Eric Lee / smarc-fsl-linux-kernel

24 Dec, 2011

1 commit

22 Dec, 2011

1 commit

  • c0ed1c14a   net: Add a flow_cache_flush_deferred function ... Browse Code »

    flow_cach_flush() might sleep but can be called from
    atomic context via the xfrm garbage collector. So add
    a flow_cache_flush_deferred() function and use this if
    the xfrm garbage colector is invoked from within the
    packet path.

    Signed-off-by: Steffen Klassert
    Acked-by: Timo Teräs
    Signed-off-by: David S. Miller

    Steffen Klassert
     

02 Dec, 2011

1 commit

  • 84f9307c5   ipv4: use a 64bit load/store in output path ... Browse Code »

    gcc compiler is smart enough to use a single load/store if we
    memcpy(dptr, sptr, 8) on x86_64, regardless of
    CONFIG_CC_OPTIMIZE_FOR_SIZE

    In IP header, daddr immediately follows saddr, this wont change in the
    future. We only need to make sure our flowi4 (saddr,daddr) fields wont
    break the rule.

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

17 Sep, 2011

2 commits

27 Jul, 2011

1 commit

  • 60063497a   atomic: use <linux/atomic.h> ... Browse Code »

    This allows us to move duplicated code in
    (atomic_inc_not_zero() for now) to

    Signed-off-by: Arun Sharma
    Reviewed-by: Eric Dumazet
    Cc: Ingo Molnar
    Cc: David Miller
    Cc: Eric Dumazet
    Acked-by: Mike Frysinger
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Arun Sharma
     

01 Apr, 2011

1 commit

31 Mar, 2011

1 commit

  • 83229aa5e   net: Add helper flowi4_init_output(). ... Browse Code »

    On-stack initialization via assignment of flow structures are
    expensive because GCC emits a memset() to clear the entire
    structure out no matter what.

    Add a helper for ipv4 output flow key setup which we can use to avoid
    the memset.

    Signed-off-by: David S. Miller

    David S. Miller
     

13 Mar, 2011

12 commits

02 Mar, 2011

1 commit

23 Feb, 2011

2 commits

28 Jan, 2011

1 commit

  • a4daad6b0   net: Pre-COW metrics for TCP. ... Browse Code »
    43

    TCP is going to record metrics for the connection,
    so pre-COW the route metrics at route cache entry
    creation time.

    This avoids several atomic operations that have to
    occur if we COW the metrics after the entry reaches
    global visibility.

    Signed-off-by: David S. Miller

    David S. Miller
     

27 Dec, 2010

1 commit

24 Dec, 2010

1 commit

  • e05846499   Revert "ipv4: Allow configuring subnets as local addresses" ... Browse Code »

    This reverts commit 4465b469008bc03b98a1b8df4e9ae501b6c69d4b.

    Conflicts:

    net/ipv4/fib_frontend.c

    As reported by Ben Greear, this causes regressions:

    > Change 4465b469008bc03b98a1b8df4e9ae501b6c69d4b caused rules
    > to stop matching the input device properly because the
    > FLOWI_FLAG_MATCH_ANY_IIF is always defined in ip_dev_find().
    >
    > This breaks rules such as:
    >
    > ip rule add pref 512 lookup local
    > ip rule del pref 0 lookup local
    > ip link set eth2 up
    > ip -4 addr add 172.16.0.102/24 broadcast 172.16.0.255 dev eth2
    > ip rule add to 172.16.0.102 iif eth2 lookup local pref 10
    > ip rule add iif eth2 lookup 10001 pref 20
    > ip route add 172.16.0.0/24 dev eth2 table 10001
    > ip route add unreachable 0/0 table 10001
    >
    > If you had a second interface 'eth0' that was on a different
    > subnet, pinging a system on that interface would fail:
    >
    > [root@ct503-60 ~]# ping 192.168.100.1
    > connect: Invalid argument

    Reported-by: Ben Greear
    Signed-off-by: David S. Miller

    David S. Miller
     

16 Nov, 2010

1 commit

  • cc9ff19da   xfrm: use gre key as flow upper protocol info ... Browse Code »

    The GRE Key field is intended to be used for identifying an individual
    traffic flow within a tunnel. It is useful to be able to have XFRM
    policy selector matches to have different policies for different
    GRE tunnels.

    Signed-off-by: Timo Teräs
    Signed-off-by: David S. Miller

    Timo Teräs
     

29 Sep, 2010

1 commit

  • 4465b4690   ipv4: Allow configuring subnets as local addresses ... Browse Code »

    This patch allows a host to be configured to respond to any address in
    a specified range as if it were local, without actually needing to
    configure the address on an interface. This is done through routing
    table configuration. For instance, to configure a host to respond
    to any address in 10.1/16 received on eth0 as a local address we can do:

    ip rule add from all iif eth0 lookup 200
    ip route add local 10.1/16 dev lo proto kernel scope host src 127.0.0.1 table 200

    This host is now reachable by any 10.1/16 address (route lookup on
    input for packets received on eth0 can find the route). On output, the
    rule will not be matched so that this host can still send packets to
    10.1/16 (not sent on loopback). Presumably, external routing can be
    configured to make sense out of this.

    To make this work, we needed to modify the logic in finding the
    interface which is assigned a given source address for output
    (dev_ip_find). We perform a normal fib_lookup instead of just a
    lookup on the local table, and in the lookup we ignore the input
    interface for matching.

    This patch is useful to implement IP-anycast for subnets of virtual
    addresses.

    Signed-off-by: Tom Herbert
    Signed-off-by: David S. Miller

    Tom Herbert
     

07 Apr, 2010

1 commit

  • fe1a5f031   flow: virtualize flow cache entry methods ... Browse Code »

    This allows to validate the cached object before returning it.
    It also allows to destruct object properly, if the last reference
    was held in flow cache. This is also a prepartion for caching
    bundles in the flow cache.

    In return for virtualizing the methods, we save on:
    - not having to regenerate the whole flow cache on policy removal:
    each flow matching a killed policy gets refreshed as the getter
    function notices it smartly.
    - we do not have to call flow_cache_flush from policy gc, since the
    flow cache now properly deletes the object if it had any references

    Signed-off-by: Timo Teras
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Timo Teräs
     

26 Nov, 2008

1 commit

  • 52479b623   netns xfrm: lookup in netns ... Browse Code »

    Pass netns to xfrm_lookup()/__xfrm_lookup(). For that pass netns
    to flow_cache_lookup() and resolver callback.

    Take it from socket or netdevice. Stub DECnet to init_net.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

01 Oct, 2008

1 commit

  • a210d01ae   ipv4: Loosen source address check on IPv4 output ... Browse Code »

    ip_route_output() contains a check to make sure that no flows with
    non-local source IP addresses are routed. This obviously makes using
    such addresses impossible.

    This patch introduces a flowi flag which makes omitting this check
    possible. The new flag provides a way of handling transparent and
    non-transparent connections differently.

    Signed-off-by: Julian Anastasov
    Signed-off-by: KOVACS Krisztian
    Signed-off-by: David S. Miller

    Julian Anastasov
     

05 Aug, 2008

1 commit

  • 95c3e8bfc   ipv4: remove unused field in struct flowi (include/net/flow.h). ... Browse Code »

    This patch removes an unused field (flags) from struct flowi; it seems
    that this "flags" field was used once in the past for multipath
    routing with FLOWI_FLAG_MULTIPATHOLDROUTE flag (which does no longer
    exist); however, the "flags" field of struct flowi is not used
    anymore.

    Signed-off-by: Rami Rosen
    Signed-off-by: David S. Miller

    Rami Rosen
     

29 Jan, 2008

1 commit

11 Jul, 2007

1 commit

30 Apr, 2007

1 commit

  • 157bfc250   [XFRM]: Restrict upper layer information by bundle. ... Browse Code »

    On MIPv6 usage, XFRM sub policy is enabled.
    When main (IPsec) and sub (MIPv6) policy selectors have the same
    address set but different upper layer information (i.e. protocol
    number and its ports or type/code), multiple bundle should be created.
    However, currently we have issue to use the same bundle created for
    the first time with all flows covered by the case.

    It is useful for the bundle to have the upper layer information
    to be restructured correctly if it does not match with the flow.

    1. Bundle was created by two policies
    Selector from another policy is added to xfrm_dst.
    If the flow does not match the selector, it goes to slow path to
    restructure new bundle by single policy.

    2. Bundle was created by one policy
    Flow cache is added to xfrm_dst as originated one. If the flow does
    not match the cache, it goes to slow path to try searching another
    policy.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     

03 Dec, 2006

2 commits

  • 47dcf0cb1   [NET]: Rethink mark field in struct flowi ... Browse Code »

    Now that all protocols have been made aware of the mark
    field it can be moved out of the union thus simplyfing
    its usage.

    The config options in the IPv4/IPv6/DECnet subsystems
    to enable respectively disable mark based routing only
    obfuscate the code with ifdefs, the cost for the
    additional comparison in the flow key is insignificant,
    and most distributions have all these options enabled
    by default anyway. Therefore it makes sense to remove
    the config options and enable mark based routing by
    default.

    Signed-off-by: Thomas Graf
    Signed-off-by: David S. Miller

    Thomas Graf
     
  • 90bcaf7b4   [IPV6]: flowlabels are net-endian ... Browse Code »

    Signed-off-by: Al Viro
    Signed-off-by: David S. Miller

    Al Viro
     

22 Oct, 2006

1 commit

  • 185b1aa12   [NET]: Reduce sizeof(struct flowi) by 20 bytes. ... Browse Code »

    As suggested by David, just kill off some unused fields in dnports to
    reduce sizef(struct flowi). If they come back, they should be moved to
    nl_u.dn_u in order not to enlarge again struct flowi

    [ Modified to really delete this stuff instead of using #if 0. -DaveM ]

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

12 Oct, 2006

1 commit

  • 134b0fc54   IPsec: propagate security module errors up from flow_cache_lookup ... Browse Code »

    When a security module is loaded (in this case, SELinux), the
    security_xfrm_policy_lookup() hook can return an access denied permission
    (or other error). We were not handling that correctly, and in fact
    inverting the return logic and propagating a false "ok" back up to
    xfrm_lookup(), which then allowed packets to pass as if they were not
    associated with an xfrm policy.

    The way I was seeing the problem was when connecting via IPsec to a
    confined service on an SELinux box (vsftpd), which did not have the
    appropriate SELinux policy permissions to send packets via IPsec.

    The first SYNACK would be blocked, because of an uncached lookup via
    flow_cache_lookup(), which would fail to resolve an xfrm policy because
    the SELinux policy is checked at that point via the resolver.

    However, retransmitted SYNACKs would then find a cached flow entry when
    calling into flow_cache_lookup() with a null xfrm policy, which is
    interpreted by xfrm_lookup() as the packet not having any associated
    policy and similarly to the first case, allowing it to pass without
    transformation.

    The solution presented here is to first ensure that errno values are
    correctly propagated all the way back up through the various call chains
    from security_xfrm_policy_lookup(), and handled correctly.

    Then, flow_cache_lookup() is modified, so that if the policy resolver
    fails (typically a permission denied via the security module), the flow
    cache entry is killed rather than having a null policy assigned (which
    indicates that the packet can pass freely). This also forces any future
    lookups for the same flow to consult the security module (e.g. SELinux)
    for current security policy (rather than, say, caching the error on the
    flow cache entry).

    Signed-off-by: James Morris

    James Morris
     

29 Sep, 2006

1 commit