Doug / smarc-fsl-linux-kernel

28 May, 2011

1 commit

04 Apr, 2011

2 commits

  • 0fae2e774   netfilter: af_info: add 'strict' parameter to limit lookup to .oif ... Browse Code »

    ipv6 fib lookup can set RT6_LOOKUP_F_IFACE flag to restrict search
    to an interface, but this flag cannot be set via struct flowi.

    Also, it cannot be set via ip6_route_output: this function uses the
    passed sock struct to determine if this flag is required
    (by testing for nonzero sk_bound_dev_if).

    Work around this by passing in an artificial struct sk in case
    'strict' argument is true.

    This is required to replace the rt6_lookup call in xt_addrtype.c with
    nf_afinfo->route().

    Signed-off-by: Florian Westphal
    Acked-by: David S. Miller
    Signed-off-by: Patrick McHardy

    Florian Westphal
     
  • 31ad3dd64   netfilter: af_info: add network namespace parameter to route hook ... Browse Code »

    This is required to eventually replace the rt6_lookup call in
    xt_addrtype.c with nf_afinfo->route().

    Signed-off-by: Florian Westphal
    Acked-by: David S. Miller
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

18 Jan, 2011

2 commits

  • 94b27cc36   netfilter: allow NFQUEUE bypass if no listener is available ... Browse Code »

    If an skb is to be NF_QUEUE'd, but no program has opened the queue, the
    packet is dropped.

    This adds a v2 target revision of xt_NFQUEUE that allows packets to
    continue through the ruleset instead.

    Because the actual queueing happens outside of the target context, the
    'bypass' flag has to be communicated back to the netfilter core.

    Unfortunately the only choice to do this without adding a new function
    argument is to use the target function return value (i.e. the verdict).

    In the NF_QUEUE case, the upper 16bit already contain the queue number
    to use. The previous patch reduced NF_VERDICT_MASK to 0xff, i.e.
    we now have extra room for a new flag.

    If a hook issued a NF_QUEUE verdict, then the netfilter core will
    continue packet processing if the queueing hook
    returns -ESRCH (== "this queue does not exist") and the new
    NF_VERDICT_FLAG_QUEUE_BYPASS flag is set in the verdict value.

    Note: If the queue exists, but userspace does not consume packets fast
    enough, the skb will still be dropped.

    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     
  • f615df76e   netfilter: reduce NF_VERDICT_MASK to 0xff ... Browse Code »

    NF_VERDICT_MASK is currently 0xffff. This is because the upper
    16 bits are used to store errno (for NF_DROP) or the queue number
    (NF_QUEUE verdict).

    As there are up to 0xffff different queues available, there is no more
    room to store additional flags.

    At the moment there are only 6 different verdicts, i.e. we can reduce
    NF_VERDICT_MASK to 0xff to allow storing additional flags in the 0xff00 space.

    NF_VERDICT_BITS would then be reduced to 8, but because the value is
    exported to userspace, this might cause breakage; e.g.:

    e.g. 'queuenr = (1 << NF_VERDICT_BITS) | NF_QUEUE' would now break.

    Thus, remove NF_VERDICT_BITS usage in the kernel and move the old value
    to the 'userspace compat' section.

    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

13 Jan, 2011

1 commit

18 Nov, 2010

1 commit

16 Nov, 2010

1 commit

12 Nov, 2010

1 commit

  • ac5aa2e33   netfilter: NF_HOOK_COND has wrong conditional ... Browse Code »

    The NF_HOOK_COND returns 0 when it shouldn't due to what I believe to be an
    error in the code as the order of operations is not what was intended. C will
    evalutate == before =. Which means ret is getting set to the bool result,
    rather than the return value of the function call. The code says

    if (ret = function() == 1)
    when it meant to say:
    if ((ret = function()) == 1)

    Normally the compiler would warn, but it doesn't notice it because its
    a actually complex conditional and so the wrong code is wrapped in an explict
    set of () [exactly what the compiler wants you to do if this was intentional].
    Fixing this means that errors when netfilter denies a packet get propagated
    back up the stack rather than lost.

    Problem introduced by commit 2249065f (netfilter: get rid of the grossness
    in netfilter.h).

    Signed-off-by: Eric Paris
    Cc: stable@kernel.org
    Signed-off-by: Patrick McHardy

    Eric Paris
     

19 Feb, 2010

1 commit

15 Feb, 2010

2 commits

02 Feb, 2010

1 commit

  • c30f540b6   netfilter: xtables: CONFIG_COMPAT redux ... Browse Code »

    Ifdef out
    struct nf_sockopt_ops::compat_set
    struct nf_sockopt_ops::compat_get
    struct xt_match::compat_from_user
    struct xt_match::compat_to_user
    struct xt_match::compatsize
    to make structures smaller on COMPAT=n kernels.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy

    Alexey Dobriyan
     

05 Nov, 2009

1 commit

  • d94d9fee9   net: cleanup include/linux ... Browse Code »

    This cleanup patch puts struct/union/enum opening braces,
    in first line to ease grep games.

    struct something
    {

    becomes :

    struct something {

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

01 Oct, 2009

1 commit

  • b7058842c   net: Make setsockopt() optlen be unsigned. ... Browse Code »

    This provides safety against negative optlen at the type
    level instead of depending upon (sometimes non-trivial)
    checks against this sprinkled all over the the place, in
    each and every implementation.

    Based upon work done by Arjan van de Ven and feedback
    from Linus Torvalds.

    Signed-off-by: David S. Miller

    David S. Miller
     

08 Oct, 2008

3 commits

22 May, 2008

1 commit

  • c8942f1f0   netfilter: Move linux/types.h inclusions outside of #ifdef __KERNEL__ ... Browse Code »

    Greg Steuck points out that some of the netfilter
    headers can't be used in userspace without including linux/types.h
    first. The headers include their own linux/types.h include statements,
    these are stripped by make headers-install because they are inside
    #ifdef __KERNEL__ however. Move them out to fix this.

    Reported and Tested by Greg Steuck.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

14 Apr, 2008

2 commits

  • d63a65073   [NETFILTER]: Add partial checksum validation helper ... Browse Code »

    Move the UDP-Lite conntrack checksum validation to a generic helper
    similar to nf_checksum() and make it fall back to nf_checksum()
    in case the full packet is to be checksummed and hardware checksums
    are available. This is to be used by DCCP conntrack, which also
    needs to verify partial checksums.

    Signed-off-by: Patrick McHardy

    Patrick McHardy
     
  • 666953df3   [NETFILTER]: ip_tables: per-netns FILTER/MANGLE/RAW tables for real ... Browse Code »

    Commit 9335f047fe61587ec82ff12fbb1220bcfdd32006 aka
    "[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW"
    added per-netns _view_ of iptables rules. They were shown to user, but
    ignored by filtering code. Now that it's possible to at least ping loopback,
    per-netns tables can affect filtering decisions.

    netns is taken in case of
    PRE_ROUTING, LOCAL_IN -- from in device,
    POST_ROUTING, LOCAL_OUT -- from out device,
    FORWARD -- from in device which should be equal to out device's netns.
    This code is relatively new, so BUG_ON was plugged.

    Wrappers were added to a) keep code the same from CONFIG_NET_NS=n users
    (overwhelming majority), b) consolidate code in one place -- similar
    changes will be done in ipv6 and arp netfilter code.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy

    Alexey Dobriyan
     

26 Mar, 2008

1 commit

28 Feb, 2008

1 commit

  • fbabbed82   [NETFILTER]: Fix NF_QUEUE_NR() parenthesis ... Browse Code »

    Properly add parens around the macro argument. This is not needed by
    the kernel but the macro is exported to userspace, so it shouldn't
    make any assumptions.

    Also use NF_VERDICT_BITS instead of NF_VERDICT_QBTIS for the left-shift
    since thats whats logically correct.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

20 Feb, 2008

1 commit

29 Jan, 2008

15 commits

16 Oct, 2007

1 commit