This patch carries basic infrastructure.
You need to make sure that the proper include/linux/xfrm.h is included
for it to compile.

Example:

Add support for SP manipulation by mark
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>

parsing a mark as a classid allows for acceptance of strange
informal input.

cheers,
jamal
commit aad0da6507ff8a95a63ed8e529c05f52be5b0e75
Author: Jamal Hadi Salim <hadi@cyberus.ca>
Date:   Mon Feb 15 06:45:29 2010 -0500

    skbedit: use get_u32 for parsing mark

    get_u32 is the more appropriate parser for a mark.
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>

Modify the parser to keep track of the first of any duplicated attributes,
instead of the last. This is required for VF configuration reporting, where
multiple attributes of the same type are added sequentially.
Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

Add support to 'ip' for setting and showing SR-IOV virtual function
link parameters.
Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

ip command should not keep track of lineno, that is done
in getcmdline().

Use santized headers from net-next tree.

Add initrwnd option parsing to iproute. This option uses the new
rtnetlink init_rcvwnd to set the TCP initial receive window size
advertised by passive and active TCP connections.
Signed-off-by: Laurent Chavey <chavey@google.com>

This adds the required changes to gain access to
the head drop classfull queuing discipline named
pfifo_head_drop. In difference to pfifo or pfifo_fast
this queuing discipline will drop the first packet
in the case of queue congestion. As a result the queue
contain always the freshest packets.

To replace the current a root queueing discipline
for eth0:
$ tc qdisc replace dev eth0 root pfifo_head_drop

And show statistics:
$ tc -s qdisc show dev eth0
Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net>

Final 2.6.33 version

This patch provides iproute2 facilities to configure 6rd tunnel. To
configure a 6rd tunnel, you need to configure a sit tunnel and set
6rd prefix as following :

  ip tunnel add sit1 mode sit local a.b.c.d ttl 64
  ip tunnel 6rd dev sit1 6rd-prefix xxxx:yyyy::/z

Optionally you can provide a relay prefix :

  ip tunnel 6rd dev sit1 6rd-relay_prefix e.f.g.h/i

Finally you can reset previous tunnel settings :

  ip tunnel 6rd dev sit1 6rd-reset
Signed-off-by: Alexandre Cassen <acassen@freebox.fr>

IPv6 addresses that have IFA_F_SECONDARY set are actually temporary addresses,
hence the IFA_F_TEMPORARY equivalent.  Change the output in this case and
allow filtering on the word "temporary".
Signed-off-by: Brian Haley <brian.haley@hp.com>

Currently you can configure "equalize" and it looks all fine and dandy.
The kernel has the interface defined, but apparently there's never actually
been any implementation for it (only a never merged patch in the 2.4 era).

I'm suggesting to drop the code to give any potential users of this feature
the benefit of receiving a proper error message. I see it unlikely that
this will be implemented in the near future, but if it ever happens
reviving the iproute2 side should be as easy as git revert this patch.

For more details see http://bugs.debian.org/149897

With help from Patrick McHardy.
Signed-off-by: Florian Westphal <fw@strlen.de>

remove unused #define and "ok" statements.
Signed-off-by: Florian Westphal <fwestphal@astaro.com>

$ tc qdisc add dev eth1 root tbf
RTNETLINK answers: Invalid argument

$ tc qdisc add dev eth1 root red
RTNETLINK answers: Invalid argument

with patch:
$ tc qdisc add dev eth1 root red
Required parameter (min, max, burst, limit, avpkt) is missing

$ tc qdisc add dev eth1 root tbf
Usage: ... tbf limit BYTES burst BYTES[/BYTES] rate KBPS ...
Signed-off-by: Florian Westphal <fw@strlen.de>

fix up reference: there is no tc(7) man page.
Signed-off-by: Florian Westphal <fw@strlen.de>

Signed-off-by: Florian Westphal <fw@strlen.de>

Allow tmpl IP addresses to have a different family than
selector addresses.  This is useful in conjunction with
XFRM_STATE_AF_UNSPEC.
Signed-off-by: Alex Badea <abadea@ixiacom.com>

Convert to/from XFRM_STATE_ICMP and XFRM_STATE_AF_UNSPEC state flags.
Signed-off-by: Alex Badea <abadea@ixiacom.com>

"function foo" should be "foo()" to work when sh is not bash.
Signed-off-by: Andreas Henriksson <andreas@fatal.se>

Since there aren't any targets that currently use this pattern rule, this
is more of a proactive fix.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

Macvlan can now optionally support forwarding between its
ports, if they are in "bridge" mode. This adds support
for this option to "ip link add", "ip link set" and "ip
-d link show".

The default mode in the kernel is now "vepa" mode, meaning
"virtual ethernet port aggregator". This mode is used
together with the "hairpin" mode of an ethernet bridge
that the parent of the macvlan device is connected to.
All frames still get sent out to the external interface,
but the adjacent bridge is able to send them back on
the same wire in hairpin mode, so the macvlan ports
are able to see each other, which the bridge can be
configured to monitor and control traffic between
all macvlan instances. Multicast traffic coming in
from the external interface is checked for the source
MAC address and only delivered to ports that have not
yet seen it.

In bridge mode, macvlan will send all multicast traffic
to other interfaces that are also in bridge mode but
not to those in vepa mode, which get them on the way
back from the hairpin.

The third supported mode is "private", which prevents
communication between macvlans even if the adjacent
bridge is in hairpin mode. This behavior is closer to
the original implementation of macvlan but stricly
maintains isolation.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Fix support for IFA_F_DADFAILED and update ip.8 man page.
Signed-off-by: Brian Haley <brian.haley@hp.com>

David Miller wrote:
> From: Patrick McHardy <kaber@trash.net>
> Date: Mon, 30 Nov 2009 19:00:14 +0100
>
>> This patch contains iproute support for iprule oif classification
>> for the send-to-self RFC I just sent out.
>
> Patrick, you need to submit a new version of this patch with
> the FIB_RULE_* macro fixed, just like the kernel version got
> fixed.

Thanks for reminind me of this. New patch attached.

commit 0fe5164cbaa1d65dda341075710be71bf1f32d10
Author: Patrick McHardy <kaber@trash.net>
Date:   Fri Dec 4 07:06:18 2009 +0100

    iprule: add oif classification support
Signed-off-by: Patrick McHardy <kaber@trash.net>

This adds support for setting the skb mark.
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>

This patch adds support for the VLAN loose binding flag that is
supported in net-next to iplink_vlan.

commit 870970deb6cbea7a5d4881bdd717304d5284d315
Author: Patrick McHardy <kaber@trash.net>
Date:   Tue Dec 1 12:21:15 2009 +0100

    iplink_vlan: add support for VLAN loose binding flag
Signed-off-by: Patrick McHardy <kaber@trash.net>

These corespond with 2.6.33-rc2

Split up in functions. Make XT checks bail if previous XT check
was successful.

This result improves the output of the configure script to not indicate
using iptables only because the last test failed (when previous ones could
have already succeded).
Signed-off-by: Andreas Henriksson <andreas@fatal.se>

The environment variable could contain format characters, causing
problems. Better to just use it directly.

Unless promote_secondaries has been active deleting the primary address of
an interface will automatically delete all the secondary addresses.

In the case where ip flush requests the primary then secondary addresses to
be removed - which is the order the addresses are returned by the kernel -
this will cause an error as by the time the request to remove a secondary
address is made it will be missing as it will have been deleted in the
course of deleting the primary address.

This approach to solving this problem orders requests for the
deletion of secondary addresses before primary ones providing
rtnl_dump_filter_l(), a version of rtnl_dump_filter() that
iterates over a list of filters. And by providing two specialised
filters print_addrinfo_secondary() and print_addrinfo_primary().

rtnl_dump_filter_l() first iterates over all addresses using
print_addrinfo_secondary(), which appends secondary addresses to the
request buffer.  Then again using print_addrinfo_primary() which appends
primary addresses.

This approach should work regardless of it promote_secondaries is
active or not. And regardless of if any primary of secondary addresses
are present or not.
Signed-off-by: Simon Horman <horms@verge.net.au>

Add a new cleaned up m_xt.c based on m_xt_old.c
The new m_xt.c has been updated to use the new names and new api
that xtables exposes in iptables 1.4.5.
All the old internal api cruft has also been dropped.

Additionally, a configure script test is added to check for
the new xtables api and set the TC_CONFIG_XT flag in Config.
(tc/Makefile already handles this flag in previous commit.)
Signed-off-by: Andreas Henriksson <andreas@fatal.se>

Move the file and rename the configure flags.
The file is being kept around for iptables < 1.4.5 compatibility.
Signed-off-by: Andreas Henriksson <andreas@fatal.se>

Peter Palfrader said in http://bugs.debian.org/545008 that
"--help output, if explicitly requested, should go to stdout, not stderr."
which this patch fixes.

Additionally, the exit code was adjusted to success if help was
explicitly requested.

(Syntax error still outputs to stderr and has the same exit code.)
Signed-off-by: Andreas Henriksson <andreas@fatal.se>

The kernel takes a lack of options as indication that the fw classifier
should operate in compatibility mode, where marks are mapped directly to
classids.

Commit e22b42a2 (tc mask patch) broke this by adding an empty TCA_OPTIONS
attribute even if no handle is specified. Restore the old behaviour.
Signed-off-by: Patrick McHardy <kaber@trash.net>

The static libnetlink.a library is exposed to other users in Debian via the
"iproute-dev" package. Apparently people are interested in using it in their
shared libraries and would like to see the code be position independent.

Patch below makes the code under lib/ build with -fPIC.

See http://bugs.debian.org/547602Signed-off-by: Andreas Henriksson <andreas@fatal.se>