: Netfilter update
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest38 patches 5 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/38 | : Hide a few more options under NETFILTER_ADVANCEDnet/ | +2 | 0 replies | |
| 2/38 | : Remove some EXPERIMENTAL dependenciesnet/ net/ net/ | +20 | 0 replies | |
| 3/38 | : remove ipt_TOS.cnet/ | +0 | 0 replies | |
| 4/38 | : xt_TOS: Change semantic of mask valuenet/ | +1 | 0 replies | |
| 5/38 | : xt_TOS: Properly set the TOS fieldnet/ | +2 | 0 replies | |
| 6/38 | : Annotate start of kernel fields in NF headersinclude/ include/ include/ +5 more | +12 | 0 replies | |
| 7/38 | : xt_CONNMARK target, revision 1include/ net/ | +102 | 0 replies | |
| 8/38 | : xt_MARK target, revision 2include/ net/ | +56 | 0 replies | |
| 9/38 | : xt_connmark match, revision 1include/ net/ | +76 | 0 replies | |
| 10/38 | : Extend nf_inet_addr with in{,6}_addrinclude/ | +4 | 0 replies | |
| 11/38 | : xt_conntrack match, revision 1include/ net/ | +197 | 0 replies | |
| 12/38 | : xt_mark match, revision 1include/ net/ | +57 | 0 replies | |
| 13/38 | : xt_pkttype: Add explicit check for IPv4net/ | +2 | 0 replies | |
| 14/38 | : xt_pkttype: IPv6 multicast address recognitionnet/ | +11 | 0 replies | |
| 15/38 | : xt_policy: use the new union nf_inet_addrinclude/ net/ | +27 | 0 replies | |
| 16/38 | : Update modules' descriptionsnet/ net/ net/ +64 more | +67 | 0 replies | |
| 17/38 | : Rename ipt_iprange to xt_iprangeinclude/ include/ include/ +5 more | +44 | 0 replies | |
| 18/38 | : xt_iprange match, revision 1net/ | +113 | 0 replies | |
| 19/38 | : Update feature-removal-schedule.txtDocumentation/ | +32 | 4 replies | |
| 20/38 | : {ip,ip6}_tables: remove some inlinesnet/ net/ | +50 | 0 replies | |
| 21/38 | : ipt_REJECT: properly handle IP optionsnet/ | +37 | 0 replies | |
| 22/38 | : nf_conntrack_{tcp,sctp}: mark state table constnet/ net/ | +2 | 0 replies | |
| 23/38 | : nf_conntrack_{tcp,sctp}: shrink state tablenet/ net/ | +2 | 0 replies | |
| 24/38 | : nf_conntrack_tcp: remove timeout indirectionnet/ | +28 | 0 replies | |
| 25/38 | : nf_conntrack_sctp: basic cleanupsnet/ | +72 | 0 replies | |
| 26/38 | : nf_conntrack_sctp: use proper types for bitopsnet/ | +12 | 0 replies | |
| 27/38 | : nf_conntrack_sctp: reduce line lengthnet/ | +21 | 0 replies | |
| 28/38 | : nf_conntrack_sctp: reduce line length furthernet/ | +12 | 0 replies | |
| 29/38 | : nf_conntrack_sctp: consolidate sctp_packet() error pathsnet/ | +20 | 0 replies | |
| 30/38 | : nf_conntrack_sctp: rename "newconntrack" variablenet/ | +21 | 0 replies | |
| 31/38 | : nf_conntrack_sctp: don't take sctp_lock once per chunknet/ | +2 | 0 replies | |
| 32/38 | : nf_conntrack_sctp: remove unused ttag field from conntrack datainclude/ | +0 | 0 replies | |
| 33/38 | : nf_conntrack_sctp: replace magic value by symbolic constantnet/ | +1 | 0 replies | |
| 34/38 | : nf_conntrack_sctp: remove timeout indirectionnet/ | +24 | 0 replies | |
| 35/38 | : kill nf_sysctl.cnet/ net/ net/ +1 more | +19 | 0 replies | |
| 36/38 | : nf_conntrack: clean up a few header filesinclude/ include/ include/ +1 more | +6 | 0 replies | |
| 37/38 | : nf_conntrack: remove print_conntrack function from l3protosinclude/ net/ net/ +3 more | +0 | 0 replies | |
| 38/38 | : nf_conntrack: make print_conntrack function optional for l4protosnet/ net/ net/ +4 more | +2 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [NETFILTER 00/38]: Netfilter update
Hi Dave,
following is another netfilter update. The diffstat contains mostly noise from a MODULE_DESCRIPTION update, the main changes are:
- removal of EXPERIMENTAL dependencies for all but a few selected modules
- Updates from Jan for multiple matches and targets to use fixed types, scheduling of the old version for removal in 2009
- IPv6 support for a few more matches and targets
- SCTP conntrack cleanup
- REJECT target conversion to construct TCP RSTs from scratch to properly deal with IP options
- Minor cleanups and optimizations
Please apply, thanks.
Documentation/feature-removal-schedule.txt | 32 ++ include/linux/netfilter.h | 4 + include/linux/netfilter/Kbuild | 1 + include/linux/netfilter/nf_conntrack_sctp.h | 1 - include/linux/netfilter/xt_CONNMARK.h | 5 + include/linux/netfilter/xt_MARK.h | 4 + include/linux/netfilter/xt_RATEEST.h | 2 + include/linux/netfilter/xt_connlimit.h | 2 +- include/linux/netfilter/xt_connmark.h | 5 + include/linux/netfilter/xt_conntrack.h | 16 +- include/linux/netfilter/xt_hashlimit.h | 2 +- include/linux/netfilter/xt_iprange.h | 17 + include/linux/netfilter/xt_mark.h | 5 + include/linux/netfilter/xt_policy.h | 23 ++- include/linux/netfilter/xt_quota.h | 2 + include/linux/netfilter/xt_rateest.h | 2 + include/linux/netfilter/xt_statistic.h | 1 + include/linux/netfilter/xt_string.h | 2 + include/linux/netfilter_ipv4/ipt_CLUSTERIP.h | 1 + include/linux/netfilter_ipv4/ipt_iprange.h | 6 +- include/net/netfilter/nf_conntrack.h | 7 - include/net/netfilter/nf_conntrack_core.h | 12 - include/net/netfilter/nf_conntrack_helper.h | 4 + include/net/netfilter/nf_conntrack_l3proto.h | 3 - net/ipv4/netfilter.c | 10 + net/ipv4/netfilter/Kconfig | 14 +- net/ipv4/netfilter/Makefile | 1 - net/ipv4/netfilter/ip_tables.c | 47 ++-- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/ipt_ECN.c | 2 +- net/ipv4/netfilter/ipt_LOG.c | 2 +- net/ipv4/netfilter/ipt_MASQUERADE.c | 2 +- net/ipv4/netfilter/ipt_NETMAP.c | 2 +- net/ipv4/netfilter/ipt_REDIRECT.c | 2 +- net/ipv4/netfilter/ipt_REJECT.c | 104 +++---- net/ipv4/netfilter/ipt_TOS.c | 82 ----- net/ipv4/netfilter/ipt_TTL.c | 2 +- net/ipv4/netfilter/ipt_ULOG.c | 2 +- net/ipv4/netfilter/ipt_addrtype.c | 2 +- net/ipv4/netfilter/ipt_ah.c | 2 +- net/ipv4/netfilter/ipt_ecn.c | 2 +- net/ipv4/netfilter/ipt_iprange.c | 77 ----- net/ipv4/netfilter/ipt_recent.c | 2 +- net/ipv4/netfilter/ipt_ttl.c | 2 +- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 7 - .../netfilter/nf_conntrack_l3proto_ipv4_compat.c | 5 +- net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 8 - net/ipv6/netfilter/Kconfig | 12 +- net/ipv6/netfilter/ip6_tables.c | 42 ++-- net/ipv6/netfilter/ip6t_HL.c | 2 +- net/ipv6/netfilter/ip6t_LOG.c | 2 +- net/ipv6/netfilter/ip6t_REJECT.c | 2 +- net/ipv6/netfilter/ip6t_ah.c | 2 +- net/ipv6/netfilter/ip6t_eui64.c | 2 +- net/ipv6/netfilter/ip6t_frag.c | 2 +- net/ipv6/netfilter/ip6t_hbh.c | 2 +- net/ipv6/netfilter/ip6t_hl.c | 2 +- net/ipv6/netfilter/ip6t_ipv6header.c | 2 +- net/ipv6/netfilter/ip6t_mh.c | 2 +- net/ipv6/netfilter/ip6t_rt.c | 2 +- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 7 - net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 8 - net/netfilter/Kconfig | 37 ++- net/netfilter/Makefile | 2 +- net/netfilter/core.c | 9 + net/netfilter/nf_conntrack_core.c | 5 +- net/netfilter/nf_conntrack_l3proto_generic.c | 7 - net/netfilter/nf_conntrack_proto_generic.c | 8 - net/netfilter/nf_conntrack_proto_sctp.c | 310 ++++++++++---------- net/netfilter/nf_conntrack_proto_tcp.c | 69 ++--- net/netfilter/nf_conntrack_proto_udp.c | 9 - net/netfilter/nf_conntrack_proto_udplite.c | 9 - net/netfilter/nf_conntrack_standalone.c | 5 +- net/netfilter/nf_sysctl.c | 25 -- net/netfilter/xt_CLASSIFY.c | 2 +- net/netfilter/xt_CONNMARK.c | 119 ++++++-- net/netfilter/xt_CONNSECMARK.c | 2 +- net/netfilter/xt_DSCP.c | 8 +- net/netfilter/xt_MARK.c | 76 ++++-- net/netfilter/xt_NFLOG.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_NOTRACK.c | 1 + net/netfilter/xt_RATEEST.c | 2 +- net/netfilter/xt_SECMARK.c | 2 +- net/netfilter/xt_TCPMSS.c | 2 +- net/netfilter/xt_TCPOPTSTRIP.c | 2 +- net/netfilter/xt_TRACE.c | 1 + net/netfilter/xt_comment.c | 2 +- net/netfilter/xt_connbytes.c | 2 +- net/netfilter/xt_connlimit.c | 2 +- net/netfilter/xt_connmark.c | 90 +++++-- net/netfilter/xt_conntrack.c | 209 ++++++++++++-- net/netfilter/xt_dccp.c | 2 +- net/netfilter/xt_dscp.c | 2 +- net/netfilter/xt_esp.c | 2 +- net/netfilter/xt_hashlimit.c | 2 +- net/netfilter/xt_helper.c | 2 +- net/netfilter/xt_iprange.c | 180 ++++++++++++ net/netfilter/xt_length.c | 2 +- net/netfilter/xt_limit.c | 2 +- net/netfilter/xt_mac.c | 2 +- net/netfilter/xt_mark.c | 74 ++++-- net/netfilter/xt_multiport.c | 2 +- net/netfilter/xt_owner.c | 2 +- net/netfilter/xt_physdev.c | 2 +- net/netfilter/xt_pkttype.c | 19 +- net/netfilter/xt_policy.c | 17 +- net/netfilter/xt_quota.c | 1 + net/netfilter/xt_realm.c | 2 +- net/netfilter/xt_sctp.c | 2 +- net/netfilter/xt_statistic.c | 2 +- net/netfilter/xt_string.c | 2 +- net/netfilter/xt_tcpmss.c | 2 +- net/netfilter/xt_tcpudp.c | 2 +- net/netfilter/xt_time.c | 2 +- net/netfilter/xt_u32.c | 2 +- 116 files changed, 1168 insertions(+), 813 deletions(-) create mode 100644 include/linux/netfilter/xt_iprange.h delete mode 100644 net/ipv4/netfilter/ipt_TOS.c delete mode 100644 net/ipv4/netfilter/ipt_iprange.c delete mode 100644 net/netfilter/nf_sysctl.c create mode 100644 net/netfilter/xt_iprange.c
Denys Vlasenko (1):
[NETFILTER]: {ip,ip6}_tables: remove some inlines
Jan Engelhardt (17):
[NETFILTER]: remove ipt_TOS.c
[NETFILTER]: xt_TOS: Change semantic of mask value [NETFILTER]: xt_TOS: Properly set the TOS field [NETFILTER]: Annotate start of kernel fields in NF headers [NETFILTER]: xt_CONNMARK target, revision 1 [NETFILTER]: xt_MARK target, revision 2 [NETFILTER]: xt_connmark match, revision 1 [NETFILTER]: Extend nf_inet_addr with in{,6}_addr [NETFILTER]: xt_conntrack match, revision 1 [NETFILTER]: xt_mark match, revision 1 [NETFILTER]: xt_pkttype: Add explicit check for IPv4 [NETFILTER]: xt_pkttype: IPv6 multicast address recognition [NETFILTER]: xt_policy: use the new union nf_inet_addr [NETFILTER]: Update modules' descriptions [NETFILTER]: Rename ipt_iprange to xt_iprange [NETFILTER]: xt_iprange match, revision 1 [NETFILTER]: Update feature-removal-schedule.txt
Patrick McHardy (20):
[NETFILTER]: Hide a few more options under NETFILTER_ADVANCED [NETFILTER]: Remove some EXPERIMENTAL dependencies
[NETFILTER]: ipt_REJECT: properly handle IP options
[NETFILTER]: nf_conntrack_{tcp,sctp}: mark state table const [NETFILTER]: nf_conntrack_{tcp,sctp}: shrink state table [NETFILTER]: nf_conntrack_tcp: remove timeout indirection [NETFILTER]: nf_conntrack_sctp: basic cleanups
[NETFILTER]: nf_conntrack_sctp: use proper types for bitops [NETFILTER]: nf_conntrack_sctp: reduce line length
[NETFILTER]: nf_conntrack_sctp: reduce line length further [NETFILTER]: nf_conntrack_sctp: consolidate sctp_packet() error paths [NETFILTER]: nf_conntrack_sctp: rename "newconntrack" variable [NETFILTER]: nf_conntrack_sctp: don't take sctp_lock once per chunk [NETFILTER]: nf_conntrack_sctp: remove unused ttag field from conntrack data [NETFILTER]: nf_conntrack_sctp: replace magic value by symbolic constant [NETFILTER]: nf_conntrack_sctp: remove timeout indirection [NETFILTER]: kill nf_sysctl.c
[NETFILTER]: nf_conntrack: clean up a few header files [NETFILTER]: nf_conntrack: remove print_conntrack function from l3protos [NETFILTER]: nf_conntrack: make print_conntrack function optional for l4protos