linux/include/net/netfilter, branch v2.6.23

[NETFILTER]: nf_nat: add symbolic dependency on IPv4 conntrack

2007-08-08T01:12:01Z

Loading nf_nat causes the conntrack core to be loaded, but we need IPv4 as well. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETFILTER]: Make nf_ct_ipv6_skip_exthdr() static.

2007-07-31T09:28:26Z

nf_ct_ipv6_skip_exthdr() can now become static. Signed-off-by: Adrian Bunk Signed-off-by: David S. Miller

netfilter endian regressions

2007-07-26T18:11:56Z

no real bugs, just misannotations cropping up Signed-off-by: Al Viro Signed-off-by: Linus Torvalds

[NETFILTER]: nf_conntrack: mark protocols __read_mostly

2007-07-15T03:48:19Z

Also remove two unnecessary EXPORT_SYMBOLs and move the nf_conntrack_l3proto_ipv4 declaration to the correct file. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: Introduces nf_ct_get_tuplepr and uses it

2007-07-15T03:45:14Z

nf_ct_get_tuple() requires the offset to transport header and that bothers callers such as icmp[v6] l4proto modules. This introduces new function to simplify them. Signed-off-by: Yasuyuki Kozakai Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: make l3proto->prepare() generic and renames it

2007-07-15T03:44:50Z

The icmp[v6] l4proto modules parse headers in ICMP[v6] error to get tuple. But they have to find the offset to transport protocol header before that. Their processings are almost same as prepare() of l3proto modules. This makes prepare() more generic to simplify icmp[v6] l4proto module later. Signed-off-by: Yasuyuki Kozakai Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETFILTER]: Convert DEBUGP to pr_debug

2007-07-11T05:18:20Z

Convert DEBUGP to pr_debug and fix lots of non-compiling debug statements. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack_helper: use hashtable for conntrack helpers

2007-07-11T05:18:13Z

Eliminate the last global list searched for every new connection. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack_expect: introduce nf_conntrack_expect_max sysct

2007-07-11T05:18:12Z

As a last step of preventing DoS by creating lots of expectations, this patch introduces a global maximum and a sysctl to control it. The default is initialized to 4 * the expectation hash table size, which results in 1/64 of the default maxmimum of conntracks. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack_expect: maintain per conntrack expectation list

2007-07-11T05:18:02Z

This patch brings back the per-conntrack expectation list that was removed around 2.6.10 to avoid walking all expectations on expectation eviction and conntrack destruction. As these were the last users of the global expectation list, this patch also kills that. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller