aboutsummaryrefslogtreecommitdiff
path: root/include/net/netns
AgeCommit message (Collapse)AuthorFilesLines
2008-11-25netns xfrm: per-netns sysctlsAlexey Dobriyan1-0/+10
Make net.core.xfrm_aevent_etime net.core.xfrm_acq_expires net.core.xfrm_aevent_rseqth net.core.xfrm_larval_drop sysctls per-netns. For that make net_core_path[] global, register it to prevent two /proc/net/core antries and change initcall position -- xfrm_init() is called from fs_initcall, so this one should be fs_initcall at least. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns MIBsAlexey Dobriyan1-0/+3
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns NETLINK_XFRM socketAlexey Dobriyan1-0/+2
Stub senders to init_net's one temporarily. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns policy hash resizing workAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns policy countsAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_policy_bydst hashAlexey Dobriyan1-0/+6
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns inexact policiesAlexey Dobriyan1-0/+2
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_policy_byidx hashmaskAlexey Dobriyan1-0/+1
Per-netns hashes are independently resizeable. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_policy_byidx hashAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns policy listAlexey Dobriyan1-0/+2
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns km_waitqAlexey Dobriyan1-0/+3
Disallow spurious wakeups in __xfrm_lookup(). Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns state GC workAlexey Dobriyan1-0/+1
State GC is per-netns, and this is part of it. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns state GC listAlexey Dobriyan1-0/+1
km_waitq is going to be made per-netns to disallow spurious wakeups in __xfrm_lookup(). To not wakeup after every garbage-collected xfrm_state (which potentially can be from different netns) make state GC list per-netns. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_hash_workAlexey Dobriyan1-0/+2
All of this is implicit passing which netns's hashes should be resized. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_state countsAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_state_hmaskAlexey Dobriyan1-0/+1
Since hashtables are per-netns, they can be independently resized. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_state_byspi hashAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_state_bysrc hashAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_state_bydst hashAlexey Dobriyan1-0/+9
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: per-netns xfrm_state_all listAlexey Dobriyan1-0/+3
This is done to get a) simple "something leaked" check b) cover possible DoSes when other netns puts many, many xfrm_states onto a list. c) not miss "alien xfrm_state" check in some of list iterators in future. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-25netns xfrm: add netns boilerplateAlexey Dobriyan1-0/+7
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-11-04netfilter: netns ebtables: ebtable_nat in netnsAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-11-04netfilter: netns ebtables: ebtable_filter in netnsAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-11-04netfilter: netns ebtables: ebtable_broute in netnsAlexey Dobriyan1-0/+3
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-27net: implement emergency route cache rebulds when gc_elasticity is exceededNeil Horman1-0/+2
This is a patch to provide on demand route cache rebuilding. Currently, our route cache is rebulid periodically regardless of need. This introduced unneeded periodic latency. This patch offers a better approach. Using code provided by Eric Dumazet, we compute the standard deviation of the average hash bucket chain length while running rt_check_expire. Should any given chain length grow to larger that average plus 4 standard deviations, we trigger an emergency hash table rebuild for that net namespace. This allows for the common case in which chains are well behaved and do not grow unevenly to not incur any latency at all, while those systems (which may be being maliciously attacked), only rebuild when the attack is detected. This patch take 2 other factors into account: 1) chains with multiple entries that differ by attributes that do not affect the hash value are only counted once, so as not to unduly bias system to rebuilding if features like QOS are heavily used 2) if rebuilding crosses a certain threshold (which is adjustable via the added sysctl in this patch), route caching is disabled entirely for that net namespace, since constant rebuilding is less efficient that no caching at all Tested successfully by me. Signed-off-by: Neil Horman <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-20netfilter: netns: use NFPROTO_NUMPROTO instead of NUMPROTO for tables arrayPatrick McHardy1-2/+2
The netfilter families have been decoupled from regular protocol families. Signed-off-by: Patrick McHardy <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-08ipv6: making ip and icmp statistics per/namespaceDenis V. Lunev1-0/+3
Signed-off-by: Denis V. Lunev <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-08netfilter: netns nat: per-netns bysource hashAlexey Dobriyan1-0/+2
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nat: per-netns NAT tableAlexey Dobriyan1-0/+1
Same story as with iptable_filter, iptables_raw tables. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns conntrack accountingAlexey Dobriyan1-0/+2
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns ↵Alexey Dobriyan1-0/+1
net.netfilter.nf_conntrack_log_invalid sysctl Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_checksum ↵Alexey Dobriyan1-0/+1
sysctl Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_count sysctlAlexey Dobriyan1-0/+4
Note, sysctl table is always duplicated, this is simpler and less special-cased. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns statisticsAlexey Dobriyan1-0/+1
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns event cacheAlexey Dobriyan1-0/+5
Heh, last minute proof-reading of this patch made me think, that this is actually unneeded, simply because "ct" pointers will be different for different conntracks in different netns, just like they are different in one netns. Not so sure anymore. [Patrick: pointers will be different, flushing can only be done while inactive though and thus it needs to be per netns] Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns unconfirmed listAlexey Dobriyan1-0/+2
What is confirmed connection in one netns can very well be unconfirmed in another one. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns expectationsAlexey Dobriyan1-0/+3
Make per-netns a) expectation hash and b) expectations count. Expectations always belongs to netns to which it's master conntrack belong. This is natural and doesn't bloat expectation. Proc files and leaf users are stubbed to init_net, this is temporary. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns conntrack hashAlexey Dobriyan1-0/+2
* make per-netns conntrack hash Other solution is to add ->ct_net pointer to tuplehashes and still has one hash, I tried that it's ugly and requires more code deep down in protocol modules et al. * propagate netns pointer to where needed, e. g. to conntrack iterators. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns conntrack countAlexey Dobriyan1-0/+3
Sysctls and proc files are stubbed to init_net's one. This is temporary. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: add netns boilerplateAlexey Dobriyan1-0/+6
One comment: #ifdefs around #include is necessary to overcome amazing compile breakages in NOTRACK-in-netns patch (see below). Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-07netns: make uplitev6 mib per/namespaceDenis V. Lunev1-0/+1
Signed-off-by: Denis V. Lunev <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07netns: make udpv6 mib per/namespaceDenis V. Lunev1-0/+1
Signed-off-by: Denis V. Lunev <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07netns: move /proc/net/dev_snmp6 to struct netDenis V. Lunev1-0/+4
Signed-off-by: Denis V. Lunev <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-07-22netns: dont alloc ipv6 fib timer listStephen Hemminger1-1/+1
FIB timer list is a trivial size structure, avoid indirection and just put it in existing ns. Signed-off-by: Stephen Hemminger <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-07-18mib: put icmpmsg statistics on struct netPavel Emelyanov1-0/+1
Signed-off-by: Pavel Emelyanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-07-18mib: put icmp statistics on struct netPavel Emelyanov1-0/+1
Signed-off-by: Pavel Emelyanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-07-18mib: put udplite statistics on struct netPavel Emelyanov1-0/+1
Signed-off-by: Pavel Emelyanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-07-18mib: put udp statistics on struct netPavel Emelyanov1-0/+1
Similar to... ouch, I repeat myself. Signed-off-by: Pavel Emelyanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-07-18mib: put net statistics on struct netPavel Emelyanov1-0/+1
Similar to ip and tcp ones :) Signed-off-by: Pavel Emelyanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-07-18mib: put ip statistics on struct netPavel Emelyanov1-0/+1
Similar to tcp one. Signed-off-by: Pavel Emelyanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.