linux/include/net/netfilter, branch v3.5

netfilter: nf_ct_ecache: fix crash with multiple containers, one shutting down

2012-07-09T08:53:19Z

Hans reports that he's still hitting: BUG: unable to handle kernel NULL pointer dereference at 000000000000027c IP: [] netlink_has_listeners+0xb/0x60 PGD 0 Oops: 0000 [#3] PREEMPT SMP CPU 0 It happens when adding a number of containers with do: nfct_query(h, NFCT_Q_CREATE, ct); and most likely one namespace shuts down. this problem was supposed to be fixed by: 70e9942 netfilter: nf_conntrack: make event callback registration per-netns Still, it was missing one rcu_access_pointer to check if the callback is set or not. Reported-by: Hans Schillstrom Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: use this_cpu_inc()

2012-05-08T17:36:33Z

this_cpu_inc() is IRQ safe and faster than local_bh_disable()/__this_cpu_inc()/local_bh_enable(), at least on x86. Signed-off-by: Eric Dumazet Cc: Patrick McHardy Cc: Christoph Lameter Cc: Tejun Heo Reviewed-by: Christoph Lameter Signed-off-by: Pablo Neira Ayuso

netfilter: nf_ct_helper: allow to disable automatic helper assignment

2012-05-08T17:35:18Z

This patch allows you to disable automatic conntrack helper lookup based on TCP/UDP ports, eg. echo 0 > /proc/sys/net/netfilter/nf_conntrack_helper [ Note: flows that already got a helper will keep using it even if automatic helper assignment has been disabled ] Once this behaviour has been disabled, you have to explicitly use the iptables CT target to attach helper to flows. There are good reasons to stop supporting automatic helper assignment, for further information, please read: http://www.netfilter.org/news.html#2012-04-03 This patch also adds one message to inform that automatic helper assignment is deprecated and it will be removed soon (this is spotted only once, with the first flow that gets a helper attached to make it as less annoying as possible). Signed-off-by: Eric Leblond Signed-off-by: Pablo Neira Ayuso

net: Convert nf_conntrack_proto to use register_net_sysctl

2012-04-21T01:22:30Z

There isn't much advantage here except that strings paths are a bit easier to read, and converting everything to them allows me to kill off ctl_path. Signed-off-by: Eric W. Biederman Acked-by: Pavel Emelyanov Signed-off-by: David S. Miller

netfilter: xt_LOG: don't use xchg() for simple assignment

2012-03-26T12:00:28Z

At least on ia64 the (bogus) use of xchg() here results in the compiler warning about an unused expression result. As only an assignment is intended here, convert it to such. Signed-off-by: Jan Beulich Acked-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso

netfilter: cttimeout: fix dependency with l4protocol conntrack module

2012-03-22T23:52:01Z

This patch introduces nf_conntrack_l4proto_find_get() and nf_conntrack_l4proto_put() to fix module dependencies between timeout objects and l4-protocol conntrack modules. Thus, we make sure that the module cannot be removed if it is used by any of the cttimeout objects. Signed-off-by: Pablo Neira Ayuso

netfilter: xt_LOG: add __printf() to sb_add()

2012-03-07T16:41:52Z

Helps to find format mismatches at compile time Suggested-by: David Laight Signed-off-by: Eric Dumazet

netfilter: nf_ct_ext: add timeout extension

2012-03-07T16:41:25Z

This patch adds the timeout extension, which allows you to attach specific timeout policies to flows. This extension is only used by the template conntrack. Signed-off-by: Pablo Neira Ayuso

netfilter: add cttimeout infrastructure for fine timeout tuning

2012-03-07T16:41:22Z

This patch adds the infrastructure to add fine timeout tuning over nfnetlink. Now you can use the NFNL_SUBSYS_CTNETLINK_TIMEOUT subsystem to create/delete/dump timeout objects that contain some specific timeout policy for one flow. The follow up patches will allow you attach timeout policy object to conntrack via the CT target and the conntrack extension infrastructure. Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: pass timeout array to l4->new and l4->packet

2012-03-07T16:41:19Z

This patch defines a new interface for l4 protocol trackers: unsigned int *(*get_timeouts)(struct net *net); that is used to return the array of unsigned int that contains the timeouts that will be applied for this flow. This is passed to the l4proto->new(...) and l4proto->packet(...) functions to specify the timeout policy. This interface allows per-net global timeout configuration (although only DCCP supports this by now) and it will allow custom custom timeout configuration by means of follow-up patches. Signed-off-by: Pablo Neira Ayuso