Eric Lee / smarc-fsl-linux-kernel

22 Nov, 2011

1 commit

  • 70e9942f1   netfilter: nf_conntrack: make event callback registration per-netns ... Browse Code »
    43

    This patch fixes an oops that can be triggered following this recipe:

    0) make sure nf_conntrack_netlink and nf_conntrack_ipv4 are loaded.
    1) container is started.
    2) connect to it via lxc-console.
    3) generate some traffic with the container to create some conntrack
    entries in its table.
    4) stop the container: you hit one oops because the conntrack table
    cleanup tries to report the destroy event to user-space but the
    per-netns nfnetlink socket has already gone (as the nfnetlink
    socket is per-netns but event callback registration is global).

    To fix this situation, we make the ctnl_notifier per-netns so the
    callback is registered/unregistered if the container is
    created/destroyed.

    Alex Bligh and Alexey Dobriyan originally proposed one small patch to
    check if the nfnetlink socket is gone in nfnetlink_has_listeners,
    but this is a very visited path for events, thus, it may reduce
    performance and it looks a bit hackish to check for the nfnetlink
    socket only to workaround this situation. As a result, I decided
    to follow the bigger path choice, which seems to look nicer to me.

    Cc: Alexey Dobriyan
    Reported-by: Alex Bligh
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

07 Nov, 2011

1 commit

  • 32aaeffbd   Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux ... Browse Code »

    * 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits)
    Revert "tracing: Include module.h in define_trace.h"
    irq: don't put module.h into irq.h for tracking irqgen modules.
    bluetooth: macroize two small inlines to avoid module.h
    ip_vs.h: fix implicit use of module_get/module_put from module.h
    nf_conntrack.h: fix up fallout from implicit moduleparam.h presence
    include: replace linux/module.h with "struct module" wherever possible
    include: convert various register fcns to macros to avoid include chaining
    crypto.h: remove unused crypto_tfm_alg_modname() inline
    uwb.h: fix implicit use of asm/page.h for PAGE_SIZE
    pm_runtime.h: explicitly requires notifier.h
    linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h
    miscdevice.h: fix up implicit use of lists and types
    stop_machine.h: fix implicit use of smp.h for smp_processor_id
    of: fix implicit use of errno.h in include/linux/of.h
    of_platform.h: delete needless include
    acpi: remove module.h include from platform/aclinux.h
    miscdevice.h: delete unnecessary inclusion of module.h
    device_cgroup.h: delete needless include
    net: sch_generic remove redundant use of
    net: inet_timewait_sock doesnt need
    ...

    Fix up trivial conflicts (other header files, and removal of the ab3550 mfd driver) in
    - drivers/media/dvb/frontends/dibx000_common.c
    - drivers/media/video/{mt9m111.c,ov6650.c}
    - drivers/mfd/ab3550-core.c
    - include/linux/dmaengine.h

    Linus Torvalds
     

01 Nov, 2011

3 commits

  • 8d83f63b1   netfilter: export NAT definitions through linux/netfilter_ipv4/nf_nat.h ... Browse Code »

    This patch exports several definitions that used to live under
    include/net/netfilter/nf_nat.h. These definitions, although not
    exported, have been used by iptables and other userspace
    applications like miniupnpd since long time. Basically, these
    userspace tools included some internal definition of the required
    structures and they assume no changes in the binary representation
    (which is OK indeed).

    To resolve this situation, this patch makes public the required
    structure and install them in INSTALL_HDR_PATH.

    See: https://bugs.gentoo.org/376873, for more information.

    This patch is heavily based on the initial patch sent by:

    Anthony G. Basile

    Which was entitled:

    netfilter: export sanitized nf_nat.h to INSTALL_HDR_PATH

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • b9075fa96   treewide: use __printf not __attribute__((format(printf,...))) ... Browse Code »

    Standardize the style for compiler based printf format verification.
    Standardized the location of __printf too.

    Done via script and a little typing.

    $ grep -rPl --include=*.[ch] -w "__attribute__" * | \
    grep -vP "^(tools|scripts|include/linux/compiler-gcc.h)" | \
    xargs perl -n -i -e 'local $/; while (<>) { s/\b__attribute__\s*\(\s*\(\s*format\s*\(\s*printf\s*,\s*(.+)\s*,\s*(.+)\s*\)\s*\)\s*\)/__printf($1, $2)/g ; print; }'

    [akpm@linux-foundation.org: revert arch bits]
    Signed-off-by: Joe Perches
    Cc: "Kirill A. Shutemov"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Joe Perches
     
  • 34641c6d0   nf_conntrack.h: fix up fallout from implicit moduleparam.h presence ... Browse Code »

    The implicit presence of module.h everywhere meant that this header
    also was getting moduleparam.h which defines struct kernel_param.

    Since it only needs to know that kernel_param is a struct, call that
    out instead of adding an include of moduleparam.h -- to get rid of this:

    include/net/netfilter/nf_conntrack.h:316: warning: 'struct kernel_param' declared inside parameter list
    include/net/netfilter/nf_conntrack.h:316: warning: its scope is only this definition or declaration, which is probably not what you want

    Signed-off-by: Paul Gortmaker

    Paul Gortmaker
     

27 Jul, 2011

1 commit

  • 60063497a   atomic: use <linux/atomic.h> ... Browse Code »

    This allows us to move duplicated code in
    (atomic_inc_not_zero() for now) to

    Signed-off-by: Arun Sharma
    Reviewed-by: Eric Dumazet
    Cc: Ingo Molnar
    Cc: David Miller
    Cc: Eric Dumazet
    Acked-by: Mike Frysinger
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Arun Sharma
     

16 Jun, 2011

1 commit

  • 42c1edd34   netfilter: nf_nat: avoid double seq_adjust for loopback ... Browse Code »

    Avoid double seq adjustment for loopback traffic
    because it causes silent repetition of TCP data. One
    example is passive FTP with DNAT rule and difference in the
    length of IP addresses.

    This patch adds check if packet is sent and
    received via loopback device. As the same conntrack is
    used both for outgoing and incoming direction, we restrict
    seq adjustment to happen only in POSTROUTING.

    Signed-off-by: Julian Anastasov
    Signed-off-by: Patrick McHardy

    Julian Anastasov
     

25 Apr, 2011

1 commit

  • 2a9e95070   net: Remove __KERNEL__ cpp checks from include/net ... Browse Code »

    These header files are never installed to user consumption, so any
    __KERNEL__ cpp checks are superfluous.

    Projects should also not copy these files into their userland utility
    sources and try to use them there. If they insist on doing so, the
    onus is on them to sanitize the headers as needed.

    Signed-off-by: David S. Miller

    David S. Miller
     

20 Feb, 2011

1 commit

17 Feb, 2011

1 commit

  • d503b30bd   netfilter: tproxy: do not assign timewait sockets to skb->sk ... Browse Code »

    Assigning a socket in timewait state to skb->sk can trigger
    kernel oops, e.g. in nfnetlink_log, which does:

    if (skb->sk) {
    read_lock_bh(&skb->sk->sk_callback_lock);
    if (skb->sk->sk_socket && skb->sk->sk_socket->file) ...

    in the timewait case, accessing sk->sk_callback_lock and sk->sk_socket
    is invalid.

    Either all of these spots will need to add a test for sk->sk_state != TCP_TIME_WAIT,
    or xt_TPROXY must not assign a timewait socket to skb->sk.

    This does the latter.

    If a TW socket is found, assign the tproxy nfmark, but skip the skb->sk assignment,
    thus mimicking behaviour of a '-m socket .. -j MARK/ACCEPT' re-routing rule.

    The 'SYN to TW socket' case is left unchanged -- we try to redirect to the
    listener socket.

    Cc: Balazs Scheidler
    Cc: KOVACS Krisztian
    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

05 Feb, 2011

1 commit

01 Feb, 2011

1 commit

  • 3db7e93d3   netfilter: ecache: always set events bits, filter them later ... Browse Code »

    For the following rule:

    iptables -I PREROUTING -t raw -j CT --ctevents assured

    The event delivered looks like the following:

    [UPDATE] tcp 6 src=192.168.0.2 dst=192.168.1.2 sport=37041 dport=80 src=192.168.1.2 dst=192.168.1.100 sport=80 dport=37041 [ASSURED]

    Note that the TCP protocol state is not included. For that reason
    the CT event filtering is not very useful for conntrackd.

    To resolve this issue, instead of conditionally setting the CT events
    bits based on the ctmask, we always set them and perform the filtering
    in the late stage, just before the delivery.

    Thus, the event delivered looks like the following:

    [UPDATE] tcp 6 432000 ESTABLISHED src=192.168.0.2 dst=192.168.1.2 sport=37041 dport=80 src=192.168.1.2 dst=192.168.1.100 sport=80 dport=37041 [ASSURED]

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     

21 Jan, 2011

1 commit

19 Jan, 2011

2 commits

  • a992ca2a0   netfilter: nf_conntrack_tstamp: add flow-based timestamp extension ... Browse Code »

    This patch adds flow-based timestamping for conntracks. This
    conntrack extension is disabled by default. Basically, we use
    two 64-bits variables to store the creation timestamp once the
    conntrack has been confirmed and the other to store the deletion
    time. This extension is disabled by default, to enable it, you
    have to:

    echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp

    This patch allows to save memory for user-space flow-based
    loogers such as ulogd2. In short, ulogd2 does not need to
    keep a hashtable with the conntrack in user-space to know
    when they were created and destroyed, instead we use the
    kernel timestamp. If we want to have a sane IPFIX implementation
    in user-space, this nanosecs resolution timestamps are also
    useful. Other custom user-space applications can benefit from
    this via libnetfilter_conntrack.

    This patch modifies the /proc output to display the delta time
    in seconds since the flow start. You can also obtain the
    flow-start date by means of the conntrack-tools.

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     
  • 93557f53e   netfilter: nf_conntrack: nf_conntrack snmp helper ... Browse Code »

    Adding support for SNMP broadcast connection tracking. The SNMP
    broadcast requests are now paired with the SNMP responses.
    Thus allowing using SNMP broadcasts with firewall enabled.

    Please refer to the following conversation:
    http://marc.info/?l=netfilter-devel&m=125992205006600&w=2

    Patrick McHardy wrote:
    > > The best solution would be to add generic broadcast tracking, the
    > > use of expectations for this is a bit of abuse.
    > > The second best choice I guess would be to move the help() function
    > > to a shared module and generalize it so it can be used for both.
    This patch implements the "second best choice".

    Since the netbios-ns conntrack module uses the same helper
    functionality as the snmp, only one helper function is added
    for both snmp and netbios-ns modules into the new object -
    nf_conntrack_broadcast.

    Signed-off-by: Jiri Olsa
    Signed-off-by: Patrick McHardy

    Jiri Olsa
     

18 Jan, 2011

1 commit

14 Jan, 2011

1 commit

13 Jan, 2011

2 commits

07 Jan, 2011

1 commit

16 Dec, 2010

1 commit

  • ae90bdeae   netfilter: fix compilation when conntrack is disabled but tproxy is enabled ... Browse Code »

    The IPv6 tproxy patches split IPv6 defragmentation off of conntrack, but
    failed to update the #ifdef stanzas guarding the defragmentation related
    fields and code in skbuff and conntrack related code in nf_defrag_ipv6.c.

    This patch adds the required #ifdefs so that IPv6 tproxy can truly be used
    without connection tracking.

    Original report:
    http://marc.info/?l=linux-netdev&m=129010118516341&w=2

    Reported-by: Randy Dunlap
    Signed-off-by: KOVACS Krisztian
    Acked-by: Randy Dunlap
    Signed-off-by: Patrick McHardy

    KOVACS Krisztian
     

16 Nov, 2010

1 commit

15 Nov, 2010

4 commits

13 Nov, 2010

1 commit

24 Oct, 2010

1 commit

  • 5f05647dd   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6 ... Browse Code »

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1699 commits)
    bnx2/bnx2x: Unsupported Ethtool operations should return -EINVAL.
    vlan: Calling vlan_hwaccel_do_receive() is always valid.
    tproxy: use the interface primary IP address as a default value for --on-ip
    tproxy: added IPv6 support to the socket match
    cxgb3: function namespace cleanup
    tproxy: added IPv6 support to the TPROXY target
    tproxy: added IPv6 socket lookup function to nf_tproxy_core
    be2net: Changes to use only priority codes allowed by f/w
    tproxy: allow non-local binds of IPv6 sockets if IP_TRANSPARENT is enabled
    tproxy: added tproxy sockopt interface in the IPV6 layer
    tproxy: added udp6_lib_lookup function
    tproxy: added const specifiers to udp lookup functions
    tproxy: split off ipv6 defragmentation to a separate module
    l2tp: small cleanup
    nf_nat: restrict ICMP translation for embedded header
    can: mcp251x: fix generation of error frames
    can: mcp251x: fix endless loop in interrupt handler if CANINTF_MERRF is set
    can-raw: add msg_flags to distinguish local traffic
    9p: client code cleanup
    rds: make local functions/variables static
    ...

    Fix up conflicts in net/core/dev.c, drivers/net/pcmcia/smc91c92_cs.c and
    drivers/net/wireless/ath/ath9k/debug.c as per David

    Linus Torvalds
     

21 Oct, 2010

4 commits

19 Oct, 2010

1 commit

05 Oct, 2010

2 commits

29 Sep, 2010

1 commit

  • bc01befdc   netfilter: ctnetlink: add support for user-space expectation helpers ... Browse Code »
    43

    This patch adds the basic infrastructure to support user-space
    expectation helpers via ctnetlink and the netfilter queuing
    infrastructure NFQUEUE. Basically, this patch:

    * adds NF_CT_EXPECT_USERSPACE flag to identify user-space
    created expectations. I have also added a sanity check in
    __nf_ct_expect_check() to avoid that kernel-space helpers
    may create an expectation if the master conntrack has no
    helper assigned.
    * adds some branches to check if the master conntrack helper
    exists, otherwise we skip the code that refers to kernel-space
    helper such as the local expectation list and the expectation
    policy.
    * allows to set the timeout for user-space expectations with
    no helper assigned.
    * a list of expectations created from user-space that depends
    on ctnetlink (if this module is removed, they are deleted).
    * includes USERSPACE in the /proc output for expectations
    that have been created by a user-space helper.

    This patch also modifies ctnetlink to skip including the helper
    name in the Netlink messages if no kernel-space helper is set
    (since no user-space expectation has not kernel-space kernel
    assigned).

    You can access an example user-space FTP conntrack helper at:
    http://people.netfilter.org/pablo/userspace-conntrack-helpers/nf-ftp-helper-userspace-POC.tar.bz

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     

22 Sep, 2010

1 commit

20 Aug, 2010

1 commit

02 Aug, 2010

2 commits