5d0aa2ccd4699a01cfdf14886191c249d7b45a01 - arm/linux

commit	5d0aa2ccd4699a01cfdf14886191c249d7b45a01	[log] [tgz]
author	Patrick McHardy <kaber@trash.net>	Mon Feb 15 18:13:33 2010 +0100
committer	Patrick McHardy <kaber@trash.net>	Mon Feb 15 18:13:33 2010 +0100
tree	6ea81b5eede26bd6a04bcc3cd79770c334139381
parent	8fea97ec1772bbf553d89187340ef624d548e115 [diff]

netfilter: nf_conntrack: add support for "conntrack zones"

Normally, each connection needs a unique identity. Conntrack zones allow
to specify a numerical zone using the CT target, connections in different
zones can use the same identity.

Example:

iptables -t raw -A PREROUTING -i veth0 -j CT --zone 1
iptables -t raw -A OUTPUT -o veth1 -j CT --zone 1

Signed-off-by: Patrick McHardy <kaber@trash.net>

include/linux/netfilter/xt_CT.h[diff]
include/net/ip.h[diff]
include/net/ipv6.h[diff]
include/net/netfilter/nf_conntrack.h[diff]
include/net/netfilter/nf_conntrack_core.h[diff]
include/net/netfilter/nf_conntrack_expect.h[diff]
include/net/netfilter/nf_conntrack_extend.h[diff]
include/net/netfilter/nf_conntrack_zones.h[Added - diff]
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c[diff]
net/ipv4/netfilter/nf_conntrack_proto_icmp.c[diff]
net/ipv4/netfilter/nf_defrag_ipv4.c[diff]
net/ipv4/netfilter/nf_nat_core.c[diff]
net/ipv4/netfilter/nf_nat_pptp.c[diff]
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c[diff]
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c[diff]
net/netfilter/Kconfig[diff]
net/netfilter/nf_conntrack_core.c[diff]
net/netfilter/nf_conntrack_expect.c[diff]
net/netfilter/nf_conntrack_h323_main.c[diff]
net/netfilter/nf_conntrack_netlink.c[diff]
net/netfilter/nf_conntrack_pptp.c[diff]
net/netfilter/nf_conntrack_sip.c[diff]
net/netfilter/nf_conntrack_standalone.c[diff]
net/netfilter/xt_CT.c[diff]
net/netfilter/xt_connlimit.c[diff]

25 files changed

tree: 6ea81b5eede26bd6a04bcc3cd79770c334139381