pm24.git/include/linux/netfilter, branch v3.2-rc3

headers, xtables: Add missing #include

2011-08-26T16:02:50Z

Various headers use union nf_inet_addr, defined in . Signed-off-by: Ben Hutchings Acked-by: Patrick McHardy Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

2011-07-21T19:39:35Z

netfilter: ipset: fix compiler warnings "'hash_ip4_data_next' declared inline after being called"

2011-07-21T10:07:10Z

Some gcc versions warn about prototypes without "inline" when the declaration includes the "inline" keyword. The fix generates a false error message "marked inline, but without a definition" with sparse below 0.4.2. Signed-off-by: Chris Friesen Signed-off-by: Jozsef Kadlecsik Signed-off-by: Patrick McHardy

netfilter: ipset: hash:net,iface fixed to handle overlapping nets behind different interfaces

2011-07-21T10:06:18Z

If overlapping networks with different interfaces was added to the set, the type did not handle it properly. Example ipset create test hash:net,iface ipset add test 192.168.0.0/16,eth0 ipset add test 192.168.0.0/24,eth1 Now, if a packet was sent from 192.168.0.0/24,eth0, the type returned a match. In the patch the algorithm is fixed in order to correctly handle overlapping networks. Limitation: the same network cannot be stored with more than 64 different interfaces in a single set. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Patrick McHardy

netfilter: ipset: make possible to hash some part of the data element only

2011-07-21T10:05:31Z

Signed-off-by: Jozsef Kadlecsik Signed-off-by: Patrick McHardy

netfilter: nfnetlink_queue: batch verdict support

2011-07-19T09:46:33Z

Introduces a new nfnetlink type that applies a given verdict to all queued packets with an id <= the id in the verdict message. If a mark is provided it is applied to all matched packets. This reduces the number of verdicts that have to be sent. Applications that make use of this feature need to maintain a timeout to send a batchverdict periodically to avoid starvation. Signed-off-by: Florian Westphal Signed-off-by: Patrick McHardy

netfilter: nfnetlink: add RCU in nfnetlink_rcv_msg()

2011-07-18T14:08:07Z

Goal of this patch is to permit nfnetlink providers not mandate nfnl_mutex being held while nfnetlink_rcv_msg() calls them. If struct nfnl_callback contains a non NULL call_rcu(), then nfnetlink_rcv_msg() will use it instead of call() field, holding rcu_read_lock instead of nfnl_mutex Signed-off-by: Eric Dumazet CC: Florian Westphal CC: Eric Leblond Signed-off-by: Patrick McHardy

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2011-06-21T05:29:08Z

Conflicts: drivers/net/wireless/iwlwifi/iwl-agn-rxon.c drivers/net/wireless/rtlwifi/pci.c net/netfilter/ipvs/ip_vs_core.c

netfilter: ipset: whitespace and coding fixes detected by checkpatch.pl

2011-06-16T17:01:26Z

Signed-off-by: Jozsef Kadlecsik Signed-off-by: Patrick McHardy

netfilter: ipset: hash:net,iface type introduced

2011-06-16T17:00:48Z

The hash:net,iface type makes possible to store network address and interface name pairs in a set. It's mostly suitable for egress and ingress filtering. Examples: # ipset create test hash:net,iface # ipset add test 192.168.0.0/16,eth0 # ipset add test 192.168.0.0/24,eth1 Signed-off-by: Jozsef Kadlecsik Signed-off-by: Patrick McHardy