Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a07aa004 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

parents cc7ec456 5d844928

include/linux/audit.h

+2 −0
Original line number Diff line number Diff line
@@ -103,6 +103,8 @@ 
#define AUDIT_BPRM_FCAPS	1321	/* Information about fcaps increasing perms */

#define AUDIT_CAPSET		1322	/* Record showing argument to sys_capset */

#define AUDIT_MMAP		1323	/* Record showing descriptor and flags in mmap */

#define AUDIT_NETFILTER_PKT	1324	/* Packets traversing netfilter chains */

#define AUDIT_NETFILTER_CFG	1325	/* Netfilter chain modifications */



#define AUDIT_AVC		1400	/* SE Linux avc denial or grant */

#define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */

include/linux/ip_vs.h

+8 −0
Original line number Diff line number Diff line
@@ -89,6 +89,14 @@ 
#define IP_VS_CONN_F_TEMPLATE	0x1000		/* template, not connection */

#define IP_VS_CONN_F_ONE_PACKET	0x2000		/* forward only one packet */



#define IP_VS_CONN_F_BACKUP_MASK (IP_VS_CONN_F_FWD_MASK | \

				  IP_VS_CONN_F_NOOUTPUT | \

				  IP_VS_CONN_F_INACTIVE | \

				  IP_VS_CONN_F_SEQ_MASK | \

				  IP_VS_CONN_F_NO_CPORT | \

				  IP_VS_CONN_F_TEMPLATE \

				 )



/* Flags that are not sent to backup server start from bit 16 */

#define IP_VS_CONN_F_NFCT	(1 << 16)	/* use netfilter conntrack */

include/linux/netfilter.h

+19 −8
Original line number Diff line number Diff line
@@ -24,16 +24,20 @@ 
#define NF_MAX_VERDICT NF_STOP



/* we overload the higher bits for encoding auxiliary data such as the queue

 * number. Not nice, but better than additional function arguments. */

#define NF_VERDICT_MASK 0x0000ffff

#define NF_VERDICT_BITS 16

 * number or errno values. Not nice, but better than additional function

 * arguments. */

#define NF_VERDICT_MASK 0x000000ff



/* extra verdict flags have mask 0x0000ff00 */

#define NF_VERDICT_FLAG_QUEUE_BYPASS	0x00008000



/* queue number (NF_QUEUE) or errno (NF_DROP) */

#define NF_VERDICT_QMASK 0xffff0000

#define NF_VERDICT_QBITS 16



#define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)

#define NF_QUEUE_NR(x) ((((x) << 16) & NF_VERDICT_QMASK) | NF_QUEUE)



#define NF_DROP_ERR(x) (((-x) << NF_VERDICT_BITS) | NF_DROP)

#define NF_DROP_ERR(x) (((-x) << 16) | NF_DROP)



/* only for userspace compatibility */

#ifndef __KERNEL__
@@ -41,6 +45,9 @@ 
   <= 0x2000 is used for protocol-flags. */

#define NFC_UNKNOWN 0x4000

#define NFC_ALTERED 0x8000



/* NF_VERDICT_BITS should be 8 now, but userspace might break if this changes */

#define NF_VERDICT_BITS 16

#endif



enum nf_inet_hooks {
@@ -72,6 +79,10 @@ union nf_inet_addr { 


#ifdef __KERNEL__

#ifdef CONFIG_NETFILTER

static inline int NF_DROP_GETERR(int verdict)

{

	return -(verdict >> NF_VERDICT_QBITS);

}



static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,

				   const union nf_inet_addr *a2)
@@ -267,7 +278,7 @@ struct nf_afinfo { 
	int		route_key_size;

};



extern const struct nf_afinfo *nf_afinfo[NFPROTO_NUMPROTO];

extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];

static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)

{

	return rcu_dereference(nf_afinfo[family]);
@@ -357,9 +368,9 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 
#endif /*CONFIG_NETFILTER*/



#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)

extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);

extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu;

extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);

extern void (*nf_ct_destroy)(struct nf_conntrack *);

extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;

#else

static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}

#endif

include/linux/netfilter/Kbuild

+2 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ header-y += nfnetlink_conntrack.h 
header-y += nfnetlink_log.h

header-y += nfnetlink_queue.h

header-y += x_tables.h

header-y += xt_AUDIT.h

header-y += xt_CHECKSUM.h

header-y += xt_CLASSIFY.h

header-y += xt_CONNMARK.h
@@ -55,6 +56,7 @@ header-y += xt_rateest.h 
header-y += xt_realm.h

header-y += xt_recent.h

header-y += xt_sctp.h

header-y += xt_socket.h

header-y += xt_state.h

header-y += xt_statistic.h

header-y += xt_string.h

include/linux/netfilter/nf_conntrack_snmp.h

0 → 100644
+9 −0
Original line number Diff line number Diff line 
#ifndef _NF_CONNTRACK_SNMP_H

#define _NF_CONNTRACK_SNMP_H



extern int (*nf_nat_snmp_hook)(struct sk_buff *skb,

				unsigned int protoff,

				struct nf_conn *ct,

				enum ip_conntrack_info ctinfo);



#endif /* _NF_CONNTRACK_SNMP_H */