Eric Lee / smarc-fsl-linux-kernel

19 Jun, 2019

1 commit

  • d2912cb15   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 ... Browse Code »

    Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation #

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 4122 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Enrico Weigelt
    Reviewed-by: Kate Stewart
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

18 Jan, 2019

4 commits

03 Nov, 2018

1 commit

21 Sep, 2018

3 commits

  • dd2934a95   netfilter: conntrack: remove l3->l4 mapping information ... Browse Code »

    l4 protocols are demuxed by l3num, l4num pair.

    However, almost all l4 trackers are l3 agnostic.

    Only exceptions are:
    - gre, icmp (ipv4 only)
    - icmpv6 (ipv6 only)

    This commit gets rid of the l3 mapping, l4 trackers can now be looked up
    by their IPPROTO_XXX value alone, which gets rid of the additional l3
    indirection.

    For icmp, ipcmp6 and gre, add a check on state->pf and
    return -NF_ACCEPT in case we're asked to track e.g. icmpv6-in-ipv4,
    this seems more fitting than using the generic tracker.

    Additionally we can kill the 2nd l4proto definitions that were needed
    for v4/v6 split -- they are now the same so we can use single l4proto
    struct for each protocol, rather than two.

    The EXPORT_SYMBOLs can be removed as all these object files are
    part of nf_conntrack with no external references.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • ca2ca6e1c   netfilter: conntrack: remove unused proto arg from netns init functions ... Browse Code »

    Its unused, next patch will remove l4proto->l3proto number to simplify
    l4 protocol demuxer lookup.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • 83d213fd9   netfilter: conntrack: deconstify packet callback skb pointer ... Browse Code »

    Only two protocols need the ->error() function: icmp and icmpv6.
    This is because icmp error mssages might be RELATED to an existing
    connection (e.g. PMTUD, port unreachable and the like), and their
    ->error() handlers do this.

    The error callback is already optional, so remove it for
    udp and call them from ->packet() instead.

    As the error() callback can call checksum functions that write to
    skb->csum*, the const qualifier has to be removed as well.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

20 Sep, 2018

2 commits

  • 9976fc6e6   netfilter: conntrack: remove the l4proto->new() function ... Browse Code »

    ->new() gets invoked after ->error() and before ->packet() if
    a conntrack lookup has found no result for the tuple.

    We can fold it into ->packet() -- the packet() implementations
    can check if the conntrack is confirmed (new) or not
    (already in hash).

    If its unconfirmed, the conntrack isn't in the hash yet so current
    skb created a new conntrack entry.

    Only relevant side effect -- if packet() doesn't return NF_ACCEPT
    but -NF_ACCEPT (or drop), while the conntrack was just created,
    then the newly allocated conntrack is freed right away, rather than not
    created in the first place.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • 93e66024b   netfilter: conntrack: pass nf_hook_state to packet and error handlers ... Browse Code »

    nf_hook_state contains all the hook meta-information: netns, protocol family,
    hook location, and so on.

    Instead of only passing selected information, pass a pointer to entire
    structure.

    This will allow to merge the error and the packet handlers and remove
    the ->new() function in followup patches.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

11 Sep, 2018

1 commit

  • a874752a1   netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT ... Browse Code »

    Now that cttimeout support for nft_ct is in place, these should depend
    on CONFIG_NF_CONNTRACK_TIMEOUT otherwise we can crash when dumping the
    policy if this option is not enabled.

    [ 71.600121] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
    [...]
    [ 71.600141] CPU: 3 PID: 7612 Comm: nft Not tainted 4.18.0+ #246
    [...]
    [ 71.600188] Call Trace:
    [ 71.600201] ? nft_ct_timeout_obj_dump+0xc6/0xf0 [nft_ct]

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

16 Jul, 2018

2 commits

09 Jan, 2018

2 commits

25 Oct, 2017

1 commit

04 Sep, 2017

1 commit

29 Aug, 2017

1 commit

25 Aug, 2017

2 commits

13 Aug, 2016

1 commit

  • adf051684   netfilter: remove ip_conntrack* sysctl compat code ... Browse Code »

    This backward compatibility has been around for more than ten years,
    since Yasuyuki Kozakai introduced IPv6 in conntrack. These days, we have
    alternate /proc/net/nf_conntrack* entries, the ctnetlink interface and
    the conntrack utility got adopted by many people in the user community
    according to what I observed on the netfilter user mailing list.

    So let's get rid of this.

    Note that nf_conntrack_htable_size and unsigned int nf_conntrack_max do
    not need to be exported as symbol anymore.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

19 Sep, 2015

1 commit

12 Jun, 2015

1 commit

  • 779668450   netfilter: conntrack: warn the user if there is a better helper to use ... Browse Code »

    After db29a9508a92 ("netfilter: conntrack: disable generic tracking for
    known protocols"), if the specific helper is built but not loaded
    (a standard for most distributions) systems with a restrictive firewall
    but weak configuration regarding netfilter modules to load, will
    silently stop working.

    This patch then puts a warning message so the sysadmin knows where to
    start looking into. It's a pr_warn_once regardless of protocol itself
    but it should be enough to give a hint on where to look.

    Cc: Florian Westphal
    Cc: Daniel Borkmann
    Signed-off-by: Marcelo Ricardo Leitner
    Signed-off-by: Pablo Neira Ayuso

    Marcelo Ricardo Leitner
     

06 Nov, 2014

1 commit

  • 824f1fbee   netfilter: Convert print_tuple functions to return void ... Browse Code »

    Since adding a new function to seq_file (seq_has_overflowed())
    there isn't any value for functions called from seq_show to
    return anything. Remove the int returns of the various
    print_tuple/_print_tuple functions.

    Link: http://lkml.kernel.org/p/f2e8cf8df433a197daa62cbaf124c900c708edc7.1412031505.git.joe@perches.com

    Cc: Pablo Neira Ayuso
    Cc: Patrick McHardy
    Cc: Jozsef Kadlecsik
    Cc: netfilter-devel@vger.kernel.org
    Cc: coreteam@netfilter.org
    Signed-off-by: Joe Perches
    Signed-off-by: Steven Rostedt

    Joe Perches
     

29 Sep, 2014

1 commit

  • db29a9508   netfilter: conntrack: disable generic tracking for known protocols ... Browse Code »

    Given following iptables ruleset:

    -P FORWARD DROP
    -A FORWARD -m sctp --dport 9 -j ACCEPT
    -A FORWARD -p tcp --dport 80 -j ACCEPT
    -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT

    One would assume that this allows SCTP on port 9 and TCP on port 80.
    Unfortunately, if the SCTP conntrack module is not loaded, this allows
    *all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT,
    which we think is a security issue.

    This is because on the first SCTP packet on port 9, we create a dummy
    "generic l4" conntrack entry without any port information (since
    conntrack doesn't know how to extract this information).

    All subsequent packets that are unknown will then be in established
    state since they will fallback to proto_generic and will match the
    'generic' entry.

    Our originally proposed version [1] completely disabled generic protocol
    tracking, but Jozsef suggests to not track protocols for which a more
    suitable helper is available, hence we now mitigate the issue for in
    tree known ct protocol helpers only, so that at least NAT and direction
    information will still be preserved for others.

    [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html

    Joint work with Daniel Borkmann.

    Signed-off-by: Florian Westphal
    Signed-off-by: Daniel Borkmann
    Acked-by: Jozsef Kadlecsik
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

05 Jul, 2012

1 commit

  • 08911475d   netfilter: nf_conntrack: generalize nf_ct_l4proto_net ... Browse Code »

    This patch generalizes nf_ct_l4proto_net by splitting it into chunks and
    moving the corresponding protocol part to where it really belongs to.

    To clarify, note that we follow two different approaches to support per-net
    depending if it's built-in or run-time loadable protocol tracker.

    Signed-off-by: Pablo Neira Ayuso
    Acked-by: Gao feng

    Pablo Neira Ayuso
     

28 Jun, 2012

2 commits

07 Jun, 2012

3 commits

02 Apr, 2012

1 commit

08 Mar, 2012

2 commits

  • 509784623   netfilter: add cttimeout infrastructure for fine timeout tuning ... Browse Code »

    This patch adds the infrastructure to add fine timeout tuning
    over nfnetlink. Now you can use the NFNL_SUBSYS_CTNETLINK_TIMEOUT
    subsystem to create/delete/dump timeout objects that contain some
    specific timeout policy for one flow.

    The follow up patches will allow you attach timeout policy object
    to conntrack via the CT target and the conntrack extension
    infrastructure.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • 2c8503f55   netfilter: nf_conntrack: pass timeout array to l4->new and l4->packet ... Browse Code »

    This patch defines a new interface for l4 protocol trackers:

    unsigned int *(*get_timeouts)(struct net *net);

    that is used to return the array of unsigned int that contains
    the timeouts that will be applied for this flow. This is passed
    to the l4proto->new(...) and l4proto->packet(...) functions to
    specify the timeout policy.

    This interface allows per-net global timeout configuration
    (although only DCCP supports this by now) and it will allow
    custom custom timeout configuration by means of follow-up
    patches.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

12 Nov, 2009

1 commit

  • f8572d8f2   sysctl net: Remove unused binary sysctl code ... Browse Code »

    Now that sys_sysctl is a compatiblity wrapper around /proc/sys
    all sysctl strategy routines, and all ctl_name and strategy
    entries in the sysctl tables are unused, and can be
    revmoed.

    In addition neigh_sysctl_register has been modified to no longer
    take a strategy argument and it's callers have been modified not
    to pass one.

    Cc: "David Miller"
    Cc: Hideaki YOSHIFUJI
    Cc: netdev@vger.kernel.org
    Signed-off-by: Eric W. Biederman

    Eric W. Biederman
     

18 Feb, 2009

1 commit

04 Nov, 2008

1 commit

  • 6d9f239a1   net: '&' redux ... Browse Code »

    I want to compile out proc_* and sysctl_* handlers totally and
    stub them to NULL depending on config options, however usage of &
    will prevent this, since taking adress of NULL pointer will break
    compilation.

    So, drop & in front of every ->proc_handler and every ->strategy
    handler, it was never needed in fact.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

08 Oct, 2008

1 commit

14 Apr, 2008

1 commit