pm24.git/include/linux/netfilter, branch v3.7-rc8

UAPI: Remove empty non-UAPI Kbuild files

2012-10-17T11:31:15Z

Remove non-UAPI Kbuild files that have become empty as a result of UAPI disintegration. They used to have only header-y lines in them and those have now moved to the Kbuild files in the corresponding uapi/ directories. Possibly these should not be removed but rather have a comment inserted to say they are intentionally left blank. This would make it easier to add generated header lines in future without having to restore the infrastructure. Note that at this point not all the UAPI disintegration parts have been merged, so it is likely that more empty Kbuild files will turn up. It is probably necessary to make the files non-empty to prevent the patch program from automatically deleting them when it reduces them to nothing. Signed-off-by: David Howells

UAPI: (Scripted) Disintegrate include/linux/netfilter/ipset

2012-10-09T08:48:55Z

Signed-off-by: David Howells Acked-by: Arnd Bergmann Acked-by: Thomas Gleixner Acked-by: Michael Kerrisk Acked-by: Paul E. McKenney Acked-by: Dave Jones

UAPI: (Scripted) Disintegrate include/linux/netfilter

2012-10-09T08:48:54Z

Signed-off-by: David Howells Acked-by: Arnd Bergmann Acked-by: Thomas Gleixner Acked-by: Michael Kerrisk Acked-by: Paul E. McKenney Acked-by: Dave Jones

Merge tag 'uapi-prep-20121002' of git://git.infradead.org/users/dhowells/linux-headers

2012-10-03T20:45:43Z

Pull preparatory patches for user API disintegration from David Howells: "The patches herein prepare for the extraction of the Userspace API bits from the various header files named in the Kbuild files. New subdirectories are created under either include/uapi/ or arch/x/include/uapi/ that correspond to the subdirectory containing that file under include/ or arch/x/include/. The new subdirs under the uapi/ directory are populated with Kbuild files that mostly do nothing at this time. Further patches will disintegrate the headers in each original directory and fill in the Kbuild files as they do it. These patches also: (1) fix up #inclusions of "foo.h" rather than . (2) Remove some redundant #includes from the DRM code. (3) Make the kernel build infrastructure handle Kbuild files both in the old places and the new UAPI place that both specify headers to be exported. (4) Fix some kernel tools that #include kernel headers during their build. I have compile tested this with allyesconfig against x86_64, allmodconfig against i386 and a scattering of additional defconfigs of other arches. Prepared for main script Signed-off-by: David Howells Acked-by: Arnd Bergmann Acked-by: Thomas Gleixner Acked-by: Michael Kerrisk Acked-by: Paul E. McKenney Acked-by: Dave Jones Acked-by: H. Peter Anvin " * tag 'uapi-prep-20121002' of git://git.infradead.org/users/dhowells/linux-headers: UAPI: Plumb the UAPI Kbuilds into the user header installation and checking UAPI: x86: Differentiate the generated UAPI and internal headers UAPI: Remove the objhdr-y export list UAPI: Move linux/version.h UAPI: Set up uapi/asm/Kbuild.asm UAPI: x86: Fix insn_sanity build failure after UAPI split UAPI: x86: Fix the test_get_len tool UAPI: (Scripted) Set up UAPI Kbuild files UAPI: Partition the header include path sets and add uapi/ header directories UAPI: (Scripted) Convert #include "..." to #include in kernel system headers UAPI: (Scripted) Convert #include "..." to #include in drivers/gpu/ UAPI: (Scripted) Remove redundant DRM UAPI header #inclusions from drivers/gpu/. UAPI: Refer to the DRM UAPI headers with <...> and from certain headers only

UAPI: (Scripted) Convert #include "..." to #include in kernel system headers

2012-10-02T17:01:25Z

Convert #include "..." to #include in kernel system headers. Signed-off-by: David Howells Acked-by: Arnd Bergmann Acked-by: Thomas Gleixner Acked-by: Paul E. McKenney Acked-by: Dave Jones

netfilter: nfnetlink_queue: add NFQA_CAP_LEN attribute

2012-09-24T13:10:29Z

This patch adds the NFQA_CAP_LEN attribute that allows us to know what is the real packet size from user-space (even if we decided to retrieve just a few bytes from the packet instead of all of it). Security software that inspects packets should always check for this new attribute to make sure that it is inspecting the entire packet. This also helps to provide a workaround for the problem described in: http://marc.info/?l=netfilter-devel&m=134519473212536&w=2 Original idea from Florian Westphal. Signed-off-by: Pablo Neira Ayuso

netfilter: nf_ct_ftp: add sequence tracking pickup facility for injected entries

2012-09-24T12:29:40Z

This patch allows the FTP helper to pickup the sequence tracking from the first packet seen. This is useful to fix the breakage of the first FTP command after the failover while using conntrackd to synchronize states. The seq_aft_nl_num field in struct nf_ct_ftp_info has been shrinked to 16-bits (enough for what it does), so we can use the remaining 16-bits to store the flags while using the same size for the private FTP helper data. Signed-off-by: Pablo Neira Ayuso

netfilter: xt_time: add support to ignore day transition

2012-09-24T12:29:01Z

Currently, if you want to do something like: "match Monday, starting 23:00, for two hours" You need two rules, one for Mon 23:00 to 0:00 and one for Tue 0:00-1:00. The rule: --weekdays Mo --timestart 23:00 --timestop 01:00 looks correct, but it will first match on monday from midnight to 1 a.m. and then again for another hour from 23:00 onwards. This permits userspace to explicitly ignore the day transition and match for a single, continuous time period instead. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Support to match elements marked with "nomatch"

2012-09-22T20:44:34Z

Exceptions can now be matched and we can branch according to the possible cases: a. match in the set if the element is not flagged as "nomatch" b. match in the set if the element is flagged with "nomatch" c. no match i.e. iptables ... -m set --match-set ... -j ... iptables ... -m set --match-set ... --nomatch-entries -j ... ... Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Coding style fixes

2012-09-22T20:44:29Z

Signed-off-by: Jozsef Kadlecsik