21 May, 2019

1 commit

  • Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details you
    should have received a copy of the gnu general public license along
    with this program if not see http www gnu org licenses

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details [based]
    [from] [clk] [highbank] [c] you should have received a copy of the
    gnu general public license along with this program if not see http
    www gnu org licenses

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 355 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Kate Stewart
    Reviewed-by: Jilayne Lovejoy
    Reviewed-by: Steve Winslow
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190519154041.837383322@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

13 Jun, 2018

1 commit

  • This needs to use xt_unregister_targets, else new revision is left
    on the list which then causes list to point to a target struct that has been free'd.

    Fixes: 472a73e00757 ("netfilter: xt_conntrack: Support bit-shifting for CONNMARK & MARK targets.")
    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

19 Apr, 2018

1 commit


11 Apr, 2018

1 commit

  • With the addition of bit-shift operations, we are able to shift
    ct/skbmark based on user requirements. However, this change might also
    cause the most left/right hand- side mark to be accidentially lost
    during shift operations.

    This patch adds the ability to 'grep' certain bits based on ctmask or
    nfmask out of the original mark. Then, apply shift operations to achieve
    a new mapping between ctmark and skb->mark.

    For example: If someone would like save the fourth F bits of ctmark
    0xFFF(F)000F into the seventh hexadecimal (0) skb->mark 0xABC000(0)E.

    new_targetmark = (ctmark & ctmask) >> 12;
    (new) skb->mark = (skb->mark &~nfmask) ^
    new_targetmark;

    This will preserve the other bits that are not related to this
    operation.

    Fixes: 472a73e00757 ("netfilter: xt_conntrack: Support bit-shifting for CONNMARK & MARK targets.")
    Reviewed-by: Florian Westphal
    Signed-off-by: Jack Ma
    Signed-off-by: Pablo Neira Ayuso

    Jack Ma
     

20 Mar, 2018

1 commit


15 Feb, 2018

1 commit


15 Apr, 2017

1 commit


05 Dec, 2016

1 commit

  • currently aliased to try_module_get/_put.
    Will be changed in next patch when we add functions to make use of ->net
    argument to store usercount per l3proto tracker.

    This is needed to avoid registering the conntrack hooks in all netns and
    later only enable connection tracking in those that need conntrack.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

09 Nov, 2016

1 commit

  • The (percpu) untracked conntrack entries can end up with nonzero connmarks.

    The 'untracked' conntrack objects are merely a way to distinguish INVALID
    (i.e. protocol connection tracker says payload doesn't meet some
    requirements or packet was never seen by the connection tracking code)
    from packets that are intentionally not tracked (some icmpv6 types such as
    neigh solicitation, or by using 'iptables -j CT --notrack' option).

    Untracked conntrack objects are implementation detail, we might as well use
    invalid magic address instead to tell INVALID and UNTRACKED apart.

    Check skb->nfct for untracked dummy and behave as if skb->nfct is NULL.

    Reported-by: XU Tianwen
    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

07 Dec, 2013

1 commit

  • Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: netfilter@vger.kernel.org
    CC: Pablo Neira Ayuso
    CC: Patrick McHardy
    CC: Jozsef Kadlecsik
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Jeff Kirsher
     

12 May, 2010

2 commits


25 Mar, 2010

5 commits


18 Mar, 2010

1 commit


17 Mar, 2010

2 commits


10 Aug, 2009

1 commit


08 Oct, 2008

5 commits


29 Jan, 2008

5 commits


20 Oct, 2007

1 commit


12 Oct, 2007

1 commit


11 Jul, 2007

6 commits


26 Apr, 2007

1 commit