linux/net/netfilter/ipvs
David S. Miller c42d7121fb Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
Pablo Neira Ayuso says:

====================
Netfilter/IPVS updates for net-next

The following patchset contains Netfilter/IPVS updates for net-next,
they are:

1) Count pre-established connections as active in "least connection"
   schedulers such that pre-established connections to avoid overloading
   backend servers on peak demands, from Michal Kubecek via Simon Horman.

2) Address a race condition when resizing the conntrack table by caching
   the bucket size when fulling iterating over the hashtable in these
   three possible scenarios: 1) dump via /proc/net/nf_conntrack,
   2) unlinking userspace helper and 3) unlinking custom conntrack timeout.
   From Liping Zhang.

3) Revisit early_drop() path to perform lockless traversal on conntrack
   eviction under stress, use del_timer() as synchronization point to
   avoid two CPUs evicting the same entry, from Florian Westphal.

4) Move NAT hlist_head to nf_conn object, this simplifies the existing
   NAT extension and it doesn't increase size since recent patches to
   align nf_conn, from Florian.

5) Use rhashtable for the by-source NAT hashtable, also from Florian.

6) Don't allow --physdev-is-out from OUTPUT chain, just like
   --physdev-out is not either, from Hangbin Liu.

7) Automagically set on nf_conntrack counters if the user tries to
   match ct bytes/packets from nftables, from Liping Zhang.

8) Remove possible_net_t fields in nf_tables set objects since we just
   simply pass the net pointer to the backend set type implementations.

9) Fix possible off-by-one in h323, from Toby DiPasquale.

10) early_drop() may be called from ctnetlink patch, so we must hold
    rcu read size lock from them too, this amends Florian's patch #3
    coming in this batch, from Liping Zhang.

11) Use binary search to validate jump offset in x_tables, this
    addresses the O(n!) validation that was introduced recently
    resolve security issues with unpriviledge namespaces, from Florian.

12) Fix reference leak to connlabel in error path of nft_ct, from Zhang.

13) Three updates for nft_log: Fix log prefix leak in error path. Bail
    out on loglevel larger than debug in nft_log and set on the new
    NF_LOG_F_COPY_LEN flag when snaplen is specified. Again from Zhang.

14) Allow to filter rule dumps in nf_tables based on table and chain
    names.

15) Simplify connlabel to always use 128 bits to store labels and
    get rid of unused function in xt_connlabel, from Florian.

16) Replace set_expect_timeout() by mod_timer() from the h323 conntrack
    helper, by Gao Feng.

17) Put back x_tables module reference in nft_compat on error, from
    Liping Zhang.

18) Add a reference count to the x_tables extensions cache in
    nft_compat, so we can remove them when unused and avoid a crash
    if the extensions are rmmod, again from Zhang.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2016-07-24 22:02:36 -07:00
..
Kconfig ipvs: Add ovf scheduler 2015-08-21 09:08:39 -07:00
Makefile ipvs: Add ovf scheduler 2015-08-21 09:08:39 -07:00
ip_vs_app.c netfilter: ipvs: avoid unused variable warnings 2016-02-18 09:17:58 +09:00
ip_vs_conn.c ipvs: update real-server binding of outgoing connections in SIP-pe 2016-06-06 09:47:25 +09:00
ip_vs_core.c ipvs: update real-server binding of outgoing connections in SIP-pe 2016-06-06 09:47:25 +09:00
ip_vs_ctl.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2016-05-09 15:02:58 -04:00
ip_vs_dh.c ipvs: use correct address family in scheduler logs 2014-09-18 08:59:23 +09:00
ip_vs_est.c ipvs: Pass ipvs not net to ip_vs_estimator_net_init and ip_vs_estimator_cleanup 2015-09-24 09:34:39 +09:00
ip_vs_fo.c ipvs: use correct address family in scheduler logs 2014-09-18 08:59:23 +09:00
ip_vs_ftp.c ipvs: Remove net argument from ip_vs_tcp_conn_listen 2015-09-24 09:34:43 +09:00
ip_vs_lblc.c ipvs: Store ipvs not net in struct ip_vs_service 2015-09-24 09:34:33 +09:00
ip_vs_lblcr.c ipvs: Store ipvs not net in struct ip_vs_service 2015-09-24 09:34:33 +09:00
ip_vs_lc.c ipvs: use correct address family in scheduler logs 2014-09-18 08:59:23 +09:00
ip_vs_nfct.c ipvs: don't alter conntrack in OPS mode 2016-04-20 12:34:17 +10:00
ip_vs_nq.c ipvs: use correct address family in scheduler logs 2014-09-18 08:59:23 +09:00
ip_vs_ovf.c ipvs: Add ovf scheduler 2015-08-21 09:08:39 -07:00
ip_vs_pe.c netfilter: Deletion of unnecessary checks before two function calls 2014-11-20 13:08:43 +01:00
ip_vs_pe_sip.c ipvs: handle connections started by real-servers 2016-04-20 12:34:17 +10:00
ip_vs_proto.c ipvs: Pass ipvs not net to ip_vs_protocol_net_(init|cleanup) 2015-09-24 09:34:43 +09:00
ip_vs_proto_ah_esp.c ipvs: Pass ipvs into .conn_schedule and ip_vs_try_to_schedule 2015-09-24 09:34:41 +09:00
ip_vs_proto_sctp.c sctp: Rename NETIF_F_SCTP_CSUM to NETIF_F_SCTP_CRC 2015-12-15 16:49:58 -05:00
ip_vs_proto_tcp.c ipvs: count pre-established TCP states as active 2016-07-07 20:30:52 +02:00
ip_vs_proto_udp.c ipvs: Pass ipvs into .conn_schedule and ip_vs_try_to_schedule 2015-09-24 09:34:41 +09:00
ip_vs_rr.c ipvs: use correct address family in scheduler logs 2014-09-18 08:59:23 +09:00
ip_vs_sched.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2015-08-04 23:57:45 -07:00
ip_vs_sed.c ipvs: use correct address family in scheduler logs 2014-09-18 08:59:23 +09:00
ip_vs_sh.c ipvs: sh: support scheduling icmp/inverse packets consistently 2015-09-01 10:33:52 +09:00
ip_vs_sync.c ipvs: fix bind to link-local mcast IPv6 address in backup 2016-07-07 20:21:32 +02:00
ip_vs_wlc.c ipvs: use correct address family in scheduler logs 2014-09-18 08:59:23 +09:00
ip_vs_wrr.c ipvs: use correct address family in scheduler logs 2014-09-18 08:59:23 +09:00
ip_vs_xmit.c net: define gso types for IPx over IPv4 and IPv6 2016-05-20 18:03:15 -04:00