| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Make sure TCF_EM_IPSET defined and corresponds to current upstream value
if not defined in target kernel. You need iproute2 version that supports
em_ipset to communicate correctly. Include ip_set_compat.h after
pkt_cls.h to prevent TCF_EM_IPSET redefine error.
Detect skb->iif => skb->skb_iif rename after commit 8964be4a9a5c ("net:
rename skb->iif to skb->skb_iif").
Add dev_get_by_index_rcu() define pointing to __dev_get_by_index() to
build on RHEL6 kernels with explicit note that this may not work on all
architectures.
Always build em_ipset regardless of CONFIG_NET_EMATCH_IPSET option.
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
|
|
|
|
|
| |
Handle changes in struct xt_action_param and the new xt_family(),
xt_net() interfaces (reported by Jan Engelhardt).
|
|
|
|
|
|
|
|
|
|
|
| |
As xt_action_param lives on the stack this does not bloat any
persistent data structures.
This is a first step in making netfilter code that needs to know
which network namespace it is executing in simpler.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
tc code implicitly considers skb->protocol even in case of accelerated
vlan paths and expects vlan protocol type here. However, on rx path,
if the vlan header was already stripped, skb->protocol contains value
of next header. Similar situation is on tx path.
So for skbs that use skb->vlan_tci for tagging, use skb->vlan_proto instead.
Reported-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
|
|
| |
Nikolay Borisov reported that the detection is broken. Fix checking in the
right sctructure and wrap the call to dev_get_by_index_rcu() too.
|
|
|
|
|
|
|
|
|
| |
em->net is always set and always available, use it in preference
to dev_net(skb->dev).
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
|
| |
|
| |
|
|
|
|
|
|
| |
We have to use dev_net() instead of the direct access to ->nd_net,
otherwise compilation fails if NET_NS is not enabled. Reported by
the kbuild test robot.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds netns support for ipset.
Major changes were made in ip_set_core.c and ip_set.h.
Global variables are moved to per net namespace.
Added initialization code and the destruction of the network namespace ipset subsystem.
In the prototypes of public functions ip_set_* added parameter "struct net*".
The remaining corrections related to the change prototypes of public functions ip_set_*.
The patch for git://git.netfilter.org/ipset.git commit 6a4ec96c0b8caac5c35474e40e319704d92ca347
Signed-off-by: Vitaly Lavrov <lve@guap.ru>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
|
|
Due to the ipset kernel API changes, em_ipset.c needs to be provided
in the ipset package, reported by Jan Engelhardt:
WARNING: //lib/modules/3.7.10-jng15-default/kernel/net/sched/em_ipset.ko
disagrees about version of symbol ip_set_test
|