summaryrefslogtreecommitdiffstats
path: root/net/ipv4/netfilter/iptable_security.c
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: xtables: generate initial table on-demandJan Engelhardt2010-02-101-32/+7
| | | | | | | | | | | The static initial tables are pretty large, and after the net namespace has been instantiated, they just hang around for nothing. This commit removes them and creates tables on-demand at runtime when needed. Size shrinks by 7735 bytes (x86_64). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: use xt_table for hook instantiationJan Engelhardt2010-02-101-26/+7
| | | | | | | | | | | | The respective xt_table structures already have most of the metadata needed for hook setup. Add a 'priority' field to struct xt_table so that xt_hook_link() can be called with a reduced number of arguments. So should we be having more tables in the future, it comes at no static cost (only runtime, as before) - space saved: 6807373->6806555. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: compact table hook functions (2/2)Jan Engelhardt2010-02-101-13/+10
| | | | | | | | | The calls to ip6t_do_table only show minimal differences, so it seems like a good cleanup to merge them to a single one too. Space saving obtained by both patches: 6807725->6807373 ("Total" column from `size -A`.) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: compact table hook functions (1/2)Jan Engelhardt2010-02-101-33/+17
| | | | | | | | This patch combines all the per-hook functions in a given table into a single function. Together with the 2nd patch, further simplifications are possible up to the point of output code reduction. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: add struct xt_mtdtor_param::netAlexey Dobriyan2010-01-181-1/+1
| | | | | | | | | | Add ->net to match destructor list like ->net in constructor list. Make sure it's set in ebtables/iptables/ip6tables, this requires to propagate netns up to *_unregister_table(). Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: net/ipv[46]/netfilter: Move && and || to end of previous lineJoe Perches2009-11-231-2/+2
| | | | | | | Compile tested only. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: mark initial tables constantJan Engelhardt2009-08-241-2/+2
| | | | | | | The inputted table is never modified, so should be considered const. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xtables: switch table AFs to nfprotoJan Engelhardt2009-08-101-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: switch hook PFs to nfprotoJan Engelhardt2009-08-101-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: x_tables: remove unneeded initializationsStephen Hemminger2009-02-181-1/+0
| | | | | | | | | Later patches change the locking on xt_table and the initialization of the lock element is not needed since the lock is always initialized in xt_table_register anyway. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter 01/09: remove "happy cracking" messagePatrick McHardy2009-01-121-5/+1
| | | | | | | | Don't spam logs for locally generated short packets. these can only be generated by root. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* netfilter: netns: remove nf_*_net() wrappersAlexey Dobriyan2008-10-081-3/+3
| | | | | | | | | Now that dev_net() exists, the usefullness of them is even less. Also they're a big problem in resolving circular header dependencies necessary for NOTRACK-in-netns patch. See below. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ip{,6}tables_security: fix future section mismatchAlexey Dobriyan2008-07-261-1/+1
| | | | | | | | | Currently not visible, because NET_NS is mutually exclusive with SYSFS which is required by SECURITY. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* netfilter: ip_tables: add iptables security table for mandatory access ↵James Morris2008-06-091-0/+180
control rules The following patch implements a new "security" table for iptables, so that MAC (SELinux etc.) networking rules can be managed separately to standard DAC rules. This is to help with distro integration of the new secmark-based network controls, per various previous discussions. The need for a separate table arises from the fact that existing tools and usage of iptables will likely clash with centralized MAC policy management. The SECMARK and CONNSECMARK targets will still be valid in the mangle table to prevent breakage of existing users. Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
OpenPOWER on IntegriCloud