Eric Lee / smarc-fsl-linux-kernel

19 Jun, 2019

1 commit

  • d2912cb15   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 ... Browse Code »

    Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation #

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 4122 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Enrico Weigelt
    Reviewed-by: Kate Stewart
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

15 Feb, 2018

1 commit

03 Nov, 2016

1 commit

08 Dec, 2013

1 commit

  • 97a2d41c4   netfilter: xt_NFQUEUE: separate reusable code ... Browse Code »

    This patch prepares the addition of nft_queue module by moving
    reusable code into a header file.

    This patch also converts NFQUEUE to use prandom_u32 to initialize
    the random jhash seed as suggested by Florian Westphal.

    Signed-off-by: Eric Leblond
    Signed-off-by: Pablo Neira Ayuso

    Eric Leblond
     

29 Oct, 2013

1 commit

02 Apr, 2013

2 commits

  • 5c33448c4   netfilter: xt_NFQUEUE: coalesce IPv4 and IPv6 hashing ... Browse Code »

    Because rev1 and rev3 of the target share the same hashing
    generalize it by introduing nfqueue_hash().

    Signed-off-by: Holger Eitzenberger
    Signed-off-by: Pablo Neira Ayuso

    holger@eitzenberger.org
     
  • 8746ddcf1   netfilter: xt_NFQUEUE: introduce CPU fanout ... Browse Code »

    Current NFQUEUE target uses a hash, computed over source and
    destination address (and other parameters), for steering the packet
    to the actual NFQUEUE. This, however forgets about the fact that the
    packet eventually is handled by a particular CPU on user request.

    If E. g.

    1) IRQ affinity is used to handle packets on a particular CPU already
    (both single-queue or multi-queue case)

    and/or

    2) RPS is used to steer packets to a specific softirq

    the target easily chooses an NFQUEUE which is not handled by a process
    pinned to the same CPU.

    The idea is therefore to use the CPU index for determining the
    NFQUEUE handling the packet.

    E. g. when having a system with 4 CPUs, 4 MQ queues and 4 NFQUEUEs it
    looks like this:

    +-----+ +-----+ +-----+ +-----+
    |NFQ#0| |NFQ#1| |NFQ#2| |NFQ#3|
    +-----+ +-----+ +-----+ +-----+
    ^ ^ ^ ^
    | |NFQUEUE | |
    + + + +
    +-----+ +-----+ +-----+ +-----+
    |rx-0 | |rx-1 | |rx-2 | |rx-3 |
    +-----+ +-----+ +-----+ +-----+

    The NFQUEUEs not necessarily have to start with number 0, setups with
    less NFQUEUEs than packet-handling CPUs are not a problem as well.

    This patch extends the NFQUEUE target to accept a new
    NFQ_FLAG_CPU_FANOUT flag. If this is specified the target uses the
    CPU index for determining the NFQUEUE being used. I have to introduce
    rev3 for this. The 'flags' are folded into _v2 'bypass'.

    By changing the way which queue is assigned, I'm able to improve the
    performance if the processes reading on the NFQUEUs are pinned
    correctly.

    Signed-off-by: Holger Eitzenberger
    Signed-off-by: Pablo Neira Ayuso

    holger@eitzenberger.org
     

20 Aug, 2012

1 commit

  • fe31d1a86   netfilter: sparse endian fixes ... Browse Code »

    Fix a couple of endian annotation in net/netfilter:

    net/netfilter/nfnetlink_acct.c:82:30: warning: cast to restricted __be64
    net/netfilter/nfnetlink_acct.c:86:30: warning: cast to restricted __be64
    net/netfilter/nfnetlink_cthelper.c:77:28: warning: cast to restricted __be16
    net/netfilter/xt_NFQUEUE.c:46:16: warning: restricted __be32 degrades to integer
    net/netfilter/xt_NFQUEUE.c:60:34: warning: restricted __be32 degrades to integer
    net/netfilter/xt_NFQUEUE.c:68:34: warning: restricted __be32 degrades to integer
    net/netfilter/xt_osf.c:272:55: warning: cast to restricted __be16

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

07 Jun, 2012

1 commit

  • 1da6dd079   netfilter: NFQUEUE: don't xor src/dst ip address for load distribution ... Browse Code »

    because reply packets need to go to the same nfqueue, src/dst ip
    address were xor'd prior to jhash().

    However, this causes bad distribution for some workloads, e.g.
    flows a.b.1.{1,n} -> a.b.2.{1,n} all share the same hash value.

    Avoid this by hashing both. To get same hash for replies,
    first argument is the smaller address.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

17 Dec, 2011

1 commit

18 Jan, 2011

1 commit

  • 94b27cc36   netfilter: allow NFQUEUE bypass if no listener is available ... Browse Code »

    If an skb is to be NF_QUEUE'd, but no program has opened the queue, the
    packet is dropped.

    This adds a v2 target revision of xt_NFQUEUE that allows packets to
    continue through the ruleset instead.

    Because the actual queueing happens outside of the target context, the
    'bypass' flag has to be communicated back to the netfilter core.

    Unfortunately the only choice to do this without adding a new function
    argument is to use the target function return value (i.e. the verdict).

    In the NF_QUEUE case, the upper 16bit already contain the queue number
    to use. The previous patch reduced NF_VERDICT_MASK to 0xff, i.e.
    we now have extra room for a new flag.

    If a hook issued a NF_QUEUE verdict, then the netfilter core will
    continue packet processing if the queueing hook
    returns -ESRCH (== "this queue does not exist") and the new
    NF_VERDICT_FLAG_QUEUE_BYPASS flag is set in the verdict value.

    Note: If the queue exists, but userspace does not consume packets fast
    enough, the skb will still be dropped.

    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

13 Nov, 2010

1 commit

12 May, 2010

1 commit

25 Mar, 2010

4 commits

17 Mar, 2010

1 commit

04 Jan, 2010

1 commit

22 Jun, 2009

1 commit

  • f9ffc3125   netfilter: fix some sparse endianess warnings ... Browse Code »

    net/netfilter/xt_NFQUEUE.c:46:9: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:46:9: expected unsigned int [unsigned] [usertype] ipaddr
    net/netfilter/xt_NFQUEUE.c:46:9: got restricted unsigned int
    net/netfilter/xt_NFQUEUE.c:68:10: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:68:10: expected unsigned int [unsigned]
    net/netfilter/xt_NFQUEUE.c:68:10: got restricted unsigned int
    net/netfilter/xt_NFQUEUE.c:69:10: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:69:10: expected unsigned int [unsigned]
    net/netfilter/xt_NFQUEUE.c:69:10: got restricted unsigned int
    net/netfilter/xt_NFQUEUE.c:70:10: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:70:10: expected unsigned int [unsigned]
    net/netfilter/xt_NFQUEUE.c:70:10: got restricted unsigned int
    net/netfilter/xt_NFQUEUE.c:71:10: warning: incorrect type in assignment (different base types)
    net/netfilter/xt_NFQUEUE.c:71:10: expected unsigned int [unsigned]
    net/netfilter/xt_NFQUEUE.c:71:10: got restricted unsigned int

    net/netfilter/xt_cluster.c:20:55: warning: incorrect type in return expression (different base types)
    net/netfilter/xt_cluster.c:20:55: expected unsigned int
    net/netfilter/xt_cluster.c:20:55: got restricted unsigned int const [usertype] ip
    net/netfilter/xt_cluster.c:20:55: warning: incorrect type in return expression (different base types)
    net/netfilter/xt_cluster.c:20:55: expected unsigned int
    net/netfilter/xt_cluster.c:20:55: got restricted unsigned int const [usertype] ip

    Signed-off-by: Patrick McHardy

    Patrick McHardy
     

05 Jun, 2009

2 commits

  • 10662aa30   netfilter: xt_NFQUEUE: queue balancing support ... Browse Code »

    Adds support for specifying a range of queues instead of a single queue
    id. Flows will be distributed across the given range.

    This is useful for multicore systems: Instead of having a single
    application read packets from a queue, start multiple
    instances on queues x, x+1, .. x+n. Each instance can process
    flows independently.

    Packets for the same connection are put into the same queue.

    Signed-off-by: Holger Eitzenberger
    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     
  • 61f5abcab   netfilter: xt_NFQUEUE: use NFPROTO_UNSPEC ... Browse Code »

    We can use wildcard matching here, just like
    ab4f21e6fb1c09b13c4c3cb8357babe8223471bd ("xtables: use NFPROTO_UNSPEC
    in more extensions").

    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

20 Oct, 2008

1 commit

  • fdc9314cb   netfilter: replace old NF_ARP calls with NFPROTO_ARP ... Browse Code »

    (Supplements: ee999d8b9573df1b547aacdc6d79f86eb79c25cd)

    NFPROTO_ARP actually has a different value from NF_ARP, so ensure all
    callers use the new value so that packets _do_ get delivered to the
    registered hooks.

    Signed-off-by: Jan Engelhardt
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Jan Engelhardt
     

08 Oct, 2008

2 commits

29 Jan, 2008

2 commits

16 Oct, 2007

1 commit

11 Jul, 2007

1 commit

13 Feb, 2007

1 commit

16 Oct, 2006

1 commit

23 Sep, 2006

2 commits

29 Mar, 2006

1 commit

  • 65b4b4e81   [NETFILTER]: Rename init functions. ... Browse Code »

    Every netfilter module uses `init' for its module_init() function and
    `fini' or `cleanup' for its module_exit() function.

    Problem is, this creates uninformative initcall_debug output and makes
    ctags rather useless.

    So go through and rename them all to $(filename)_init and
    $(filename)_fini.

    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    Andrew Morton
     

23 Mar, 2006

1 commit

21 Mar, 2006

2 commits

13 Jan, 2006

1 commit

  • 2e4e6a17a   [NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables ... Browse Code »

    This monster-patch tries to do the best job for unifying the data
    structures and backend interfaces for the three evil clones ip_tables,
    ip6_tables and arp_tables. In an ideal world we would never have
    allowed this kind of copy+paste programming... but well, our world
    isn't (yet?) ideal.

    o introduce a new x_tables module
    o {ip,arp,ip6}_tables depend on this x_tables module
    o registration functions for tables, matches and targets are only
    wrappers around x_tables provided functions
    o all matches/targets that are used from ip_tables and ip6_tables
    are now implemented as xt_FOOBAR.c files and provide module aliases
    to ipt_FOOBAR and ip6t_FOOBAR
    o header files for xt_matches are in include/linux/netfilter/,
    include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
    around the xt_FOOBAR.h headers

    Based on this patchset we're going to further unify the code,
    gradually getting rid of all the layer 3 specific assumptions.

    Signed-off-by: Harald Welte
    Signed-off-by: David S. Miller

    Harald Welte