Doug / smarc-fsl-linux-kernel

02 May, 2008

1 commit

29 Apr, 2008

1 commit

14 Apr, 2008

1 commit

26 Mar, 2008

1 commit

01 Feb, 2008

7 commits

  • 3cb609d57   [NETFILTER]: x_tables: create per-netns /proc/net/*_tables_* ... Browse Code »

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     
  • 715cf35ac   [NETFILTER]: x_tables: netns propagation for /proc/net/*_tables_names ... Browse Code »

    Propagate netns together with AF down to ->start/->next/->stop
    iterators. Choose table based on netns and AF for showing.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     
  • 025d93d14   [NETFILTER]: x_tables: semi-rewrite of /proc/net/foo_tables_* ... Browse Code »

    There are many small but still wrong things with /proc/net/*_tables_*
    so I decided to do overhaul simultaneously making it more suitable for
    per-netns /proc/net/*_tables_* implementation.

    Fix
    a) xt_get_idx() duplicating now standard seq_list_start/seq_list_next
    iterators
    b) tables/matches/targets list was chosen again and again on every ->next
    c) multiple useless "af >= NPROTO" checks -- we simple don't supply invalid
    AFs there and registration function should BUG_ON instead.

    Regardless, the one in ->next() is the most useless -- ->next doesn't
    run at all if ->start fails.
    d) Don't use mutex_lock_interruptible() -- it can fail and ->stop is
    executed even if ->start failed, so unlock without lock is possible.

    As side effect, streamline code by splitting xt_tgt_ops into xt_target_ops,
    xt_matches_ops, xt_tables_ops.

    xt_tables_ops hooks will be changed by per-netns code. Code of
    xt_matches_ops, xt_target_ops is identical except the list chosen for
    iterating, but I think consolidating code for two files not worth it
    given "<< 16" hacks needed for it.

    [Patrick: removed unused enum in x_tables.c]

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     
  • b0a6363c2   [NETFILTER]: {ip,arp,ip6}_tables: fix sparse warnings in compat code ... Browse Code »

    CHECK net/ipv4/netfilter/ip_tables.c
    net/ipv4/netfilter/ip_tables.c:1453:8: warning: incorrect type in argument 3 (different signedness)
    net/ipv4/netfilter/ip_tables.c:1453:8: expected int *size
    net/ipv4/netfilter/ip_tables.c:1453:8: got unsigned int [usertype] *size
    net/ipv4/netfilter/ip_tables.c:1458:44: warning: incorrect type in argument 3 (different signedness)
    net/ipv4/netfilter/ip_tables.c:1458:44: expected int *size
    net/ipv4/netfilter/ip_tables.c:1458:44: got unsigned int [usertype] *size
    net/ipv4/netfilter/ip_tables.c:1603:2: warning: incorrect type in argument 2 (different signedness)
    net/ipv4/netfilter/ip_tables.c:1603:2: expected unsigned int *i
    net/ipv4/netfilter/ip_tables.c:1603:2: got int *
    net/ipv4/netfilter/ip_tables.c:1627:8: warning: incorrect type in argument 3 (different signedness)
    net/ipv4/netfilter/ip_tables.c:1627:8: expected int *size
    net/ipv4/netfilter/ip_tables.c:1627:8: got unsigned int *size
    net/ipv4/netfilter/ip_tables.c:1634:40: warning: incorrect type in argument 3 (different signedness)
    net/ipv4/netfilter/ip_tables.c:1634:40: expected int *size
    net/ipv4/netfilter/ip_tables.c:1634:40: got unsigned int *size
    net/ipv4/netfilter/ip_tables.c:1653:8: warning: incorrect type in argument 5 (different signedness)
    net/ipv4/netfilter/ip_tables.c:1653:8: expected unsigned int *i
    net/ipv4/netfilter/ip_tables.c:1653:8: got int *
    net/ipv4/netfilter/ip_tables.c:1666:2: warning: incorrect type in argument 2 (different signedness)
    net/ipv4/netfilter/ip_tables.c:1666:2: expected unsigned int *i
    net/ipv4/netfilter/ip_tables.c:1666:2: got int *
    CHECK net/ipv4/netfilter/arp_tables.c
    net/ipv4/netfilter/arp_tables.c:1285:40: warning: incorrect type in argument 3 (different signedness)
    net/ipv4/netfilter/arp_tables.c:1285:40: expected int *size
    net/ipv4/netfilter/arp_tables.c:1285:40: got unsigned int *size
    net/ipv4/netfilter/arp_tables.c:1543:44: warning: incorrect type in argument 3 (different signedness)
    net/ipv4/netfilter/arp_tables.c:1543:44: expected int *size
    net/ipv4/netfilter/arp_tables.c:1543:44: got unsigned int [usertype] *size
    CHECK net/ipv6/netfilter/ip6_tables.c
    net/ipv6/netfilter/ip6_tables.c:1481:8: warning: incorrect type in argument 3 (different signedness)
    net/ipv6/netfilter/ip6_tables.c:1481:8: expected int *size
    net/ipv6/netfilter/ip6_tables.c:1481:8: got unsigned int [usertype] *size
    net/ipv6/netfilter/ip6_tables.c:1486:44: warning: incorrect type in argument 3 (different signedness)
    net/ipv6/netfilter/ip6_tables.c:1486:44: expected int *size
    net/ipv6/netfilter/ip6_tables.c:1486:44: got unsigned int [usertype] *size
    net/ipv6/netfilter/ip6_tables.c:1631:2: warning: incorrect type in argument 2 (different signedness)
    net/ipv6/netfilter/ip6_tables.c:1631:2: expected unsigned int *i
    net/ipv6/netfilter/ip6_tables.c:1631:2: got int *
    net/ipv6/netfilter/ip6_tables.c:1655:8: warning: incorrect type in argument 3 (different signedness)
    net/ipv6/netfilter/ip6_tables.c:1655:8: expected int *size
    net/ipv6/netfilter/ip6_tables.c:1655:8: got unsigned int *size
    net/ipv6/netfilter/ip6_tables.c:1662:40: warning: incorrect type in argument 3 (different signedness)
    net/ipv6/netfilter/ip6_tables.c:1662:40: expected int *size
    net/ipv6/netfilter/ip6_tables.c:1662:40: got unsigned int *size
    net/ipv6/netfilter/ip6_tables.c:1680:8: warning: incorrect type in argument 5 (different signedness)
    net/ipv6/netfilter/ip6_tables.c:1680:8: expected unsigned int *i
    net/ipv6/netfilter/ip6_tables.c:1680:8: got int *
    net/ipv6/netfilter/ip6_tables.c:1693:2: warning: incorrect type in argument 2 (different signedness)
    net/ipv6/netfilter/ip6_tables.c:1693:2: expected unsigned int *i
    net/ipv6/netfilter/ip6_tables.c:1693:2: got int *

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • 44d34e721   [NETFILTER]: x_tables: return new table from {arp,ip,ip6}t_register_table() ... Browse Code »

    Typical table module registers xt_table structure (i.e. packet_filter)
    and link it to list during it. We can't use one template for it because
    corresponding list_head will become corrupted. We also can't unregister
    with template because it wasn't changed at all and thus doesn't know in
    which list it is.

    So, we duplicate template at the very first step of table registration.
    Table modules will save it for use during unregistration time and actual
    filtering.

    Do it at once to not screw bisection.

    P.S.: renaming i.e. packet_filter => __packet_filter is temporary until
    full netnsization of table modules is done.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     
  • 8d8700520   [NETFILTER]: x_tables: per-netns xt_tables ... Browse Code »

    In fact all we want is per-netns set of rules, however doing that will
    unnecessary complicate routines such as ipt_hook()/ipt_do_table, so
    make full xt_table array per-netns.

    Every user stubbed with init_net for a while.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     
  • a98da11d8   [NETFILTER]: x_tables: change xt_table_register() return value convention ... Browse Code »

    Switch from 0/-E to ptr/PTR_ERR convention.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

29 Jan, 2008

3 commits

15 Dec, 2007

1 commit

  • a18aa31b7   [NETFILTER]: ip_tables: fix compat copy race ... Browse Code »

    When copying entries to user, the kernel makes two passes through the
    data, first copying all the entries, then fixing up names and counters.
    On the second pass it copies the kernel and match data from userspace
    to the kernel again to find the corresponding structures, expecting
    that kernel pointers contained in the data are still valid.

    This is obviously broken, fix by avoiding the second pass completely
    and fixing names and counters while dumping the ruleset, using the
    kernel-internal data structures.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

11 Oct, 2007

1 commit

  • 457c4cbc5   [NET]: Make /proc/net per network namespace ... Browse Code »

    This patch makes /proc/net per network namespace. It modifies the global
    variables proc_net and proc_net_stat to be per network namespace.
    The proc_net file helpers are modified to take a network namespace argument,
    and all of their callers are fixed to pass &init_net for that argument.
    This ensures that all of the /proc/net files are only visible and
    usable in the initial network namespace until the code behind them
    has been updated to be handle multiple network namespaces.

    Making /proc/net per namespace is necessary as at least some files
    in /proc/net depend upon the set of network devices which is per
    network namespace, and even more files in /proc/net have contents
    that are relevant to a single network namespace.

    Signed-off-by: Eric W. Biederman
    Signed-off-by: David S. Miller

    Eric W. Biederman
     

11 Jul, 2007

2 commits

26 Apr, 2007

1 commit

13 Feb, 2007

2 commits

04 Dec, 2006

1 commit

23 Sep, 2006

3 commits

01 Jul, 2006

1 commit

04 May, 2006

1 commit

25 Apr, 2006

1 commit

11 Apr, 2006

1 commit

  • 6f9120422   [PATCH] for_each_possible_cpu: network codes ... Browse Code »

    for_each_cpu() actually iterates across all possible CPUs. We've had mistakes
    in the past where people were using for_each_cpu() where they should have been
    iterating across only online or present CPUs. This is inefficient and
    possibly buggy.

    We're renaming for_each_cpu() to for_each_possible_cpu() to avoid this in the
    future.

    This patch replaces for_each_cpu with for_each_possible_cpu under /net

    Signed-off-by: KAMEZAWA Hiroyuki
    Acked-by: "David S. Miller"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    KAMEZAWA Hiroyuki
     

01 Apr, 2006

1 commit

  • 2722971cb   [NETFILTER]: iptables 32bit compat layer ... Browse Code »

    This patch extends current iptables compatibility layer in order to get
    32bit iptables to work on 64bit kernel. Current layer is insufficient due
    to alignment checks both in kernel and user space tools.

    Patch is for current net-2.6.17 with addition of move of ipt_entry_{match|
    target} definitions to xt_entry_{match|target}.

    Signed-off-by: Dmitry Mishin
    Acked-off-by: Kirill Korotaev
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Dmitry Mishin
     

25 Mar, 2006

1 commit

  • 9e19bb6d7   [NETFILTER] x_table.c: sem2mutex ... Browse Code »

    Semaphore to mutex conversion.

    The conversion was generated via scripts, and the result was validated
    automatically via a script as well.

    Signed-off-by: Ingo Molnar
    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    Ingo Molnar
     

23 Mar, 2006

1 commit

21 Mar, 2006

1 commit

13 Jan, 2006

1 commit

  • 2e4e6a17a   [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables ... Browse Code »

    This monster-patch tries to do the best job for unifying the data
    structures and backend interfaces for the three evil clones ip_tables,
    ip6_tables and arp_tables. In an ideal world we would never have
    allowed this kind of copy+paste programming... but well, our world
    isn't (yet?) ideal.

    o introduce a new x_tables module
    o {ip,arp,ip6}_tables depend on this x_tables module
    o registration functions for tables, matches and targets are only
    wrappers around x_tables provided functions
    o all matches/targets that are used from ip_tables and ip6_tables
    are now implemented as xt_FOOBAR.c files and provide module aliases
    to ipt_FOOBAR and ip6t_FOOBAR
    o header files for xt_matches are in include/linux/netfilter/,
    include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
    around the xt_FOOBAR.h headers

    Based on this patchset we're going to further unify the code,
    gradually getting rid of all the layer 3 specific assumptions.

    Signed-off-by: Harald Welte
    Signed-off-by: David S. Miller

    Harald Welte