Eric Lee / smarc-fsl-linux-kernel

04 Oct, 2010

9 commits

29 Sep, 2010

1 commit

  • bc01befdc   netfilter: ctnetlink: add support for user-space expectation helpers ... Browse Code »
    44

    This patch adds the basic infrastructure to support user-space
    expectation helpers via ctnetlink and the netfilter queuing
    infrastructure NFQUEUE. Basically, this patch:

    * adds NF_CT_EXPECT_USERSPACE flag to identify user-space
    created expectations. I have also added a sanity check in
    __nf_ct_expect_check() to avoid that kernel-space helpers
    may create an expectation if the master conntrack has no
    helper assigned.
    * adds some branches to check if the master conntrack helper
    exists, otherwise we skip the code that refers to kernel-space
    helper such as the local expectation list and the expectation
    policy.
    * allows to set the timeout for user-space expectations with
    no helper assigned.
    * a list of expectations created from user-space that depends
    on ctnetlink (if this module is removed, they are deleted).
    * includes USERSPACE in the /proc output for expectations
    that have been created by a user-space helper.

    This patch also modifies ctnetlink to skip including the helper
    name in the Netlink messages if no kernel-space helper is set
    (since no user-space expectation has not kernel-space kernel
    assigned).

    You can access an example user-space FTP conntrack helper at:
    http://people.netfilter.org/pablo/userspace-conntrack-helpers/nf-ftp-helper-userspace-POC.tar.bz

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     

22 Sep, 2010

4 commits

  • 8b008faf9   netfilter: ctnetlink: allow to specify the expectation flags ... Browse Code »

    With this patch, you can specify the expectation flags for user-space
    created expectations.

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     
  • bcac0dfab   netfilter: ctnetlink: missing validation of CTA_EXPECT_ZONE attribute ... Browse Code »

    This patch adds the missing validation of the CTA_EXPECT_ZONE
    attribute in the ctnetlink code.

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     
  • 5b92b61f3   netfilter: nf_nat: better error handling of nf_ct_expect_related() in helpers ... Browse Code »

    This patch improves the situation in which the expectation table is
    full for conntrack NAT helpers. Basically, we give up if we don't
    find a place in the table instead of looping over nf_ct_expect_related()
    with a different port (we should only do this if it returns -EBUSY, for
    -EMFILE or -ESHUTDOWN I think that it's better to skip this).

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     
  • 26c15cfd2   ipvs: changes related to service usecnt ... Browse Code »

    Change the usage of svc usecnt during command execution:

    - we check if svc is registered but we do not need to hold usecnt
    reference while under __ip_vs_mutex, only the packet handling needs
    it during scheduling

    - change __ip_vs_service_get to __ip_vs_service_find and
    __ip_vs_svc_fwm_get to __ip_vs_svc_fwm_find because now caller
    will increase svc->usecnt

    - put common code that calls update_service in __ip_vs_update_dest

    - put common code in ip_vs_unlink_service() and use it to unregister
    the service

    - add comment that svc should not be accessed after ip_vs_del_service
    anymore

    - all IP_VS_WAIT_WHILE calls are now unified: usecnt > 0

    - Properly log the app ports

    As result, some problems are fixed:

    - possible use-after-free of svc in ip_vs_genl_set_cmd after
    ip_vs_del_service because our usecnt reference does not guarantee that
    svc is not freed on refcnt==0, eg. when no dests are moved to trash

    - possible usecnt leak in do_ip_vs_set_ctl after ip_vs_del_service
    when the service is not freed now, for example, when some
    destionations are moved into trash and svc->refcnt remains above 0.
    It is harmless because svc is not in hash anymore.

    Signed-off-by: Julian Anastasov
    Acked-by: Simon Horman
    Signed-off-by: Patrick McHardy

    Julian Anastasov
     

21 Sep, 2010

3 commits

  • 99f07e91b   netfilter: save the hash of the tuple in the original direction for latter use ... Browse Code »

    Since we don't change the tuple in the original direction, we can save it
    in ct->tuplehash[IP_CT_DIR_REPLY].hnode.pprev for __nf_conntrack_confirm()
    use.

    __hash_conntrack() is split into two steps: hash_conntrack_raw() is used
    to get the raw hash, and __hash_bucket() is used to get the bucket id.

    In SYN-flood case, early_drop() doesn't need to recompute the hash again.

    Signed-off-by: Changli Gao
    Signed-off-by: Patrick McHardy

    Changli Gao
     
  • 8a8030407   ipvs: make rerouting optional with snat_reroute ... Browse Code »

    Add new sysctl flag "snat_reroute". Recent kernels use
    ip_route_me_harder() to route LVS-NAT responses properly by
    VIP when there are multiple paths to client. But setups
    that do not have alternative default routes can skip this
    routing lookup by using snat_reroute=0.

    Signed-off-by: Julian Anastasov
    Signed-off-by: Patrick McHardy

    Julian Anastasov
     
  • f4bc17cdd   ipvs: netfilter connection tracking changes ... Browse Code »

    Add more code to IPVS to work with Netfilter connection
    tracking and fix some problems.

    - Allow IPVS to be compiled without connection tracking as in
    2.6.35 and before. This can avoid keeping conntracks for all
    IPVS connections because this costs memory. ip_vs_ftp still
    depends on connection tracking and NAT as implemented for 2.6.36.

    - Add sysctl var "conntrack" to enable connection tracking for
    all IPVS connections. For loaded IPVS directors it needs
    tuning of nf_conntrack_max limit.

    - Add IP_VS_CONN_F_NFCT connection flag to request the connection
    to use connection tracking. This allows user space to provide this
    flag, for example, in dest->conn_flags. This can be useful to
    request connection tracking per real server instead of forcing it
    for all connections with the "conntrack" sysctl. This flag is
    set currently only by ip_vs_ftp and of course by "conntrack" sysctl.

    - Add ip_vs_nfct.c file to hold all connection tracking code,
    by this way main code should not depend of netfilter conntrack
    support.

    - Return back the ip_vs_post_routing handler as in 2.6.35 and use
    skb->ipvs_property=1 to allow IPVS to work without connection
    tracking

    Connection tracking:

    - most of the code is already in 2.6.36-rc

    - alter conntrack reply tuple for LVS-NAT connections when first packet
    from client is forwarded and conntrack state is NEW or RELATED.
    Additionally, alter reply for RELATED connections from real server,
    again for packet in original direction.

    - add IP_VS_XMIT_TUNNEL to confirm conntrack (without altering
    reply) for LVS-TUN early because we want to call nf_reset. It is
    needed because we add IPIP header and the original conntrack
    should be preserved, not destroyed. The transmitted IPIP packets
    can reuse same conntrack, so we do not set skb->ipvs_property.

    - try to destroy conntrack when the IPVS connection is destroyed.
    It is not fatal if conntrack disappears before that, it depends
    on the used timers.

    Fix problems from long time:

    - add skb->ip_summed = CHECKSUM_NONE for the LVS-TUN transmitters

    Signed-off-by: Julian Anastasov
    Signed-off-by: Patrick McHardy

    Julian Anastasov
     

17 Sep, 2010

5 commits

16 Sep, 2010

1 commit

15 Sep, 2010

1 commit

  • 068e8a303   e1000e: Simplify MSI interrupt testing ... Browse Code »

    The code is quite convoluted, simplify it. This also avoids calling
    e1000_request_irq() without testing the value it returned, which was
    bad.

    Signed-off-by: Jean Delvare
    Cc: Bruce Allan
    Cc: Jeff Kirsher
    Acked-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Jean Delvare
     

14 Sep, 2010

10 commits

13 Sep, 2010

1 commit

11 Sep, 2010

5 commits