Doug / smarc-fsl-linux-kernel

08 Jul, 2012

1 commit

05 Jul, 2012

5 commits

30 Jun, 2012

2 commits

  • 03292745b   netlink: add nlk->netlink_bind hook for module auto-loading ... Browse Code »

    This patch adds a hook in the binding path of netlink.

    This is used by ctnetlink to allow module autoloading for the case
    in which one user executes:

    conntrack -E

    So far, this resulted in nfnetlink loaded, but not
    nf_conntrack_netlink.

    I have received in the past many complains on this behaviour.

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: David S. Miller

    Pablo Neira Ayuso
     
  • a31f2d17b   netlink: add netlink_kernel_cfg parameter to netlink_kernel_create ... Browse Code »

    This patch adds the following structure:

    struct netlink_kernel_cfg {
    unsigned int groups;
    void (*input)(struct sk_buff *skb);
    struct mutex *cb_mutex;
    };

    That can be passed to netlink_kernel_create to set optional configurations
    for netlink kernel sockets.

    I've populated this structure by looking for NULL and zero parameters at the
    existing code. The remaining parameters that always need to be set are still
    left in the original interface.

    That includes optional parameters for the netlink socket creation. This allows
    easy extensibility of this interface in the future.

    This patch also adapts all callers to use this new interface.

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: David S. Miller

    Pablo Neira Ayuso
     

29 Jun, 2012

2 commits

28 Jun, 2012

11 commits

27 Jun, 2012

3 commits

25 Jun, 2012

2 commits

23 Jun, 2012

2 commits

22 Jun, 2012

1 commit

21 Jun, 2012

1 commit

19 Jun, 2012

4 commits

  • 7c6223454   netfilter: nfnetlink_queue: fix compilation with NF_CONNTRACK disabled ... Browse Code »

    In "9cb0176 netfilter: add glue code to integrate nfnetlink_queue and ctnetlink"
    the compilation with NF_CONNTRACK disabled is broken. This patch fixes this
    issue.

    I have moved the conntrack part into nfnetlink_queue_ct.c to avoid
    peppering the entire nfnetlink_queue.c code with ifdefs.

    I also needed to rename nfnetlink_queue.c to nfnetlink_queue_pkt.c
    to update the net/netfilter/Makefile to support conditional compilation
    of the conntrack integration.

    This patch also adds CONFIG_NETFILTER_QUEUE_CT in case you want to explicitly
    disable the integration between nf_conntrack and nfnetlink_queue.

    Reported-by: Andrew Morton
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • 6e9c2db3a   netfilter: fix compilation of the nfnl_cthelper if NF_CONNTRACK is unset ... Browse Code »

    This patch fixes the compilation of net/netfilter/nfnetlink_cthelper.c
    if CONFIG_NF_CONNTRACK is not set.

    This patch also moves the definition of the cthelper infrastructure to
    the scope of NF_CONNTRACK things.

    I have also renamed NETFILTER_NETLINK_CTHELPER by NF_CT_NETLINK_HELPER,
    to use similar names to other nf_conntrack_netlink extensions. Better now
    that this has been only for two days in David's tree.

    Two new dependencies have been added:

    * NF_CT_NETLINK
    * NETFILTER_NETLINK_QUEUE

    Since these infrastructure requires both ctnetlink and nfqueue.

    Reported-by: Randy Dunlap
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • 32f537600   netfilter: nf_ct_helper: disable automatic helper re-assignment of different type ... Browse Code »

    This patch modifies __nf_ct_try_assign_helper in a way that invalidates support
    for the following scenario:

    1) attach the helper A for first time when the conntrack is created
    2) attach new (different) helper B due to changes the reply tuple caused by NAT

    eg. port redirection from TCP/21 to TCP/5060 with both FTP and SIP helpers
    loaded, which seems to be a quite unorthodox scenario.

    I can provide a more elaborated patch to support this scenario but explicit
    helper attachment provides a better solution for this since now the use can
    attach the helpers consistently, without relying on the automatic helper
    lookup magic.

    This patch fixes a possible out of bound zeroing of the conntrack helper
    extension if the helper B uses more memory for its private data than
    helper A.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • fd7462de4   netfilter: ctnetlink: fix NULL dereference while trying to change helper ... Browse Code »

    The patch 1afc56794e03: "netfilter: nf_ct_helper: implement variable
    length helper private data" from Jun 7, 2012, leads to the following
    Smatch complaint:

    net/netfilter/nf_conntrack_netlink.c:1231 ctnetlink_change_helper()
    error: we previously assumed 'help->helper' could be null (see line 1228)

    This NULL dereference can be triggered with the following sequence:

    1) attach the helper for first time when the conntrack is created.
    2) remove the helper module or detach the helper from the conntrack
    via ctnetlink.
    3) attach helper again (the same or different one, no matter) to the
    that existing conntrack again via ctnetlink.

    This patch fixes the problem by removing the use case that allows you
    to re-assign again a helper for one conntrack entry via ctnetlink since
    I cannot find any practical use for it.

    Reported-by: Dan Carpenter
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

17 Jun, 2012

1 commit

  • 82f437b95   Merge branch 'master' of git://1984.lsi.us.es/nf-next ... Browse Code »

    Pablo says:

    ====================
    This is the second batch of Netfilter updates for net-next. It contains the
    kernel changes for the new user-space connection tracking helper
    infrastructure.

    More details on this infrastructure are provides here:
    http://lwn.net/Articles/500196/

    Still, I plan to provide some official documentation through the
    conntrack-tools user manual on how to setup user-space utilities for this.
    So far, it provides two helper in user-space, one for NFSv3 and another for
    Oracle/SQLnet/TNS. Yet in my TODO list.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

16 Jun, 2012

5 commits

  • 12f7a5053   netfilter: add user-space connection tracking helper infrastructure ... Browse Code »

    There are good reasons to supports helpers in user-space instead:

    * Rapid connection tracking helper development, as developing code
    in user-space is usually faster.

    * Reliability: A buggy helper does not crash the kernel. Moreover,
    we can monitor the helper process and restart it in case of problems.

    * Security: Avoid complex string matching and mangling in kernel-space
    running in privileged mode. Going further, we can even think about
    running user-space helpers as a non-root process.

    * Extensibility: It allows the development of very specific helpers (most
    likely non-standard proprietary protocols) that are very likely not to be
    accepted for mainline inclusion in the form of kernel-space connection
    tracking helpers.

    This patch adds the infrastructure to allow the implementation of
    user-space conntrack helpers by means of the new nfnetlink subsystem
    `nfnetlink_cthelper' and the existing queueing infrastructure
    (nfnetlink_queue).

    I had to add the new hook NF_IP6_PRI_CONNTRACK_HELPER to register
    ipv[4|6]_helper which results from splitting ipv[4|6]_confirm into
    two pieces. This change is required not to break NAT sequence
    adjustment and conntrack confirmation for traffic that is enqueued
    to our user-space conntrack helpers.

    Basic operation, in a few steps:

    1) Register user-space helper by means of `nfct':

    nfct helper add ftp inet tcp

    [ It must be a valid existing helper supported by conntrack-tools ]

    2) Add rules to enable the FTP user-space helper which is
    used to track traffic going to TCP port 21.

    For locally generated packets:

    iptables -I OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp

    For non-locally generated packets:

    iptables -I PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp

    3) Run the test conntrackd in helper mode (see example files under
    doc/helper/conntrackd.conf

    conntrackd

    4) Generate FTP traffic going, if everything is OK, then conntrackd
    should create expectations (you can check that with `conntrack':

    conntrack -E expect

    [NEW] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp
    [DESTROY] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp

    This confirms that our test helper is receiving packets including the
    conntrack information, and adding expectations in kernel-space.

    The user-space helper can also store its private tracking information
    in the conntrack structure in the kernel via the CTA_HELP_INFO. The
    kernel will consider this a binary blob whose layout is unknown. This
    information will be included in the information that is transfered
    to user-space via glue code that integrates nfnetlink_queue and
    ctnetlink.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • ae243bee3   netfilter: ctnetlink: add CTA_HELP_INFO attribute ... Browse Code »

    This attribute can be used to modify and to dump the internal
    protocol information.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • 8c88f87cb   netfilter: nfnetlink_queue: add NAT TCP sequence adjustment if packet mangled ... Browse Code »

    User-space programs that receive traffic via NFQUEUE may mangle packets.
    If NAT is enabled, this usually puzzles sequence tracking, leading to
    traffic disruptions.

    With this patch, nfnl_queue will make the corresponding NAT TCP sequence
    adjustment if:

    1) The packet has been mangled,
    2) the NFQA_CFG_F_CONNTRACK flag has been set, and
    3) NAT is detected.

    There are some records on the Internet complaning about this issue:
    http://stackoverflow.com/questions/260757/packet-mangling-utilities-besides-iptables

    By now, we only support TCP since we have no helpers for DCCP or SCTP.
    Better to add this if we ever have some helper over those layer 4 protocols.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • 9cb017665   netfilter: add glue code to integrate nfnetlink_queue and ctnetlink ... Browse Code »

    This patch allows you to include the conntrack information together
    with the packet that is sent to user-space via NFQUEUE.

    Previously, there was no integration between ctnetlink and
    nfnetlink_queue. If you wanted to access conntrack information
    from your libnetfilter_queue program, you required to query
    ctnetlink from user-space to obtain it. Thus, delaying the packet
    processing even more.

    Including the conntrack information is optional, you can set it
    via NFQA_CFG_F_CONNTRACK flag with the new NFQA_CFG_FLAGS attribute.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • 1afc56794   netfilter: nf_ct_helper: implement variable length helper private data ... Browse Code »

    This patch uses the new variable length conntrack extensions.

    Instead of using union nf_conntrack_help that contain all the
    helper private data information, we allocate variable length
    area to store the private helper data.

    This patch includes the modification of all existing helpers.
    It also includes a couple of include header to avoid compilation
    warnings.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso