Commit Graph

349616 Commits

Author SHA1 Message Date
Tilman Schmidt bc882b1880 isdn/gigaset: beautify common.c
Rearrange the gigaset_freecs() function to make it more readable,
and adapt gigaset_initcs() accordingly.

Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 17:36:25 -05:00
Tilman Schmidt cdc4827098 isdn/gigaset: beautify interface.c
Avoid forward declarations and remove a needless initialization.

Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 17:36:25 -05:00
Tilman Schmidt d2ca848194 isdn/gigaset: leave DLE mode before hanging up
Some firmware releases of Gigaset M105 do not accept AT+VLS=0 command
in DLE mode, so always leave DLE mode before sending the command.

Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 17:36:25 -05:00
Tilman Schmidt 03f18285cd isdn/divert: fix readability damage
Fix up some of the readibility deterioration caused by last year's
ISDN whitespace coding style cleanup.
Note that the checkpatch complaints all apply to the state of the
source before this patch as well, and in many cases even more so.

Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 17:36:25 -05:00
Julia Lawall 56567c6f87 drivers/net/ethernet/sfc/ptp.c: adjust duplicate test
Delete successive tests to the same location.  rc was previously tested and
not subsequently updated.  efx_phc_adjtime can return an error code, so the
call is updated so that is tested instead.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@s exists@
local idexpression y;
expression x,e;
@@

*if ( \(x == NULL\|IS_ERR(x)\|y != 0\) )
 { ... when forall
   return ...; }
... when != \(y = e\|y += e\|y -= e\|y |= e\|y &= e\|y++\|y--\|&y\)
    when != \(XT_GETPAGE(...,y)\|WMI_CMD_BUF(...)\)
*if ( \(x == NULL\|IS_ERR(x)\|y != 0\) )
 { ... when forall
   return ...; }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Acked-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 15:44:58 -05:00
YOSHIFUJI Hideaki / 吉藤英明 b820bb6b99 ndisc: Do not try to update "updated" time if neighbour has already gone.
Commit 2152caea ("ipv6: Do not depend on rt->n in rt6_probe().")
introduce a bug to try to update "updated" time in neighbour
structure.
Update the "updated" time only if neighbour is available.

Bug was found by Dan Carpenter <dan.carpenter@oracle.com>

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 15:41:41 -05:00
David S. Miller 100204147b Merge branch 'dsa'
Florian Fainelli says:

====================
These two patches are non-critical bugfixes based on net-next which I
stumbled upon while working on Device Tree bindings for DSA (will comme
as a separate patch later).

====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 15:40:47 -05:00
Florian Fainelli f9bf5a2ca6 dsa: make dsa_switch_setup check for valid port names
This patch changes dsa_switch_setup() to ensure that at least one valid
valid port name is specified and will bail out with an error in case we
walked the maximum number of port with a valid port name found.

Signed-off-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 15:40:12 -05:00
Florian Fainelli f490be049b dsa: use an unique and non conflicting bus name for the slave MII bus
The slave MII bus registered by the DSA code is using the parent MII bus
as part of its name (ds->master_mii_bus_id), in case the parent MII bus
name is already 16 characters long (such as d0072004.mdio-mi) we will
get the following WARN_ON in dsa_switch_setup() when calling
mdiobus_register():

[   79.088782] ------------[ cut here ]------------
[   79.093448] WARNING: at fs/sysfs/dir.c:536 sysfs_add_one+0x80/0xa0()
[   79.099831] sysfs: cannot create duplicate filename
'/class/mdio_bus/d0072004.mdio-mi'

This is a genuine warning, because the DSA slave MII bus will also be
named d0072004.mdio-mi, and since MII_BUS_ID_SIZE is 17 characters long
(with null-terminator) the following will truncate the slave MII bus id:

snprintf(ds->slave_mii_bus->id, MII_BUS_ID_SIZE, "%s-%d:%.2x",
                        ds->master_mii_bus->id, ds->pd->sw_addr);

Fix this by using dsa-<switch index->:<sw_add> which is guaranteed to be
unique.

Signed-off-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 15:40:11 -05:00
Cong Wang 441d9d327f net: move rx and tx hash functions to net/core/flow_dissector.c
__skb_tx_hash() and __skb_get_rxhash() are all for calculating hash
value based by some fields in skb, mostly used for selecting queues
by device drivers.

Meanwhile, net/core/dev.c is bloating.

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 14:26:17 -05:00
David S. Miller cd5f20461d Merge branch 'virtio_mac'
Amos Kong says:

====================
Currenly mac is programmed byte by byte. This means that we
have an intermediate step where mac is wrong.

Third patch introduced a new vq control command to set mac
address, it's atomic.

V2: check return of sending command, delay eth_mac_addr()
V3: restore software address when fail to set hardware address
V4: split eth_mac_addr, fix error handle
V5: rebase patches to net-next tree
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 14:14:09 -05:00
Amos Kong 7e58d5aea8 virtio-net: introduce a new control to set macaddr
Currently we write MAC address to pci config space byte by byte,
this means that we have an intermediate step where mac is wrong.
This patch introduced a new control command to set MAC address,
it's atomic.

VIRTIO_NET_F_CTRL_MAC_ADDR is a new feature bit for compatibility.

Signed-off-by: Amos Kong <akong@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 14:07:44 -05:00
Stefan Hajnoczi fa0879e37b net: split eth_mac_addr for better error handling
When we set mac address, software mac address in system and hardware mac
address all need to be updated. Current eth_mac_addr() doesn't allow
callers to implement error handling nicely.

This patch split eth_mac_addr() to prepare part and real commit part,
then we can prepare first, and try to change hardware address, then do
the real commit if hardware address is set successfully.

Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Amos Kong <akong@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 14:07:44 -05:00
Amos Kong 40cbfc3707 move virtnet_send_command() above virtnet_set_mac_address()
We want to send vq command to set mac address in
virtnet_set_mac_address(), so do this function moving.
Fixed a little issue of coding style.

Signed-off-by: Amos Kong <akong@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 14:07:43 -05:00
David S. Miller 3fcd550a4b Merge branch 'mcast'
Nicolas Dichtel says:

====================
The goal of this serie is to add the support of proxy multicast, ie being able
to build a static multicast tree. In other words, it adds the support of (*,G)
mf[6]c entries.

v2: use INADDR_ANY instead of 0 for IPv4 addresses
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 14:06:34 -05:00
Nicolas Dichtel 660b26dc1a mcast: add multicast proxy support (IPv4 and IPv6)
This patch add the support of proxy multicast, ie being able to build a static
multicast tree. It adds the support of (*,*) and (*,G) entries.

The user should define an (*,*) entry which is not used for real forwarding.
This entry defines the upstream in iif and contains all interfaces from the
static tree in its oifs. It will be used to forward packet upstream when they
come from an interface belonging to the static tree.
Hence, the user should define (*,G) entries to build its static tree. Note that
upstream interface must be part of oifs: packets are sent to all oifs
interfaces except the input interface. This ensures to always join the whole
static tree, even if the packet is not coming from the upstream interface.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:55:14 -05:00
Nicolas Dichtel bbb923a4c2 mcast: define and use MRT[6]_MAX in ip[6]_mroute_opt()
This will ease further addition of new MRT[6]_* values and avoid to update
in6.h each time.
Note that we reduce the maximum value from 210 to 209, but 210 does not match
any known value in ip[6]_mroute_setsockopt().

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:55:14 -05:00
Paul Gortmaker 202dc3fc59 Documentation: remove obsolete networking/multicast.txt file
The original intent of this file was to list limitations in
drivers/hardware relating to multicast use, back when some
modest hardware from the early 1990s did not support things
we might take for granted today.

I was intending to delete some now-gone MCA/token ring entries
in this file, but once I opened it, I found it only contained
information on the earliest (pre-2000) linux networking drivers.

Checking the git history shows that the file hasn't been touched
since 2005.  Clearly nobody is actively consulting this file
as a meaningful reference.

Rather than add a "YES YES YES" line for all of the drivers we
currently have, lets just take advantage of the fact that nobody
is using the file to delete it.

This has the side benefit of not having to do a line-by-line
deletion of the file content as each older driver is expired.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:54:05 -05:00
David S. Miller 12dfac6c95 Merge branch 'qeth'
Merge s390 networking changes from Frank Blaschka.

Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:51:24 -05:00
Stefan Raspl 0fa81cd49d qeth: Fix HiperSockets performance regression
Commit 46d3ceab "tcp: TCP Small Queues" has severly degraded
performance for single connection RR workloads on HiperSockets with
MTU >=16K due to a conflict of the TCP Small Queues approach with our
buffer scan threshold which releases buffers not frequently enough yet.
This fix restores performance to the same level as before cited commit.

Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:51:15 -05:00
Stefan Raspl 819dc537fd qeth: Make s390dbf card entries persistent
As of now, s390dbf entries for the cards are discarded as soon as the
device is removed. However, this will also bar us of all chances of
getting valuable debug information after a device has been removed.
This patch will keep the s390dbf entries around until the qeth module
is removed.

Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Reviewed-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:51:15 -05:00
Stefan Raspl 26e4b3340e qeth: Update Kconfig wording
Refer to virtual NICs instead of GuestLANs.

Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:51:15 -05:00
Stefan Raspl 0f54761d16 qeth: Support VEPA mode
The existing port isolation mode 'forward' will now verify that the adjacent
switch port supports the required reflective relay (RR) mode. This patch adds
the required error handling for the cases where enabling port isolation mode
'forward' can now fail.
Furthermore, once established, we never fall back from one of the port
isolation modes to a non-isolated mode without further user-interaction.
This includes cases where the isolation mode was enabled successfully, but
ceases to work e.g. due to configuration changes at the switch port.
Finally, configuring an isolation mode with the device being offline
will make onlining the device fail permanently upon errors encountered until
either errors are resolved or the isolation mode is changed by the user to a
different mode.

Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Reviewed-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:51:14 -05:00
Stefan Raspl eb3fb0baa2 qeth: Remove unused exports
Remove exports that are not used anywhere else.

Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:51:14 -05:00
Stefan Raspl 6ebb7f8d79 qeth: Fix retry logic in hardsetup
The previous code did never retry any idx setup unless retries were done
for device offline/online at the beginning of the function.

Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Reviewed-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:51:14 -05:00
David S. Miller 9acefd17cb Merge branch 'ipv6_ndisc'
YOSHIFUJI Hideaki says:

====================
This series of changes basically clean up NDISC logic,
especially on sender side.

We originally do For NS/NA/RS:
 1) build temporary ICMPv6 header
 2) ndisc_build_skb() with temporary ICMPv6 header and rather
    criptic arguments.
    - Calculate total length and allocate sk_buff
    - Build IPv6 header.
    - copy ICMPv6 header, additional data and ND options.
    - Fill-in ICMPv6 checksum.
    Here, structures defined for message format was not used
    at all, it is difficult to understand what is being sent,
    and it was not generic.
 3) __ndisc_send()
    - Allocate temporary dst.
    - Send it.

Several issues:
- We could not defer decision if we should/can send some ND
  option.
- It is hard to see the packet format at a glance.
- ICMPv6 header was built as temporary variable, and then
  copied to the buffer.
- Some code path for Redirect was not shared.

With these patches, we do:
 1) Calculate (or estimate) message length and option length.
 2) Allocate skb (via new ndisc_skb_alloc()).
 3) Fill-in ICMPv6 message directly using compound literals.
 4) Fill-in ICMPv6 checksum
 5) Build IPv6 header (including length)
 6) Send the packet (via ndisc_send_skb()).
    - allocate temporary dst and send it.

- We can defer calculating real length of the packet.
  For example, we can give up filling some option at when
  filling in.
- Message is built directly without temporary buffer.
- Structures defined for message format is easier to understand
  what is being built.
- NS/NA/RS/Redirect share same logic.
- Reduced code/data size:
	   text	   data	    bss	    dec	    hex	filename
	 265407	  14133	   3488	 283028	  45194	old/net/ipv6/ipv6.o
	 264955	  14109	   3488	 282552	  44fb8	new/net/ipv6/ipv6.o
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:50:10 -05:00
YOSHIFUJI Hideaki / 吉藤英明 4d5c152e86 ndisc: Use compound literals to build redirect message.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:18 -05:00
YOSHIFUJI Hideaki / 吉藤英明 1cb3fe513f ndisc: Break down ndisc_build_skb() and build message directly.
Construct NS/NA/RS message directly using C99 compound literals.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:18 -05:00
YOSHIFUJI Hideaki / 吉藤英明 b44b5f4ae9 ndisc: Break down __ndisc_send().
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:17 -05:00
YOSHIFUJI Hideaki / 吉藤英明 7b3d9b06d8 ndisc: Fill in ICMPv6 checksum and IPv6 header in ndisc_send_skb().
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:17 -05:00
YOSHIFUJI Hideaki / 吉藤英明 f4de84c64e ndisc: Use ndisc_send_skb() for redirect.
Reuse dst if one is attached with skb.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:17 -05:00
YOSHIFUJI Hideaki / 吉藤英明 aa4bdd4b3f ndisc: Remove icmp6h argument from ndisc_send_skb().
skb_transport_header() (thus icmp6_hdr()) is available here,
use it.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:17 -05:00
YOSHIFUJI Hideaki / 吉藤英明 5f5a011563 ndisc: Make ndisc_fill_xxx_option() for sk_buff.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:16 -05:00
YOSHIFUJI Hideaki / 吉藤英明 2ce1357614 ndisc: Calculate message body length and option length separately.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:16 -05:00
YOSHIFUJI Hideaki / 吉藤英明 5135e633f9 ndisc: Reset skb->trasport_headner inside ndisc_alloc_send_skb().
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:16 -05:00
YOSHIFUJI Hideaki / 吉藤英明 527a150fb2 ndisc: Defer building IPv6 header.
Build ICMPv6 message first and make buffer management easier;
we can use skb->len when filling checksum in ICMPv6 header,
and then build IP header with length field.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:16 -05:00
YOSHIFUJI Hideaki / 吉藤英明 af9a997629 ndisc: Remove dev argument for ndisc_send_skb().
Since we have skb->dev, use it.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:15 -05:00
YOSHIFUJI Hideaki / 吉藤英明 f382d03ad0 ndisc: Set skb->dev and skb->protocol inside ndisc_alloc_skb().
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:15 -05:00
YOSHIFUJI Hideaki / 吉藤英明 c8d6c380d9 ndisc: Simplify arguments for ip6_nd_hdr().
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:15 -05:00
YOSHIFUJI Hideaki / 吉藤英明 2576f17dfa ipv6: Unshare ip6_nd_hdr() and change return type to void.
- move ip6_nd_hdr() to its users' source files.
  In net/ipv6/mcast.c, it will be called ip6_mc_hdr().
- make return type to void since this function never fails.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:15 -05:00
YOSHIFUJI Hideaki / 吉藤英明 de09334b93 ndisc: Introduce ndisc_alloc_skb() helper.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:15 -05:00
YOSHIFUJI Hideaki / 吉藤英明 9c86dafe94 ndisc: Introduce ndisc_fill_redirect_hdr_option().
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:14 -05:00
YOSHIFUJI Hideaki / 吉藤英明 6bce6b4e16 ndisc: Use skb_linearize() instead of pskb_may_pull(skb, skb->len).
Suggested by Eric Dumazet <edumazet@google.com>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:14 -05:00
YOSHIFUJI Hideaki / 吉藤英明 c558e9fca8 ndisc: Move ndisc_opt_addr_space() to include/net/ndisc.h.
This also makes ndisc_opt_addr_data() and ndisc_fill_addr_option()
use ndisc_opt_addr_space().

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:14 -05:00
YOSHIFUJI Hideaki / 吉藤英明 315ff09dba ndisc: Reduce number of arguments for ndisc_fill_addr_option().
Add pointer to struct net_device (dev) and remove
data_len (= dev->addr_len) and addr_type (= dev->type).

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:33:14 -05:00
Thierry Reding 7373470202 net: ethernet: davinci: Fix build breakage
The correct name of the transmit DMA channel field in struct emac_priv
is txchan, not txch.

Signed-off-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21 13:12:19 -05:00
Pablo Neira Ayuso 8a454ab95e netfilter: add missing xt_connlabel.h header in installation
In (c539f01 netfilter: add connlabel conntrack extension), it
was missing the change to the Kbuild file to install the header
in the system.

Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-21 13:46:49 +01:00
Jiri Pirko c9f9e0e159 netfilter: doc: add nf_conntrack sysctl api documentation
I grepped through the code and picked bits about nf_conntrack sysctl api
and put that into one documentation file.

[ I have mangled this patch including comments from several grammar
  improvements proposed by Neal Murphy <neal.p.murphy@alum.wpi.edu>,
  any new grammar error is my mistake --pablo ]

Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-21 12:50:06 +01:00
Pablo Neira Ayuso e7db3cbcd6 netfilter: add missing xt_bpf.h header in installation
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-21 12:30:59 +01:00
Willem de Bruijn e6f30c7317 netfilter: x_tables: add xt_bpf match
Support arbitrary linux socket filter (BPF) programs as x_tables
match rules. This allows for very expressive filters, and on
platforms with BPF JIT appears competitive with traditional
hardcoded iptables rules using the u32 match.

The size of the filter has been artificially limited to 64
instructions maximum to avoid bloating the size of each rule
using this new match.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-21 12:20:19 +01:00