Eric Lee / smarc-fsl-linux-kernel

21 May, 2019

1 commit

  • 1ccea77e2   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 ... Browse Code »

    Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details you
    should have received a copy of the gnu general public license along
    with this program if not see http www gnu org licenses

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details [based]
    [from] [clk] [highbank] [c] you should have received a copy of the
    gnu general public license along with this program if not see http
    www gnu org licenses

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 355 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Kate Stewart
    Reviewed-by: Jilayne Lovejoy
    Reviewed-by: Steve Winslow
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190519154041.837383322@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

16 Oct, 2018

1 commit

30 Jul, 2018

1 commit

07 May, 2018

1 commit

06 Dec, 2017

1 commit

  • 916a27901   netfilter: xt_osf: Add missing permission checks ... Browse Code »

    The capability check in nfnetlink_rcv() verifies that the caller
    has CAP_NET_ADMIN in the namespace that "owns" the netlink socket.
    However, xt_osf_fingers is shared by all net namespaces on the
    system. An unprivileged user can create user and net namespaces
    in which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()
    check:

    vpnns -- nfnl_osf -f /tmp/pf.os

    vpnns -- nfnl_osf -f /tmp/pf.os -d

    These non-root operations successfully modify the systemwide OS
    fingerprint list. Add new capable() checks so that they can't.

    Signed-off-by: Kevin Cernekee
    Signed-off-by: Pablo Neira Ayuso

    Kevin Cernekee
     

24 Jul, 2017

1 commit

  • 0b35f6031   netfilter: Remove duplicated rcu_read_lock. ... Browse Code »

    This patch removes duplicate rcu_read_lock().

    1. IPVS part:

    According to Julian Anastasov's mention, contexts of ipvs are described
    at: http://marc.info/?l=netfilter-devel&m=149562884514072&w=2, in summary:

    - packet RX/TX: does not need locks because packets come from hooks.
    - sync msg RX: backup server uses RCU locks while registering new
    connections.
    - ip_vs_ctl.c: configuration get/set, RCU locks needed.
    - xt_ipvs.c: It is a netfilter match, running from hook context.

    As result, rcu_read_lock and rcu_read_unlock can be removed from:

    - ip_vs_core.c: all
    - ip_vs_ctl.c:
    - only from ip_vs_has_real_service
    - ip_vs_ftp.c: all
    - ip_vs_proto_sctp.c: all
    - ip_vs_proto_tcp.c: all
    - ip_vs_proto_udp.c: all
    - ip_vs_xmit.c: all (contains only packet processing)

    2. Netfilter part:

    There are three types of functions that are guaranteed the rcu_read_lock().
    First, as result, functions are only called by nf_hook():

    - nf_conntrack_broadcast_help(), pptp_expectfn(), set_expected_rtp_rtcp().
    - tcpmss_reverse_mtu(), tproxy_laddr4(), tproxy_laddr6().
    - match_lookup_rt6(), check_hlist(), hashlimit_mt_common().
    - xt_osf_match_packet().

    Second, functions that caller already held the rcu_read_lock().
    - destroy_conntrack(), ctnetlink_conntrack_event().
    - ctnl_timeout_find_get(), nfqnl_nf_hook_drop().

    Third, functions that are mixed with type1 and type2.

    These functions are called by nf_hook() also these are called by
    ordinary functions that already held the rcu_read_lock():

    - __ctnetlink_glue_build(), ctnetlink_expect_event().
    - ctnetlink_proto_size().

    Applied files are below:

    - nf_conntrack_broadcast.c, nf_conntrack_core.c, nf_conntrack_netlink.c.
    - nf_conntrack_pptp.c, nf_conntrack_sip.c, nfnetlink_cttimeout.c.
    - nfnetlink_queue.c, xt_TCPMSS.c, xt_TPROXY.c, xt_addrtype.c.
    - xt_connlimit.c, xt_hashlimit.c, xt_osf.c

    Detailed calltrace can be found at:
    http://marc.info/?l=netfilter-devel&m=149667610710350&w=2

    Signed-off-by: Taehee Yoo
    Acked-by: Julian Anastasov
    Signed-off-by: Pablo Neira Ayuso

    Taehee Yoo
     

20 Jun, 2017

1 commit

  • 04ba724b6   netfilter: nfnetlink: extended ACK reporting ... Browse Code »

    Pass down struct netlink_ext_ack as parameter to all of our nfnetlink
    subsystem callbacks, so we can work on follow up patches to provide
    finer grain error reporting using the new infrastructure that
    2d4bc93368f5 ("netlink: extended ACK reporting") provides.

    No functional change, just pass down this new object to callbacks.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

03 Nov, 2016

1 commit

29 Feb, 2016

1 commit

  • 8ee225e78   netfilter: xt_osf: remove unused variable ... Browse Code »

    While building with W=1 we got the warning:
    net/netfilter/xt_osf.c:265:9: warning: variable 'loop_cont' set but not used

    The local variable loop_cont was only initialized and then assigned a
    value but was never used or checked after that.
    While removing the variable, the case of OSFOPT_TS was not removed so
    that it will serve as a reminder to us that we can do something in that
    particular case.

    Signed-off-by: Sudip Mukherjee
    Signed-off-by: Pablo Neira Ayuso

    Sudip Mukherjee
     

29 Dec, 2015

1 commit

19 Sep, 2015

1 commit

23 Dec, 2014

1 commit

  • 372e28661   netfilter: xt_osf: Use continue to reduce indentation ... Browse Code »

    Invert logic in test to use continue.

    This routine already uses continue, use it a bit more to
    minimize > 80 column long lines and unnecessary indentation.

    No change in compiled object file.

    Other miscellanea:

    o Remove trailing whitespace
    o Realign arguments to multiline statement

    Signed-off-by: Joe Perches
    Acked-by: Evgeniy Polyakov
    Signed-off-by: Pablo Neira Ayuso

    Joe Perches
     

04 Apr, 2014

1 commit

  • b8ddd9eac   netfilter: Add {ipt,ip6t}_osf aliases for xt_osf ... Browse Code »

    There are no these aliases, so kernel can not request appropriate
    match table:

    $ iptables -I INPUT -p tcp -m osf --genre Windows --ttl 2 -j DROP
    iptables: No chain/target/match by that name.

    setsockopt() requests ipt_osf module, which is not present. Add
    the aliases.

    Signed-off-by: Kirill Tkhai
    Signed-off-by: Pablo Neira Ayuso

    Kirill Tkhai
     

07 Dec, 2013

1 commit

  • e664eabd1   netfilter: Fix FSF address in file headers ... Browse Code »

    Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: netfilter@vger.kernel.org
    CC: Pablo Neira Ayuso
    CC: Patrick McHardy
    CC: Jozsef Kadlecsik
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Jeff Kirsher
     

06 Apr, 2013

1 commit

  • 30e0c6a6b   netfilter: nf_log: prepare net namespace support for loggers ... Browse Code »

    This patch adds netns support to nf_log and it prepares netns
    support for existing loggers. It is composed of four major
    changes.

    1) nf_log_register has been split to two functions: nf_log_register
    and nf_log_set. The new nf_log_register is used to globally
    register the nf_logger and nf_log_set is used for enabling
    pernet support from nf_loggers.

    Per netns is not yet complete after this patch, it comes in
    separate follow up patches.

    2) Add net as a parameter of nf_log_bind_pf. Per netns is not
    yet complete after this patch, it only allows to bind the
    nf_logger to the protocol family from init_net and it skips
    other cases.

    3) Adapt all nf_log_packet callers to pass netns as parameter.
    After this patch, this function only works for init_net.

    4) Make the sysctl net/netfilter/nf_log pernet.

    Signed-off-by: Gao feng
    Signed-off-by: Pablo Neira Ayuso

    Gao feng
     

20 Aug, 2012

1 commit

  • fe31d1a86   netfilter: sparse endian fixes ... Browse Code »

    Fix a couple of endian annotation in net/netfilter:

    net/netfilter/nfnetlink_acct.c:82:30: warning: cast to restricted __be64
    net/netfilter/nfnetlink_acct.c:86:30: warning: cast to restricted __be64
    net/netfilter/nfnetlink_cthelper.c:77:28: warning: cast to restricted __be16
    net/netfilter/xt_NFQUEUE.c:46:16: warning: restricted __be32 degrades to integer
    net/netfilter/xt_NFQUEUE.c:60:34: warning: restricted __be32 degrades to integer
    net/netfilter/xt_NFQUEUE.c:68:34: warning: restricted __be32 degrades to integer
    net/netfilter/xt_osf.c:272:55: warning: cast to restricted __be16

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

08 May, 2011

1 commit

12 May, 2010

2 commits

18 Mar, 2010

1 commit

11 Jan, 2010

1 commit

  • 7f635d0d1   netfilter: xt_osf: change %pi4 to %pI4 ... Browse Code »

    commit 8a27f7c90ffcb791eed7574922b51fb60b08fc89
    changed the output style of %pi4 to use fixed
    width leading zero IP addresses "001.002.003.004".

    It's useful when printing multiple lines of
    addresses, but was a change in output style for
    some existing uses.

    Using %pI4 restores the previous output style.

    Signed-off-by: Joe Perches
    Signed-off-by: Patrick McHardy

    Joe Perches
     

20 Nov, 2009

1 commit

25 Aug, 2009

1 commit

16 Jul, 2009

1 commit

08 Jun, 2009

1 commit

  • 11eeef41d   netfilter: passive OS fingerprint xtables match ... Browse Code »

    Passive OS fingerprinting netfilter module allows to passively detect
    remote OS and perform various netfilter actions based on that knowledge.
    This module compares some data (WS, MSS, options and it's order, ttl, df
    and others) from packets with SYN bit set with dynamically loaded OS
    fingerprints.

    Fingerprint matching rules can be downloaded from OpenBSD source tree
    or found in archive and loaded via netfilter netlink subsystem into
    the kernel via special util found in archive.

    Archive contains library file (also attached), which was shipped
    with iptables extensions some time ago (at least when ipt_osf existed
    in patch-o-matic).

    Following changes were made in this release:
    * added NLM_F_CREATE/NLM_F_EXCL checks
    * dropped _rcu list traversing helpers in the protected add/remove calls
    * dropped unneded structures, debug prints, obscure comment and check

    Fingerprints can be downloaded from
    http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os
    or can be found in archive

    Example usage:
    -d switch removes fingerprints

    Please consider for inclusion.
    Thank you.

    Passive OS fingerprint homepage (archives, examples):
    http://www.ioremap.net/projects/osf

    Signed-off-by: Evgeniy Polyakov
    Signed-off-by: Patrick McHardy

    Evgeniy Polyakov