Skip to content
  1. Jul 02, 2013
  2. Jul 01, 2013
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · 4e144d3a
      David S. Miller authored
      
      
      Pablo Neira Ayuso says:
      
      ====================
      The following batch contains Netfilter/IPVS updates for net-next,
      they are:
      
      * Enforce policy to several nfnetlink subsystem, from Daniel
        Borkmann.
      
      * Use xt_socket to match the third packet (to perform simplistic
        socket-based stateful filtering), from Eric Dumazet.
      
      * Avoid large timeout for picked up from the middle TCP flows,
        from Florian Westphal.
      
      * Exclude IPVS from struct net if IPVS is disabled and removal
        of unnecessary included header file, from JunweiZhang.
      
      * Release SCTP connection immediately under load, to mimic current
        TCP behaviour, from Julian Anastasov.
      
      * Replace and enhance SCTP state machine, from Julian Anastasov.
      
      * Add tweak to reduce sync traffic in the presence of persistence,
        also from Julian Anastasov.
      
      * Add tweak for the IPVS SH scheduler not to reject connections
        directed to a server, choose a new one instead, from Alexander
        Frolkin.
      
      * Add support for sloppy TCP and SCTP modes, that creates state
        information on any packet, not only initial handshake packets,
        from Alexander Frolkin.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4e144d3a
    • Florian Westphal's avatar
      netfilter: nf_queue: add NFQA_SKB_CSUM_NOTVERIFIED info flag · 496e4ae7
      Florian Westphal authored
      
      
      The common case is that TCP/IP checksums have already been
      verified, e.g. by hardware (rx checksum offload), or conntrack.
      
      Userspace can use this flag to determine when the checksum
      has not been validated yet.
      
      If the flag is set, this doesn't necessarily mean that the packet has
      an invalid checksum, e.g. if NIC doesn't support rx checksum.
      
      Userspace that sucessfully enabled NFQA_CFG_F_GSO queue feature flag can
      infer that IP/TCP checksum has already been validated if either the
      SKB_INFO attribute is not present or the NFQA_SKB_CSUM_NOTVERIFIED
      flag is unset.
      
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      496e4ae7
  3. Jun 30, 2013
  4. Jun 29, 2013