04 Jul, 2020

1 commit

  • There are a couple of places in net/sched/ that check skb->protocol and act
    on the value there. However, in the presence of VLAN tags, the value stored
    in skb->protocol can be inconsistent based on whether VLAN acceleration is
    enabled. The commit quoted in the Fixes tag below fixed the users of
    skb->protocol to use a helper that will always see the VLAN ethertype.

    However, most of the callers don't actually handle the VLAN ethertype, but
    expect to find the IP header type in the protocol field. This means that
    things like changing the ECN field, or parsing diffserv values, stops
    working if there's a VLAN tag, or if there are multiple nested VLAN
    tags (QinQ).

    To fix this, change the helper to take an argument that indicates whether
    the caller wants to skip the VLAN tags or not. When skipping VLAN tags, we
    make sure to skip all of them, so behaviour is consistent even in QinQ
    mode.

    To make the helper usable from the ECN code, move it to if_vlan.h instead
    of pkt_sched.h.

    v3:
    - Remove empty lines
    - Move vlan variable definitions inside loop in skb_protocol()
    - Also use skb_protocol() helper in IP{,6}_ECN_decapsulate() and
    bpf_skb_ecn_set_ce()

    v2:
    - Use eth_type_vlan() helper in skb_protocol()
    - Also fix code that reads skb->protocol directly
    - Change a couple of 'if/else if' statements to switch constructs to avoid
    calling the helper twice

    Reported-by: Ilya Ponetayev
    Fixes: d8b9605d2697 ("net: sched: fix skb->protocol use in case of accelerated vlan path")
    Signed-off-by: Toke Høiland-Jørgensen
    Signed-off-by: David S. Miller

    Toke Høiland-Jørgensen
     

19 Jun, 2019

1 commit

  • Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation #

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 4122 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Enrico Weigelt
    Reviewed-by: Kate Stewart
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

03 Nov, 2016

1 commit


19 Sep, 2015

1 commit


19 Jun, 2015

1 commit


14 Jan, 2015

1 commit

  • tc code implicitly considers skb->protocol even in case of accelerated
    vlan paths and expects vlan protocol type here. However, on rx path,
    if the vlan header was already stripped, skb->protocol contains value
    of next header. Similar situation is on tx path.

    So for skbs that use skb->vlan_tci for tagging, use skb->vlan_proto instead.

    Reported-by: Jamal Hadi Salim
    Signed-off-by: Jiri Pirko
    Acked-by: Jamal Hadi Salim
    Signed-off-by: David S. Miller

    Jiri Pirko
     

07 Oct, 2014

1 commit

  • This removes the tcf_proto argument from the ematch code paths that
    only need it to reference the net namespace. This allows simplifying
    qdisc code paths especially when we need to tear down the ematch
    from an RCU callback. In this case we can not guarentee that the
    tcf_proto structure is still valid.

    Signed-off-by: John Fastabend
    Acked-by: Cong Wang
    Signed-off-by: David S. Miller

    John Fastabend
     

19 Oct, 2013

1 commit

  • Randy found that if network namespace not enabled then
    nd_net does not exist and would cause compilation failure.

    This is handled correctly by using the dev_net() macro.

    Signed-off-by: Stephen Hemminger
    Acked-by: Randy Dunlap
    Signed-off-by: David S. Miller

    stephen hemminger
     

01 Oct, 2013

1 commit

  • This patch adds netns support for ipset.

    Major changes were made in ip_set_core.c and ip_set.h.
    Global variables are moved to per net namespace.
    Added initialization code and the destruction of the network namespace ipset subsystem.
    In the prototypes of public functions ip_set_* added parameter "struct net*".

    The remaining corrections related to the change prototypes of public functions ip_set_*.

    The patch for git://git.netfilter.org/ipset.git commit 6a4ec96c0b8caac5c35474e40e319704d92ca347

    Signed-off-by: Vitaly Lavrov
    Signed-off-by: Jozsef Kadlecsik

    Vitaly Lavrov
     

30 Apr, 2013

1 commit


12 Jul, 2012

1 commit

  • Can be used to match packets against netfilter ip sets created via ipset(8).
    skb->sk_iif is used as 'incoming interface', skb->dev is 'outgoing interface'.

    Since ipset is usually called from netfilter, the ematch
    initializes a fake xt_action_param, pulls the ip header into the
    linear area and also sets skb->data to the IP header (otherwise
    matching Layer 4 set types doesn't work).

    Tested-by: Mr Dash Four
    Signed-off-by: Florian Westphal
    Signed-off-by: David S. Miller

    Florian Westphal