1. 16 1月, 2015 38 次提交
  2. 15 1月, 2015 2 次提交
    • D
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · 4e7a84b1
      David S. Miller 提交于
      Pablo Neira Ayuso says:
      
      ====================
      netfilter updates for net-next
      
      The following patchset contains netfilter updates for net-next, just a
      bunch of cleanups and small enhancement to selectively flush conntracks
      in ctnetlink, more specifically the patches are:
      
      1) Rise default number of buckets in conntrack from 16384 to 65536 in
         systems with >= 4GBytes, patch from Marcelo Leitner.
      
      2) Small refactor to save one level on indentation in xt_osf, from
         Joe Perches.
      
      3) Remove unnecessary sizeof(char) in nf_log, from Fabian Frederick.
      
      4) Another small cleanup to remove redundant variable in nfnetlink,
         from Duan Jiong.
      
      5) Fix compilation warning in nfnetlink_cthelper on parisc, from
         Chen Gang.
      
      6) Fix wrong format in debugging for ctseqadj, from Gao feng.
      
      7) Selective conntrack flushing through the mark for ctnetlink, patch
         from Kristian Evensen.
      
      8) Remove nf_ct_conntrack_flush_report() exported symbol now that is
         not required anymore after the selective flushing patch, again from
         Kristian.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4e7a84b1
    • D
      Merge branch 'vxlan_group_policy_extension' · 2e62fa69
      David S. Miller 提交于
      Thomas Graf says:
      
      ====================
      VXLAN Group Policy Extension
      
      Implements supports for the Group Policy VXLAN extension [0] to provide
      a lightweight and simple security label mechanism across network peers
      based on VXLAN. The security context and associated metadata is mapped
      to/from skb->mark. This allows further mapping to a SELinux context
      using SECMARK, to implement ACLs directly with nftables, iptables, OVS,
      tc, etc.
      
      The extension is disabled by default and should be run on a distinct
      port in mixed Linux VXLAN VTEP environments. Liberal VXLAN VTEPs
      which ignore unknown reserved bits will be able to receive VXLAN-GBP
      frames.
      
      Simple usage example:
      
      10.1.1.1:
         # ip link add vxlan0 type vxlan id 10 remote 10.1.1.2 gbp
         # iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200
      
      10.1.1.2:
         # ip link add vxlan0 type vxlan id 10 remote 10.1.1.1 gbp
         # iptables -I INPUT -m mark --mark 0x200 -j DROP
      
      iproute2 [1] and OVS [2] support will be provided in separate patches.
      
      [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
      [1] https://github.com/tgraf/iproute2/tree/vxlan-gbp
      [2] https://github.com/tgraf/ovs/tree/vxlan-gbp
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2e62fa69