summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* sparc64: Kill bogus ip_tables.h include.David S. Miller2010-02-161-1/+0
| | | | | | | | | | | Fixes the following build failure: CC arch/sparc/kernel/sys_sparc32.o In file included from include/linux/netfilter_ipv4/ip_tables.h:28, from arch/sparc/kernel/sys_sparc32.c:46: include/linux/netfilter/x_tables.h:525: error: expected declaration specifiers or ‘...’ before ‘nf_hookfn’ Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2: Update firmwares and update version to 2.0.8.Michael Chan2010-02-169-9068/+9143
| | | | | | | | - Increase FTQ depth to 256 to ehnabce performance. - Fix RV2P context corruption on 5709 when flow control is enabled. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2: Fix bug when saving statistics.Patrick Rabau2010-02-161-5/+5
| | | | | | | | | | | This fixes the problem of dropping the carry when adding 2 32-bit values. Switch to use array indexing for better readability. Reported by and fix provided by Patrick Rabau. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2: Allow user-specified multiple advertisement speed values.Michael Chan2010-02-161-25/+8
| | | | | | | | | | | | Remove unnecessary code that works around older versions of ethtool that can pass down invalid advertisement speed values. This old code prevents the user from specifying multiple advertisement values. The new code uses simple masking to mask out invalid advertisment bits. Reported-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2: Adjust flow control water marks.Michael Chan2010-02-162-2/+2
| | | | | | | | | The current water marks are too high and can cause unnecessary flow control frames. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2: Need to call cnic_setup_cnic_irq_info() after MTU change.Michael Chan2010-02-161-0/+7
| | | | | | | | | New status blocks are allocated during MTU change so we need to update this information for the cnic driver. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2: Check BNX2_FLAG_USING_MSIX flag when setting up MSIX.Michael Chan2010-02-161-1/+1
| | | | | | | | | | Checking the flag is more correct than checking bp->irq_nvecs. By accident it is not a problem because we always have more than 1 vectors when using MSIX mode. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* atl1c: Add support for Atheros AR8152 and AR8152Luis R. Rodriguez2010-02-165-25/+191
| | | | | | | | | | | | | | | | | | | | | | AR8151 is a Gigabit Ethernet device. AR8152 devices are Fast Ethernet devices, there are two revisions, a 1.0 and a 2.0 revision. This has been tested against these devices: Driver Model-name vendor:device Type atl1c AR8131 1969:1063 Gigabit Ethernet atl1c AR8132 1969:1062 Fast Ethernet atl1c AR8151(v1.0) 1969:1073 Gigabit Ethernet atl1c AR8152(v1.1) 1969:2060 Fast Ethernet This device has no hardware available yet so it goes untested, but it should work: atl1c AR8152(v2.0) 1969:2062 Fast Ethernet Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* tunnels: fix netns vs proto registration orderingAlexey Dobriyan2010-02-164-62/+47
| | | | | | | | Same stuff as in ip_gre patch: receive hook can be called before netns setup is done, oopsing in net_generic(). Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* gre: fix netns vs proto registration orderingAlexey Dobriyan2010-02-161-9/+10
| | | | | | | | | | | | GRE protocol receive hook can be called right after protocol addition is done. If netns stuff is not yet initialized, we're going to oops in net_generic(). This is remotely oopsable if ip_gre is compiled as module and packet comes at unfortunate moment of module loading. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2010-02-16111-1836/+2313
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * netfilter: CONFIG_COMPAT: allow delta to exceed 32767Florian Westphal2010-02-152-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | with 32 bit userland and 64 bit kernels, it is unlikely but possible that insertion of new rules fails even tough there are only about 2000 iptables rules. This happens because the compat delta is using a short int. Easily reproducible via "iptables -m limit" ; after about 2050 rules inserting new ones fails with -ELOOP. Note that compat_delta included 2 bytes of padding on x86_64, so structure size remains the same. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ebtables: avoid explicit XT_ALIGN() in match/targetsFlorian Westphal2010-02-1517-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will cause trouble once CONFIG_COMPAT support is added to ebtables. xt_compat_*_offset() calculate the kernel/userland structure size delta using: XT_ALIGN(size) - COMPAT_XT_ALIGN(size) If the match/target sizes are aligned at registration time, delta is always zero. Should have zero effect for existing systems: xtables uses XT_ALIGN() whenever it deals with match/target sizes. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ebtables: abort if next_offset is too smallFlorian Westphal2010-02-151-0/+2
| | | | | | | | | | | | | | | | | | next_offset must be > 0, otherwise this loops forever. The offset also contains the size of the ebt_entry structure itself, so anything smaller is invalid. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: add zone supportPatrick McHardy2010-02-152-19/+75
| | | | | | | | | | | | Parse and dump the conntrack zone in ctnetlink. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: add support for "conntrack zones"Patrick McHardy2010-02-1525-85/+236
| | | | | | | | | | | | | | | | | | | | | | | | | | Normally, each connection needs a unique identity. Conntrack zones allow to specify a numerical zone using the CT target, connections in different zones can use the same identity. Example: iptables -t raw -A PREROUTING -i veth0 -j CT --zone 1 iptables -t raw -A OUTPUT -o veth1 -j CT --zone 1 Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: pass template to l4proto ->error() handlerPatrick McHardy2010-02-158-11/+15
| | | | | | | | | | | | | | The error handlers might need the template to get the conntrack zone introduced in the next patches to perform a conntrack lookup. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: add const qualifiersJan Engelhardt2010-02-154-136/+168
| | | | | | | | | | | | This should make it easier to remove redundant arguments later. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: xtables: constify args in compat copying functionsJan Engelhardt2010-02-158-22/+22
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: xtables: print details on size mismatchJan Engelhardt2010-02-151-2/+6
| | | | | | | | | | | | | | Print which revision has been used and which size are which (kernel/user) for easier debugging. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: get rid of the grossness in netfilter.hJan Engelhardt2010-02-151-17/+28
| | | | | | | | | | | | | | GCC is now smart enough to follow the inline trail correctly. vmlinux size remain the same. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: reduce NF_HOOK by one argumentJan Engelhardt2010-02-151-9/+5
| | | | | | | | | | | | No changes in vmlinux filesize. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: iptables: remove unused function argumentsJan Engelhardt2010-02-152-14/+6
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: xt_recent: inform user when hitcount is too largeJan Engelhardt2010-02-151-2/+6
| | | | | | | | | | | | | | | | | | It is one of these things that iptables cannot catch and which can cause "Invalid argument" to be printed. Without a hint in dmesg, it is not going to be helpful. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: don't use INIT_RCU_HEAD()Alexey Dobriyan2010-02-123-3/+0
| | | | | | | | | | | | | | | | call_rcu() will unconditionally reinitialize RCU head anyway. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: elegantly simplify nf_ct_exp_net()Alexey Dobriyan2010-02-121-5/+1
| | | | | | | | | | | | | | Remove #ifdef at nf_ct_exp_net() by using nf_ct_net(). Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: fix mangle tablesAlexey Dobriyan2010-02-112-2/+6
| | | | | | | | | | | | | | In POST_ROUTING hook, calling dev_net(in) is going to oops. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack_sip: add T.38 FAX supportPatrick McHardy2010-02-113-6/+25
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_nat_sip: add TCP supportPatrick McHardy2010-02-113-6/+58
| | | | | | | | | | | | Add support for mangling TCP SIP packets. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_nat: support mangling a single TCP packet multiple timesPatrick McHardy2010-02-112-23/+48
| | | | | | | | | | | | | | | | | | | | | | | | nf_nat_mangle_tcp_packet() can currently only handle a single mangling per window because it only maintains two sequence adjustment positions: the one before the last adjustment and the one after. This patch makes sequence number adjustment tracking in nf_nat_mangle_tcp_packet() optional and allows a helper to manually update the offsets after the packet has been fully handled. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack_sip: add TCP supportPatrick McHardy2010-02-113-31/+179
| | | | | | | | | | | | | | | | | | | | Add TCP support, which is mandated by RFC3261 for all SIP elements. SIP over TCP is similar to UDP, except that messages are delimited by Content-Length: headers and multiple messages may appear in one packet. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack_sip: pass data offset to NAT functionsPatrick McHardy2010-02-113-92/+105
| | | | | | | | | | | | | | | | | | | | When using TCP multiple SIP messages might be present in a single packet. A following patch will parse them by setting the dptr to the beginning of each message. The NAT helper needs to reload the dptr value after mangling the packet however, so it needs to know the offset of the message to the beginning of the packet. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack_sip: fix ct_sip_parse_request() REGISTER request parsingPatrick McHardy2010-02-111-3/+4
| | | | | | | | | | | | | | | | | | | | When requests are parsed, the "sip:" part of the SIP URI should be skipped. Usually this doesn't matter because address parsing skips forward until after the username part, but in case REGISTER requests it doesn't contain a username and the address can not be parsed. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: show helper and class in /proc/net/nf_conntrack_expectPatrick McHardy2010-02-113-0/+13
| | | | | | | | | | | | | | Make the output a bit more informative by showing the helper an expectation belongs to and the expectation class. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: dump expectation helper namePatrick McHardy2010-02-111-0/+4
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge branch 'master' of git://dev.medozas.de/linuxPatrick McHardy2010-02-1019-825/+348
| |\
| | * netfilter: xtables: generate initial table on-demandJan Engelhardt2010-02-1018-334/+141
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The static initial tables are pretty large, and after the net namespace has been instantiated, they just hang around for nothing. This commit removes them and creates tables on-demand at runtime when needed. Size shrinks by 7735 bytes (x86_64). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: use xt_table for hook instantiationJan Engelhardt2010-02-1011-250/+121
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The respective xt_table structures already have most of the metadata needed for hook setup. Add a 'priority' field to struct xt_table so that xt_hook_link() can be called with a reduced number of arguments. So should we be having more tables in the future, it comes at no static cost (only runtime, as before) - space saved: 6807373->6806555. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: compact table hook functions (2/2)Jan Engelhardt2010-02-107-59/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | The calls to ip6t_do_table only show minimal differences, so it seems like a good cleanup to merge them to a single one too. Space saving obtained by both patches: 6807725->6807373 ("Total" column from `size -A`.) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: compact table hook functions (1/2)Jan Engelhardt2010-02-109-258/+126
| | | | | | | | | | | | | | | | | | | | | | | | This patch combines all the per-hook functions in a given table into a single function. Together with the 2nd patch, further simplifications are possible up to the point of output code reduction. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * | netfilter: ctnetlink: add missing netlink attribute policiesPatrick McHardy2010-02-101-5/+36
| | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xtables: symmetric COMPAT_XT_ALIGN definitionAlexey Dobriyan2010-02-102-6/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | Rewrite COMPAT_XT_ALIGN in terms of dummy structure hack. Compat counters logically have nothing to do with it. Use ALIGN() macro while I'm at it for same types. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xtables: consistent struct compat_xt_counters definitionAlexey Dobriyan2010-02-101-5/+1
| |/ | | | | | | | | | | | | | | | | There is compat_u64 type which deals with different u64 type alignment on different compat-capable platforms, so use it and removed some hardcoded assumptions. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge branch 'master' of /repos/git/net-next-2.6Patrick McHardy2010-02-102023-23829/+75974
| |\ | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: fix build failure with CONNTRACK=y NAT=nFlorian Westphal2010-02-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | net/ipv4/netfilter/nf_defrag_ipv4.c: In function 'ipv4_conntrack_defrag': net/ipv4/netfilter/nf_defrag_ipv4.c:62: error: implicit declaration of function 'nf_ct_is_template' Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xtables: add CT targetPatrick McHardy2010-02-037-0/+211
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new target for the raw table, which can be used to specify conntrack parameters for specific connections, f.i. the conntrack helper. The target attaches a "template" connection tracking entry to the skb, which is used by the conntrack core when initializing a new conntrack. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_conntrack: support conntrack templatesPatrick McHardy2010-02-038-24/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support initializing selected parameters of new conntrack entries from a "conntrack template", which is a specially marked conntrack entry attached to the skb. Currently the helper and the event delivery masks can be initialized this way. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: ctnetlink: support selective event deliveryPatrick McHardy2010-02-034-33/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add two masks for conntrack end expectation events to struct nf_conntrack_ecache and use them to filter events. Their default value is "all events" when the event sysctl is on and "no events" when it is off. A following patch will add specific initializations. Expectation events depend on the ecache struct of their master conntrack. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_conntrack: split up IPCT_STATUS eventPatrick McHardy2010-02-038-18/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Split up the IPCT_STATUS event into an IPCT_REPLY event, which is generated when the IPS_SEEN_REPLY bit is set, and an IPCT_ASSURED event, which is generated when the IPS_ASSURED bit is set. In combination with a following patch to support selective event delivery, this can be used for "sparse" conntrack replication: start replicating the conntrack entry after it reached the ASSURED state and that way it's SYN-flood resistant. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: add struct net * to target parametersPatrick McHardy2010-02-034-10/+18
| | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
OpenPOWER on IntegriCloud