iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/netfilter
History
Eric Paris 1cc63249ad conntrack: export lsm context rather than internal secid via netlink 
The conntrack code can export the internal secid to userspace.  These are
dynamic, can change on lsm changes, and have no meaning in userspace.  We
should instead be sending lsm contexts to userspace instead.  This patch sends
the secctx (rather than secid) to userspace over the netlink socket.  We use a
new field CTA_SECCTX and stop using the the old CTA_SECMARK field since it did
not send particularly useful information.

Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Paul Moore <paul.moore@hp.com>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: James Morris <jmorris@namei.org>
2010-10-21 10:12:51 +11:00
..
ipvs
ipvs: fix active FTP
2010-09-08 10:39:57 -07:00
core.c
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
Kconfig
netfilter: add xt_cpu match
2010-07-23 12:59:36 +02:00
Makefile
netfilter: add xt_cpu match
2010-07-23 12:59:36 +02:00
nf_conntrack_acct.c
netfilter: complete the deprecation of CONFIG_NF_CT_ACCT
2010-06-25 14:46:56 +02:00
nf_conntrack_amanda.c
netfilter: cleanup printk messages
2010-05-13 15:02:08 +02:00
nf_conntrack_core.c
netfilter: nf_conntrack_acct: use skb->len for accounting
2010-08-02 17:56:28 +02:00
nf_conntrack_ecache.c
netfilter: use rcu_dereference_protected()
2010-05-10 18:47:57 +02:00
nf_conntrack_expect.c
netfilter: nf_conntrack: add support for "conntrack zones"
2010-02-15 18:13:33 +01:00
nf_conntrack_extend.c
netfilter: fix a race in nf_ct_ext_create()
2010-09-22 13:13:33 -07:00
nf_conntrack_ftp.c
netfilter: cleanup printk messages
2010-05-13 15:02:08 +02:00
nf_conntrack_h323_asn1.c
[NETFILTER]: nf_conntrack_h323: constify and annotate H.323 helper
2008-01-31 19:28:07 -08:00
nf_conntrack_h323_main.c
net-next: remove useless union keyword
2010-06-10 23:31:35 -07:00
nf_conntrack_h323_types.c
[NETFILTER]: nf_conntrack_h323: constify and annotate H.323 helper
2008-01-31 19:28:07 -08:00
nf_conntrack_helper.c
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
nf_conntrack_irc.c
netfilter: cleanup printk messages
2010-05-13 15:02:08 +02:00
nf_conntrack_l3proto_generic.c
[NETFILTER]: nf_conntrack: use bool type in struct nf_conntrack_l3proto
2008-04-14 11:15:52 +02:00
nf_conntrack_netbios_ns.c
net-next: remove useless union keyword
2010-06-10 23:31:35 -07:00
nf_conntrack_netlink.c
conntrack: export lsm context rather than internal secid via netlink
2010-10-21 10:12:51 +11:00
nf_conntrack_pptp.c
netfilter: nf_conntrack: add support for "conntrack zones"
2010-02-15 18:13:33 +01:00
nf_conntrack_proto_dccp.c
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
nf_conntrack_proto_generic.c
sysctl net: Remove unused binary sysctl code
2009-11-12 02:05:06 -08:00
nf_conntrack_proto_gre.c
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
nf_conntrack_proto_sctp.c
netfilter: cleanup printk messages
2010-05-13 15:02:08 +02:00
nf_conntrack_proto_tcp.c
netfilter: nf_ct_tcp: fix flow recovery with TCP window tracking enabled
2010-07-15 17:09:04 +02:00
nf_conntrack_proto_udp.c
netfilter: nf_conntrack: pass template to l4proto ->error() handler
2010-02-15 17:45:08 +01:00
nf_conntrack_proto_udplite.c
netfilter: nf_conntrack: pass template to l4proto ->error() handler
2010-02-15 17:45:08 +01:00
nf_conntrack_proto.c
netfilter: nf_conntrack_proto: fix warning with CONFIG_PROVE_RCU
2010-05-10 17:45:56 +02:00
nf_conntrack_sane.c
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
nf_conntrack_sip.c
netfilter: nf_ct_sip: default to NF_ACCEPT in sip_help_tcp()
2010-09-22 13:13:32 -07:00
nf_conntrack_standalone.c
netfilter: cleanup printk messages
2010-05-13 15:02:08 +02:00
nf_conntrack_tftp.c
netfilter: cleanup printk messages
2010-05-13 15:02:08 +02:00
nf_internals.h
netfilter: cleanup printk messages
2010-05-13 15:02:08 +02:00
nf_log.c
netfilter: use rcu_dereference_protected()
2010-05-10 18:47:57 +02:00
nf_queue.c
net: add a noref bit on skb dst
2010-05-17 17:18:50 -07:00
nf_sockopt.c
net: Make setsockopt() optlen be unsigned.
2009-09-30 16:12:20 -07:00
nf_tproxy_core.c
netfilter: tproxy: nf_tproxy_assign_sock() can handle tw sockets
2010-09-22 13:13:31 -07:00
nfnetlink_log.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
2010-06-15 13:49:24 -07:00
nfnetlink_queue.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
2010-06-15 13:49:24 -07:00
nfnetlink.c
netfilter: cleanup printk messages
2010-05-13 15:02:08 +02:00
x_tables.c
netfilter: xtables: stackptr should be percpu
2010-05-31 16:41:35 +02:00
xt_CHECKSUM.c
netfilter: add CHECKSUM target
2010-07-15 17:20:46 +02:00
xt_CLASSIFY.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_cluster.c
netfilter: nf_conntrack: IPS_UNTRACKED bit
2010-06-08 16:09:52 +02:00
xt_comment.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_connbytes.c
netfilter: xt_connbytes: Force CT accounting to be enabled
2010-06-25 14:44:07 +02:00
xt_connlimit.c
netfilter: xtables: change hotdrop pointer to direct modification
2010-05-11 18:35:27 +02:00
xt_connmark.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_CONNSECMARK.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_conntrack.c
netfilter: nf_conntrack: IPS_UNTRACKED bit
2010-06-08 16:09:52 +02:00
xt_cpu.c
netfilter: add xt_cpu match
2010-07-23 12:59:36 +02:00
xt_CT.c
secmark: make secmark object handling generic
2010-10-21 10:12:48 +11:00
xt_dccp.c
netfilter: xtables: change hotdrop pointer to direct modification
2010-05-11 18:35:27 +02:00
xt_dscp.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_DSCP.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_esp.c
netfilter: xtables: change hotdrop pointer to direct modification
2010-05-11 18:35:27 +02:00
xt_hashlimit.c
netfilter: xtables: change hotdrop pointer to direct modification
2010-05-11 18:35:27 +02:00
xt_helper.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_hl.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_HL.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_IDLETIMER.c
netfilter: xt_IDLETIMER needs kdev_t.h
2010-06-22 08:13:31 +02:00
xt_iprange.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_ipvs.c
netfilter: xt_ipvs (netfilter matcher for IPVS)
2010-07-23 12:42:58 +02:00
xt_LED.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_length.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_limit.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_mac.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_mark.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_multiport.c
netfilter: xtables: change hotdrop pointer to direct modification
2010-05-11 18:35:27 +02:00
xt_NFLOG.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_NFQUEUE.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_NOTRACK.c
netfilter: nf_conntrack: IPS_UNTRACKED bit
2010-06-08 16:09:52 +02:00
xt_osf.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_owner.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_physdev.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_pkttype.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_policy.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_quota.c
xt_quota: report initial quota value instead of current value to userspace
2010-07-23 14:07:47 +02:00
xt_rateest.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_RATEEST.c
pkt_sched: gen_kill_estimator() rcu fixes
2010-06-11 18:37:08 -07:00
xt_realm.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_recent.c
netfilter: xtables: change hotdrop pointer to direct modification
2010-05-11 18:35:27 +02:00
xt_repldata.h
netfilter: xtables: generate initial table on-demand
2010-02-10 17:50:47 +01:00
xt_sctp.c
netfilter: xt_sctp: use WORD_ROUND macro to calculate length of multiple of 4 bytes
2010-06-09 14:47:40 +02:00
xt_SECMARK.c
secmark: make secmark object handling generic
2010-10-21 10:12:48 +11:00
xt_socket.c
netfilter: nf_conntrack: IPS_UNTRACKED bit
2010-06-08 16:09:52 +02:00
xt_state.c
netfilter: nf_conntrack: IPS_UNTRACKED bit
2010-06-08 16:09:52 +02:00
xt_statistic.c
netfilter: xt_statistic: remove nth_lock spinlock
2010-06-01 12:00:41 +02:00
xt_string.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00
xt_tcpmss.c
netfilter: xtables: change hotdrop pointer to direct modification
2010-05-11 18:35:27 +02:00
xt_TCPMSS.c
tcp: unify tcp flag macros
2010-06-15 11:56:19 -07:00
xt_TCPOPTSTRIP.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_tcpudp.c
netfilter: xtables: change hotdrop pointer to direct modification
2010-05-11 18:35:27 +02:00
xt_TEE.c
Merge branch 'master' of /repos/git/net-next-2.6
2010-06-15 17:31:06 +02:00
xt_time.c
netfilter: remove unnecessary returns from void function()s
2010-05-13 15:16:27 +02:00
xt_TPROXY.c
netfilter: xt_TPROXY: the length of lines should be within 80
2010-07-09 17:31:49 +02:00
xt_TRACE.c
netfilter: xtables: substitute temporary defines by final name
2010-05-11 18:31:17 +02:00
xt_u32.c
netfilter: xtables: deconstify struct xt_action_param for matches
2010-05-11 18:33:37 +02:00