Eric Lee / smarc-fsl-linux-kernel

24 May, 2019

1 commit

  • e97150df8   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 77 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation or any later at your
    option

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 5 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Richard Fontana
    Reviewed-by: Armijn Hemel
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190520075210.769496418@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

28 Apr, 2019

1 commit

  • 8cb081746   netlink: make validation more configurable for future strictness ... Browse Code »

    We currently have two levels of strict validation:

    1) liberal (default)
    - undefined (type >= max) & NLA_UNSPEC attributes accepted
    - attribute length >= expected accepted
    - garbage at end of message accepted
    2) strict (opt-in)
    - NLA_UNSPEC attributes accepted
    - attribute length >= expected accepted

    Split out parsing strictness into four different options:
    * TRAILING - check that there's no trailing data after parsing
    attributes (in message or nested)
    * MAXTYPE - reject attrs > max known type
    * UNSPEC - reject attributes with NLA_UNSPEC policy entries
    * STRICT_ATTRS - strictly validate attribute size

    The default for future things should be *everything*.
    The current *_strict() is a combination of TRAILING and MAXTYPE,
    and is renamed to _deprecated_strict().
    The current regular parsing has none of this, and is renamed to
    *_parse_deprecated().

    Additionally it allows us to selectively set one of the new flags
    even on old policies. Notably, the UNSPEC flag could be useful in
    this case, since it can be arranged (by filling in the policy) to
    not be an incompatible userspace ABI change, but would then going
    forward prevent forgetting attribute entries. Similar can apply
    to the POLICY flag.

    We end up with the following renames:
    * nla_parse -> nla_parse_deprecated
    * nla_parse_strict -> nla_parse_deprecated_strict
    * nlmsg_parse -> nlmsg_parse_deprecated
    * nlmsg_parse_strict -> nlmsg_parse_deprecated_strict
    * nla_parse_nested -> nla_parse_nested_deprecated
    * nla_validate_nested -> nla_validate_nested_deprecated

    Using spatch, of course:
    @@
    expression TB, MAX, HEAD, LEN, POL, EXT;
    @@
    -nla_parse(TB, MAX, HEAD, LEN, POL, EXT)
    +nla_parse_deprecated(TB, MAX, HEAD, LEN, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated_strict(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression TB, MAX, NLA, POL, EXT;
    @@
    -nla_parse_nested(TB, MAX, NLA, POL, EXT)
    +nla_parse_nested_deprecated(TB, MAX, NLA, POL, EXT)

    @@
    expression START, MAX, POL, EXT;
    @@
    -nla_validate_nested(START, MAX, POL, EXT)
    +nla_validate_nested_deprecated(START, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, MAX, POL, EXT;
    @@
    -nlmsg_validate(NLH, HDRLEN, MAX, POL, EXT)
    +nlmsg_validate_deprecated(NLH, HDRLEN, MAX, POL, EXT)

    For this patch, don't actually add the strict, non-renamed versions
    yet so that it breaks compile if I get it wrong.

    Also, while at it, make nla_validate and nla_parse go down to a
    common __nla_validate_parse() function to avoid code duplication.

    Ultimately, this allows us to have very strict validation for every
    new caller of nla_parse()/nlmsg_parse() etc as re-introduced in the
    next patch, while existing things will continue to work as is.

    In effect then, this adds fully strict validation for any new command.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     

17 Aug, 2018

1 commit

  • 3e673b23b   netfilter: fix memory leaks on netlink_dump_start error ... Browse Code »

    Shaochun Chen points out we leak dumper filter state allocations
    stored in dump_control->data in case there is an error before netlink sets
    cb_running (after which ->done will be called at some point).

    In order to fix this, add .start functions and move allocations there.

    Same pattern as used in commit 90fd131afc565159c9e0ea742f082b337e10f8c6
    ("netfilter: nf_tables: move dumper state allocation into ->start").

    Reported-by: shaochun chen
    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

24 May, 2018

1 commit

  • 4b83a9049   netfilter: provide correct argument to nla_strlcpy() ... Browse Code »

    Recent patch forgot to remove nla_data(), upsetting syzkaller a bit.

    BUG: KASAN: slab-out-of-bounds in nla_strlcpy+0x13d/0x150 lib/nlattr.c:314
    Read of size 1 at addr ffff8801ad1f4fdd by task syz-executor189/4509

    CPU: 1 PID: 4509 Comm: syz-executor189 Not tainted 4.17.0-rc6+ #62
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x1b9/0x294 lib/dump_stack.c:113
    print_address_description+0x6c/0x20b mm/kasan/report.c:256
    kasan_report_error mm/kasan/report.c:354 [inline]
    kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
    __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
    nla_strlcpy+0x13d/0x150 lib/nlattr.c:314
    nfnl_acct_new+0x574/0xc50 net/netfilter/nfnetlink_acct.c:118
    nfnetlink_rcv_msg+0xdb5/0xff0 net/netfilter/nfnetlink.c:212
    netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448
    nfnetlink_rcv+0x1fe/0x1ba0 net/netfilter/nfnetlink.c:513
    netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
    netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336
    netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901
    sock_sendmsg_nosec net/socket.c:629 [inline]
    sock_sendmsg+0xd5/0x120 net/socket.c:639
    sock_write_iter+0x35a/0x5a0 net/socket.c:908
    call_write_iter include/linux/fs.h:1784 [inline]
    new_sync_write fs/read_write.c:474 [inline]
    __vfs_write+0x64d/0x960 fs/read_write.c:487
    vfs_write+0x1f8/0x560 fs/read_write.c:549
    ksys_write+0xf9/0x250 fs/read_write.c:598
    __do_sys_write fs/read_write.c:610 [inline]
    __se_sys_write fs/read_write.c:607 [inline]
    __x64_sys_write+0x73/0xb0 fs/read_write.c:607

    Fixes: 4e09fc873d92 ("netfilter: prefer nla_strlcpy for dealing with NLA_STRING attributes")
    Signed-off-by: Eric Dumazet
    Acked-by: Florian Westphal
    Reported-by: syzbot
    Signed-off-by: Pablo Neira Ayuso

    Eric Dumazet
     

08 May, 2018

1 commit

  • 4e09fc873   netfilter: prefer nla_strlcpy for dealing with NLA_STRING attributes ... Browse Code »

    fixes these warnings:
    'nfnl_cthelper_create' at net/netfilter/nfnetlink_cthelper.c:237:2,
    'nfnl_cthelper_new' at net/netfilter/nfnetlink_cthelper.c:450:9:
    ./include/linux/string.h:246:9: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation]
    return __builtin_strncpy(p, q, size);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Moreover, strncpy assumes null-terminated source buffers, but thats
    not the case here.
    Unlike strlcpy, nla_strlcpy *does* pad the destination buffer
    while also considering nla attribute size.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

06 Mar, 2018

1 commit

20 Jan, 2018

1 commit

  • e55311665   netfilter: remove messages print and boot/module load time ... Browse Code »

    Several reasons for this:

    * Several modules maintain internal version numbers, that they print at
    boot/module load time, that are not exposed to userspace, as a
    primitive mechanism to make revision number control from the earlier
    days of Netfilter.

    * IPset shows the protocol version at boot/module load time, instead
    display this via module description, as Jozsef suggested.

    * Remove copyright notice at boot/module load time in two spots, the
    Netfilter codebase is a collective development effort, if we would
    have to display copyrights for each contributor at boot/module load
    time for each extensions we have, we would probably fill up logs with
    lots of useless information - from a technical standpoint.

    So let's be consistent and remove them all.

    Acked-by: Florian Westphal
    Acked-by: Jozsef Kadlecsik
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

20 Jun, 2017

1 commit

  • 04ba724b6   netfilter: nfnetlink: extended ACK reporting ... Browse Code »

    Pass down struct netlink_ext_ack as parameter to all of our nfnetlink
    subsystem callbacks, so we can work on follow up patches to provide
    finer grain error reporting using the new infrastructure that
    2d4bc93368f5 ("netlink: extended ACK reporting") provides.

    No functional change, just pass down this new object to callbacks.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

01 May, 2017

1 commit

  • a01aa920b   Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next ... Browse Code »

    Pablo Neira Ayuso says:

    ====================
    Netfilter/IPVS updates for net-next

    The following patchset contains Netfilter updates for your net-next
    tree. A large bunch of code cleanups, simplify the conntrack extension
    codebase, get rid of the fake conntrack object, speed up netns by
    selective synchronize_net() calls. More specifically, they are:

    1) Check for ct->status bit instead of using nfct_nat() from IPVS and
    Netfilter codebase, patch from Florian Westphal.

    2) Use kcalloc() wherever possible in the IPVS code, from Varsha Rao.

    3) Simplify FTP IPVS helper module registration path, from Arushi Singhal.

    4) Introduce nft_is_base_chain() helper function.

    5) Enforce expectation limit from userspace conntrack helper,
    from Gao Feng.

    6) Add nf_ct_remove_expect() helper function, from Gao Feng.

    7) NAT mangle helper function return boolean, from Gao Feng.

    8) ctnetlink_alloc_expect() should only work for conntrack with
    helpers, from Gao Feng.

    9) Add nfnl_msg_type() helper function to nfnetlink to build the
    netlink message type.

    10) Get rid of unnecessary cast on void, from simran singhal.

    11) Use seq_puts()/seq_putc() instead of seq_printf() where possible,
    also from simran singhal.

    12) Use list_prev_entry() from nf_tables, from simran signhal.

    13) Remove unnecessary & on pointer function in the Netfilter and IPVS
    code.

    14) Remove obsolete comment on set of rules per CPU in ip6_tables,
    no longer true. From Arushi Singhal.

    15) Remove duplicated nf_conntrack_l4proto_udplite4, from Gao Feng.

    16) Remove unnecessary nested rcu_read_lock() in
    __nf_nat_decode_session(). Code running from hooks are already
    guaranteed to run under RCU read side.

    17) Remove deadcode in nf_tables_getobj(), from Aaron Conole.

    18) Remove double assignment in nf_ct_l4proto_pernet_unregister_one(),
    also from Aaron.

    19) Get rid of unsed __ip_set_get_netlink(), from Aaron Conole.

    20) Don't propagate NF_DROP error to userspace via ctnetlink in
    __nf_nat_alloc_null_binding() function, from Gao Feng.

    21) Revisit nf_ct_deliver_cached_events() to remove unnecessary checks,
    from Gao Feng.

    22) Kill the fake untracked conntrack objects, use ctinfo instead to
    annotate a conntrack object is untracked, from Florian Westphal.

    23) Remove nf_ct_is_untracked(), now obsolete since we have no
    conntrack template anymore, from Florian.

    24) Add event mask support to nft_ct, also from Florian.

    25) Move nf_conn_help structure to
    include/net/netfilter/nf_conntrack_helper.h.

    26) Add a fixed 32 bytes scratchpad area for conntrack helpers.
    Thus, we don't deal with variable conntrack extensions anymore.
    Make sure userspace conntrack helper doesn't go over that size.
    Remove variable size ct extension infrastructure now this code
    got no more clients. From Florian Westphal.

    27) Restore offset and length of nf_ct_ext structure to 8 bytes now
    that wraparound is not possible any longer, also from Florian.

    28) Allow to get rid of unassured flows under stress in conntrack,
    this applies to DCCP, SCTP and TCP protocols, from Florian.

    29) Shrink size of nf_conntrack_ecache structure, from Florian.

    30) Use TCP_MAX_WSCALE instead of hardcoded 14 in TCP tracker,
    from Gao Feng.

    31) Register SYNPROXY hooks on demand, from Florian Westphal.

    32) Use pernet hook whenever possible, instead of global hook
    registration, from Florian Westphal.

    33) Pass hook structure to ebt_register_table() to consolidate some
    infrastructure code, from Florian Westphal.

    34) Use consume_skb() and return NF_STOLEN, instead of NF_DROP in the
    SYNPROXY code, to make sure device stats are not fooled, patch
    from Gao Feng.

    35) Remove NF_CT_EXT_F_PREALLOC this kills quite some code that we
    don't need anymore if we just select a fixed size instead of
    expensive runtime time calculation of this. From Florian.

    36) Constify nf_ct_extend_register() and nf_ct_extend_unregister(),
    from Florian.

    37) Simplify nf_ct_ext_add(), this kills nf_ct_ext_create(), from
    Florian.

    38) Attach NAT extension on-demand from masquerade and pptp helper
    path, from Florian.

    39) Get rid of useless ip_vs_set_state_timeout(), from Aaron Conole.

    40) Speed up netns by selective calls of synchronize_net(), from
    Florian Westphal.

    41) Silence stack size warning gcc in 32-bit arch in snmp helper,
    from Florian.

    42) Inconditionally call nf_ct_ext_destroy(), even if we have no
    extensions, to deal with the NF_NAT_MANIP_SRC case. Patch from
    Liping Zhang.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

14 Apr, 2017

1 commit

07 Apr, 2017

1 commit

20 Mar, 2017

1 commit

17 Mar, 2017

1 commit

  • b54ab92b8   netfilter: refcounter conversions ... Browse Code »

    refcount_t type and corresponding API (see include/linux/refcount.h)
    should be used instead of atomic_t when the variable is used as
    a reference counter. This allows to avoid accidental
    refcounter overflows that might lead to use-after-free
    situations.

    Signed-off-by: Elena Reshetova
    Signed-off-by: Hans Liljestrand
    Signed-off-by: Kees Cook
    Signed-off-by: David Windsor
    Signed-off-by: Pablo Neira Ayuso

    Reshetova, Elena
     

25 Aug, 2016

1 commit

18 Aug, 2016

2 commits

  • 12be15dd5   netfilter: nfnetlink_acct: fix race between nfacct del and xt_nfacct destroy ... Browse Code »

    Suppose that we input the following commands at first:
    # nfacct add test
    # iptables -A INPUT -m nfacct --nfacct-name test

    And now "test" acct's refcnt is 2, but later when we try to delete the
    "test" nfacct and the related iptables rule at the same time, race maybe
    happen:
    CPU0 CPU1
    nfnl_acct_try_del nfnl_acct_put
    atomic_dec_and_test //ref=1,testfail -
    - atomic_dec_and_test //ref=0,testok
    - kfree_rcu
    atomic_inc //ref=1 -

    So after the rcu grace period, nf_acct will be freed but it is still linked
    in the nfnl_acct_list, and we can access it later, then oops will happen.

    Convert atomic_dec_and_test and atomic_inc combinaiton to one atomic
    operation atomic_cmpxchg here to fix this problem.

    Signed-off-by: Liping Zhang
    Signed-off-by: Pablo Neira Ayuso

    Liping Zhang
     
  • aca300183   netfilter: nfnetlink_acct: report overquota to the right netns ... Browse Code »

    We should report the over quota message to the right net namespace
    instead of the init netns.

    Signed-off-by: Liping Zhang
    Signed-off-by: Pablo Neira Ayuso

    Liping Zhang
     

16 May, 2016

1 commit

  • 909b27f70   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net ... Browse Code »

    The nf_conntrack_core.c fix in 'net' is not relevant in 'net-next'
    because we no longer have a per-netns conntrack hash.

    The ip_gre.c conflict as well as the iwlwifi ones were cases of
    overlapping changes.

    Conflicts:
    drivers/net/wireless/intel/iwlwifi/mvm/tx.c
    net/ipv4/ip_gre.c
    net/netfilter/nf_conntrack_core.c

    Signed-off-by: David S. Miller

    David S. Miller
     

05 May, 2016

1 commit

24 Apr, 2016

1 commit

29 Feb, 2016

1 commit

29 Dec, 2015

1 commit

07 Aug, 2015

1 commit

  • 3499abb24   netfilter: nfacct: per network namespace support ... Browse Code »

    - Move the nfnl_acct_list into the network namespace, initialize
    and destroy it per namespace
    - Keep track of refcnt on nfacct objects, the old logic does not
    longer work with a per namespace list
    - Adjust xt_nfacct to pass the namespace when registring objects

    Signed-off-by: Andreas Schultz
    Signed-off-by: Pablo Neira Ayuso

    Andreas Schultz
     

27 Aug, 2014

1 commit

  • f111f780a   netfilter: nfnetlink_acct: add filter support to nfacct counter list/reset ... Browse Code »

    You can use this to skip accounting objects when listing/resetting
    via NFNL_MSG_ACCT_GET/NFNL_MSG_ACCT_GET_CTRZERO messages with the
    NLM_F_DUMP netlink flag. The filtering covers the following cases:

    1. No filter specified. In this case, the client will get old behaviour,
    2. List/reset counter object only: In this case, you have to use
    NFACCT_F_QUOTA as mask and value 0.
    3. List/reset quota objects only: You have to use NFACCT_F_QUOTA_PKTS
    as mask and value - the same, for byte based quota mask should be
    NFACCT_F_QUOTA_BYTES and value - the same.

    If you want to obtain the object with any quota type
    (ie. NFACCT_F_QUOTA_PKTS|NFACCT_F_QUOTA_BYTES), you need to perform
    two dump requests, one to obtain NFACCT_F_QUOTA_PKTS objects and
    another for NFACCT_F_QUOTA_BYTES.

    Signed-off-by: Alexey Perevalov
    Signed-off-by: Pablo Neira Ayuso

    Alexey Perevalov
     

01 Aug, 2014

1 commit

31 Jul, 2014

1 commit

13 Jun, 2014

1 commit

  • f9da455b9   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next ... Browse Code »

    Pull networking updates from David Miller:

    1) Seccomp BPF filters can now be JIT'd, from Alexei Starovoitov.

    2) Multiqueue support in xen-netback and xen-netfront, from Andrew J
    Benniston.

    3) Allow tweaking of aggregation settings in cdc_ncm driver, from Bjørn
    Mork.

    4) BPF now has a "random" opcode, from Chema Gonzalez.

    5) Add more BPF documentation and improve test framework, from Daniel
    Borkmann.

    6) Support TCP fastopen over ipv6, from Daniel Lee.

    7) Add software TSO helper functions and use them to support software
    TSO in mvneta and mv643xx_eth drivers. From Ezequiel Garcia.

    8) Support software TSO in fec driver too, from Nimrod Andy.

    9) Add Broadcom SYSTEMPORT driver, from Florian Fainelli.

    10) Handle broadcasts more gracefully over macvlan when there are large
    numbers of interfaces configured, from Herbert Xu.

    11) Allow more control over fwmark used for non-socket based responses,
    from Lorenzo Colitti.

    12) Do TCP congestion window limiting based upon measurements, from Neal
    Cardwell.

    13) Support busy polling in SCTP, from Neal Horman.

    14) Allow RSS key to be configured via ethtool, from Venkata Duvvuru.

    15) Bridge promisc mode handling improvements from Vlad Yasevich.

    16) Don't use inetpeer entries to implement ID generation any more, it
    performs poorly, from Eric Dumazet.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1522 commits)
    rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
    tcp: fixing TLP's FIN recovery
    net: fec: Add software TSO support
    net: fec: Add Scatter/gather support
    net: fec: Increase buffer descriptor entry number
    net: fec: Factorize feature setting
    net: fec: Enable IP header hardware checksum
    net: fec: Factorize the .xmit transmit function
    bridge: fix compile error when compiling without IPv6 support
    bridge: fix smatch warning / potential null pointer dereference
    via-rhine: fix full-duplex with autoneg disable
    bnx2x: Enlarge the dorq threshold for VFs
    bnx2x: Check for UNDI in uncommon branch
    bnx2x: Fix 1G-baseT link
    bnx2x: Fix link for KR with swapped polarity lane
    sctp: Fix sk_ack_backlog wrap-around problem
    net/core: Add VF link state control policy
    net/fsl: xgmac_mdio is dependent on OF_MDIO
    net/fsl: Make xgmac_mdio read error message useful
    net_sched: drr: warn when qdisc is not work conserving
    ...

    Linus Torvalds
     

02 Jun, 2014

1 commit

30 Apr, 2014

1 commit

  • 683399edd   netfilter: nfnetlink_acct: Adding quota support to accounting framework ... Browse Code »

    nfacct objects already support accounting at the byte and packet
    level. As such it is a natural extension to add the possiblity to
    define a ceiling limit for both metrics.

    All the support for quotas itself is added to nfnetlink acctounting
    framework to stay coherent with current accounting object management.
    Quota limit checks are implemented in xt_nfacct filter where
    statistic collection is already done.

    Pablo Neira Ayuso has also contributed to this feature.

    Signed-off-by: Mathieu Poirier
    Signed-off-by: Pablo Neira Ayuso

    Mathieu Poirier
     

05 Jun, 2013

1 commit

25 Mar, 2013

1 commit

11 Sep, 2012

1 commit

  • 15e473046   netlink: Rename pid to portid to avoid confusion ... Browse Code »

    It is a frequent mistake to confuse the netlink port identifier with a
    process identifier. Try to reduce this confusion by renaming fields
    that hold port identifiers portid instead of pid.

    I have carefully avoided changing the structures exported to
    userspace to avoid changing the userspace API.

    I have successfully built an allyesconfig kernel with this change.

    Signed-off-by: "Eric W. Biederman"
    Acked-by: Stephen Hemminger
    Signed-off-by: David S. Miller

    Eric W. Biederman
     

20 Aug, 2012

1 commit

  • fe31d1a86   netfilter: sparse endian fixes ... Browse Code »

    Fix a couple of endian annotation in net/netfilter:

    net/netfilter/nfnetlink_acct.c:82:30: warning: cast to restricted __be64
    net/netfilter/nfnetlink_acct.c:86:30: warning: cast to restricted __be64
    net/netfilter/nfnetlink_cthelper.c:77:28: warning: cast to restricted __be16
    net/netfilter/xt_NFQUEUE.c:46:16: warning: restricted __be32 degrades to integer
    net/netfilter/xt_NFQUEUE.c:60:34: warning: restricted __be32 degrades to integer
    net/netfilter/xt_NFQUEUE.c:68:34: warning: restricted __be32 degrades to integer
    net/netfilter/xt_osf.c:272:55: warning: cast to restricted __be16

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

02 Apr, 2012

2 commits

27 Feb, 2012

1 commit

01 Jan, 2012

1 commit

25 Dec, 2011

1 commit

  • 941390279   netfilter: add extended accounting infrastructure over nfnetlink ... Browse Code »

    We currently have two ways to account traffic in netfilter:

    - iptables chain and rule counters:

    # iptables -L -n -v
    Chain INPUT (policy DROP 3 packets, 867 bytes)
    pkts bytes target prot opt in out source destination
    8 1104 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0

    - use flow-based accounting provided by ctnetlink:

    # conntrack -L
    tcp 6 431999 ESTABLISHED src=192.168.1.130 dst=212.106.219.168 sport=58152 dport=80 packets=47 bytes=7654 src=212.106.219.168 dst=192.168.1.130 sport=80 dport=58152 packets=49 bytes=66340 [ASSURED] mark=0 use=1

    While trying to display real-time accounting statistics, we require
    to pool the kernel periodically to obtain this information. This is
    OK if the number of flows is relatively low. However, in case that
    the number of flows is huge, we can spend a considerable amount of
    cycles to iterate over the list of flows that have been obtained.

    Moreover, if we want to obtain the sum of the flow accounting results
    that match some criteria, we have to iterate over the whole list of
    existing flows, look for matchings and update the counters.

    This patch adds the extended accounting infrastructure for
    nfnetlink which aims to allow displaying real-time traffic accounting
    without the need of complicated and resource-consuming implementation
    in user-space. Basically, this new infrastructure allows you to create
    accounting objects. One accounting object is composed of packet and
    byte counters.

    In order to manipulate create accounting objects, you require the
    new libnetfilter_acct library. It contains several examples of use:

    libnetfilter_acct/examples# ./nfacct-add http-traffic
    libnetfilter_acct/examples# ./nfacct-get
    http-traffic = { pkts = 000000000000, bytes = 000000000000 };

    Then, you can use one of this accounting objects in several iptables
    rules using the new nfacct match (which comes in a follow-up patch):

    # iptables -I INPUT -p tcp --sport 80 -m nfacct --nfacct-name http-traffic
    # iptables -I OUTPUT -p tcp --dport 80 -m nfacct --nfacct-name http-traffic

    The idea is simple: if one packet matches the rule, the nfacct match
    updates the counters.

    Thanks to Patrick McHardy, Eric Dumazet, Changli Gao for reviewing and
    providing feedback for this contribution.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso