Eric Lee / smarc-fsl-linux-kernel

18 Jan, 2011

1 commit

  • 94b27cc36   netfilter: allow NFQUEUE bypass if no listener is available ... Browse Code »

    If an skb is to be NF_QUEUE'd, but no program has opened the queue, the
    packet is dropped.

    This adds a v2 target revision of xt_NFQUEUE that allows packets to
    continue through the ruleset instead.

    Because the actual queueing happens outside of the target context, the
    'bypass' flag has to be communicated back to the netfilter core.

    Unfortunately the only choice to do this without adding a new function
    argument is to use the target function return value (i.e. the verdict).

    In the NF_QUEUE case, the upper 16bit already contain the queue number
    to use. The previous patch reduced NF_VERDICT_MASK to 0xff, i.e.
    we now have extra room for a new flag.

    If a hook issued a NF_QUEUE verdict, then the netfilter core will
    continue packet processing if the queueing hook
    returns -ESRCH (== "this queue does not exist") and the new
    NF_VERDICT_FLAG_QUEUE_BYPASS flag is set in the verdict value.

    Note: If the queue exists, but userspace does not consume packets fast
    enough, the skb will still be dropped.

    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

13 Nov, 2010

1 commit

12 May, 2010

1 commit

25 Mar, 2010

4 commits

17 Mar, 2010

1 commit

04 Jan, 2010

1 commit

22 Jun, 2009

1 commit

  • f9ffc3125   netfilter: fix some sparse endianess warnings ... Browse Code »

    net/netfilter/xt_NFQUEUE.c:46:9: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:46:9: expected unsigned int [unsigned] [usertype] ipaddr
    net/netfilter/xt_NFQUEUE.c:46:9: got restricted unsigned int
    net/netfilter/xt_NFQUEUE.c:68:10: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:68:10: expected unsigned int [unsigned]
    net/netfilter/xt_NFQUEUE.c:68:10: got restricted unsigned int
    net/netfilter/xt_NFQUEUE.c:69:10: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:69:10: expected unsigned int [unsigned]
    net/netfilter/xt_NFQUEUE.c:69:10: got restricted unsigned int
    net/netfilter/xt_NFQUEUE.c:70:10: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:70:10: expected unsigned int [unsigned]
    net/netfilter/xt_NFQUEUE.c:70:10: got restricted unsigned int
    net/netfilter/xt_NFQUEUE.c:71:10: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:71:10: expected unsigned int [unsigned]
    net/netfilter/xt_NFQUEUE.c:71:10: got restricted unsigned int

    net/netfilter/xt_cluster.c:20:55: warning: incorrect type in return expression (different base types)
    net/netfilter/xt_cluster.c:20:55: expected unsigned int
    net/netfilter/xt_cluster.c:20:55: got restricted unsigned int const [usertype] ip
    net/netfilter/xt_cluster.c:20:55: warning: incorrect type in return expression (different base types)
    net/netfilter/xt_cluster.c:20:55: expected unsigned int
    net/netfilter/xt_cluster.c:20:55: got restricted unsigned int const [usertype] ip

    Signed-off-by: Patrick McHardy

    Patrick McHardy
     

05 Jun, 2009

2 commits

  • 10662aa30   netfilter: xt_NFQUEUE: queue balancing support ... Browse Code »

    Adds support for specifying a range of queues instead of a single queue
    id. Flows will be distributed across the given range.

    This is useful for multicore systems: Instead of having a single
    application read packets from a queue, start multiple
    instances on queues x, x+1, .. x+n. Each instance can process
    flows independently.

    Packets for the same connection are put into the same queue.

    Signed-off-by: Holger Eitzenberger
    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     
  • 61f5abcab   netfilter: xt_NFQUEUE: use NFPROTO_UNSPEC ... Browse Code »

    We can use wildcard matching here, just like
    ab4f21e6fb1c09b13c4c3cb8357babe8223471bd ("xtables: use NFPROTO_UNSPEC
    in more extensions").

    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

20 Oct, 2008

1 commit

  • fdc9314cb   netfilter: replace old NF_ARP calls with NFPROTO_ARP ... Browse Code »

    (Supplements: ee999d8b9573df1b547aacdc6d79f86eb79c25cd)

    NFPROTO_ARP actually has a different value from NF_ARP, so ensure all
    callers use the new value so that packets _do_ get delivered to the
    registered hooks.

    Signed-off-by: Jan Engelhardt
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Jan Engelhardt
     

08 Oct, 2008

2 commits

29 Jan, 2008

2 commits

16 Oct, 2007

1 commit

11 Jul, 2007

1 commit

13 Feb, 2007

1 commit

16 Oct, 2006

1 commit

23 Sep, 2006

2 commits

29 Mar, 2006

1 commit

  • 65b4b4e81   [NETFILTER]: Rename init functions. ... Browse Code »

    Every netfilter module uses `init' for its module_init() function and
    `fini' or `cleanup' for its module_exit() function.

    Problem is, this creates uninformative initcall_debug output and makes
    ctags rather useless.

    So go through and rename them all to $(filename)_init and
    $(filename)_fini.

    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    Andrew Morton
     

23 Mar, 2006

1 commit

21 Mar, 2006

2 commits

13 Jan, 2006

1 commit

  • 2e4e6a17a   [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables ... Browse Code »

    This monster-patch tries to do the best job for unifying the data
    structures and backend interfaces for the three evil clones ip_tables,
    ip6_tables and arp_tables. In an ideal world we would never have
    allowed this kind of copy+paste programming... but well, our world
    isn't (yet?) ideal.

    o introduce a new x_tables module
    o {ip,arp,ip6}_tables depend on this x_tables module
    o registration functions for tables, matches and targets are only
    wrappers around x_tables provided functions
    o all matches/targets that are used from ip_tables and ip6_tables
    are now implemented as xt_FOOBAR.c files and provide module aliases
    to ipt_FOOBAR and ip6t_FOOBAR
    o header files for xt_matches are in include/linux/netfilter/,
    include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
    around the xt_FOOBAR.h headers

    Based on this patchset we're going to further unify the code,
    gradually getting rid of all the layer 3 specific assumptions.

    Signed-off-by: Harald Welte
    Signed-off-by: David S. Miller

    Harald Welte