Eric Lee / smarc-fsl-linux-kernel

22 Jul, 2020

1 commit

  • 954d82979   netfilter: Use fallthrough pseudo-keyword ... Browse Code »

    Replace the existing /* fall through */ comments and its variants with
    the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
    fall-through markings when it is the case.

    [1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: Pablo Neira Ayuso

    Gustavo A. R. Silva
     

19 Jun, 2019

1 commit

  • d2912cb15   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 ... Browse Code »

    Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation #

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 4122 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Enrico Weigelt
    Reviewed-by: Kate Stewart
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

21 May, 2019

1 commit

  • e633508a9   netfilter: nft_fib: Fix existence check support ... Browse Code »

    NFTA_FIB_F_PRESENT flag was not always honored since eval functions did
    not call nft_fib_store_result in all cases.

    Given that in all callsites there is a struct net_device pointer
    available which holds the interface data to be stored in destination
    register, simplify nft_fib_store_result() to just accept that pointer
    instead of the nft_pktinfo pointer and interface index. This also
    allows to drop the index to interface lookup previously needed to get
    the name associated with given index.

    Fixes: 055c4b34b94f6 ("netfilter: nft_fib: Support existence check")
    Signed-off-by: Phil Sutter
    Signed-off-by: Pablo Neira Ayuso

    Phil Sutter
     

13 Mar, 2017

1 commit

07 Mar, 2017

1 commit

  • c56e3956c   netfilter: nf_tables: validate the expr explicitly after init successfully ... Browse Code »

    When we want to validate the expr's dependency or hooks, we must do two
    things to accomplish it. First, write a X_validate callback function
    and point ->validate to it. Second, call X_validate in init routine.
    This is very common, such as fib, nat, reject expr and so on ...

    It is a little ugly, since we will call X_validate in the expr's init
    routine, it's better to do it in nf_tables_newexpr. So we can avoid to
    do this again and again. After doing this, the second step listed above
    is not useful anymore, remove them now.

    Patch was tested by nftables/tests/py/nft-test.py and
    nftables/tests/shell/run-tests.sh.

    Signed-off-by: Liping Zhang
    Signed-off-by: Pablo Neira Ayuso

    Liping Zhang
     

07 Dec, 2016

1 commit

03 Nov, 2016

1 commit

02 Nov, 2016

1 commit

  • f6d0cbcf0   netfilter: nf_tables: add fib expression ... Browse Code »

    Add FIB expression, supported for ipv4, ipv6 and inet family (the latter
    just dispatches to ipv4 or ipv6 one based on nfproto).

    Currently supports fetching output interface index/name and the
    rtm_type associated with an address.

    This can be used for adding path filtering. rtm_type is useful
    to e.g. enforce a strong-end host model where packets
    are only accepted if daddr is configured on the interface the
    packet arrived on.

    The fib expression is a native nftables alternative to the
    xtables addrtype and rp_filter matches.

    FIB result order for oif/oifname retrieval is as follows:
    - if packet is local (skb has rtable, RTF_LOCAL set, this
    will also catch looped-back multicast packets), set oif to
    the loopback interface.
    - if fib lookup returns an error, or result points to local,
    store zero result. This means '--local' option of -m rpfilter
    is not supported. It is possible to use 'fib type local' or add
    explicit saddr/daddr matching rules to create exceptions if this
    is really needed.
    - store result in the destination register.
    In case of multiple routes, search set for desired oif in case
    strict matching is requested.

    ipv4 and ipv6 behave fib expressions are supposed to behave the same.

    [ I have collapsed Arnd Bergmann's ("netfilter: nf_tables: fib warnings")

    http://patchwork.ozlabs.org/patch/688615/

    to address fallout from this patch after rebasing nf-next, that was
    posted to address compilation warnings. --pablo ]

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal