linux-toradex.git/include/net/netns/ipv6.h, branch v3.14.37

ipv6: add flowlabel_consistency sysctl

2014-01-20T01:12:31+00:00

With the introduction of IPV6_FL_F_REFLECT, there is no guarantee of
flow label unicity. This patch introduces a new sysctl to protect the old
behaviour, enable by default.

Changelog of V3:
 * rename ip6_flowlabel_consistency to flowlabel_consistency
 * use net_info_ratelimited()
 * checkpatch cleanups

Signed-off-by: Florent Fourcot 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

IPv6: move the anycast_src_echo_reply sysctl to netns_sysctl_ipv6

2014-01-15T02:18:22+00:00

This change move anycast_src_echo_reply sysctl with other ipv6 sysctls.

Suggested-by: Hannes Frederic Sowa 
Signed-off-by: Francois-Xavier Le Bail 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

IPv6: add the option to use anycast addresses as source addresses in echo reply

2014-01-07T20:51:39+00:00

This change allows to follow a recommandation of RFC4942.

- Add "anycast_src_echo_reply" sysctl to control the use of anycast addresses
  as source addresses for ICMPv6 echo reply. This sysctl is false by default
  to preserve existing behavior.
- Add inline check ipv6_anycast_destination().
- Use them in icmpv6_echo_reply().

Reference:
RFC4942 - IPv6 Transition/Coexistence Security Considerations
   (http://tools.ietf.org/html/rfc4942#section-2.1.6)

2.1.6. Anycast Traffic Identification and Security

   [...]
   To avoid exposing knowledge about the internal structure of the
   network, it is recommended that anycast servers now take advantage of
   the ability to return responses with the anycast address as the
   source address if possible.

Signed-off-by: Francois-Xavier Le Bail 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

net: split rt_genid for ipv4 and ipv6

2013-07-31T21:56:36+00:00

Current net name space has only one genid for both IPv4 and IPv6, it has below
drawbacks:

- Add/delete an IPv4 address will invalidate all IPv6 routing table entries.
- Insert/remove XFRM policy will also invalidate both IPv4/IPv6 routing table
  entries even when the policy is only applied for one address family.

Thus, this patch attempt to split one genid for two to cater for IPv4 and IPv6
separately in a fine granularity.

Signed-off-by: Fan Du 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

ipv6: provide addr and netconf dump consistency info

2013-03-24T21:16:29+00:00

This patch adds a dev_addr_genid for IPv6. The goal is to use it, combined with
dev_base_seq to check if a change occurs during a netlink dump.
If a change is detected, the flag NLM_F_DUMP_INTR is set in the first message
after the dump was interrupted.

Note that only dump of unicast addresses is checked (multicast and anycast are
not checked).

Reported-by: Junwei Zhang 
Reported-by: Hongjun Li 
Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller

xfrm: make gc_thresh configurable in all namespaces

2013-02-06T10:36:29+00:00

The xfrm gc threshold can be configured via xfrm{4,6}_gc_thresh
sysctl but currently only in init_net, other namespaces always
use the default value. This can substantially limit the number
of IPsec tunnels that can be effectively used.

Signed-off-by: Michal Kubecek 
Signed-off-by: Steffen Klassert

ipv6: add a new namespace for nf_conntrack_reasm

2012-09-19T21:23:28+00:00

As pointed by Michal, it is necessary to add a new
namespace for nf_conntrack_reasm code, this prepares
for the second patch.

Cc: Herbert Xu 
Cc: Michal Kubeček 
Cc: David Miller 
Cc: Patrick McHardy 
Cc: Pablo Neira Ayuso 
Cc: netfilter-devel@vger.kernel.org
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

netfilter: ipv6: add IPv6 NAT support

2012-08-30T01:00:17+00:00

Signed-off-by: Patrick McHardy

inetpeer: add namespace support for inetpeer

2012-06-08T21:27:23+00:00

now inetpeer doesn't support namespace,the information will
be leaking across namespace.

this patch move the global vars v4_peers and v6_peers to
netns_ipv4 and netns_ipv6 as a field peers.

add struct pernet_operations inetpeer_ops to initial pernet
inetpeer data.

and change family_to_base and inet_getpeer to support namespace.

Signed-off-by: Gao feng 
Signed-off-by: David S. Miller

net ipv6: Don't use sysctl tables with .child entries.

2012-04-21T01:22:29+00:00

The sysctl core no longer natively understands sysctl tables
with .child entries.

Split the ipv6_table to remove the .child entries.

Signed-off-by: Eric W. Biederman 
Acked-by: Pavel Emelyanov 
Signed-off-by: David S. Miller