Eric Lee / smarc-fsl-linux-kernel

27 Aug, 2011

1 commit

10 Jun, 2008

1 commit

  • 560ee653b   netfilter: ip_tables: add iptables security table for mandatory access control rules ... Browse Code »

    The following patch implements a new "security" table for iptables, so
    that MAC (SELinux etc.) networking rules can be managed separately to
    standard DAC rules.

    This is to help with distro integration of the new secmark-based
    network controls, per various previous discussions.

    The need for a separate table arises from the fact that existing tools
    and usage of iptables will likely clash with centralized MAC policy
    management.

    The SECMARK and CONNSECMARK targets will still be valid in the mangle
    table to prevent breakage of existing users.

    Signed-off-by: James Morris
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    James Morris
     

14 Apr, 2008

1 commit

  • dd13b0103   [NETFILTER]: nf_nat: kill helper and seq_adjust hooks ... Browse Code »

    Connection tracking helpers (specifically FTP) need to be called
    before NAT sequence numbers adjustments are performed to be able
    to compare them against previously seen ones. We've introduced
    two new hooks around 2.6.11 to maintain this ordering when NAT
    modules were changed to get called from conntrack helpers directly.

    The cost of netfilter hooks is quite high and sequence number
    adjustments are only rarely needed however. Add a RCU-protected
    sequence number adjustment function pointer and call it from
    IPv4 conntrack after calling the helper.

    Signed-off-by: Patrick McHardy

    Patrick McHardy
     

29 Jan, 2008

1 commit

  • 6e23ae2a4   [NETFILTER]: Introduce NF_INET_ hook values ... Browse Code »

    The IPv4 and IPv6 hook values are identical, yet some code tries to figure
    out the "correct" value by looking at the address family. Introduce NF_INET_*
    values for both IPv4 and IPv6. The old values are kept in a #ifndef __KERNEL__
    section for userspace compatibility.

    Signed-off-by: Patrick McHardy
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Patrick McHardy
     

16 Oct, 2007

1 commit

14 Dec, 2006

1 commit

03 Dec, 2006

1 commit

04 Oct, 2006

1 commit

  • b4c4ed175   [NETFILTER]: add type parameter to ip_route_me_harder ... Browse Code »

    By adding a type parameter to ip_route_me_harder() the
    expensive call to inet_addr_type() can be avoided in some cases.
    A followup patch where ip_route_me_harder() is called from within
    ip_vs_out() is one such example.

    Signed-off-By: Simon Horman
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Simon Horman
     

26 Apr, 2006

1 commit

10 Apr, 2006

1 commit

15 Feb, 2006

1 commit

  • ee68cea2c   [NETFILTER]: Fix xfrm lookup after SNAT ... Browse Code »

    To find out if a packet needs to be handled by IPsec after SNAT, packets
    are currently rerouted in POST_ROUTING and a new xfrm lookup is done. This
    breaks SNAT of non-unicast packets to non-local addresses because the
    packet is routed as incoming packet and no neighbour entry is bound to the
    dst_entry. In general, it seems to be a bad idea to replace the dst_entry
    after the packet was already sent to the output routine because its state
    might not match what's expected.

    This patch changes the xfrm lookup in POST_ROUTING to re-use the original
    dst_entry without routing the packet again. This means no policy routing
    can be used for transport mode transforms (which keep the original route)
    when packets are SNATed to match the policy, but it looks like the best
    we can do for now.

    Signed-off-by: Patrick McHardy
    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Patrick McHardy
     

30 Aug, 2005

2 commits

  • 089af26c7   [NETFILTER]: Rename skb_ip_make_writable() to skb_make_writable() ... Browse Code »

    There is nothing IPv4-specific in it. In fact, it was already used by
    IPv6, too... Upcoming nfnetlink_queue code will use it for any kind
    of packet.

    Signed-off-by: Harald Welte
    Signed-off-by: David S. Miller

    Harald Welte
     
  • 6869c4d8e   [NETFILTER]: reduce netfilter sk_buff enlargement ... Browse Code »

    As discussed at netconf'05, we're trying to save every bit in sk_buff.
    The patch below makes sk_buff 8 bytes smaller. I did some basic
    testing on my notebook and it seems to work.

    The only real in-tree user of nfcache was IPVS, who only needs a
    single bit. Unfortunately I couldn't find some other free bit in
    sk_buff to stuff that bit into, so I introduced a separate field for
    them. Maybe the IPVS guys can resolve that to further save space.

    Initially I wanted to shrink pkt_type to three bits (PACKET_HOST and
    alike are only 6 values defined), but unfortunately the bluetooth code
    overloads pkt_type :(

    The conntrack-event-api (out-of-tree) uses nfcache, but Rusty just
    came up with a way how to do it without any skb fields, so it's safe
    to remove it.

    - remove all never-implemented 'nfcache' code
    - don't have ipvs code abuse 'nfcache' field. currently get's their own
    compile-conditional skb->ipvs_property field. IPVS maintainers can
    decide to move this bit elswhere, but nfcache needs to die.
    - remove skb->nfcache field to save 4 bytes
    - move skb->nfctinfo into three unused bits to save further 4 bytes

    Signed-off-by: Harald Welte
    Signed-off-by: David S. Miller

    Harald Welte
     

22 Jun, 2005

1 commit

25 Apr, 2005

1 commit

  • e281e3ac2   [NETFILTER]: Fix NAT sequence number adjustment ... Browse Code »

    The NAT changes in 2.6.11 changed the position where helpers
    are called and perform packet mangling. Before 2.6.11, a NAT
    helper was called before the packet was NATed and had its
    sequence number adjusted. Since 2.6.11, the helpers get packets
    with already adjusted sequence numbers.

    This breaks sequence number adjustment, adjust_tcp_sequence()
    needs the original sequence number to determine whether
    a packet was a retransmission and to store it for further
    corrections. It can't be reconstructed without more information
    than available, so this patch restores the old order by
    calling helpers from a new conntrack hook two priorities
    below ip_conntrack_confirm() and adjusting the sequence number
    from a new NAT hook one priority below ip_conntrack_confirm().

    Tracked down by Phil Oester

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

17 Apr, 2005

1 commit

  • 1da177e4c   Linux-2.6.12-rc2 ... Browse Code »

    Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds