linux/include/net/netfilter, branch v3.4.55

netfilter: nf_conntrack: fix racy timer handling with reliable events

2012-10-21T16:28:00Z

commit 5b423f6a40a0327f9d40bc8b97ce9be266f74368 upstream. Existing code assumes that del_timer returns true for alive conntrack entries. However, this is not true if reliable events are enabled. In that case, del_timer may return true for entries that were just inserted in the dying list. Note that packets / ctnetlink may hold references to conntrack entries that were just inserted to such list. This patch fixes the issue by adding an independent timer for event delivery. This increases the size of the ecache extension. Still we can revisit this later and use variable size extensions to allocate this area on demand. Tested-by: Oliver Smith Signed-off-by: Pablo Neira Ayuso Acked-by: David Miller Signed-off-by: Greg Kroah-Hartman

netfilter: xt_LOG: don't use xchg() for simple assignment

2012-03-26T12:00:28Z

At least on ia64 the (bogus) use of xchg() here results in the compiler warning about an unused expression result. As only an assignment is intended here, convert it to such. Signed-off-by: Jan Beulich Acked-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso

netfilter: cttimeout: fix dependency with l4protocol conntrack module

2012-03-22T23:52:01Z

This patch introduces nf_conntrack_l4proto_find_get() and nf_conntrack_l4proto_put() to fix module dependencies between timeout objects and l4-protocol conntrack modules. Thus, we make sure that the module cannot be removed if it is used by any of the cttimeout objects. Signed-off-by: Pablo Neira Ayuso

netfilter: xt_LOG: add __printf() to sb_add()

2012-03-07T16:41:52Z

Helps to find format mismatches at compile time Suggested-by: David Laight Signed-off-by: Eric Dumazet

netfilter: nf_ct_ext: add timeout extension

2012-03-07T16:41:25Z

This patch adds the timeout extension, which allows you to attach specific timeout policies to flows. This extension is only used by the template conntrack. Signed-off-by: Pablo Neira Ayuso

netfilter: add cttimeout infrastructure for fine timeout tuning

2012-03-07T16:41:22Z

This patch adds the infrastructure to add fine timeout tuning over nfnetlink. Now you can use the NFNL_SUBSYS_CTNETLINK_TIMEOUT subsystem to create/delete/dump timeout objects that contain some specific timeout policy for one flow. The follow up patches will allow you attach timeout policy object to conntrack via the CT target and the conntrack extension infrastructure. Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: pass timeout array to l4->new and l4->packet

2012-03-07T16:41:19Z

This patch defines a new interface for l4 protocol trackers: unsigned int *(*get_timeouts)(struct net *net); that is used to return the array of unsigned int that contains the timeouts that will be applied for this flow. This is passed to the l4proto->new(...) and l4proto->packet(...) functions to specify the timeout policy. This interface allows per-net global timeout configuration (although only DCCP supports this by now) and it will allow custom custom timeout configuration by means of follow-up patches. Signed-off-by: Pablo Neira Ayuso

netfilter: ctnetlink: allow to set expectfn for expectations

2012-03-07T16:40:46Z

This patch allows you to set expectfn which is specifically used by the NAT side of most of the existing conntrack helpers. I have added a symbol map that uses a string as key to look up for the function that is attached to the expectation object. This is the best solution I came out with to solve this issue. Signed-off-by: Pablo Neira Ayuso

netfilter: ctnetlink: fix soft lockup when netlink adds new entries (v2)

2012-02-24T11:24:15Z

Marcell Zambo and Janos Farago noticed and reported that when new conntrack entries are added via netlink and the conntrack table gets full, soft lockup happens. This is because the nf_conntrack_lock is held while nf_conntrack_alloc is called, which is in turn wants to lock nf_conntrack_lock while evicting entries from the full table. The patch fixes the soft lockup with limiting the holding of the nf_conntrack_lock to the minimum, where it's absolutely required. It required to extend (and thus change) nf_conntrack_hash_insert so that it makes sure conntrack and ctnetlink do not add the same entry twice to the conntrack table. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso

Merge branch 'nf-next' of git://1984.lsi.us.es/net-next

2011-12-25T07:21:45Z