Eric Lee / smarc-fsl-linux-kernel

06 Apr, 2019

1 commit

  • 2e6bcc327   netfilter: physdev: relax br_netfilter dependency ... Browse Code »

    [ Upstream commit 8e2f311a68494a6677c1724bdcb10bada21af37c ]

    Following command:
    iptables -D FORWARD -m physdev ...
    causes connectivity loss in some setups.

    Reason is that iptables userspace will probe kernel for the module revision
    of the physdev patch, and physdev has an artificial dependency on
    br_netfilter (xt_physdev use makes no sense unless a br_netfilter module
    is loaded).

    This causes the "phydev" module to be loaded, which in turn enables the
    "call-iptables" infrastructure.

    bridged packets might then get dropped by the iptables ruleset.

    The better fix would be to change the "call-iptables" defaults to 0 and
    enforce explicit setting to 1, but that breaks backwards compatibility.

    This does the next best thing: add a request_module call to checkentry.
    This was a stray '-D ... -m physdev' won't activate br_netfilter
    anymore.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Sasha Levin

    Florian Westphal
     

15 Feb, 2018

1 commit

12 Aug, 2016

1 commit

11 Jul, 2016

1 commit

  • 47c744562   netfilter: physdev: physdev-is-out should not work with OUTPUT chain ... Browse Code »

    physdev_mt() will check skb->nf_bridge first, which was alloced in
    br_nf_pre_routing. So if we want to use --physdev-out and physdev-is-out,
    we need to match it in FORWARD or POSTROUTING chain. physdev_mt_check()
    only checked physdev-out and missed physdev-is-out. Fix it and update the
    debug message to make it clearer.

    Signed-off-by: Hangbin Liu
    Reviewed-by: Marcelo R Leitner
    Signed-off-by: Pablo Neira Ayuso

    Hangbin Liu
     

08 Apr, 2015

1 commit

16 Mar, 2015

1 commit

  • e4bb9bcbf   netfilter: bridge: remove BRNF_STATE_BRIDGED flag ... Browse Code »

    Its not needed anymore since 2bf540b73ed5b
    ([NETFILTER]: bridge-netfilter: remove deferred hooks).
    Before this it was possible to have physoutdev set for locally generated
    packets -- this isn't the case anymore:

    BRNF_STATE_BRIDGED flag is set when we assign nf_bridge->physoutdev,
    so physoutdev != NULL means BRNF_STATE_BRIDGED is set.
    If physoutdev is NULL, then we are looking at locally-delivered and
    routed packet.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

03 Oct, 2014

1 commit

  • 4b7fd5d97   netfilter: explicit module dependency between br_netfilter and physdev ... Browse Code »

    You can use physdev to match the physical interface enslaved to the
    bridge device. This information is stored in skb->nf_bridge and it is
    set up by br_netfilter. So, this is only available when iptables is
    used from the bridge netfilter path.

    Since 34666d4 ("netfilter: bridge: move br_netfilter out of the core"),
    the br_netfilter code is modular. To reduce the impact of this change,
    we can autoload the br_netfilter if the physdev match is used since
    we assume that the users need br_netfilter in place.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

12 May, 2010

2 commits

25 Mar, 2010

2 commits

  • bd414ee60   netfilter: xtables: change matches to return error code ... Browse Code »

    The following semantic patch does part of the transformation:
    //
    @ rule1 @
    struct xt_match ops;
    identifier check;
    @@
    ops.checkentry = check;

    @@
    identifier rule1.check;
    @@
    check(...) { }

    @@
    identifier rule1.check;
    @@
    check(...) { }
    //

    Signed-off-by: Jan Engelhardt

    Jan Engelhardt
     
  • b0f38452f   netfilter: xtables: change xt_match.checkentry return type ... Browse Code »

    Restore function signatures from bool to int so that we can report
    memory allocation failures or similar using -ENOMEM rather than
    always having to pass -EINVAL back.

    This semantic patch may not be too precise (checking for functions
    that use xt_mtchk_param rather than functions referenced by
    xt_match.checkentry), but reviewed, it produced the intended result.

    //
    @@
    type bool;
    identifier check, par;
    @@
    -bool check
    +int check
    (struct xt_mtchk_param *par) { ... }
    //

    Signed-off-by: Jan Engelhardt

    Jan Engelhardt
     

18 Mar, 2010

1 commit

26 Mar, 2009

1 commit

19 Feb, 2009

2 commits

08 Oct, 2008

4 commits

29 Jan, 2008

3 commits

25 Jul, 2007

1 commit

11 Jul, 2007

5 commits

13 Feb, 2007

1 commit

14 Dec, 2006

1 commit

23 Sep, 2006

2 commits

18 Aug, 2006

1 commit

25 Jul, 2006

1 commit

29 Mar, 2006

1 commit

  • 65b4b4e81   [NETFILTER]: Rename init functions. ... Browse Code »

    Every netfilter module uses `init' for its module_init() function and
    `fini' or `cleanup' for its module_exit() function.

    Problem is, this creates uninformative initcall_debug output and makes
    ctags rather useless.

    So go through and rename them all to $(filename)_init and
    $(filename)_fini.

    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    Andrew Morton
     

23 Mar, 2006

1 commit

21 Mar, 2006

2 commits

13 Jan, 2006

1 commit

  • 2e4e6a17a   [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables ... Browse Code »

    This monster-patch tries to do the best job for unifying the data
    structures and backend interfaces for the three evil clones ip_tables,
    ip6_tables and arp_tables. In an ideal world we would never have
    allowed this kind of copy+paste programming... but well, our world
    isn't (yet?) ideal.

    o introduce a new x_tables module
    o {ip,arp,ip6}_tables depend on this x_tables module
    o registration functions for tables, matches and targets are only
    wrappers around x_tables provided functions
    o all matches/targets that are used from ip_tables and ip6_tables
    are now implemented as xt_FOOBAR.c files and provide module aliases
    to ipt_FOOBAR and ip6t_FOOBAR
    o header files for xt_matches are in include/linux/netfilter/,
    include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
    around the xt_FOOBAR.h headers

    Based on this patchset we're going to further unify the code,
    gradually getting rid of all the layer 3 specific assumptions.

    Signed-off-by: Harald Welte
    Signed-off-by: David S. Miller

    Harald Welte