hemminger2009-06-143-15/+9
| | | | | | | | | | | | It is not safe to use a network device destructor that is a function in the module, since it can be called after module is unloaded if sysfs handle is open. When eventually using netlink, the device cleanup code needs to be done via uninit function. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: remove bonding read/write semaphoreStephen Hemminger2009-06-143-36/+6
| | | | | | | | The whole read/write semaphore locking can be removed. It doesn't add any protection that isn't already done by using the RTNL mutex properly. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: initialize before registrationStephen Hemminger2009-06-141-4/+4
| | | | | | | | | Avoid a unnecessary carrier state transistion that happens when device is registered. Lockdep works better if initialization is done before registration as well. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: bond_create always called with default parametersStephen Hemminger2009-06-143-9/+8
| | | | | | | | bond_create() is always called with same parameters so move the argument down. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'for-next' of ↵David S. Miller2009-06-146-1/+1016
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/sameo/irda-2.6
| * irda: add git tree to MAINTAINERS fileSamuel Ortiz2009-06-131-0/+1
| | | | | | | | | | | | | | We now have an IrDA git tree on kernel.org: git://git.kernel.org/pub/scm/linux/kernel/git/sameo/irda-2.6.git Signed-off-by: Samuel Ortiz <samuel@sortiz.org>
| * irda: smsc wait count reaches -1Roel Kluin2009-06-131-1/+1
| | | | | | | | | | | | | | | | The sir retries count reaches -1 rather than 0. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Samuel Ortiz <samuel@sortiz.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
| * irda: new Blackfin on-chip SIR IrDA driverGraff Yang2009-06-134-0/+1014
| | | | | | | | | | | | | | | | Signed-off-by: Graff Yang <graff.yang@gmail.com> Cc: Mike Frysinger <vapier@gentoo.org> Cc: Bryan Wu <bryan.wu@analog.com> Signed-off-by: Samuel Ortiz <samuel@sortiz.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
* | Merge branch 'master' of ↵David S. Miller2009-06-1412-220/+431
|\ \ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * | x_tables: Convert printk to pr_errJoe Perches2009-06-131-8/+8
| | | | | | | | | | | | | | | Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: conntrack: optional reliable conntrack event deliveryPablo Neira Ayuso2009-06-136-35/+166
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch improves ctnetlink event reliability if one broadcast listener has set the NETLINK_BROADCAST_ERROR socket option. The logic is the following: if an event delivery fails, we keep the undelivered events in the missed event cache. Once the next packet arrives, we add the new events (if any) to the missed events in the cache and we try a new delivery, and so on. Thus, if ctnetlink fails to deliver an event, we try to deliver them once we see a new packet. Therefore, we may lose state transitions but the userspace process gets in sync at some point. At worst case, if no events were delivered to userspace, we make sure that destroy events are successfully delivered. Basically, if ctnetlink fails to deliver the destroy event, we remove the conntrack entry from the hashes and we insert them in the dying list, which contains inactive entries. Then, the conntrack timer is added with an extra grace timeout of random32() % 15 seconds to trigger the event again (this grace timeout is tunable via /proc). The use of a limited random timeout value allows distributing the "destroy" resends, thus, avoiding accumulating lots "destroy" events at the same time. Event delivery may re-order but we can identify them by means of the tuple plus the conntrack ID. The maximum number of conntrack entries (active or inactive) is still handled by nf_conntrack_max. Thus, we may start dropping packets at some point if we accumulate a lot of inactive conntrack entries that did not successfully report the destroy event to userspace. During my stress tests consisting of setting a very small buffer of 2048 bytes for conntrackd and the NETLINK_BROADCAST_ERROR socket flag, and generating lots of very small connections, I noticed very few destroy entries on the fly waiting to be resend. A simple way to test this patch consist of creating a lot of entries, set a very small Netlink buffer in conntrackd (+ a patch which is not in the git tree to set the BROADCAST_ERROR flag) and invoke `conntrack -F'. For expectations, no changes are introduced in this patch. Currently, event delivery is only done for new expectations (no events from expectation expiration, removal and confirmation). In that case, they need a per-expectation event cache to implement the same idea that is exposed in this patch. This patch can be useful to provide reliable flow-accouting. We still have to add a new conntrack extension to store the creation and destroy time. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | list_nulls: add hlist_nulls_add_head and hlist_nulls_delPablo Neira Ayuso2009-06-131-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the hlist_nulls_add_head() function which is based on hlist_nulls_add_head_rcu() but without the use of rcu_assign_pointer(). It also adds hlist_nulls_del which is exactly the same like hlist_nulls_del_rcu(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: conntrack: move helper destruction to nf_ct_helper_destroy()Pablo Neira Ayuso2009-06-133-10/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch moves the helper destruction to a function that lives in nf_conntrack_helper.c. This new function is used in the patch to add ctnetlink reliable event delivery. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: conntrack: move event caching to conntrack extension infrastructurePablo Neira Ayuso2009-06-136-163/+223
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reworks the per-cpu event caching to use the conntrack extension infrastructure. The main drawback is that we consume more memory per conntrack if event delivery is enabled. This patch is required by the reliable event delivery that follows to this patch. BTW, this patch allows you to enable/disable event delivery via /proc/sys/net/netfilter/nf_conntrack_events in runtime, although you can still disable event caching as compilation option. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_conntrack: use mod_timer_pending() for conntrack refreshPatrick McHardy2009-06-131-11/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use mod_timer_pending() instead of atomic sequence of del_timer()/ add_timer(). mod_timer_pending() does not rearm an inactive timer, so we don't need the conntrack lock anymore to make sure we don't accidentally rearm a timer of a conntrack which is in the process of being destroyed. With this change, we don't need to take the global lock anymore at all, counter updates can be performed under the per-conntrack lock. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_log: fix sleeping function called from invalid contextPatrick McHardy2009-06-131-3/+3
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix regression introduced by 17625274 "netfilter: sysctl support of logger choice": BUG: sleeping function called from invalid context at /mnt/s390test/linux-2.6-tip/arch/s390/include/asm/uaccess.h:234 in_atomic(): 1, irqs_disabled(): 0, pid: 3245, name: sysctl CPU: 1 Not tainted 2.6.30-rc8-tipjun10-02053-g39ae214 #1 Process sysctl (pid: 3245, task: 000000007f675da0, ksp: 000000007eb17cf0) 0000000000000000 000000007eb17be8 0000000000000002 0000000000000000 000000007eb17c88 000000007eb17c00 000000007eb17c00 0000000000048156 00000000003e2de8 000000007f676118 000000007eb17f10 0000000000000000 0000000000000000 000000007eb17be8 000000000000000d 000000007eb17c58 00000000003e2050 000000000001635c 000000007eb17be8 000000007eb17c30 Call Trace: (Ý<00000000000162e6>¨ show_trace+0x13a/0x148) Ý<00000000000349ea>¨ __might_sleep+0x13a/0x164 Ý<0000000000050300>¨ proc_dostring+0x134/0x22c Ý<0000000000312b70>¨ nf_log_proc_dostring+0xfc/0x188 Ý<0000000000136f5e>¨ proc_sys_call_handler+0xf6/0x118 Ý<0000000000136fda>¨ proc_sys_read+0x26/0x34 Ý<00000000000d6e9c>¨ vfs_read+0xac/0x158 Ý<00000000000d703e>¨ SyS_read+0x56/0x88 Ý<0000000000027f42>¨ sysc_noemu+0x10/0x16 Use the nf_log_mutex instead of RCU to fix this. Reported-and-tested-by: Maran Pakkirisamy <maranpsamy@in.ibm.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | net: use symbolic values for ndo_start_xmit() return codesPatrick McHardy2009-06-1381-109/+109
| | | | | | | | | | | | | | | | | | | | Convert magic values 1 and -1 to NETDEV_TX_BUSY and NETDEV_TX_LOCKED respectively. 0 (NETDEV_TX_OK) is not changed to keep the noise down, except in very few cases where its in direct proximity to one of the other values. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix network drivers ndo_start_xmit() return values (part 8)Patrick McHardy2009-06-132-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix up USB drivers that return an errno value (result of usb_submit_urb()) to qdisc_restart(), causing qdisc_restart() to print a warning and requeue/ retransmit the skb. - hso: skb is freed: use after free - at76_usb: skb is freed: use after free Compile tested only. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix network drivers ndo_start_xmit() return values (part 7)Patrick McHardy2009-06-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | Fix up ATM drivers that return an errno value to qdisc_restart(), causing qdisc_restart() to print a warning an requeue/retransmit the skb. - lec: condition can only be remedied by userspace, until that retransmissions Compile tested only. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix network drivers ndo_start_xmit() return values (part 6)Patrick McHardy2009-06-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Fix up hamradio drivers that return an errno value to dev_queue_xmit(), causing it to print a warning an free the skb. - bpqether: skb is freed: use after free Compile tested only. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix network drivers ndo_start_xmit() return values (part 5)Patrick McHardy2009-06-131-6/+0
| | | | | | | | | | | | | | | | | | | | Fix up s390 drivers that return an errno value to qdisc_restart(), causing qdisc_restart() to print a warning an requeue/retransmit the skb. - claw: impossible condition, simply remove it Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix network drivers ndo_start_xmit() return values (part 4)Patrick McHardy2009-06-131-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Fix up WAN drivers that return an errno value to qdisc_restart(), causing qdisc_restart() to print a warning an requeue/retransmit the skb. - cycx_x25: intention appears to be to requeue the skb Does not compile cleanly for me even without this patch, so untested. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix network drivers ndo_start_xmit() return values (part 3)Patrick McHardy2009-06-135-13/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | net: fix network drivers ndo_start_xmit() return values (part 3) Fix up wireless drivers that return an errno value to qdisc_restart(), causing qdisc_restart() to print a warning an requeue/retransmit the skb. - airo: transmission not implemented for chip, intention is to free and abort - ipw2200: transmission not implemented for promiscous mode, intention is to drop - prism54: intention is to drop - wl3501_cs: intention appears to be to drop - zd1201: error counter indicates intention is to drop All drivers compile tested. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix network drivers ndo_start_xmit() return values (part 2)Patrick McHardy2009-06-136-24/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix up IRDA drivers that return an errno value to qdisc_restart(), causing qdisc_restart() to print a warning an requeue/retransmit the skb. - donauboe: intention appears to be to have the skb retransmitted without error message - irda-usb: intention is to drop silently according to comment - kingsub-sir: skb is freed: use after free - ks959-sir: skb is freed: use after free - ksdazzle-sir: skb is freed: use after free - mcs7880: skb is freed: use after free All but donauboe compile tested. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix network driver ndo_start_xmit() return values (part 1)Patrick McHardy2009-06-134-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix up drivers that return an errno value to qdisc_restart(), causing qdisc_restart() to print a warning and requeue/retransmit the skb. - xpnet: memory allocation error, intention is to drop - ethoc: oversized packet, packet must be dropped - ibmlana: skb freed: use after free - rrunner: skb freed: use after free Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bridge: Simplify interface for ATM LANEMichał Mirosław2009-06-125-58/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch changes FDB entry check for ATM LANE bridge integration. There's no point in holding a FDB entry around SKB building. br_fdb_get()/br_fdb_put() pair are changed into single br_fdb_test_addr() hook that checks if the addr has FDB entry pointing to other port to the one the request arrived on. FDB entry refcounting is removed as it's not used anywhere else. Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> Acked-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [PATCH] net core: Some interface flags not returned by SIOCGIFFLAGSJohn Dykstra2009-06-122-4/+1
|/ | | | | | | | | | | | | | | | | | | | | | Commit b00055aacdb172c05067612278ba27265fcd05ce " [NET] core: add RFC2863 operstate" defined new interface flag values. Its documentation specified that these flags could be accessed from user space via SIOCGIFFLAGS. However, this does not work because the new flags do not fit in that ioctl's argument width. Change the documentation to match the code's behavior. Also change the source to explicitly show the truncation. This _should_ have no effect on executable code, and did not with gcc 4.2.4 generating x86 code. A new ioctl could be defined to return all interface flags to user space. However, since this has been broken for three years with no one complaining, there doesn't seem much need. They are still accessible via netlink. Reported-by: "Fredrik Arnerup" <fredrik.arnerup@edgeware.tv> Signed-off-by: John Dykstra <john.dykstra1@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* virtio_net: Fix IP alignment on non-mergeable RX pathHerbert Xu2009-06-121-1/+2
| | | | | | | | | | We need to enforce the IP alignment on the non-mergeable RX path just like the other RX path. Not doing so results in misaligned IP headers. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2009-06-1240-699/+1459
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * netfilter: ip_tables: fix build errorPatrick McHardy2009-06-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Fix build error introduced by commit bb70dfa5 (netfilter: xtables: consolidate comefrom debug cast access): net/ipv4/netfilter/ip_tables.c: In function 'ipt_do_table': net/ipv4/netfilter/ip_tables.c:421: error: 'comefrom' undeclared (first use in this function) net/ipv4/netfilter/ip_tables.c:421: error: (Each undeclared identifier is reported only once net/ipv4/netfilter/ip_tables.c:421: error: for each function it appears in.) Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_ct_tcp: fix up build after mergePatrick McHardy2009-06-111-1/+1
| | | | | | | | | | | | Replace the last occurence of tcp_lock by the per-conntrack lock. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge branch 'master' of ↵Patrick McHardy2009-06-11518-11363/+20731
| |\ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6
| * | netfilter: nf_conntrack: use per-conntrack locks for protocol dataPatrick McHardy2009-06-108-55/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce per-conntrack locks and use them instead of the global protocol locks to avoid contention. Especially tcp_lock shows up very high in profiles on larger machines. This will also allow to simplify the upcoming reliable event delivery patches. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xt_socket: added new revision of the 'socket' match supporting flagsLaszlo Attila Toth2009-06-092-11/+64
| | | | | | | | | | | | | | | | | | | | | | | | If the XT_SOCKET_TRANSPARENT flag is set, enabled 'transparent' socket option is required for the socket to be matched. Signed-off-by: Laszlo Attila Toth <panther@balabit.hu> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: passive OS fingerprint xtables matchEvgeniy Polyakov2009-06-086-1/+578
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Passive OS fingerprinting netfilter module allows to passively detect remote OS and perform various netfilter actions based on that knowledge. This module compares some data (WS, MSS, options and it's order, ttl, df and others) from packets with SYN bit set with dynamically loaded OS fingerprints. Fingerprint matching rules can be downloaded from OpenBSD source tree or found in archive and loaded via netfilter netlink subsystem into the kernel via special util found in archive. Archive contains library file (also attached), which was shipped with iptables extensions some time ago (at least when ipt_osf existed in patch-o-matic). Following changes were made in this release: * added NLM_F_CREATE/NLM_F_EXCL checks * dropped _rcu list traversing helpers in the protected add/remove calls * dropped unneded structures, debug prints, obscure comment and check Fingerprints can be downloaded from http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os or can be found in archive Example usage: -d switch removes fingerprints Please consider for inclusion. Thank you. Passive OS fingerprint homepage (archives, examples): http://www.ioremap.net/projects/osf Signed-off-by: Evgeniy Polyakov <zbr@ioremap.net> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_ct_icmp: keep the ICMP ct entries longerJan Kasprzak2009-06-085-45/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current conntrack code kills the ICMP conntrack entry as soon as the first reply is received. This is incorrect, as we then see only the first ICMP echo reply out of several possible duplicates as ESTABLISHED, while the rest will be INVALID. Also this unnecessarily increases the conntrackd traffic on H-A firewalls. Make all the ICMP conntrack entries (including the replied ones) last for the default of nf_conntrack_icmp{,v6}_timeout seconds. Signed-off-by: Jan "Yenya" Kasprzak <kas@fi.muni.cz> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: ipt_MASQUERADE: remove redundant rwlockFlorian Westphal2009-06-051-11/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The lock "protects" an assignment and a comparision of an integer. When the caller of device_cmp() evaluates the result, nat->masq_index may already have been changed (regardless if the lock is there or not). So, the lock either has to be held during nf_ct_iterate_cleanup(), or can be removed. This does the latter. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-25 20:52:41 +0100