- 28 Jan, 2008 40 commits
-
-
Pablo Neira Ayuso authored
This patch adds support for master tuple event notification and dumping. Conntrackd needs this information to recover related connections appropriately. Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Pablo Neira Ayuso authored
The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see: http://people.netfilter.org/pablo/conntrack-tools/Signed-off-by:
-
Benjamin LaHaise authored
When terminating DSL connections for an assortment of random customers, I've found it necessary to use iptables to clamp the MSS used for connections to work around the various ICMP blackholes in the greater net. Unfortunately, the current behaviour in Linux is imperfect and actually make things worse, so I'm proposing the following: increasing the MSS in a packet can never be a good thing, so make --set-mss only lower the MSS in a packet. Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing connections from clients (ie web traffic), as it only looks at the PMTU on the destination route, not the source of the packet (the DSL interfaces in question have a 1442 byte MTU while the destination ethernet interface is 1500 -- there are problematic hosts which use a 1300 byte MTU). Reworking that is probably a good idea at some point, but it's more work than this is. Signed-off-by:
Benjamin LaHaise <bcrl@kvack.org> Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Resync get_entries() with ip_tables.c by moving the checks from the setsockopt handler to the function itself. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
More resyncing with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Resync with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Remove compatiblity hack copied from ip_tables.c - ipchains didn't even support arp_tables :) Signed-off-by:
-
Patrick McHardy authored
Use vmalloc_node() as in ip_tables.c. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
The size check is already performed by xt_check_target, no need to do it again. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
ipchains support has been removed years ago. kill last remains. Signed-off-by:
-
Patrick McHardy authored
Use raw_smp_processor_id() in do_add_counters() as in ip_tables.c. Signed-off-by:
-
Patrick McHardy authored
Fix leakage of local variable on stack. This already got fixed in ip_tables silently by the compat patches. Signed-off-by:
-
Patrick McHardy authored
Use %zu for sizeof() and remove casts. Signed-off-by:
-
Patrick McHardy authored
Reformat ip_tables.c and ip6_tables.c in order to eliminate non-functional differences and minimize diff output. This allows to get a view of the real differences using: sed -e 's/IP6T/IPT/g' \ -e 's/IP6/IP/g' \ -e 's/INET6/INET/g' \ -e 's/ip6t/ipt/g' \ -e 's/ip6/ip/g' \ -e 's/ipv6/ip/g' \ -e 's/icmp6/icmp/g' \ net/ipv6/netfilter/ip6_tables.c | \ diff -wup /dev/stdin net/ipv4/netfilter/ip_tables.c Signed-off-by: -
Patrick McHardy authored
Old userspace doesn't support revision 1, especially for IPv6, which is only available in the SVN snapshot. Add compat support for revision 0. Signed-off-by:
-
Patrick McHardy authored
The current netfilter SVN version includes support for this, so enable it in the kernel as well. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Resync get_entries() with ip_tables.c by moving the checks from the setsockopt handler to the function itself. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
More resyncing with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Consistently use vmalloc_node for all counter allocations. Signed-off-by:
-
Patrick McHardy authored
Resync with ip_tables.c as preparation for compat support. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Its needed by ip6_tables and arp_tables as well. Signed-off-by:
-
Patrick McHardy authored
Use compat types and compat iterators when dealing with compat entries for clarity. This doesn't actually make a difference for ip_tables, but is needed for ip6_tables and arp_tables. Signed-off-by:
-
Patrick McHardy authored
Account for size differences when dumping entries or calculating the entry positions. This doesn't actually make any difference for IPv4 since the structures have the same size, but its logically correct and needed for IPv6. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Patrick McHardy authored
Make xt_compat_match_from_user return an int to make it usable in the *tables iterator macros and kill a now unnecessary wrapper function. Signed-off-by:
-
Patrick McHardy authored
The compat code has some very odd formating, clean it up before porting it to ip6_tables. Signed-off-by:
-
Patrick McHardy authored
Signed-off-by:
-
Johannes Berg authored
These drivers pass full mactime information to the stack, make them indicate this via the new RX_FLAG_TSFT to get mac80211 to show this information in monitor mode. Signed-off-by:
Johannes Berg <johannes@sipsolutions.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com> Signed-off-by:
-
Dan Williams authored
Introduce scan capabilities to WEXT so that userspace can do intelligent things with scan behavior such as handling hidden SSIDs more gracefully. If the driver reports a specific scan capability, the driver must respect the options specified in the iw_scan_req structure when handling the SIOCSIWSCAN call, unless it's mode or state does not allow it to do so, in which case it must return an error. This version switches to Dave Kilroy's suggestion of claiming unused padding space for the scan_capa field. Signed-off-by:
Dan Williams <dcbw@redhat.com> Signed-off-by:
-
Johannes Berg authored
This makes mac80211 include the low-level MAC timestamp in the radiotap header if the driver indicated (by a new RX flag) that the timestamp is valid. Signed-off-by:
-
Gerrit Renker authored
The function follows48(), which is a special-case of dccp_delta_seqno(), is nowhere used in the DCCP code, thus removed by this patch. Signed-off-by:
Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by:
Ian McDonald <ian.mcdonald@jandi.co.nz> Signed-off-by:
Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by:
-
Gerrit Renker authored
This implements the changes to the nofeedback timer handling suggested in draft rfc3448bis00, section 4.4. In particular, these changes mean: * better handling of the lossless case (p == 0) * the timestamp for computing t_ld becomes obsolete * much more recent document (RFC 3448 is almost 5 years old) * concepts in rfc3448bis arose from a real, working implementation (cf. sec. 12) Signed-off-by:
-
