Eric Lee / smarc-fsl-linux-kernel

19 Sep, 2015

1 commit

12 Jun, 2015

1 commit

  • 779668450   netfilter: conntrack: warn the user if there is a better helper to use ... Browse Code »

    After db29a9508a92 ("netfilter: conntrack: disable generic tracking for
    known protocols"), if the specific helper is built but not loaded
    (a standard for most distributions) systems with a restrictive firewall
    but weak configuration regarding netfilter modules to load, will
    silently stop working.

    This patch then puts a warning message so the sysadmin knows where to
    start looking into. It's a pr_warn_once regardless of protocol itself
    but it should be enough to give a hint on where to look.

    Cc: Florian Westphal
    Cc: Daniel Borkmann
    Signed-off-by: Marcelo Ricardo Leitner
    Signed-off-by: Pablo Neira Ayuso

    Marcelo Ricardo Leitner
     

06 Nov, 2014

1 commit

  • 824f1fbee   netfilter: Convert print_tuple functions to return void ... Browse Code »

    Since adding a new function to seq_file (seq_has_overflowed())
    there isn't any value for functions called from seq_show to
    return anything. Remove the int returns of the various
    print_tuple/_print_tuple functions.

    Link: http://lkml.kernel.org/p/f2e8cf8df433a197daa62cbaf124c900c708edc7.1412031505.git.joe@perches.com

    Cc: Pablo Neira Ayuso
    Cc: Patrick McHardy
    Cc: Jozsef Kadlecsik
    Cc: netfilter-devel@vger.kernel.org
    Cc: coreteam@netfilter.org
    Signed-off-by: Joe Perches
    Signed-off-by: Steven Rostedt

    Joe Perches
     

29 Sep, 2014

1 commit

  • db29a9508   netfilter: conntrack: disable generic tracking for known protocols ... Browse Code »

    Given following iptables ruleset:

    -P FORWARD DROP
    -A FORWARD -m sctp --dport 9 -j ACCEPT
    -A FORWARD -p tcp --dport 80 -j ACCEPT
    -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT

    One would assume that this allows SCTP on port 9 and TCP on port 80.
    Unfortunately, if the SCTP conntrack module is not loaded, this allows
    *all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT,
    which we think is a security issue.

    This is because on the first SCTP packet on port 9, we create a dummy
    "generic l4" conntrack entry without any port information (since
    conntrack doesn't know how to extract this information).

    All subsequent packets that are unknown will then be in established
    state since they will fallback to proto_generic and will match the
    'generic' entry.

    Our originally proposed version [1] completely disabled generic protocol
    tracking, but Jozsef suggests to not track protocols for which a more
    suitable helper is available, hence we now mitigate the issue for in
    tree known ct protocol helpers only, so that at least NAT and direction
    information will still be preserved for others.

    [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html

    Joint work with Daniel Borkmann.

    Signed-off-by: Florian Westphal
    Signed-off-by: Daniel Borkmann
    Acked-by: Jozsef Kadlecsik
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

05 Jul, 2012

1 commit

  • 08911475d   netfilter: nf_conntrack: generalize nf_ct_l4proto_net ... Browse Code »

    This patch generalizes nf_ct_l4proto_net by splitting it into chunks and
    moving the corresponding protocol part to where it really belongs to.

    To clarify, note that we follow two different approaches to support per-net
    depending if it's built-in or run-time loadable protocol tracker.

    Signed-off-by: Pablo Neira Ayuso
    Acked-by: Gao feng

    Pablo Neira Ayuso
     

28 Jun, 2012

2 commits

07 Jun, 2012

3 commits

02 Apr, 2012

1 commit

08 Mar, 2012

2 commits

  • 509784623   netfilter: add cttimeout infrastructure for fine timeout tuning ... Browse Code »

    This patch adds the infrastructure to add fine timeout tuning
    over nfnetlink. Now you can use the NFNL_SUBSYS_CTNETLINK_TIMEOUT
    subsystem to create/delete/dump timeout objects that contain some
    specific timeout policy for one flow.

    The follow up patches will allow you attach timeout policy object
    to conntrack via the CT target and the conntrack extension
    infrastructure.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • 2c8503f55   netfilter: nf_conntrack: pass timeout array to l4->new and l4->packet ... Browse Code »

    This patch defines a new interface for l4 protocol trackers:

    unsigned int *(*get_timeouts)(struct net *net);

    that is used to return the array of unsigned int that contains
    the timeouts that will be applied for this flow. This is passed
    to the l4proto->new(...) and l4proto->packet(...) functions to
    specify the timeout policy.

    This interface allows per-net global timeout configuration
    (although only DCCP supports this by now) and it will allow
    custom custom timeout configuration by means of follow-up
    patches.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

12 Nov, 2009

1 commit

  • f8572d8f2   sysctl net: Remove unused binary sysctl code ... Browse Code »

    Now that sys_sysctl is a compatiblity wrapper around /proc/sys
    all sysctl strategy routines, and all ctl_name and strategy
    entries in the sysctl tables are unused, and can be
    revmoed.

    In addition neigh_sysctl_register has been modified to no longer
    take a strategy argument and it's callers have been modified not
    to pass one.

    Cc: "David Miller"
    Cc: Hideaki YOSHIFUJI
    Cc: netdev@vger.kernel.org
    Signed-off-by: Eric W. Biederman

    Eric W. Biederman
     

18 Feb, 2009

1 commit

04 Nov, 2008

1 commit

  • 6d9f239a1   net: '&' redux ... Browse Code »

    I want to compile out proc_* and sysctl_* handlers totally and
    stub them to NULL depending on config options, however usage of &
    will prevent this, since taking adress of NULL pointer will break
    compilation.

    So, drop & in front of every ->proc_handler and every ->strategy
    handler, it was never needed in fact.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

08 Oct, 2008

1 commit

14 Apr, 2008

1 commit

01 Feb, 2008

1 commit

29 Jan, 2008

1 commit

19 Oct, 2007

1 commit

  • 064b5bba0   sysctl: remove broken netfilter binary sysctls ... Browse Code »

    No one has bothered to set strategy routine for the the netfilter sysctls that
    return jiffies to be sysctl_jiffies.

    So it appears the sys_sysctl path is unused and untested, so this patch
    removes the binary sysctl numbers.

    Which fixes the netfilter oops in 2.6.23-rc2-mm2 for me.

    Signed-off-by: Eric W. Biederman
    Cc: Patrick McHardy
    Cc: "David S. Miller"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric W. Biederman
     

15 Jul, 2007

1 commit

26 Apr, 2007

1 commit

15 Feb, 2007

1 commit

  • cd354f1ae   [PATCH] remove many unneeded #includes of sched.h ... Browse Code »

    After Al Viro (finally) succeeded in removing the sched.h #include in module.h
    recently, it makes sense again to remove other superfluous sched.h includes.
    There are quite a lot of files which include it but don't actually need
    anything defined in there. Presumably these includes were once needed for
    macros that used to live in sched.h, but moved to other header files in the
    course of cleaning it up.

    To ease the pain, this time I did not fiddle with any header files and only
    removed #includes from .c-files, which tend to cause less trouble.

    Compile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,
    arm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,
    allmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all
    configs in arch/arm/configs on arm. I also checked that no new warnings were
    introduced by the patch (actually, some warnings are removed that were emitted
    by unnecessarily included header files).

    Signed-off-by: Tim Schmielau
    Acked-by: Russell King
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tim Schmielau
     

03 Dec, 2006

3 commits

23 Sep, 2006

1 commit

  • 94aec08ea   [NETFILTER]: Change tunables to __read_mostly ... Browse Code »

    Change some netfilter tunables to __read_mostly. Also fixed some
    incorrect file reference comments while I was in there.

    (this will be my last __read_mostly patch unless someone points out
    something else that needs it)

    Signed-off-by: Brian Haley
    Acked-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Brian Haley
     

11 Jan, 2006

1 commit

10 Nov, 2005

1 commit

  • 9fb9cbb10   [NETFILTER]: Add nf_conntrack subsystem. ... Browse Code »

    The existing connection tracking subsystem in netfilter can only
    handle ipv4. There were basically two choices present to add
    connection tracking support for ipv6. We could either duplicate all
    of the ipv4 connection tracking code into an ipv6 counterpart, or (the
    choice taken by these patches) we could design a generic layer that
    could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
    (TCP, UDP, etc.) connection tracking helper module to be written.

    In fact nf_conntrack is capable of working with any layer 3
    protocol.

    The existing ipv4 specific conntrack code could also not deal
    with the pecularities of doing connection tracking on ipv6,
    which is also cured here. For example, these issues include:

    1) ICMPv6 handling, which is used for neighbour discovery in
    ipv6 thus some messages such as these should not participate
    in connection tracking since effectively they are like ARP
    messages

    2) fragmentation must be handled differently in ipv6, because
    the simplistic "defrag, connection track and NAT, refrag"
    (which the existing ipv4 connection tracking does) approach simply
    isn't feasible in ipv6

    3) ipv6 extension header parsing must occur at the correct spots
    before and after connection tracking decisions, and there were
    no provisions for this in the existing connection tracking
    design

    4) ipv6 has no need for stateful NAT

    The ipv4 specific conntrack layer is kept around, until all of
    the ipv4 specific conntrack helpers are ported over to nf_conntrack
    and it is feature complete. Once that occurs, the old conntrack
    stuff will get placed into the feature-removal-schedule and we will
    fully kill it off 6 months later.

    Signed-off-by: Yasuyuki Kozakai
    Signed-off-by: Harald Welte
    Signed-off-by: Arnaldo Carvalho de Melo

    Yasuyuki Kozakai