aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/ethernet/adaptec/starfire.c (unfollow)
AgeCommit message (Collapse)AuthorFilesLines
2013-10-18net: 8390: remove unnecessary pci_set_drvdata()Jingoo Han1-3/+0
The driver core clears the driver data to NULL after device_release or on probe failure. Thus, it is not needed to manually clear the device driver data to NULL. Signed-off-by: Jingoo Han <jg1.han@samsung.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-18net: typhoon: remove unnecessary pci_set_drvdata()Jingoo Han1-1/+0
The driver core clears the driver data to NULL after device_release or on probe failure. Thus, it is not needed to manually clear the device driver data to NULL. Signed-off-by: Jingoo Han <jg1.han@samsung.com> Acked-by: David Dillow <dave@thedillows.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17ipv4: shrink rt_cache_statEric Dumazet2-16/+8
Half of the rt_cache_stat fields are no longer used after IP route cache removal, lets shrink this per cpu area. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17netdev: inet_timewait_sock.h missing semi-colon when KMEMCHECK is enabledRandy Dunlap1-1/+1
Fix (a few hundred) build errors due to missing semi-colon when KMEMCHECK is enabled: include/net/inet_timewait_sock.h:139:2: error: expected ',', ';' or '}' before 'int' include/net/inet_timewait_sock.h:148:28: error: 'const struct inet_timewait_sock' has no member named 'tw_death_node' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17xen-netback: enable IPv6 TCP GSO to the guestPaul Durrant5-16/+77
This patch adds code to handle SKB_GSO_TCPV6 skbs and construct appropriate extra or prefix segments to pass the large packet to the frontend. New xenstore flags, feature-gso-tcpv6 and feature-gso-tcpv6-prefix, are sampled to determine if the frontend is capable of handling such packets. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Cc: Wei Liu <wei.liu2@citrix.com> Cc: David Vrabel <david.vrabel@citrix.com> Cc: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17xen-netback: handle IPv6 TCP GSO packets from the guestPaul Durrant3-4/+24
This patch adds a xenstore feature flag, festure-gso-tcpv6, to advertise that netback can handle IPv6 TCP GSO packets. It creates SKB_GSO_TCPV6 skbs if the frontend passes an extra segment with the new type XEN_NETIF_GSO_TYPE_TCPV6 added to netif.h. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Cc: Wei Liu <wei.liu2@citrix.com> Cc: David Vrabel <david.vrabel@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17xen-netback: Unconditionally set NETIF_F_RXCSUMPaul Durrant1-1/+1
There is no mechanism to insist that a guest always generates a packet with good checksum (at least for IPv4) so we must handle checksum offloading from the guest and hence should set NETIF_F_RXCSUM. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Cc: Wei Liu <wei.liu2@citrix.com> Cc: David Vrabel <david.vrabel@citrix.com> Cc: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17xen-netback: add support for IPv6 checksum offload from guestPaul Durrant2-39/+205
For performance of VM to VM traffic on a single host it is better to avoid calculation of TCP/UDP checksum in the sending frontend. To allow this this patch adds the code necessary to set up partial checksum for IPv6 packets and xenstore flag feature-ipv6-csum-offload to advertise that fact to frontends. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Cc: Wei Liu <wei.liu2@citrix.com> Cc: David Vrabel <david.vrabel@citrix.com> Cc: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17xen-netback: add support for IPv6 checksum offload to guestPaul Durrant4-5/+22
Check xenstore flag feature-ipv6-csum-offload to determine if a guest is happy to accept IPv6 packets with only partial checksum. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Cc: Wei Liu <wei.liu2@citrix.com> Cc: David Vrabel <david.vrabel@citrix.com> Cc: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17bonding: add rtnl lock and remove read lock for bond sysfsdingtianhong1-13/+17
The bond_for_each_slave() will not be protected by read_lock(), only protected by rtnl_lock(), so need to replace read_lock() with rtnl_lock(). Signed-off-by: Ding Tianhong <dingtianhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17bonding: use RCU protection for alb xmit pathdingtianhong2-15/+57
The commit 278b20837511776dc9d5f6ee1c7fabd5479838bb (bonding: initial RCU conversion) has convert the roundrobin, active-backup, broadcast and xor xmit path to rcu protection, the performance will be better for these mode, so this time, convert xmit path for alb mode. Signed-off-by: Ding Tianhong <dingtianhong@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Cc: Nikolay Aleksandrov <nikolay@redhat.com> Cc: Veaceslav Falico <vfalico@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17bonding: use RCU protection for 3ad xmit pathdingtianhong1-6/+4
The commit 278b20837511776dc9d5f6ee1c7fabd5479838bb (bonding: initial RCU conversion) has convert the roundrobin, active-backup, broadcast and xor xmit path to rcu protection, the performance will be better for these mode, so this time, convert xmit path for 3ad mode. Suggested-by: Nikolay Aleksandrov <nikolay@redhat.com> Suggested-by: Veaceslav Falico <vfalico@redhat.com> Signed-off-by: Ding Tianhong <dingtianhong@huawei.com> Signed-off-by: Wang Yufen <wangyufen@huawei.com> Cc: Nikolay Aleksandrov <nikolay@redhat.com> Cc: Veaceslav Falico <vfalico@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17irda: update comment mentioning IRQF_DISABLEDMichael Opdenacker1-1/+1
This patch removes a comment mentioning IRQF_DISABLED, which is deprecated. Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17isdn: remove deprecated IRQF_DISABLEDMichael Opdenacker2-2/+2
This patch proposes to remove the use of the IRQF_DISABLED flag It's a NOOP since 2.6.35 and it will be removed one day. Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17net/mlx4_core: Load higher level modules according to ports typeEyal Perry1-0/+29
Mellanox ConnectX architecture is: mlx4_core is the lower level PCI driver which register on the PCI id, and protocol specific drivers are depended on it: mlx4_en - for Ethernet and mlx4_ib for Infiniband. NIC could have multiple ports which can change their type dynamically. We use the request_module() call to load the relevant protocol driver when needed: on loading time or at port type change event. Signed-off-by: Eyal Perry <eyalpe@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17net/mlx4: Unused local variable in mlx4_opreq_actionAmir Vadai1-2/+0
Clean up warning added by commit fe6f700d "net/mlx4_core: Respond to operation request by firmware". Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17net/mlx4: Fix typo, move similar defs to same locationOr Gerlitz4-7/+5
Small code cleanup: 1. change MLX4_DEV_CAP_FLAGS2_REASSIGN_MAC_EN to MLX4_DEV_CAP_FLAG2_REASSIGN_MAC_EN 2. put MLX4_SET_PORT_PRIO2TC and MLX4_SET_PORT_SCHEDULER in the same union with the other MLX4_SET_PORT_yyy Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17net/mlx4: Clean the code to eliminate trivial build warningsOr Gerlitz3-5/+4
Remove code that triggers trivial build warnings. drivers/net/ethernet/mellanox/mlx4/cmd.c: In function ‘mlx4_set_vf_vlan’: drivers/net/ethernet/mellanox/mlx4/cmd.c:2256: warning: variable ‘vf_oper’ set but not used drivers/net/ethernet/mellanox/mlx4/mcg.c: In function ‘mlx4_map_sw_to_hw_steering_mode’: drivers/net/ethernet/mellanox/mlx4/mcg.c:648: warning: comparison of unsigned expression < 0 is always false drivers/net/ethernet/mellanox/mlx4/mcg.c: In function ‘mlx4_map_sw_to_hw_steering_id’: drivers/net/ethernet/mellanox/mlx4/mcg.c:685: warning: comparison of unsigned expression < 0 is always false drivers/net/ethernet/mellanox/mlx4/mcg.c: In function ‘mlx4_hw_rule_sz’: drivers/net/ethernet/mellanox/mlx4/mcg.c:712: warning: comparison of unsigned expression < 0 is always false drivers/net/ethernet/mellanox/mlx4/fw.c: In function ‘mlx4_opreq_action’: drivers/net/ethernet/mellanox/mlx4/fw.c:1732: warning: variable ‘type_m’ set but not used drivers/net/ethernet/mellanox/mlx4/srq.c:302: warning: no previous prototype for ‘mlx4_srq_lookup’ Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-17inet_diag: use sock_gen_put()Eric Dumazet1-6/+3
TCP listener refactoring, part 6 : Use sock_gen_put() from inet_diag_dump_one_icsk() for future SYN_RECV support. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-14rt2x00: rt2800lib: remove duplicate rf_vals for RF3053Kevin Lo1-72/+3
lready have rf_vals_3x with same values. Hence rf_vals_3053 is removed in this patch. Signed-off-by: Kevin Lo <kevlo@kevlo.org> Acked-by: Paul Menzel <paulepanter@users.sourceforge.net> Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14rt2x00: rt2800lib: fix RF registers for RT5390/RT5392Kevin Lo1-3/+2
Update rf registers to use the same values that the MediaTek/Ralink reference driver DPO_RT5572_LinuxSTA_2.6.1.3_20121022 uses. References: RF5390RegTable in chips/rt5390.c RF5392RegTable in chips/rt5390.c Tested on TP-Link TL-WN727N and D-Link DWA-140 Rev.b3 usb wifi dongles. Signed-off-by: Kevin Lo <kevlo@kevlo.org> Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14mwifiex: use alloc_workqueue() functionAmitkumar Karwar1-1/+3
It replaces deprecated create_workqueue(). Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k_hw: remove references to hw->confFelix Fietkau5-20/+15
Accessing it to get the current operating channel is racy and in the way of further channel handling related changes Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k: make ath9k_uses_beacons staticFelix Fietkau2-2/+1
Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k: remove sc->config.cabqReadyTimeFelix Fietkau4-12/+1
It is not exposed as a configuration option anyway Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k: move channel change code to ath_set_channelFelix Fietkau1-72/+78
Preparation for adding the scanning state machine to ath9k Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k: make ath9k_cmn_update_ichannel staticFelix Fietkau5-21/+17
Rework its wrapper function to make it more generic, using it as a replacement for previous calls to ath9k_cmn_update_ichannel. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k_hw: simplify channel flagsFelix Fietkau4-130/+50
There was some duplication between channelFlags and chanmode, as well as a lot of redundant checks based on the combinations of flags. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k_hw: remove IS_CHAN_OFDM()Felix Fietkau2-7/+2
The hardware is always configured with OFDM support enabled Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k_hw: remove IS_CHAN_B()Felix Fietkau6-22/+13
Hardware 802.11b-only mode isn't supported by the driver (the device is configured for 802.11n/g instead). Simplify the code by removing checks for it. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k_hw: remove direct accesses to channel mode flagsFelix Fietkau9-169/+49
Use wrappers where available. Simplifies code and helps with further improvements to the channel data structure Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14ath9k: use a separate data structure for rx buffersFelix Fietkau3-50/+92
There's no shared code for handling both rx and tx buffers, and tx buffers require a lot more metadata than rx buffers. Using a separate data structure for rx reduces memory usage and improves cache footprint. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14wcn36xx: fix coccinelle warningsFengguang Wu1-9/+2
drivers/net/wireless/ath/wcn36xx/debug.c:27:11-31: WARNING opportunity for simple_open, see also structure on line 106 /c/kernel-tests/src/i386/drivers/net/wireless/ath/wcn36xx/debug.c:27:11-31: WARNING opportunity for simple_open, see also structure on line 148 This removes an open coded simple_open() function and replaces file operations references to the function with simple_open() instead. Generated by: coccinelle/api/simple_open.cocci CC: Eugene Krasnikov <k.eugene.e@gmail.com> CC: John W. Linville <linville@tuxdriver.com> Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14rt2x00: rt73usb: use rt2x00_has_cap_* helpersGabor Juhos1-9/+9
Use the appropriate helper functions instead of directly accessing the rt2x00dev->cap_flags field to check device capability flags. This improves readability of the code a bit. Compile tested only. Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14rt2x00: rt61pci: use rt2x00_has_cap_* helpersGabor Juhos1-10/+10
Use the appropriate helper functions instead of directly accessing the rt2x00dev->cap_flags field to check device capability flags. This improves readability of the code a bit. Compile tested only. Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14rt2x00: rt2800lib: use rt2x00_has_cap_* helpersGabor Juhos1-13/+12
Use the appropriate helper functions instead of directly accessing the rt2x00dev->cap_flags field to check device capability flags. This improves readability of the code a bit. Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14rt2x00: rt2x00lib: use rt2x00_has_cap_* helpersGabor Juhos6-13/+13
Use the appropriate helper functions instead of directly accessing the rt2x00dev->cap_flags field to check device capability flags. This improves readability of the code a bit. Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14rt2x00: add rt2x00_has_cap_* helpersGabor Juhos1-0/+87
The rt2x00 code directly accesses the 'cap_flags' field of 'struct rt2x00_dev' when checking presence of a given capability flag. The direct access needs long expressions which lowers readability of the code. Add a few helper functions which can be used to test device capabilities without directly accessing the cap_flags filed. Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14rt2x00: cleanup indentation in rt2800.hGabor Juhos1-21/+21
Adjust whitespaces to move badly aligned constants to the right column. The patch contains no functional changes. Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-10-14netfilter: nf_tables: add ARP filtering supportPablo Neira Ayuso4-0/+108
This patch registers the ARP family and he filter chain type for this family. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nf_tables: add trace supportPablo Neira Ayuso3-0/+60
This patch adds support for tracing the packet travel through the ruleset, in a similar fashion to x_tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nfnetlink: add batch support and use it from nf_tablesPablo Neira Ayuso7-23/+401
This patch adds a batch support to nfnetlink. Basically, it adds two new control messages: * NFNL_MSG_BATCH_BEGIN, that indicates the beginning of a batch, the nfgenmsg->res_id indicates the nfnetlink subsystem ID. * NFNL_MSG_BATCH_END, that results in the invocation of the ss->commit callback function. If not specified or an error ocurred in the batch, the ss->abort function is invoked instead. The end message represents the commit operation in nftables, the lack of end message results in an abort. This patch also adds the .call_batch function that is only called from the batch receival path. This patch adds atomic rule updates and dumps based on bitmask generations. This allows to atomically commit a set of rule-set updates incrementally without altering the internal state of existing nf_tables expressions/matches/targets. The idea consists of using a generation cursor of 1 bit and a bitmask of 2 bits per rule. Assuming the gencursor is 0, then the genmask (expressed as a bitmask) can be interpreted as: 00 active in the present, will be active in the next generation. 01 inactive in the present, will be active in the next generation. 10 active in the present, will be deleted in the next generation. ^ gencursor Once you invoke the transition to the next generation, the global gencursor is updated: 00 active in the present, will be active in the next generation. 01 active in the present, needs to zero its future, it becomes 00. 10 inactive in the present, delete now. ^ gencursor If a dump is in progress and nf_tables enters a new generation, the dump will stop and return -EBUSY to let userspace know that it has to retry again. In order to invalidate dumps, a global genctr counter is increased everytime nf_tables enters a new generation. This new operation can be used from the user-space utility that controls the firewall, eg. nft -f restore The rule updates contained in `file' will be applied atomically. cat file ----- add filter INPUT ip saddr 1.1.1.1 counter accept #1 del filter INPUT ip daddr 2.2.2.2 counter drop #2 -EOF- Note that the rule 1 will be inactive until the transition to the next generation, the rule 2 will be evicted in the next generation. There is a penalty during the rule update due to the branch misprediction in the packet matching framework. But that should be quickly resolved once the iteration over the commit list that contain rules that require updates is finished. Event notification happens once the rule-set update has been committed. So we skip notifications is case the rule-set update is aborted, which can happen in case that the rule-set is tested to apply correctly. This patch squashed the following patches from Pablo: * nf_tables: atomic rule updates and dumps * nf_tables: get rid of per rule list_head for commits * nf_tables: use per netns commit list * nfnetlink: add batch support and use it from nf_tables * nf_tables: all rule updates are transactional * nf_tables: attach replacement rule after stale one * nf_tables: do not allow deletion/replacement of stale rules * nf_tables: remove unused NFTA_RULE_FLAGS Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nf_tables: add insert operationEric Leblond2-6/+34
This patch adds a new rule attribute NFTA_RULE_POSITION which is used to store the position of a rule relatively to the others. By providing the create command and specifying the position, the rule is inserted after the rule with the handle equal to the provided position. Regarding notification, the position attribute specifies the handle of the previous rule to make sure we don't point to any stale rule in notifications coming from the commit path. This patch includes the following fix from Pablo: * nf_tables: fix rule deletion event reporting Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nf_tables: complete net namespace supportPablo Neira Ayuso7-35/+168
Register family per netnamespace to ensure that sets are only visible in its approapriate namespace. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nf_tables: Add support for IPv6 NATTomasz Bursztyka9-162/+457
This patch generalizes the NAT expression to support both IPv4 and IPv6 using the existing IPv4/IPv6 NAT infrastructure. This also adds the NAT chain type for IPv6. This patch collapses the following patches that were posted to the netfilter-devel mailing list, from Tomasz: * nf_tables: Change NFTA_NAT_ attributes to better semantic significance * nf_tables: Split IPv4 NAT into NAT expression and IPv4 NAT chain * nf_tables: Add support for IPv6 NAT expression * nf_tables: Add support for IPv6 NAT chain * nf_tables: Fix up build issue on IPv6 NAT support And, from Pablo Neira Ayuso: * fix missing dependencies in nft_chain_nat Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nf_tables: add support for dormant tablesPablo Neira Ayuso2-7/+101
This patch allows you to temporarily disable an entire table. You can change the state of a dormant table via NFT_MSG_NEWTABLE messages. Using this operation you can wake up a table, so their chains are registered. This provides atomicity at chain level. Thus, the rule-set of one chain is applied at once, avoiding any possible intermediate state in every chain. Still, the chains that belongs to a table are registered consecutively. This also allows you to have inactive tables in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nf_tables: nft_payload: fix transport header basePablo Neira Ayuso2-2/+2
We cannot use skb->transport_header since it's unset, use pkt->xt.thoff instead. Now possible using information made available through the x_tables compatibility layer. Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nf_tables: add compatibility layer for x_tablesPablo Neira Ayuso20-78/+1241
This patch adds the x_tables compatibility layer. This allows you to use existing x_tables matches and targets from nf_tables. This compatibility later allows us to use existing matches/targets for features that are still missing in nf_tables. We can progressively replace them with native nf_tables extensions. It also provides the userspace compatibility software that allows you to express the rule-set using the iptables syntax but using the nf_tables kernel components. In order to get this compatibility layer working, I've done the following things: * add NFNL_SUBSYS_NFT_COMPAT: this new nfnetlink subsystem is used to query the x_tables match/target revision, so we don't need to use the native x_table getsockopt interface. * emulate xt structures: this required extending the struct nft_pktinfo to include the fragment offset, which is already obtained from ip[6]_tables and that is used by some matches/targets. * add support for default policy to base chains, required to emulate x_tables. * add NFTA_CHAIN_USE attribute to obtain the number of references to chains, required by x_tables emulation. * add chain packet/byte counters using per-cpu. * support 32-64 bits compat. For historical reasons, this patch includes the following patches that were posted in the netfilter-devel mailing list. From Pablo Neira Ayuso: * nf_tables: add default policy to base chains * netfilter: nf_tables: add NFTA_CHAIN_USE attribute * nf_tables: nft_compat: private data of target and matches in contiguous area * nf_tables: validate hooks for compat match/target * nf_tables: nft_compat: release cached matches/targets * nf_tables: x_tables support as a compile time option * nf_tables: fix alias for xtables over nftables module * nf_tables: add packet and byte counters per chain * nf_tables: fix per-chain counter stats if no counters are passed * nf_tables: don't bump chain stats * nf_tables: add protocol and flags for xtables over nf_tables * nf_tables: add ip[6]t_entry emulation * nf_tables: move specific layer 3 compat code to nf_tables_ipv[4|6] * nf_tables: support 32bits-64bits x_tables compat * nf_tables: fix compilation if CONFIG_COMPAT is disabled From Patrick McHardy: * nf_tables: move policy to struct nft_base_chain * nf_tables: send notifications for base chain policy changes From Alexander Primak: * nf_tables: remove the duplicate NF_INET_LOCAL_OUT From Nicolas Dichtel: * nf_tables: fix compilation when nf-netlink is a module Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nf_tables: convert built-in tables/chains to chain typesPablo Neira Ayuso12-274/+221
This patch converts built-in tables/chains to chain types that allows you to deploy customized table and chain configurations from userspace. After this patch, you have to specify the chain type when creating a new chain: add chain ip filter output { type filter hook input priority 0; } ^^^^ ------ The existing chain types after this patch are: filter, route and nat. Note that tables are just containers of chains with no specific semantics, which is a significant change with regards to iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14netfilter: nft_payload: add optimized payload implementation for small loadsPatrick McHardy3-28/+81
Add an optimized payload expression implementation for small (up to 4 bytes) aligned data loads from the linear packet area. This patch also includes original Patrick McHardy's entitled (nf_tables: inline nft_payload_fast_eval() into main evaluation loop). Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>