summaryrefslogtreecommitdiffstats
path: root/net/ipv4
Commit message (Collapse)AuthorAgeFilesLines
* [NETFILTER]: nf_nat: sprinkle a few __read_mostlysPatrick McHardy2008-01-281-4/+5
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_nat: mark NAT protocols constPatrick McHardy2008-01-286-15/+15
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nf_nat_proto_gre: add missing module referencePatrick McHardy2008-01-281-0/+1
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: ctnetlink: use netlink attribute helpersPatrick McHardy2008-01-283-26/+14Star
| | | | | | | Use NLA_PUT_BE32, nla_get_be32() etc. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: ctnetlink: add support for NAT sequence adjustmentsPablo Neira Ayuso2008-01-281-0/+3
| | | | | | | | | | | | | The combination of NAT and helpers may produce TCP sequence adjustments. In failover setups, this information needs to be replicated in order to achieve a successful recovery of mangled, related connections. This patch is particularly useful for conntrackd, see: http://people.netfilter.org/pablo/conntrack-tools/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: arp_tables: add compat supportPatrick McHardy2008-01-281-58/+690
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: arp_tables: resync get_entries() with ip_tablesPatrick McHardy2008-01-281-20/+19Star
| | | | | | | | Resync get_entries() with ip_tables.c by moving the checks from the setsockopt handler to the function itself. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: arp_tables: move ARPT_SO_GET_INFO handling to seperate functionPatrick McHardy2008-01-281-42/+46
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: arp_tables: move counter allocation to seperate functionPatrick McHardy2008-01-281-8/+21
| | | | | | | More resyncing with ip_tables.c as preparation for compat support. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: arp_tables: move entry and target checks to seperate functionsPatrick McHardy2008-01-281-17/+41
| | | | | | | Resync with ip_tables.c as preparation for compat support. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: arp_tables: remove ipchains compat hackPatrick McHardy2008-01-281-4/+0Star
| | | | | | | | Remove compatiblity hack copied from ip_tables.c - ipchains didn't even support arp_tables :) Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: arp_tables: use vmalloc_node()Patrick McHardy2008-01-281-2/+3
| | | | | | | Use vmalloc_node() as in ip_tables.c. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: arp_tables: remove obsolete standard_check functionPatrick McHardy2008-01-281-25/+3Star
| | | | | | | | The size check is already performed by xt_check_target, no need to do it again. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: ip_tables: remove ipchains compatibility hackPatrick McHardy2008-01-281-8/+0Star
| | | | | | | ipchains support has been removed years ago. kill last remains. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: {ip,ip6}_tables: fix format stringsPatrick McHardy2008-01-281-12/+8Star
| | | | | | | Use %zu for sizeof() and remove casts. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: {ip,ip6}_tables: reformat to eliminate differencesPatrick McHardy2008-01-281-36/+30Star
| | | | | | | | | | | | | | | | | | | | Reformat ip_tables.c and ip6_tables.c in order to eliminate non-functional differences and minimize diff output. This allows to get a view of the real differences using: sed -e 's/IP6T/IPT/g' \ -e 's/IP6/IP/g' \ -e 's/INET6/INET/g' \ -e 's/ip6t/ipt/g' \ -e 's/ip6/ip/g' \ -e 's/ipv6/ip/g' \ -e 's/icmp6/icmp/g' \ net/ipv6/netfilter/ip6_tables.c | \ diff -wup /dev/stdin net/ipv4/netfilter/ip_tables.c Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: ip_tables: move compat offset calculation to x_tablesPatrick McHardy2008-01-281-59/+8Star
| | | | | | | Its needed by ip6_tables and arp_tables as well. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: ip_tables: fix compat typesPatrick McHardy2008-01-281-24/+27
| | | | | | | | | Use compat types and compat iterators when dealing with compat entries for clarity. This doesn't actually make a difference for ip_tables, but is needed for ip6_tables and arp_tables. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: ip_tables: account for struct ipt_entry/struct compat_ipt_entry ↵Patrick McHardy2008-01-281-2/+6
| | | | | | | | | | | | size diff Account for size differences when dumping entries or calculating the entry positions. This doesn't actually make any difference for IPv4 since the structures have the same size, but its logically correct and needed for IPv6. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: x_tables: make xt_compat_match_from_user usable in iterator macrosPatrick McHardy2008-01-281-12/+1Star
| | | | | | | | Make xt_compat_match_from_user return an int to make it usable in the *tables iterator macros and kill a now unnecessary wrapper function. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: ip_tables: reformat compat codePatrick McHardy2008-01-281-89/+92
| | | | | | | | The compat code has some very odd formating, clean it up before porting it to ip6_tables. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: ip_tables: kill useless wrapperPatrick McHardy2008-01-281-7/+1Star
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4] net/ipv4: Use ipv4_is_<type>Joe Perches2008-01-2810-51/+60
| | | | | Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Switch users of ipv4_devconf(_all) to use the pernet onePavel Emelyanov2008-01-286-11/+12
| | | | | | | | | | These are scattered over the code, but almost all the "critical" places already have the proper struct net at hand except for snmp proc showing function and routing rtnl handler. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Switch users of ipv4_devconf_dflt to use the pernet onePavel Emelyanov2008-01-281-7/+9
| | | | | | | | | | They are all collected in the net/ipv4/devinet.c file and mostly use the IPV4_DEVCONF_DFLT macro. So I add the net parameter to it and patch users accordingly. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Move the devinet pointers on the struct netPavel Emelyanov2008-01-281-9/+96
| | | | | | | | | | | | | | | | This is the core. Add all and default pointers on the netns_ipv4 and register a new pernet subsys to initialize them. Also add the ctl_table_header to register the net.ipv4.ip_forward ctl. I don't allocate additional memory for init_net, but use global devinets. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Store the net pointer on devinet's ctl tablesPavel Emelyanov2008-01-281-11/+18
| | | | | | | | | | | | | | | | | | Some handers and strategies of devinet sysctl tables need to know the net to propagate the ctl change to all the net devices. I use the (currently unused) extra2 pointer on the tables to get it. Holding the reference on the struct net is not possible, because otherwise we'll get a net->ctl_table->net circular dependency. But since the ctl tables are unregistered during the net destruction, this is safe to get it w/o additional protection. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Pass the net pointer to the arp_req_set_proxy()Pavel Emelyanov2008-01-282-13/+17
| | | | | | | | | This one will need to set the IPV4_DEVCONF_ALL(PROXY_ARP), but there's no ways to get the net right in place, so we have to pull one from the inet_ioctl's struct sock. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Make __devinet_sysctl_register return an errorPavel Emelyanov2008-01-281-4/+4
| | | | | | | | | | | | | Currently, this function is void, so failures in creating sysctls for new/renamed devices are not reported to anywhere. Fixing this is another complex (needed?) task, but this return value is needed during the namespaces creation to handle the case, when we failed to create "all" and "default" entries. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [UDP]: Move udp_stats_in6 into net/ipv4/udp.cHerbert Xu2008-01-281-0/+3
| | | | | | | | | | | | | Now that external users may increment the counters directly, we need to ensure that udp_stats_in6 is always available. Otherwise we'd either have to requrie the external users to be built as modules or ipv6 to be built-in. This isn't too bad because udp_stats_in6 is just a pair of pointers plus an EXPORT, e.g., just 40 (16 + 24) bytes on x86-64. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPVS]: Use htons() where appropriate.YOSHIFUJI Hideaki2008-01-282-9/+9
| | | | | Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Thresholds in fib_trie.c are used as consts, so make them const.Denis V. Lunev2008-01-281-4/+4
| | | | | | | | | There are several thresholds for trie fib hash management. They are used in the code as a constants. Make them constants from the compiler point of view. Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IP_GRE]: Rebinding of GRE tunnels to other interfacesMichal Schmidt2008-01-281-42/+60
| | | | | | | | | | | | | | | | | | | | | | | | This is similar to the change already done for IPIP tunnels. Once created, a GRE tunnel can't be bound to another device. To reproduce: # create a tunnel: ip tunnel add tunneltest0 mode gre remote 10.0.0.1 dev eth0 # try to change the bounding device from eth0 to eth1: ip tunnel change tunneltest0 dev eth1 # show the result: ip tunnel show tunneltest0 tunneltest0: gre/ip remote 10.0.0.1 local any dev eth0 ttl inherit Notice the bound device has not changed from eth0 to eth1. This patch fixes it. When changing the binding, it also recalculates the MTU according to the new bound device's MTU. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPSEC]: Do not let packets pass when ICMP flag is offHerbert Xu2008-01-281-2/+5
| | | | | | | | This fixes a logical error in ICMP policy checks which lets packets through if the state ICMP flag is off. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPSEC]: Make callers of xfrm_lookup to use XFRM_LOOKUP_WAITHerbert Xu2008-01-281-1/+2
| | | | | | | | | This patch converts all callers of xfrm_lookup that used an explicit value of 1 to indiciate blocking to use the new flag XFRM_LOOKUP_WAIT. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPSEC]: Fix reversed ICMP6 policy checkHerbert Xu2008-01-281-1/+1
| | | | | | | | | | | The policy check I added for ICMP on IPv6 is reversed. This patch fixes that. It also adds an skb->sp check so that unprotected packets that fail the policy check do not crash the machine. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPIP]: Allow rebinding the tunnel to another interfaceMichal Schmidt2008-01-281-26/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | Once created, an IP tunnel can't be bound to another device. (reported as https://bugzilla.redhat.com/show_bug.cgi?id=419671) To reproduce: # create a tunnel: ip tunnel add tunneltest0 mode ipip remote 10.0.0.1 dev eth0 # try to change the bounding device from eth0 to eth1: ip tunnel change tunneltest0 dev eth1 # show the result: ip tunnel show tunneltest0 tunneltest0: ip/ip remote 10.0.0.1 local any dev eth0 ttl inherit Notice the bound device has not changed from eth0 to eth1. This patch fixes it. When changing the binding, it also recalculates the MTU according to the new bound device's MTU. If the change is acceptable, I'll do the same for GRE and SIT tunnels. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPSEC]: Add ICMP host relookup supportHerbert Xu2008-01-282-3/+80
| | | | | | | | | | | | | | | RFC 4301 requires us to relookup ICMP traffic that does not match any policies using the reverse of its payload. This patch implements this for ICMP traffic that originates from or terminates on localhost. This is activated on outbound with the new policy flag XFRM_POLICY_ICMP, and on inbound by the new state flag XFRM_STATE_ICMP. On inbound the policy check is now performed by the ICMP protocol so that it can repeat the policy check where necessary. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPSEC]: Added xfrm_decode_session_reverse and xfrmX_policy_check_reverseHerbert Xu2008-01-281-5/+5
| | | | | | | | | | RFC 4301 requires us to relookup ICMP traffic that does not match any policies using the reverse of its payload. This patch adds the functions xfrm_decode_session_reverse and xfrmX_policy_check_reverse so we can get the reverse flow to perform such a lookup. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Cleanup sysctl manipulations in devinet.cPavel Emelyanov2008-01-281-30/+29Star
| | | | | | | | | | | | | | | | | This includes: * moving neigh_sysctl_(un)register calls inside devinet_sysctl_(un)register ones, as they are always called in pairs; * making __devinet_sysctl_unregister() to unregister the ipv4_devconf struct, while original devinet_sysctl_unregister() works with the in_device to handle both - devconf and neigh sysctls; * make stubs for CONFIG_SYSCTL=n case to get rid of in-code ifdefs. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [INET]: Use BUILD_BUG_ON in inet_timewait_sock.c checksPavel Emelyanov2008-01-281-4/+2Star
| | | | | | | | Make the INET_TWDR_TWKILL_SLOTS vs sizeof(twdr->thread_slots) check nicer. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [TCP]: Use BUILD_BUG_ON for tcp_skb_cb size checkingPavel Emelyanov2008-01-281-4/+1Star
| | | | | | | | | The sizeof(struct tcp_skb_cb) should not be less than the sizeof(skb->cb). This is checked in net/ipv4/tcp.c, but this check can be made more gracefully. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NET]: Remove unused "mibalign" argument for snmp_mib_init().YOSHIFUJI Hideaki2008-01-281-15/+8Star
| | | | | | | | With fixes from Arnaldo Carvalho de Melo. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: last default route is a fib table propertyDenis V. Lunev2008-01-282-17/+17
| | | | | | Signed-off-by: Denis V. Lunev <den@openvz.org> Acked-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Unify assignment of fi to fib_resultDenis V. Lunev2008-01-283-30/+18Star
| | | | | | Signed-off-by: Denis V. Lunev <den@openvz.org> Acked-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: no need pass pointer to a default into fib_detect_deathDenis V. Lunev2008-01-284-8/+8
| | | | | | | | ipv4: no need pass pointer to a default into fib_detect_death Signed-off-by: Denis V. Lunev <den@openvz.org> Acked-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4] net/ipv4/cipso_ipv4.c: use LIST_HEAD instead of LIST_HEAD_INITDenis Cheng2008-01-281-1/+1
| | | | | | | | | single list_head variable initialized with LIST_HEAD_INIT could almost always can be replaced with LIST_HEAD declaration, this shrinks the code and looks better. Signed-off-by: Denis Cheng <crquan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Move trie_local and trie_main into the proc iterator.Eric W. Biederman2008-01-281-13/+34
| | | | | | | | | | | | We only use these variables when displaying the trie in proc so place them into the iterator to make this explicit. We should probably do something smarter to handle the CONFIG_IP_MULTIPLE_TABLES case but at least this makes it clear that the silliness is limited to the display in /proc. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [IPV4]: Remove ip_fib_local_table and ip_fib_main_table defines.Eric W. Biederman2008-01-281-2/+3
| | | | | | | | | | There are only 2 users and it doesn't hurt to call fib_get_table instead, and it makes it easier to make the fib network namespace aware. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NET]: Multiple namespaces in the all dst_ifdown routines.Denis V. Lunev2008-01-282-3/+5
| | | | | | | Move dst entries to a namespace loopback to catch refcounting leaks. Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-23 18:17:46 +0200