linux-2.6
17 years ago[DCCP] tfrc: Add protection against invalid parameters to TFRC routines
Gerrit Renker [Sun, 3 Dec 2006 16:52:26 +0000 (14:52 -0200)] 
[DCCP] tfrc: Add protection against invalid parameters to TFRC routines

 1) For the forward X_calc lookup, it
    * protects effectively against RTT=0 (this case is possible), by
      returning the maximal lookup value instead of just setting it to 1
    * reformulates the array-bounds exceeded condition: this only happens
      if p is greater than 1E6 (due to the scaling)
    * the case of negative indices can now with certainty be excluded,
      since documentation shows that the formulas are within bounds
    * additional protection against p = 0 (would give divide-by-zero)

 2) For the reverse lookup, it warns against
    * protects against exceeding array bounds
    * now returns 0 if f(p) = 0, due to function definition
    * warns about minimal resolution error and returns the smallest table
      value instead of p=0 [this would mask congestion conditions]

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
17 years ago[DCCP] tfrc: Fix small error in reverse lookup of p for given f(p)
Gerrit Renker [Sun, 3 Dec 2006 16:52:01 +0000 (14:52 -0200)] 
[DCCP] tfrc: Fix small error in reverse lookup of p for given f(p)

This fixes the following small error in tfrc_calc_x_reverse_lookup.

 1) The table is generated by the following equations:
lookup[index][0] = g((index+1) * 1000000/TFRC_CALC_X_ARRSIZE);
lookup[index][1] = g((index+1) * TFRC_CALC_X_SPLIT/TFRC_CALC_X_ARRSIZE);
    where g(q) is 1E6 * f(q/1E6)

 2) The reverse lookup assigns an entry in lookup[index][small]

 3) This index needs to match the above, i.e.
    * if small=0 then

       p  = (index + 1) * 1000000/TFRC_CALC_X_ARRSIZE

    * if small=1 then

p = (index+1) * TFRC_CALC_X_SPLIT/TFRC_CALC_X_ARRSIZE

These are exactly the changes that the patch makes; previously the code did
not conform to the way the lookup table was generated (this difference resulted
in a mean error of about 1.12%).

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
17 years ago[DCCP] tfrc: Document boundaries and limits of the TFRC lookup table
Gerrit Renker [Sun, 3 Dec 2006 16:51:29 +0000 (14:51 -0200)] 
[DCCP] tfrc: Document boundaries and limits of the TFRC lookup table

This adds documentation for the TCP Reno throughput equation which is at
the heart of the TFRC sending rate / loss rate calculations.

It spells out precisely how the values were determined and what they mean.
The equations were derived through reverse engineering and found to be
fully accurate (verified using test programs).

This patch does not change any code.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
17 years ago[DCCP] ccid3: Fix warning message about illegal ACK
Gerrit Renker [Sun, 3 Dec 2006 16:51:14 +0000 (14:51 -0200)] 
[DCCP] ccid3: Fix warning message about illegal ACK

This avoids a (harmless) warning message being printed at the DCCP server
(the receiver of a DCCP half connection).

Incoming packets are both directed to

 * ccid_hc_rx_packet_recv() for the server half
 * ccid_hc_tx_packet_recv() for the client half

The message gets printed since on a server the client half is currently not
sending data packets.
This is resolved for the moment by checking the DCCP-role first. In future
times (bidirectional DCCP connections), this test may have to be more
sophisticated.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
17 years ago[DCCP] ccid3: Fix bug in calculation of send rate
Gerrit Renker [Sun, 3 Dec 2006 16:50:56 +0000 (14:50 -0200)] 
[DCCP] ccid3: Fix bug in calculation of send rate

The main object of this patch is the following bug:
 ==> In ccid3_hc_tx_packet_recv, the parameters p and X_recv were updated
     _after_ the send rate was calculated. This is clearly an error and is
     resolved by re-ordering statements.

In addition,
  * r_sample is converted from u32 to long to check whether the time difference
    was negative (it would otherwise be converted to a large u32 value)
  * protection against RTT=0 (this is possible) is provided in a further patch
  * t_elapsed is also converted to long, to match the type of r_sample
  * adds a a more debugging information regarding current send rates
  * various trivial comment/documentation updates

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
17 years ago[DCCP]: Fix BUG in retransmission delay calculation
Gerrit Renker [Sun, 3 Dec 2006 16:50:42 +0000 (14:50 -0200)] 
[DCCP]: Fix BUG in retransmission delay calculation

This bug resulted in ccid3_hc_tx_send_packet returning negative
delay values, which in turn triggered silently dequeueing packets in
dccp_write_xmit. As a result, only a few out of the submitted packets made
it at all onto the network.  Occasionally, when dccp_wait_for_ccid was
involved, this also triggered a bug warning since ccid3_hc_tx_send_packet
returned a negative value (which in reality was a negative delay value).

The cause for this bug lies in the comparison

 if (delay >= hctx->ccid3hctx_delta)
return delay / 1000L;

The type of `delay' is `long', that of ccid3hctx_delta is `u32'. When comparing
negative long values against u32 values, the test returned `true' whenever delay
was smaller than 0 (meaning the packet was overdue to send).

The fix is by casting, subtracting, and then testing the difference with
regard to 0.

This has been tested and shown to work.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
17 years ago[DCCP]: Use higher RTO default for CCID3
Gerrit Renker [Sun, 3 Dec 2006 16:50:23 +0000 (14:50 -0200)] 
[DCCP]: Use higher RTO default for CCID3

The TFRC nofeedback timer normally expires after the maximum of 4
RTTs and twice the current send interval (RFC 3448, 4.3). On LANs
with a small RTT this can mean a high processing load and reduced
performance, since then the nofeedback timer is triggered very
frequently.

This patch provides a configuration option to set the bound for the
nofeedback timer, using as default 100 milliseconds.

By setting the configuration option to 0, strict RFC 3448 behaviour
can be enforced for the nofeedback timer.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
17 years ago[XFRM]: Fix aevent structuring to be more complete.
Jamal Hadi Salim [Sun, 3 Dec 2006 06:22:25 +0000 (22:22 -0800)] 
[XFRM]: Fix aevent structuring to be more complete.

aevents can not uniquely identify an SA. We break the ABI with this
patch, but consensus is that since it is not yet utilized by any
(known) application then it is fine (better do it now than later).

Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: xtables: fixes warning on compilation of hashlimit
Yasuyuki Kozakai [Sun, 3 Dec 2006 06:19:01 +0000 (22:19 -0800)] 
[NETFILTER]: xtables: fixes warning on compilation of hashlimit

To use ipv6_find_hdr(), IP6_NF_IPTABLES is necessary.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[ROSE] rose_add_loopback_node: propagate -E
Alexey Dobriyan [Sun, 3 Dec 2006 06:17:48 +0000 (22:17 -0800)] 
[ROSE] rose_add_loopback_node: propagate -E

David Binderman's icc logs:
net/rose/rose_route.c(399): remark #593: variable "err" was set but never used

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: fix header inclusions for helpers
Yasuyuki Kozakai [Sun, 3 Dec 2006 06:12:54 +0000 (22:12 -0800)] 
[NETFILTER]: nf_conntrack: fix header inclusions for helpers

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: EXPORT_SYMBOL cleanup
Patrick McHardy [Sun, 3 Dec 2006 06:11:25 +0000 (22:11 -0800)] 
[NETFILTER]: nf_conntrack: EXPORT_SYMBOL cleanup

- move EXPORT_SYMBOL next to exported symbol
- use EXPORT_SYMBOL_GPL since this is what the original code used

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: Mark old IPv4-only connection tracking scheduled for removal
Patrick McHardy [Sun, 3 Dec 2006 06:11:01 +0000 (22:11 -0800)] 
[NETFILTER]: Mark old IPv4-only connection tracking scheduled for removal

Also remove the references to "new connection tracking" from Kconfig.
After some short stabilization period of the new connection tracking
helpers/NAT code the old one will be removed.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_nat: add SNMP NAT helper port
Patrick McHardy [Sun, 3 Dec 2006 06:10:34 +0000 (22:10 -0800)] 
[NETFILTER]: nf_nat: add SNMP NAT helper port

Add nf_conntrack port of the SNMP NAT helper.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack/nf_nat: add TFTP helper port
Patrick McHardy [Sun, 3 Dec 2006 06:10:18 +0000 (22:10 -0800)] 
[NETFILTER]: nf_conntrack/nf_nat: add TFTP helper port

Add IPv4 and IPv6 capable nf_conntrack port of the TFTP conntrack/NAT helper.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack/nf_nat: add SIP helper port
Patrick McHardy [Sun, 3 Dec 2006 06:09:57 +0000 (22:09 -0800)] 
[NETFILTER]: nf_conntrack/nf_nat: add SIP helper port

Add IPv4 and IPv6 capable nf_conntrack port of the SIP conntrack/NAT helper.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack/nf_nat: add PPTP helper port
Patrick McHardy [Sun, 3 Dec 2006 06:09:41 +0000 (22:09 -0800)] 
[NETFILTER]: nf_conntrack/nf_nat: add PPTP helper port

Add nf_conntrack port of the PPtP conntrack/NAT helper. Since there seems
to be no IPv6-capable PPtP implementation the helper only support IPv4.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: add NetBIOS name service helper port
Patrick McHardy [Sun, 3 Dec 2006 06:09:24 +0000 (22:09 -0800)] 
[NETFILTER]: nf_conntrack: add NetBIOS name service helper port

Add nf_conntrack port of the NetBIOS name service conntrack helper.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port
Patrick McHardy [Sun, 3 Dec 2006 06:09:06 +0000 (22:09 -0800)] 
[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port

Add nf_conntrack port of the IRC conntrack/NAT helper. Since DCC doesn't
support IPv6 yet, the helper is still IPv4 only.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port
Patrick McHardy [Sun, 3 Dec 2006 06:08:46 +0000 (22:08 -0800)] 
[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port

Add IPv4 and IPv6 capable nf_conntrack port of the H.323 conntrack/NAT helper.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack/nf_nat: add amanda helper port
Patrick McHardy [Sun, 3 Dec 2006 06:08:26 +0000 (22:08 -0800)] 
[NETFILTER]: nf_conntrack/nf_nat: add amanda helper port

Add IPv4 and IPv6 capable nf_conntrack port of the Amanda conntrack/NAT helper.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: add helper function for expectation initialization
Patrick McHardy [Sun, 3 Dec 2006 06:08:01 +0000 (22:08 -0800)] 
[NETFILTER]: nf_conntrack: add helper function for expectation initialization

Expectation address masks need to be differently initialized depending
on the address family, create helper function to avoid cluttering up
the code too much.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_nat: add FTP NAT helper port
Jozsef Kadlecsik [Sun, 3 Dec 2006 06:07:44 +0000 (22:07 -0800)] 
[NETFILTER]: nf_nat: add FTP NAT helper port

Add FTP NAT helper.

Split out from Jozsef's big nf_nat patch with a few small fixes by myself.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: Add NAT support for nf_conntrack
Jozsef Kadlecsik [Sun, 3 Dec 2006 06:07:13 +0000 (22:07 -0800)] 
[NETFILTER]: Add NAT support for nf_conntrack

Add NAT support for nf_conntrack. Joint work of Jozsef Kadlecsik,
Yasuyuki Kozakai, Martin Josefsson and myself.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: add module aliases to IPv4 conntrack names
Patrick McHardy [Sun, 3 Dec 2006 06:06:05 +0000 (22:06 -0800)] 
[NETFILTER]: nf_conntrack: add module aliases to IPv4 conntrack names

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: Kconfig: improve conntrack selection
Patrick McHardy [Sun, 3 Dec 2006 06:05:46 +0000 (22:05 -0800)] 
[NETFILTER]: Kconfig: improve conntrack selection

Improve the connection tracking selection (well, the user experience,
not really the aesthetics) by offering one option to enable connection
tracking and a choice between the implementations.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: automatic helper assignment for expectations
Patrick McHardy [Sun, 3 Dec 2006 06:05:25 +0000 (22:05 -0800)] 
[NETFILTER]: nf_conntrack: automatic helper assignment for expectations

Some helpers (namely H.323) manually assign further helpers to expected
connections. This is not possible with nf_conntrack anymore since we
need to know whether a helper is used at allocation time.

Handle the helper assignment centrally, which allows to perform the
correct allocation and as a nice side effect eliminates the need
for the H.323 helper to fiddle with nf_conntrack_lock.

Mid term the allocation scheme really needs to be redesigned since
we do both the helper and expectation lookup _twice_ for every new
connection.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: endian annotations
Patrick McHardy [Sun, 3 Dec 2006 06:05:08 +0000 (22:05 -0800)] 
[NETFILTER]: nf_conntrack: endian annotations

Resync with Al Viro's ip_conntrack annotations and fix a missed
spot in ip_nat_proto_icmp.c.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: fix helper structure alignment
Patrick McHardy [Sun, 3 Dec 2006 06:04:50 +0000 (22:04 -0800)] 
[NETFILTER]: nf_conntrack: fix helper structure alignment

Adding the alignment to the size doesn't make any sense, what it
should do is align the size of the conntrack structure to the
alignment requirements of the helper structure and return an
aligned pointer in nfct_help().

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: nf_conntrack: fix NF_CONNTRACK_PROC_COMPAT dependency
Patrick McHardy [Sun, 3 Dec 2006 06:04:24 +0000 (22:04 -0800)] 
[NETFILTER]: nf_conntrack: fix NF_CONNTRACK_PROC_COMPAT dependency

NF_CONNTRACK_PROC_COMPAT depends on NF_CONNTRACK_IPV4, not NF_CONNTRACK.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET]: Accept wildcard delimiters in in[46]_pton
Patrick McHardy [Sun, 3 Dec 2006 06:04:04 +0000 (22:04 -0800)] 
[NET]: Accept wildcard delimiters in in[46]_pton

Accept -1 as delimiter to abort parsing without an error at the first
unknown character. This is needed by the upcoming nf_conntrack SIP
helper, where addresses are delimited by either '\r' or '\n' characters.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[PKT_SCHED] act_gact: division by zero
Kim Nordlund [Sat, 2 Dec 2006 04:21:44 +0000 (20:21 -0800)] 
[PKT_SCHED] act_gact: division by zero

Not returning -EINVAL, because someone might want to use the value
zero in some future gact_prob algorithm?

Signed-off-by: Kim Nordlund <kim.nordlund@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NETFILTER]: Kill ip_queue from feature removal schedule.
Patrick McHardy [Sat, 2 Dec 2006 04:10:13 +0000 (20:10 -0800)] 
[NETFILTER]: Kill ip_queue from feature removal schedule.

We really can't remove ip_queue. Many users use this, there is no binary
compatible interface and even the compat replacement for the originally
statically linked library doesn't work. There is also no real necessity
to remove the code, so the feature-removal-schedule entry should be
removed instead.

Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[GENETLINK]: Add cmd dump completion.
Jamal Hadi Salim [Sat, 2 Dec 2006 04:07:42 +0000 (20:07 -0800)] 
[GENETLINK]: Add cmd dump completion.

Remove assumption that generic netlink commands cannot have dump
completion callbacks.

Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[ATM]: Kill ipcommon.[ch]
David S. Miller [Fri, 1 Dec 2006 05:05:23 +0000 (21:05 -0800)] 
[ATM]: Kill ipcommon.[ch]

All that remained was skb_migrate() and that was overkill
for what the two call sites were trying to do.

Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET_SCHED]: policer: restore compatibility with old iproute binaries
Patrick McHardy [Fri, 1 Dec 2006 03:54:05 +0000 (19:54 -0800)] 
[NET_SCHED]: policer: restore compatibility with old iproute binaries

The tc actions increased the size of struct tc_police, which broke
compatibility with old iproute binaries since both the act_police
and the old NET_CLS_POLICE code check for an exact size match.

Since the new members are not even used, the simple fix is to also
accept the size of the old structure. Dumping is not affected since
old userspace will receive a bigger structure, which is handled fine.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[PKT_SCHED]: Remove unused exports.
Adrian Bunk [Fri, 1 Dec 2006 03:50:36 +0000 (19:50 -0800)] 
[PKT_SCHED]: Remove unused exports.

This patch removes the following unused EXPORT_SYMBOL's:
- sch_api.c: qdisc_lookup
- sch_generic.c: __netdev_watchdog_up
- sch_generic.c: noop_qdisc_ops
- sch_generic.c: qdisc_alloc

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Split ebt_replace into user and kernel variants, annotate.
Al Viro [Fri, 1 Dec 2006 03:28:48 +0000 (19:28 -0800)] 
[EBTABLES]: Split ebt_replace into user and kernel variants, annotate.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Clean ebt_register_table() up.
Al Viro [Fri, 1 Dec 2006 03:28:25 +0000 (19:28 -0800)] 
[EBTABLES]: Clean ebt_register_table() up.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Move calls of ebt_verify_pointers() upstream.
Al Viro [Fri, 1 Dec 2006 03:28:08 +0000 (19:28 -0800)] 
[EBTABLES]: Move calls of ebt_verify_pointers() upstream.

... and pass just repl->name to translate_table()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: ebt_check_entry() doesn't need valid_hooks
Al Viro [Fri, 1 Dec 2006 03:27:48 +0000 (19:27 -0800)] 
[EBTABLES]: ebt_check_entry() doesn't need valid_hooks

We can check newinfo->hook_entry[...] instead.
Kill unused argument.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Clean ebt_get_udc_positions() up.
Al Viro [Fri, 1 Dec 2006 03:27:32 +0000 (19:27 -0800)] 
[EBTABLES]: Clean ebt_get_udc_positions() up.

Check for valid_hooks is redundant (newinfo->hook_entry[i] will
be NULL if bit i is not set).  Kill it, kill unused arguments.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Switch ebt_check_entry_size_and_hooks() to use of newinfo->hook_entry[]
Al Viro [Fri, 1 Dec 2006 03:27:13 +0000 (19:27 -0800)] 
[EBTABLES]: Switch ebt_check_entry_size_and_hooks() to use of newinfo->hook_entry[]

kill unused arguments

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: translate_table(): switch direct uses of repl->hook_info to newinfo
Al Viro [Fri, 1 Dec 2006 03:26:53 +0000 (19:26 -0800)] 
[EBTABLES]: translate_table(): switch direct uses of repl->hook_info to newinfo

Since newinfo->hook_table[] already has been set up, we can switch to using
it instead of repl->{hook_info,valid_hooks}.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Move more stuff into ebt_verify_pointers().
Al Viro [Fri, 1 Dec 2006 03:26:35 +0000 (19:26 -0800)] 
[EBTABLES]: Move more stuff into ebt_verify_pointers().

Take intialization of ->hook_entry[...], ->entries_size and ->nentries
over there, pull the check for empty chains into the end of that sucker.

Now it's self-contained, so we can move it up in the very beginning of
translate_table() *and* we can rely on ->hook_entry[] being properly
transliterated after it.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Pull the loop doing __ebt_verify_pointers() into a separate function.
Al Viro [Fri, 1 Dec 2006 03:26:14 +0000 (19:26 -0800)] 
[EBTABLES]: Pull the loop doing __ebt_verify_pointers() into a separate function.

It's easier to expand the iterator here *and* we'll be able to move all
uses of ebt_replace from translate_table() into this one.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Split ebt_check_entry_size_and_hooks
Al Viro [Fri, 1 Dec 2006 03:25:51 +0000 (19:25 -0800)] 
[EBTABLES]: Split ebt_check_entry_size_and_hooks

Split ebt_check_entry_size_and_hooks() in two parts - one that does
sanity checks on pointers (basically, checks that we can safely
use iterator from now on) and the rest of it (looking into details
of entry).

The loop applying ebt_check_entry_size_and_hooks() is split in two.

Populating newinfo->hook_entry[] is done in the first part.

Unused arguments killed.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Prevent wraparounds in checks for entry components' sizes.
Al Viro [Fri, 1 Dec 2006 03:25:21 +0000 (19:25 -0800)] 
[EBTABLES]: Prevent wraparounds in checks for entry components' sizes.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Deal with the worst-case behaviour in loop checks.
Al Viro [Fri, 1 Dec 2006 03:24:49 +0000 (19:24 -0800)] 
[EBTABLES]: Deal with the worst-case behaviour in loop checks.

No need to revisit a chain we'd already finished with during
the check for current hook.  It's either instant loop (which
we'd just detected) or a duplicate work.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Verify that ebt_entries have zero ->distinguisher.
Al Viro [Fri, 1 Dec 2006 03:24:12 +0000 (19:24 -0800)] 
[EBTABLES]: Verify that ebt_entries have zero ->distinguisher.

We need that for iterator to work; existing check had been too weak.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[EBTABLES]: Fix wraparounds in ebt_entries verification.
Al Viro [Fri, 1 Dec 2006 03:22:42 +0000 (19:22 -0800)] 
[EBTABLES]: Fix wraparounds in ebt_entries verification.

We need to verify that
a) we are not too close to the end of buffer to dereference
b) next entry we'll be checking won't be _before_ our

While we are at it, don't subtract unrelated pointers...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[TCP]: Fix warnings with TCP_MD5SIG disabled.
Andrew Morton [Fri, 1 Dec 2006 03:16:28 +0000 (19:16 -0800)] 
[TCP]: Fix warnings with TCP_MD5SIG disabled.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET]: Possible cleanups.
Adrian Bunk [Fri, 1 Dec 2006 01:22:29 +0000 (17:22 -0800)] 
[NET]: Possible cleanups.

This patch contains the following possible cleanups:
- make the following needlessly global functions statis:
  - ipv4/tcp.c: __tcp_alloc_md5sig_pool()
  - ipv4/tcp_ipv4.c: tcp_v4_reqsk_md5_lookup()
  - ipv4/udplite.c: udplite_rcv()
  - ipv4/udplite.c: udplite_err()
- make the following needlessly global structs static:
  - ipv4/tcp_ipv4.c: tcp_request_sock_ipv4_ops
  - ipv4/tcp_ipv4.c: tcp_sock_ipv4_specific
  - ipv6/tcp_ipv6.c: tcp_request_sock_ipv6_ops
- net/ipv{4,6}/udplite.c: remove inline's from static functions
                          (gcc should know best when to inline them)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[IPSEC]: Add AF_KEY interface for encapsulation family.
Miika Komu [Fri, 1 Dec 2006 00:41:50 +0000 (16:41 -0800)] 
[IPSEC]: Add AF_KEY interface for encapsulation family.

Signed-off-by: Miika Komu <miika@iki.fi>
Signed-off-by: Diego Beltrami <Diego.Beltrami@hiit.fi>
Signed-off-by: Kazunori Miyazawa <miyazawa@linux-ipv6.org>
17 years ago[IPSEC]: Add netlink interface for the encapsulation family.
Miika Komu [Fri, 1 Dec 2006 00:40:51 +0000 (16:40 -0800)] 
[IPSEC]: Add netlink interface for the encapsulation family.

Signed-off-by: Miika Komu <miika@iki.fi>
Signed-off-by: Diego Beltrami <Diego.Beltrami@hiit.fi>
Signed-off-by: Kazunori Miyazawa <miyazawa@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[IPSEC]: Add encapsulation family.
Miika Komu [Fri, 1 Dec 2006 00:40:43 +0000 (16:40 -0800)] 
[IPSEC]: Add encapsulation family.

Signed-off-by: Miika Komu <miika@iki.fi>
Signed-off-by: Diego Beltrami <Diego.Beltrami@hiit.fi>
Signed-off-by: Kazunori Miyazawa <miyazawa@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[TCP] MD5SIG: Kill CONFIG_TCP_MD5SIG_DEBUG.
David S. Miller [Fri, 1 Dec 2006 00:35:01 +0000 (16:35 -0800)] 
[TCP] MD5SIG: Kill CONFIG_TCP_MD5SIG_DEBUG.

It just obfuscates the code and adds limited value.  And as Adrian
Bunk noticed, it lacked Kconfig help text too, so just kill it.

Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET_SCHED]: Fix endless loops (part 5): netem/tbf/hfsc ->requeue failures
Patrick McHardy [Thu, 30 Nov 2006 01:37:42 +0000 (17:37 -0800)] 
[NET_SCHED]: Fix endless loops (part 5): netem/tbf/hfsc ->requeue failures

When peeking at the next packet in a child qdisc by calling dequeue/requeue,
the upper qdisc qlen counter may get out of sync in case the requeue fails.
The qdisc and the child qdisc both have their counter decremented, but since
no packet is given to the upper qdisc it won't decrement its counter itself.

requeue should not fail, so this is mostly for "correctness".

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET_SCHED]: Fix endless loops (part 4): HTB
Patrick McHardy [Thu, 30 Nov 2006 01:37:05 +0000 (17:37 -0800)] 
[NET_SCHED]: Fix endless loops (part 4): HTB

Convert HTB to use qdisc_tree_decrease_len() and add a callback
for deactivating a class when its child queue becomes empty.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET_SCHED]: Fix endless loops (part 3): HFSC
Patrick McHardy [Thu, 30 Nov 2006 01:36:43 +0000 (17:36 -0800)] 
[NET_SCHED]: Fix endless loops (part 3): HFSC

Convert HFSC to use qdisc_tree_decrease_len() and add a callback
for deactivating a class when its child queue becomes empty.

All queue purging goes through hfsc_purge_queue(), which is used in
three cases: grafting, class creation (when a leaf class is turned
into an intermediate class by attaching a new class) and class
deletion. In all cases qdisc_tree_decrease_len() is needed.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs
Patrick McHardy [Thu, 30 Nov 2006 01:36:20 +0000 (17:36 -0800)] 
[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs

Convert the "simple" qdiscs to use qdisc_tree_decrease_qlen() where
necessary:

- all graft operations
- destruction of old child qdiscs in prio, red and tbf change operation
- purging of queue in sfq change operation

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET_SCHED]: Fix endless loops caused by inaccurate qlen counters (part 1)
Patrick McHardy [Thu, 30 Nov 2006 01:35:48 +0000 (17:35 -0800)] 
[NET_SCHED]: Fix endless loops caused by inaccurate qlen counters (part 1)

There are multiple problems related to qlen adjustment that can lead
to an upper qdisc getting out of sync with the real number of packets
queued, leading to endless dequeueing attempts by the upper layer code.

All qdiscs must maintain an accurate q.qlen counter. There are basically
two groups of operations affecting the qlen: operations that propagate
down the tree (enqueue, dequeue, requeue, drop, reset) beginning at the
root qdisc and operations only affecting a subtree or single qdisc
(change, graft, delete class). Since qlen changes during operations from
the second group don't propagate to ancestor qdiscs, their qlen values
become desynchronized.

This patch adds a function to propagate qlen changes up the qdisc tree,
optionally calling a callback function to perform qdisc-internal
maintenance when the child qdisc becomes empty. The follow-up patches
will convert all qdiscs to use this function where necessary.

Noticed by Timo Steinbach <tsteinbach@astaro.com>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET_SCHED]: Set parent classid in default qdiscs
Patrick McHardy [Thu, 30 Nov 2006 01:35:18 +0000 (17:35 -0800)] 
[NET_SCHED]: Set parent classid in default qdiscs

Set parent classids in default qdiscs to allow walking up the tree
from outside the qdiscs. This is needed by the next patch.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years ago[NET_SCHED]: sch_htb: perform qlen adjustment immediately in ->delete
Patrick McHardy [Thu, 30 Nov 2006 01:34:50 +0000 (17:34 -0800)] 
[NET_SCHED]: sch_htb: perform qlen adjustment immediately in ->delete

qlen adjustment should happen immediately in ->delete and not in the
class destroy function because the reference count will not hit zero in
->delete (sch_api holds a reference) but in ->put. Since the qdisc
lock is released between deletion of the class and final destruction
this creates an externally visible error in the qlen counter.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years agoRename class_destroy to avoid namespace conflicts.
James Morris [Wed, 29 Nov 2006 21:50:27 +0000 (16:50 -0500)] 
Rename class_destroy to avoid namespace conflicts.

We're seeing increasing namespace conflicts between the global
class_destroy() function declared in linux/device.h, and the private
function in the SELinux core code.  This patch renames the SELinux
function to cls_destroy() to avoid this conflict.

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
17 years agoNetLabel: add the ranged tag to the CIPSOv4 protocol
Paul Moore [Wed, 29 Nov 2006 18:18:20 +0000 (13:18 -0500)] 
NetLabel: add the ranged tag to the CIPSOv4 protocol

Add support for the ranged tag (tag type #5) to the CIPSOv4 protocol.

The ranged tag allows for seven, or eight if zero is the lowest category,
category ranges to be specified in a CIPSO option.  Each range is specified by
two unsigned 16 bit fields, each with a maximum value of 65534.  The two values
specify the start and end of the category range; if the start of the category
range is zero then it is omitted.

See Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt for more details.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
17 years agoNetLabel: add the enumerated tag to the CIPSOv4 protocol
Paul Moore [Wed, 29 Nov 2006 18:18:19 +0000 (13:18 -0500)] 
NetLabel: add the enumerated tag to the CIPSOv4 protocol

Add support for the enumerated tag (tag type #2) to the CIPSOv4 protocol.

The enumerated tag allows for 15 categories to be specified in a CIPSO option,
where each category is an unsigned 16 bit field with a maximum value of 65534.

See Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt for more details.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
17 years agoNetLabel: convert to an extensibile/sparse category bitmap
Paul Moore [Wed, 29 Nov 2006 18:18:18 +0000 (13:18 -0500)] 
NetLabel: convert to an extensibile/sparse category bitmap

The original NetLabel category bitmap was a straight char bitmap which worked
fine for the initial release as it only supported 240 bits due to limitations
in the CIPSO restricted bitmap tag (tag type 0x01).  This patch converts that
straight char bitmap into an extensibile/sparse bitmap in order to lay the
foundation for other CIPSO tag types and protocols.

This patch also has a nice side effect in that all of the security attributes
passed by NetLabel into the LSM are now in a format which is in the host's
native byte/bit ordering which makes the LSM specific code much simpler; look
at the changes in security/selinux/ss/ebitmap.c as an example.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
17 years ago[NETFILTER]: remove the reference to ipchains from Kconfig
Pablo Neira Ayuso [Wed, 29 Nov 2006 01:35:43 +0000 (02:35 +0100)] 
[NETFILTER]: remove the reference to ipchains from Kconfig

It is time to move on :-)

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: Fix PROC_FS=n warnings
Patrick McHardy [Wed, 29 Nov 2006 01:35:42 +0000 (02:35 +0100)] 
[NETFILTER]: Fix PROC_FS=n warnings

Fix some unused function/variable warnings.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: remove remaining ASSERT_{READ,WRITE}_LOCK
Patrick McHardy [Wed, 29 Nov 2006 01:35:41 +0000 (02:35 +0100)] 
[NETFILTER]: remove remaining ASSERT_{READ,WRITE}_LOCK

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: ebtables: add --snap-arp option
Bart De Schuymer [Wed, 29 Nov 2006 01:35:40 +0000 (02:35 +0100)] 
[NETFILTER]: ebtables: add --snap-arp option

The attached patch adds --snat-arp support, which makes it possible to
change the source mac address in both the mac header and the arp header
with one rule.

Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: x_tables: add NFLOG target
Patrick McHardy [Wed, 29 Nov 2006 01:35:38 +0000 (02:35 +0100)] 
[NETFILTER]: x_tables: add NFLOG target

Add new NFLOG target to allow use of nfnetlink_log for both IPv4 and IPv6.
Currently we have two (unsupported by userspace) hacks in the LOG and ULOG
targets to optionally call to the nflog API. They lack a few features,
namely the IPv4 and IPv6 LOG targets can not specify a number of arguments
related to nfnetlink_log, while the ULOG target is only available for IPv4.
Remove those hacks and add a clean way to use nfnetlink_log.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: x_tables: add port of hashlimit match for IPv4 and IPv6
Patrick McHardy [Wed, 29 Nov 2006 01:35:36 +0000 (02:35 +0100)] 
[NETFILTER]: x_tables: add port of hashlimit match for IPv4 and IPv6

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nfnetlink_log: remove useless prefix length limitation
Patrick McHardy [Wed, 29 Nov 2006 01:35:34 +0000 (02:35 +0100)] 
[NETFILTER]: nfnetlink_log: remove useless prefix length limitation

There is no reason for limiting netlink attributes in size.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nfnetlink_queue: allow changing queue length through netlink
Eric Leblond [Wed, 29 Nov 2006 01:35:33 +0000 (02:35 +0100)] 
[NETFILTER]: nfnetlink_queue: allow changing queue length through netlink

Signed-off-by: Eric Leblond <eric@inl.fr>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: ctnetlink: rework conntrack fields dumping logic on events
Pablo Neira Ayuso [Wed, 29 Nov 2006 01:35:32 +0000 (02:35 +0100)] 
[NETFILTER]: ctnetlink: rework conntrack fields dumping logic on events

               |   NEW   | UPDATE  | DESTROY |
     ----------------------------------------|
     tuples    |    Y    |    Y    |    Y    |
     status    |    Y    |    Y    |    N    |
     timeout   |    Y    |    Y    |    N    |
     protoinfo |    S    |    S    |    N    |
     helper    |    S    |    S    |    N    |
     mark      |    S    |    S    |    N    |
     counters  |    F    |    F    |    Y    |

 Leyend:
         Y: yes
         N: no
         S: iif the field is set
 F: iif overflow

This patch also replace IPCT_HELPINFO by IPCT_HELPER since we want to
track the helper assignation process, not the changes in the private
information held by the helper.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: ctnetlink: check for status attribute existence on conntrack creation
Pablo Neira Ayuso [Wed, 29 Nov 2006 01:35:31 +0000 (02:35 +0100)] 
[NETFILTER]: ctnetlink: check for status attribute existence on conntrack creation

Check that status flags are available in the netlink message received
to create a new conntrack.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: sip conntrack: better NAT handling
Patrick McHardy [Wed, 29 Nov 2006 01:35:30 +0000 (02:35 +0100)] 
[NETFILTER]: sip conntrack: better NAT handling

The NAT handling of the SIP helper has a few problems:

- Request headers are only mangled in the reply direction, From/To headers
  not at all, which can lead to authentication failures with DNAT in case
  the authentication domain is the IP address

- Contact headers in responses are only mangled for REGISTER responses

- Headers may be mangled even though they contain addresses not
  participating in the connection, like alternative addresses

- Packets are droppen when domain names are used where the helper expects
  IP addresses

This patch takes a different approach, instead of fixed rules what field
to mangle to what content, it adds symetric mapping of From/To/Via/Contact
headers, which allows to deal properly with echoed addresses in responses
and foreign addresses not belonging to the connection.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: sip conntrack: make header shortcuts optional
Patrick McHardy [Wed, 29 Nov 2006 01:35:28 +0000 (02:35 +0100)] 
[NETFILTER]: sip conntrack: make header shortcuts optional

Not every header has a shortcut, so make them optional instead
of searching for the same string twice.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: sip conntrack: do case insensitive SIP header search
Patrick McHardy [Wed, 29 Nov 2006 01:35:27 +0000 (02:35 +0100)] 
[NETFILTER]: sip conntrack: do case insensitive SIP header search

SIP headers are generally case-insensitive, only SDP headers are
case sensitive.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: sip conntrack: minor cleanup
Patrick McHardy [Wed, 29 Nov 2006 01:35:26 +0000 (02:35 +0100)] 
[NETFILTER]: sip conntrack: minor cleanup

- Use enum for header field enumeration
- Use numerical value instead of pointer to header info structure to
  identify headers, unexport ct_sip_hdrs
- group SIP and SDP entries in header info structure
- remove double forward declaration of ct_sip_get_info

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: ip_conntrack: fix NAT helper unload races
Patrick McHardy [Wed, 29 Nov 2006 01:35:25 +0000 (02:35 +0100)] 
[NETFILTER]: ip_conntrack: fix NAT helper unload races

The NAT helpr hooks are protected by RCU, but all of the
conntrack helpers test and use the global pointers instead
of copying them first using rcu_dereference()

Also replace synchronize_net() by synchronize_rcu() for clarity
since sychronizing only with packet receive processing is
insufficient to prevent races.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: conntrack: add '_get' to {ip, nf}_conntrack_expect_find
Yasuyuki Kozakai [Wed, 29 Nov 2006 01:35:23 +0000 (02:35 +0100)] 
[NETFILTER]: conntrack: add '_get' to {ip, nf}_conntrack_expect_find

We usually uses 'xxx_find_get' for function which increments
reference count.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: /proc compatibility with old connection tracking
Patrick McHardy [Wed, 29 Nov 2006 01:35:22 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: /proc compatibility with old connection tracking

This patch adds /proc/net/ip_conntrack, /proc/net/ip_conntrack_expect and
/proc/net/stat/ip_conntrack files to keep old programs using them working.

The /proc/net/ip_conntrack and /proc/net/ip_conntrack_expect files show only
IPv4 entries, the /proc/net/stat/ip_conntrack shows global statistics.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: sysctl compatibility with old connection tracking
Patrick McHardy [Wed, 29 Nov 2006 01:35:20 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: sysctl compatibility with old connection tracking

This patch adds an option to keep the connection tracking sysctls visible
under their old names.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: move conntrack protocol sysctls to individual modules
Patrick McHardy [Wed, 29 Nov 2006 01:35:18 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: move conntrack protocol sysctls to individual modules

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: automatic sysctl registation for conntrack protocols
Patrick McHardy [Wed, 29 Nov 2006 01:35:17 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: automatic sysctl registation for conntrack protocols

Add helper functions for sysctl registration with optional instantiating
of common path elements (like net/netfilter) and use it for support for
automatic registation of conntrack protocol sysctls.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: move extern declaration to header files
Patrick McHardy [Wed, 29 Nov 2006 01:35:15 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: move extern declaration to header files

Using extern in a C file is a bad idea because the compiler can't
catch type errors.

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack_ftp: fix missing helper mask initilization
Patrick McHardy [Wed, 29 Nov 2006 01:35:14 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack_ftp: fix missing helper mask initilization

Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: reduce timer updates in __nf_ct_refresh_acct()
Martin Josefsson [Wed, 29 Nov 2006 01:35:12 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: reduce timer updates in __nf_ct_refresh_acct()

Only update the conntrack timer if there's been at least HZ jiffies since
the last update. Reduces the number of del_timer/add_timer cycles from one
per packet to one per connection per second (plus once for each state change
of a connection)

Should handle timer wraparounds and connection timeout changes.

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: remove unused struct list_head from protocols
Martin Josefsson [Wed, 29 Nov 2006 01:35:11 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: remove unused struct list_head from protocols

Remove unused struct list_head from struct nf_conntrack_l3proto and
nf_conntrack_l4proto as all protocols are kept in arrays, not linked
lists.

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: minor __nf_ct_refresh_acct() whitespace cleanup
Martin Josefsson [Wed, 29 Nov 2006 01:35:10 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: minor __nf_ct_refresh_acct() whitespace cleanup

Minor whitespace cleanup.

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: remove ASSERT_{READ,WRITE}_LOCK
Martin Josefsson [Wed, 29 Nov 2006 01:35:09 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: remove ASSERT_{READ,WRITE}_LOCK

Remove the usage of ASSERT_READ_LOCK/ASSERT_WRITE_LOCK in nf_conntrack,
it didn't do anything, it was just an empty define and it uglified the code.

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: more sanity checks in protocol registration/unregistration
Martin Josefsson [Wed, 29 Nov 2006 01:35:08 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: more sanity checks in protocol registration/unregistration

Add some more sanity checks when registering/unregistering l3/l4 protocols.

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: rename struct nf_conntrack_protocol
Martin Josefsson [Wed, 29 Nov 2006 01:35:06 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: rename struct nf_conntrack_protocol

Rename 'struct nf_conntrack_protocol' to 'struct nf_conntrack_l4proto' in
order to help distinguish it from 'struct nf_conntrack_l3proto'. It gets
rather confusing with 'nf_conntrack_protocol'.

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: More __read_mostly annotations
Martin Josefsson [Wed, 29 Nov 2006 01:35:04 +0000 (02:35 +0100)] 
[NETFILTER]: More __read_mostly annotations

Place rarely written variables in the read-mostly section by using
__read_mostly

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: split out protocol handling
Martin Josefsson [Wed, 29 Nov 2006 01:35:03 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: split out protocol handling

This patch splits out L3/L4 protocol handling into its own file
nf_conntrack_proto.c

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: split out the event cache
Martin Josefsson [Wed, 29 Nov 2006 01:35:01 +0000 (02:35 +0100)] 
[NETFILTER]: nf_conntrack: split out the event cache

This patch splits out the event cache into its own file
nf_conntrack_ecache.c

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
17 years ago[NETFILTER]: nf_conntrack: split out helper handling
Martin Josefsson [Wed, 29 Nov 2006 01:34:59 +0000 (02:34 +0100)] 
[NETFILTER]: nf_conntrack: split out helper handling

This patch splits out handling of helpers into its own file
nf_conntrack_helper.c

Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>