aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* netlink: add NETLINK_NO_ENOBUFS socket flagPablo Neira Ayuso2009-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the NETLINK_NO_ENOBUFS socket flag. This flag can be used by unicast and broadcast listeners to avoid receiving ENOBUFS errors. Generally speaking, ENOBUFS errors are useful to notify two things to the listener: a) You may increase the receiver buffer size via setsockopt(). b) You have lost messages, you may be out of sync. In some cases, ignoring ENOBUFS errors can be useful. For example: a) nfnetlink_queue: this subsystem does not have any sort of resync method and you can decide to ignore ENOBUFS once you have set a given buffer size. b) ctnetlink: you can use this together with the socket flag NETLINK_BROADCAST_SEND_ERROR to stop getting ENOBUFS errors as you do not need to resync (packets whose event are not delivered are drop to provide reliable logging and state-synchronization). Moreover, the use of NETLINK_NO_ENOBUFS also reduces a "go up, go down" effect in terms of performance which is due to the netlink congestion control when the listener cannot back off. The effect is the following: 1) throughput rate goes up and netlink messages are inserted in the receiver buffer. 2) Then, netlink buffer fills and overruns (set on nlk->state bit 0). 3) While the listener empties the receiver buffer, netlink keeps dropping messages. Thus, throughput goes dramatically down. 4) Then, once the listener has emptied the buffer (nlk->state bit 0 is set off), goto step 1. This effect is easy to trigger with netlink broadcast under heavy load, and it is more noticeable when using a big receiver buffer. You can find some results in [1] that show this problem. [1] http://1984.lsi.us.es/linux/netlink/ This patch also includes the use of sk_drop to account the number of netlink messages drop due to overrun. This value is shown in /proc/net/netlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* myri10ge: update firmware headers to 1.4.41Brice Goglin2009-03-24
| | | | | | | Update myri10ge firmware headers to firmware version 1.4.41. Signed-off-by: Brice Goglin <brice@myri.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* macb: fix warning "warning: unused variable `dev' "vibi sreenivasan2009-03-24
| | | | | | | | Removed unused variable dev Signed-off-by: vibi sreenivasan <vibi_sreenivasan@cms.com> Signed-off-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ucc_geth: Convert to net_device_opsJoakim Tjernlund2009-03-24
| | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* claw: fix minor findings from code analysis toolAndrew H. Richter2009-03-24
| | | | | | | | | | | This patch fixes two problems in the claw driver identified by static code analysis: o Change in case differentiation of received sense codes o Use correct data length in claw hard_start_xmit routine Signed-off-by: Andrew H. Richter <richtera@us.ibm.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ctcm: fix minor findings from code analysis toolJoel A. Fowler2009-03-24
| | | | | | | | | | | | | | | | | From: Ursula Braun <ursula.braun@de.ibm.com> This patch fixes problems in the ctcm driver identified by static code analysis: o remove an unnecessary always true condition in ctcm_unpack_skb o remove duplicate assignment in ctc_mpc_alloc_channel o remove an unnecessary always true condition in ctcmpc_send_sweep_resp o remove duplicate initialization in ctcmpc_unpack_skb o shorten if condition in mpc_action_go_inop o remove INOP event if mpc group is undefined in mpc_action_doxid7 Signed-off-by: Joel A. Fowler <fowlerja@us.ibm.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ctcm: avoid wraparound in length of incoming dataRoel Kluin2009-03-24
| | | | | | | | | | | | Since the receive code should tolerate any incoming garbage, it should be protected against a potential wraparound when manipulating length values within incoming data. block_len is unsigned, so a too large subtraction will cause a wraparound. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ctcm: invalid return code from hard_start_xmitUrsula Braun2009-03-24
| | | | | | | | Avoid kernel warning by using the correct hard_start_xmit return code NETDEV_TX_BUSY for skb requeuing. Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* claw: invalid return codes from hard_start_xmitUrsula Braun2009-03-24
| | | | | | | | Avoid kernel warnings by using the correct hard_start_xmit return code NETDEV_TX_BUSY for skb requeuing. Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* netiucv: invalid return code from hard_start_xmitUrsula Braun2009-03-24
| | | | | | | | Avoid kernel warning by using the correct hard_start_xmit return code NETDEV_TX_BUSY for skb requeuing. Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* lcs: invalid return codes from hard_start_xmit.Klaus-Dieter Wacker2009-03-24
| | | | | | | | | | Lcs hard_start_xmit routine issued return codes other than defined for this interface. Now lcs returns only either NETDEV_TX_OK or NETDEV_TX_BUSY. Signed-off-by: Klaus-Dieter Wacker <kdwacker@de.ibm.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Use kthread instead of kernel_threadKlaus-Dieter Wacker2009-03-24
| | | | | | | | | Lcs uses low-level kernel_thread implementation. All drivers should use <linux/kthread.h> API instead. Signed-off-by: Klaus-Dieter Wacker <kdwacker@de.ibm.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: Add dependent headers to trace/skb.hJosh Stone2009-03-24
| | | | | | | | | | | The tracing header needs to include definitions for the macros used and the types referenced. This lets automated tracing tools like SystemTap make use of the tracepoint without any specific knowledge of its meaning (leaving that to the user). Signed-off-by: Josh Stone <jistone@redhat.com> CC: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* arp_tables: ifname_compare() can assume 16bit alignmentEric Dumazet2009-03-24
| | | | | | | | Arches without efficient unaligned access can still perform a loop assuming 16bit alignment in ifname_compare() Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* netfilter: trivial Kconfig spelling fixesJan Engelhardt2009-03-24
| | | | | | | Supplements commit 67c0d57930ff9a24c6c34abee1b01f7716a9b0e2. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2009-03-24
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * netfilter: nf_conntrack: Reduce conntrack count in nf_conntrack_free()Eric Dumazet2009-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | We use RCU to defer freeing of conntrack structures. In DOS situation, RCU might accumulate about 10.000 elements per CPU in its internal queues. To get accurate conntrack counts (at the expense of slightly more RAM used), we might consider conntrack counter not taking into account "about to be freed elements, waiting in RCU queues". We thus decrement it in nf_conntrack_free(), not in the RCU callback. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Tested-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * nefilter: nfnetlink: add nfnetlink_set_err and use it in ctnetlinkPablo Neira Ayuso2009-03-23
| | | | | | | | | | | | | | | | | | This patch adds nfnetlink_set_err() to propagate the error to netlink broadcast listener in case of memory allocation errors in the message building. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: sysctl support of logger choiceEric Leblond2009-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patchs adds support of modification of the used logger via sysctl. It can be used to change the logger to module that can not use the bind operation (ipt_LOG and ipt_ULOG). For this purpose, it creates a directory /proc/sys/net/netfilter/nf_log which contains a file per-protocol. The content of the file is the name current logger (NONE if not set) and a logger can be setup by simply echoing its name to the file. By echoing "NONE" to a /proc/sys/net/netfilter/nf_log/PROTO file, the logger corresponding to this PROTO is set to NULL. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: fix rcu context imbalancePatrick McHardy2009-03-18
| | | | | | | | | | | | | | | | Introduced by 7ec47496 (netfilter: ctnetlink: cleanup master conntrack assignation): net/netfilter/nf_conntrack_netlink.c:1275:2: warning: context imbalance in 'ctnetlink_create_conntrack' - different lock contexts for basic block Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: remove nf_ct_l4proto_find_get/nf_ct_l4proto_putFlorian Westphal2009-03-18
| | | | | | | | | | | | | | users have been moved to __nf_ct_l4proto_find. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: remove remaining module refcountingFlorian Westphal2009-03-18
| | | | | | | | | | | | | | | | | | Convert the remaining refcount users. As pointed out by Patrick McHardy, the protocols can be accessed safely using RCU. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: add cluster matchPablo Neira Ayuso2009-03-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the iptables cluster match. This match can be used to deploy gateway and back-end load-sharing clusters. The cluster can be composed of 32 nodes maximum (although I have only tested this with two nodes, so I cannot tell what is the real scalability limit of this solution in terms of cluster nodes). Assuming that all the nodes see all packets (see below for an example on how to do that if your switch does not allow this), the cluster match decides if this node has to handle a packet given: (jhash(source IP) % total_nodes) & node_mask For related connections, the master conntrack is used. The following is an example of its use to deploy a gateway cluster composed of two nodes (where this is the node 1): iptables -I PREROUTING -t mangle -i eth1 -m cluster \ --cluster-total-nodes 2 --cluster-local-node 1 \ --cluster-proc-name eth1 -j MARK --set-mark 0xffff iptables -A PREROUTING -t mangle -i eth1 \ -m mark ! --mark 0xffff -j DROP iptables -A PREROUTING -t mangle -i eth2 -m cluster \ --cluster-total-nodes 2 --cluster-local-node 1 \ --cluster-proc-name eth2 -j MARK --set-mark 0xffff iptables -A PREROUTING -t mangle -i eth2 \ -m mark ! --mark 0xffff -j DROP And the following commands to make all nodes see the same packets: ip maddr add 01:00:5e:00:01:01 dev eth1 ip maddr add 01:00:5e:00:01:02 dev eth2 arptables -I OUTPUT -o eth1 --h-length 6 \ -j mangle --mangle-mac-s 01:00:5e:00:01:01 arptables -I INPUT -i eth1 --h-length 6 \ --destination-mac 01:00:5e:00:01:01 \ -j mangle --mangle-mac-d 00:zz:yy:xx:5a:27 arptables -I OUTPUT -o eth2 --h-length 6 \ -j mangle --mangle-mac-s 01:00:5e:00:01:02 arptables -I INPUT -i eth2 --h-length 6 \ --destination-mac 01:00:5e:00:01:02 \ -j mangle --mangle-mac-d 00:zz:yy:xx:5a:27 In the case of TCP connections, pickup facility has to be disabled to avoid marking TCP ACK packets coming in the reply direction as valid. echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose BTW, some final notes: * This match mangles the skbuff pkt_type in case that it detects PACKET_MULTICAST for a non-multicast address. This may be done in a PKTTYPE target for this sole purpose. * This match supersedes the CLUSTERIP target. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * net: netfilter conntrack - add per-net functionality for DCCP protocolCyrill Gorcunov2009-03-16
| | | | | | | | | | | | | | | | | | Module specific data moved into per-net site and being allocated/freed during net namespace creation/deletion. Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org> Acked-by: Daniel Lezcano <daniel.lezcano@free.fr> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * net: sysctl_net - use net_eq to compare netsCyrill Gorcunov2009-03-16
| | | | | | | | | | | | Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org> Acked-by: Daniel Lezcano <daniel.lezcano@free.fr> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: avoid pointer to selfJan Engelhardt2009-03-16
| | | | | | | | | | | | | | | | | | | | Commit 784544739a25c30637397ace5489eeb6e15d7d49 (netfilter: iptables: lock free counters) broke a number of modules whose rule data referenced itself. A reallocation would not reestablish the correct references, so it is best to use a separate struct that does not fall under RCU. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: auto-load ip_queue module when socket openedScott James Remnant2009-03-16
| | | | | | | | | | | | | | | | | | | | The ip_queue module is missing the net-pf-16-proto-3 alias that would causae it to be auto-loaded when a socket of that type is opened. This patch adds the alias. Signed-off-by: Scott James Remnant <scott@canonical.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: auto-load ip6_queue module when socket openedScott James Remnant2009-03-16
| | | | | | | | | | | | | | | | | | | | The ip6_queue module is missing the net-pf-16-proto-13 alias that would cause it to be auto-loaded when a socket of that type is opened. This patch adds the alias. Signed-off-by: Scott James Remnant <scott@canonical.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: move event reporting for new entries outside the lockPablo Neira Ayuso2009-03-16
| | | | | | | | | | | | | | | | | | | | | | This patch moves the event reporting outside the lock section. With this patch, the creation and update of entries is homogeneous from the event reporting perspective. Moreover, as the event reporting is done outside the lock section, the netlink broadcast delivery can benefit of the yield() call under congestion. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: cleanup conntrack update preliminary checkingsPablo Neira Ayuso2009-03-16
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch moves the preliminary checkings that must be fulfilled to update a conntrack, which are the following: * NAT manglings cannot be updated * Changing the master conntrack is not allowed. This patch is a cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: cleanup master conntrack assignationPablo Neira Ayuso2009-03-16
| | | | | | | | | | | | | | | | | | This patch moves the assignation of the master conntrack to ctnetlink_create_conntrack(), which is where it really belongs. This patch is a cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: conntrack: increase drop stats if sequence adjustment failsPablo Neira Ayuso2009-03-16
| | | | | | | | | | | | | | | | This patch increases the statistics of packets drop if the sequence adjustment fails in ipv4_confirm(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: Kconfig spelling fixes (trivial)Stephen Hemminger2009-03-16
| | | | | | | | | | Signed-off-by: Stephen Hemminger <sheminger@vyatta.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: remove IPvX specific parts from nf_conntrack_l4proto.hChristoph Paasch2009-03-16
| | | | | | | | | | | | Moving the structure definitions to the corresponding IPvX specific header files. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: print the list of register loggersEric Leblond2009-03-16
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch modifies the proc output to add display of registered loggers. The content of /proc/net/netfilter/nf_log is modified. Instead of displaying a protocol per line with format: proto:logger it now displays: proto:logger (comma_separated_list_of_loggers) NONE is used as keyword if no logger is used. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: use a linked list of loggersEric Leblond2009-03-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch modifies nf_log to use a linked list of loggers for each protocol. This list of loggers is read and write protected with a mutex. This patch separates registration and binding. To be used as logging module, a module has to register calling nf_log_register() and to bind to a protocol it has to call nf_log_bind_pf(). This patch also converts the logging modules to the new API. For nfnetlink_log, it simply switchs call to register functions to call to bind function and adds a call to nf_log_register() during init. For other modules, it just remove a const flag from the logger structure and replace it with a __read_mostly. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xt_hashlimit fixEric Dumazet2009-02-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 784544739a25c30637397ace5489eeb6e15d7d49 (netfilter: iptables: lock free counters) broke xt_hashlimit netfilter module : This module was storing a pointer inside its xt_hashlimit_info, and this pointer is not relocated when we temporarly switch tables (iptables -L). This hack is not not needed at all (probably a leftover from ancient time), as each cpu should and can access to its own copy. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: install missing headersJan Engelhardt2009-02-24
| | | | | | | | | | | | | | | | iptables imports headers from (the unifdefed headers of a) kernel tree, but some headers happened to not be installed. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: account packets drop by tcp_packet()Pablo Neira Ayuso2009-02-24
| | | | | | | | | | | | | | | | Since tcp_packet() may return -NF_DROP in two situations, the packet-drop stats must be increased. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ip_tables: unfold two critical loops in ip_packet_match()Eric Dumazet2009-02-20
| | | | | | | | | | | | | | | | | | | | While doing oprofile tests I noticed two loops are not properly unrolled by gcc Using a hand coded unrolled loop provides nice speedup : ipt_do_table credited of 2.52 % of cpu instead of 3.29 % in tbench. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: x_tables: add LED trigger targetAdam Nielsen2009-02-20
| | | | | | | | | | | | | | | | | | | | Kernel module providing implementation of LED netfilter target. Each instance of the target appears as a led-trigger device, which can be associated with one or more LEDs in /sys/class/leds/ Signed-off-by: Adam Nielsen <a.nielsen@shikadi.net> Acked-by: Richard Purdie <rpurdie@linux.intel.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: fix hardcoded size assumptionsHagen Paul Pfeifer2009-02-20
| | | | | | | | | | | | | | | | | | get_random_bytes() is sometimes called with a hard coded size assumption of an integer. This could not be true for next centuries. This patch replace it with a compile time statement. Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: table max size should hold at least table sizeHagen Paul Pfeifer2009-02-20
| | | | | | | | | | | | | | | | | | | | Table size is defined as unsigned, wheres the table maximum size is defined as a signed integer. The calculation of max is 8 or 4, multiplied the table size. Therefore the max value is aligned to unsigned. Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: iptables: lock free countersStephen Hemminger2009-02-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The reader/writer lock in ip_tables is acquired in the critical path of processing packets and is one of the reasons just loading iptables can cause a 20% performance loss. The rwlock serves two functions: 1) it prevents changes to table state (xt_replace) while table is in use. This is now handled by doing rcu on the xt_table. When table is replaced, the new table(s) are put in and the old one table(s) are freed after RCU period. 2) it provides synchronization when accesing the counter values. This is now handled by swapping in new table_info entries for each cpu then summing the old values, and putting the result back onto one cpu. On a busy system it may cause sampling to occur at different times on each cpu, but no packet/byte counts are lost in the process. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Sucessfully tested on my dual quad core machine too, but iptables only (no ipv6 here) BTW, my new "tbench 8" result is 2450 MB/s, (it was 2150 MB/s not so long ago) Acked-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ip6_tables: unfold two loops in ip6_packet_match()Eric Dumazet2009-02-19
| | | | | | | | | | | | | | | | ip6_tables netfilter module can use an ifname_compare() helper so that two loops are unfolded. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xt_physdev: unfold two loops in physdev_mt()Eric Dumazet2009-02-19
| | | | | | | | | | | | | | | | xt_physdev netfilter module can use an ifname_compare() helper so that two loops are unfolded. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: add backward-compat optionsJan Engelhardt2009-02-19
| | | | | | | | | | | | | | | | Concern has been expressed about the changing Kconfig options. Provide the old options that forward-select. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xt_physdev fixesEric Dumazet2009-02-18
| | | | | | | | | | | | | | | | | | 1) physdev_mt() incorrectly assumes nulldevname[] is aligned on an int 2) It also uses word comparisons, while it could use long word ones. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: Combine ipt_ttl and ip6t_hl sourceJan Engelhardt2009-02-18
| | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: Combine ipt_TTL and ip6t_HL sourceJan Engelhardt2009-02-18
| | | | | | | | | | | | | | | | | | | | | | | | | | Suggested by: James King <t.james.king@gmail.com> Similarly to commit c9fd49680954714473d6cbd2546d6ff120f96840, merge TTL and HL. Since HL does not depend on any IPv6-specific function, no new module dependencies would arise. With slight adjustments to the Kconfig help text. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-30 21:28:57 -0500