Fixes problems with xtables based MARK target ("ipt" module).
When tc loads the "ipt" (xt) module it kept the symbols local,
this made loading of libxtables not find the required struct.

currently ipt/xt is the only tc action module.
iproute2 never seem to do dlclose.
hopefully the modules doesn't export more symbols then needed.

In this situation hopefully the RTLD_GLOBAL flag won't hurt us.

I've been using this patch in the Debian package of iproute for
the last 3 weeks and noone has complained.
( This fixes http://bugs.debian.org/584898 )
Signed-off-by: Andreas Henriksson <andreas@fatal.se>

> On closer inspection, it appears that ss -p does a quadratic scan. It
> rescans every entry in /proc/*/fd/* repeatedly (once per listening
> port? per process? I don't remember what I figured out.)
>
> I humbly suggest that this is not a good idea.

Yep, this is junk.  Please give this patch a try:

ss: Avoid quadradic complexity with '-p'

Scan the process list of open sockets once, and store in a hash
table to be used by subsequent find_user() calls.
Reported-by: Steve Fink <sphink@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The tc program searches LIBDIR by default for the .dist files, and that
defaults to /usr/lib.  But the netem subdir has /lib/ hardcoded which
means the default build+install results in the files not being found.

Further, these are plain text files which are read at runtime, so it
doesn't make sense to give them executable bits.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

If basic match has no tree of matches underneath
then print_ematch would core dump.

Add all current values. Since if_arp.h is included, get rid
of ifdefs'. Make table constant.

Recent gcc doesn't like it when you cast char pointers to uint16_t
pointers and then dereference it.  So use memcpy() instead and let
gcc take care of optimizing things away (when appropriate).  This
should also fix alignment issues on arches where gcc packs the char
pointer tighter than 16bits.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

This patch adds ipv6 filter priority/traffic class function
static int parse_ip6_class(int *argc_p, char ***argv_p, struct tc_u32_sel *sel)
shifting filter value to 5th bit and ignoring "at" as header position
is exactly given.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

The recent commit "iproute2: add option to build m_xt as a tc module"
(ab814d63) looks like it wrongly included debug changes in the
install target.  So drop the `echo` so the tc binary actually gets
installed again.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

Get ip rule parsing of "dsfield" in sync with ip route parsing and manual page.
Signed-off-by: Arnd Hannemann <hannemann@nets.rwth-aachen.de>

The do_multirule logic was broken in batch mode because
it expected the preferred_family to be AF_INET or AF_INET6,
but it then assigned it to RTNL_FAMILY_IPMR or RTNL_FAMILY_IP6MR.
So, the next iteration of the batch processing, it failed
the check for AF_INET or AF_INET6.
Signed-off-by: Ben Greear <greearb@candelatech.com>

otherwise "if ((int)val == -1)" will never match on 64 bit systems
Signed-off-by: Ulrich Weber <uweber@astaro.com>

as already done in IPv4 and metrics code part
Signed-off-by: Ulrich Weber <uweber@astaro.com>

Before IPv6 routing cache entries were always displayed
if additional tables beside MAIN and LOCAL are installed.
Signed-off-by: Ulrich Weber <uweber@astaro.com>

commit 44a5293c1c47b8c32d9bb0756660ea5d4802acf2
Author: Patrick McHardy <kaber@trash.net>
Date:   Tue Apr 13 17:03:47 2010 +0200

    ip: add support for multicast rules
Signed-off-by: Patrick McHardy <kaber@trash.net>

`ip -s link` shows interface counters truncated to 32 bit. This is
because interface statistics are transported only in 32-bit quantity
to userspace. This commit adds recognition for the new IFLA_STATS64
attribute that exports them in full 64 bit.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

Version for 2.6.35 version on -next

Cloned from ip-cref.tex

Mention initcwnd in ip(8). Text taken from doc/ip-cref.tex.
Signed-off-by: Brian Bloniarz <bmb@athenacr.com>

The kernel interface changed just before 2.6.34 was released.  This brings
iproute2 in line with the current changes.  The VF portion of setlink is
comprised of a set of nested attributes.

  IFLA_VFINFO_LIST (NESTED)
    IFLA_VF_INFO (NESTED)
      IFLA_VF_MAC
      IFLA_VF_VLAN
      IFLA_VF_TX_RATE
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

Add some missing pieces. Still need to add doucmentation for rest
of vlan arguments.

Last minute IOV format change.

ip addrlabel outputs if%d names due to missing init call:
$ ip addrlabel s
prefix a::42/128 dev if4 label 1000

Also, ip did not accept "if%d" interfaces on input.
Signed-off-by: Florian Westphal <fw@strlen.de>

When building on an old environment, the flex generated
tc/emp_ematch.lex.c file would not compile.  The error given was:

emp_ematch.lex.c:1686: error: expected ‘;’, ‘,’ or ‘)’ before numeric constant

The emp_ematch.l uses 'str' as a start symbol name, and  flex would create
a '#define str 1' statement.  This particular version of flex,
unfortunately, used 'str' as names of string variables in the generated
parser functions.  This is line 1686 in the generated file:

YY_BUFFER_STATE ematch__scan_string (yyconst char * str )

This patch just substitutes 'str' for 'lexstr' in emp_ematch.l to avoid
the collision.

2.6 kernel allows 2^32 route tables, but documentation stated only
255 values were possible.

This patch fix two issues:

* If kernel is not supporting 6rd then ioctl() call
  will return EINVAL, if so just skip perror call.

* 6rd scope is ipv6/ip tunnels. Dont try to fetch
  6rd tunnel parms if tunnel protocol != IPPROTO_IPV6.
Signed-off-by: Alexandre Cassen <acassen@freebox.fr>

This will build the xt module (action ipt) of tc as a
shared object that is linked at runtime by tc if used,
rather then built into tc.

This is similar to how the atm qdisc support
is handled (q_atm.so).
Signed-off-by: Andreas Henriksson <andreas@xxxxxxxx>

Other commands are quiet if successful. mirred action had leftover
debug message.

XT_ALIGN() calls ALIGN macro but ALIGN is in kernel source not userspace.

Try to automatically detect iptables modules directory.

Make the configure script look for iptables modules.
This also makes it possible to specify it on the
command line while building via "make IPT_LIB_DIR=/foo/bar".
Signed-off-by: Andreas Henriksson <andreas@fatal.se>

Up until now, "tun" tunnels were displayed as link/[65534].
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

This tool reads /etc/gai.conf, configuration for getaddrinfo(3), and
set up kernel parameter.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Allow ip to process all the file passed with the -batch argument when
is passed also the -force switch
Signed-off-by: Michele Petrazzo <michele.petrazzo@unipex.it>

This patch uses the new features of the kernel's netlink CAN interface
making the bus-error reporting configurable and allowing to retrieve
the CAN TX and RX bus error counters via netlink interface. Here is the
output of my test session showing how to use them:

# ip link set can0 up type can bitrate 500000 berr-reporting on
# ip -d -s link show can0
2: can0: <NOARP,UP,LOWER_UP,ECHO> mtu 16 qdisc pfifo_fast state UNKNOWN qlen 10
    link/can
    can <BERR-REPORTING> state ERROR-PASSIVE (berr-counter tx 128 rx 0) restart-ms 0
                              CAN bus error counter values ^^^^^^^^^^^
    bitrate 500000 sample-point 0.875
    tq 125 prop-seg 6 phase-seg1 7 phase-seg2 2 sjw 1
    sja1000: tseg1 1..16 tseg2 1..8 sjw 1..4 brp 1..64 brp-inc 1
    clock 8000000
    re-started bus-errors arbit-lost error-warn error-pass bus-off
    0          54101      0          1          1          0
    RX: bytes  packets  errors  dropped overrun mcast
    432808     54101    54101   0       0       0
    TX: bytes  packets  errors  dropped carrier collsns
    0          0        0       0       0       0

# ifconfig can0 down
# ip link set can0 up type can berr-reporting off
# candump -t d any,0:0,#FFFFFFFF
 (0.000000)  can0  20000004  [8] 00 08 00 00 00 00 60 00   ERRORFRAME
 (0.000474)  can0  20000004  [8] 00 20 00 00 00 00 80 00   ERRORFRAME
                                                   ^^ ^^
						    \  \___ rxerr
						     \_____ txerr

Furthermore, the missing support for one-shot mode has been added.
Signed-off-by: Wolfgang Grandegger <wg@grandegger.com>

Add support for SA manipulation by mark
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>

This patch carries basic infrastructure.
You need to make sure that the proper include/linux/xfrm.h is included
for it to compile.

Example: