kernel.git/include/net/netns/ipv4.h, branch linux-2.6.29.y

net: implement emergency route cache rebulds when gc_elasticity is exceeded

2008-10-28T00:06:14Z

This is a patch to provide on demand route cache rebuilding. Currently, our route cache is rebulid periodically regardless of need. This introduced unneeded periodic latency. This patch offers a better approach. Using code provided by Eric Dumazet, we compute the standard deviation of the average hash bucket chain length while running rt_check_expire. Should any given chain length grow to larger that average plus 4 standard deviations, we trigger an emergency hash table rebuild for that net namespace. This allows for the common case in which chains are well behaved and do not grow unevenly to not incur any latency at all, while those systems (which may be being maliciously attacked), only rebuild when the attack is detected. This patch take 2 other factors into account: 1) chains with multiple entries that differ by attributes that do not affect the hash value are only counted once, so as not to unduly bias system to rebuilding if features like QOS are heavily used 2) if rebuilding crosses a certain threshold (which is adjustable via the added sysctl in this patch), route caching is disabled entirely for that net namespace, since constant rebuilding is less efficient that no caching at all Tested successfully by me. Signed-off-by: Neil Horman Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller

netfilter: netns nat: per-netns bysource hash

2008-10-08T09:35:11Z

Signed-off-by: Alexey Dobriyan Signed-off-by: Patrick McHardy

netfilter: netns nat: per-netns NAT table

2008-10-08T09:35:10Z

Same story as with iptable_filter, iptables_raw tables. Signed-off-by: Alexey Dobriyan Signed-off-by: Patrick McHardy

netns: place rt_genid into struct net

2008-07-06T02:04:32Z

Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller

netns: make rt_secret_rebuild timer per namespace

2008-07-06T02:02:59Z

Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller

netns: register net.ipv4.route.flush in each namespace

2008-07-06T02:02:33Z

Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller

netfilter: ip_tables: add iptables security table for mandatory access control rules

2008-06-09T22:57:24Z

The following patch implements a new "security" table for iptables, so that MAC (SELinux etc.) networking rules can be managed separately to standard DAC rules. This is to help with distro integration of the new secmark-based network controls, per various previous discussions. The need for a separate table arises from the fact that existing tools and usage of iptables will likely clash with centralized MAC policy management. The SECMARK and CONNSECMARK targets will still be valid in the mangle table to prevent breakage of existing users. Signed-off-by: James Morris Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETNS]: Create tcp control socket in the each namespace.

2008-04-03T21:31:33Z

Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller

[NETNS][ICMP]: Make ctl tables for ICMP sysctls per-net.

2008-03-26T08:56:24Z

Add some flesh to ipv4_sysctl_init_net and ipv4_sysctl_exit_net, i.e. copy the table, alter .data pointers and register it per-net. Other ipv4_table's sysctls are now global, but this is going to change once sysctl permissions patches migrate from -mm tree to mainline in 2.6.26 merge window :) Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller

[NETNS][ICMP]: Move ICMP sysctls on struct net.

2008-03-26T08:55:37Z

Initialization is moved to icmp_sk_init, all the places, that refer to them use init_net for now. Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller