Eric Lee / smarc-fsl-linux-kernel

06 Jun, 2011

1 commit

  • 88ed01d17   netfilter: nf_conntrack: fix ct refcount leak in l4proto->error() ... Browse Code »

    This patch fixes a refcount leak of ct objects that may occur if
    l4proto->error() assigns one conntrack object to one skbuff. In
    that case, we have to skip further processing in nf_conntrack_in().

    With this patch, we can also fix wrong return values (-NF_ACCEPT)
    for special cases in ICMP[v6] that should not bump the invalid/error
    statistic counters.

    Reported-by: Zoltan Menyhart
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

16 Feb, 2010

2 commits

08 Dec, 2009

1 commit

  • d7fc02c7b   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6 ... Browse Code »

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1815 commits)
    mac80211: fix reorder buffer release
    iwmc3200wifi: Enable wimax core through module parameter
    iwmc3200wifi: Add wifi-wimax coexistence mode as a module parameter
    iwmc3200wifi: Coex table command does not expect a response
    iwmc3200wifi: Update wiwi priority table
    iwlwifi: driver version track kernel version
    iwlwifi: indicate uCode type when fail dump error/event log
    iwl3945: remove duplicated event logging code
    b43: fix two warnings
    ipw2100: fix rebooting hang with driver loaded
    cfg80211: indent regulatory messages with spaces
    iwmc3200wifi: fix NULL pointer dereference in pmkid update
    mac80211: Fix TX status reporting for injected data frames
    ath9k: enable 2GHz band only if the device supports it
    airo: Fix integer overflow warning
    rt2x00: Fix padding bug on L2PAD devices.
    WE: Fix set events not propagated
    b43legacy: avoid PPC fault during resume
    b43: avoid PPC fault during resume
    tcp: fix a timewait refcnt race
    ...

    Fix up conflicts due to sysctl cleanups (dead sysctl_check code and
    CTL_UNNUMBERED removed) in
    kernel/sysctl_check.c
    net/ipv4/sysctl_net_ipv4.c
    net/ipv6/addrconf.c
    net/sctp/sysctl.c

    Linus Torvalds
     

24 Nov, 2009

1 commit

12 Nov, 2009

1 commit

  • f8572d8f2   sysctl net: Remove unused binary sysctl code ... Browse Code »

    Now that sys_sysctl is a compatiblity wrapper around /proc/sys
    all sysctl strategy routines, and all ctl_name and strategy
    entries in the sysctl tables are unused, and can be
    revmoed.

    In addition neigh_sysctl_register has been modified to no longer
    take a strategy argument and it's callers have been modified not
    to pass one.

    Cc: "David Miller"
    Cc: Hideaki YOSHIFUJI
    Cc: netdev@vger.kernel.org
    Signed-off-by: Eric W. Biederman

    Eric W. Biederman
     

08 Jun, 2009

1 commit

  • f87fb666b   netfilter: nf_ct_icmp: keep the ICMP ct entries longer ... Browse Code »

    Current conntrack code kills the ICMP conntrack entry as soon as
    the first reply is received. This is incorrect, as we then see only
    the first ICMP echo reply out of several possible duplicates as
    ESTABLISHED, while the rest will be INVALID. Also this unnecessarily
    increases the conntrackd traffic on H-A firewalls.

    Make all the ICMP conntrack entries (including the replied ones)
    last for the default of nf_conntrack_icmp{,v6}_timeout seconds.

    Signed-off-by: Jan "Yenya" Kasprzak
    Signed-off-by: Patrick McHardy

    Jan Kasprzak
     

03 Jun, 2009

1 commit

  • 17e6e4eac   netfilter: conntrack: simplify event caching system ... Browse Code »

    This patch simplifies the conntrack event caching system by removing
    several events:

    * IPCT_[*]_VOLATILE, IPCT_HELPINFO and IPCT_NATINFO has been deleted
    since the have no clients.
    * IPCT_COUNTER_FILLING which is a leftover of the 32-bits counter
    days.
    * IPCT_REFRESH which is not of any use since we always include the
    timeout in the messages.

    After this patch, the existing events are:

    * IPCT_NEW, IPCT_RELATED and IPCT_DESTROY, that are used to identify
    addition and deletion of entries.
    * IPCT_STATUS, that notes that the status bits have changes,
    eg. IPS_SEEN_REPLY and IPS_ASSURED.
    * IPCT_PROTOINFO, that reports that internal protocol information has
    changed, eg. the TCP, DCCP and SCTP protocol state.
    * IPCT_HELPER, that a helper has been assigned or unassigned to this
    entry.
    * IPCT_MARK and IPCT_SECMARK, that reports that the mark has changed, this
    covers the case when a mark is set to zero.
    * IPCT_NATSEQADJ, to report that there's updates in the NAT sequence
    adjustment.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

26 Mar, 2009

1 commit

13 Jan, 2009

1 commit

04 Nov, 2008

1 commit

  • 6d9f239a1   net: '&' redux ... Browse Code »

    I want to compile out proc_* and sysctl_* handlers totally and
    stub them to NULL depending on config options, however usage of &
    will prevent this, since taking adress of NULL pointer will break
    compilation.

    So, drop & in front of every ->proc_handler and every ->strategy
    handler, it was never needed in fact.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

08 Oct, 2008

6 commits

10 Jun, 2008

2 commits

  • 718d4ad98   netfilter: nf_conntrack: properly account terminating packets ... Browse Code »

    Currently the last packet of a connection isn't accounted when its causing
    abnormal termination.

    Introduces nf_ct_kill_acct() which increments the accounting counters on
    conntrack kill. The new function was necessary, because there are calls
    to nf_ct_kill() which don't need accounting:

    nf_conntrack_proto_tcp.c line ~847:
    Kills ct and returns NF_REPEAT. We don't want to count twice.

    nf_conntrack_proto_tcp.c line ~880:
    Kills ct and returns NF_DROP. I think we don't want to count dropped
    packets.

    nf_conntrack_netlink.c line ~824:
    As far as I can see ctnetlink_del_conntrack() is used to destroy a
    conntrack on behalf of the user. There is an sk_buff, but I don't think
    this is an actual packet. Incrementing counters here is therefore not
    desired.

    Signed-off-by: Fabian Hugelshofer
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Fabian Hugelshofer
     
  • 51091764f   netfilter: nf_conntrack: add nf_ct_kill() ... Browse Code »

    Encapsulate the common

    if (del_timer(&ct->timeout))
    ct->timeout.function((unsigned long)ct)

    sequence in a new function.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

14 Apr, 2008

2 commits

01 Feb, 2008

2 commits

29 Jan, 2008

5 commits

19 Oct, 2007

1 commit

  • 064b5bba0   sysctl: remove broken netfilter binary sysctls ... Browse Code »

    No one has bothered to set strategy routine for the the netfilter sysctls that
    return jiffies to be sysctl_jiffies.

    So it appears the sys_sysctl path is unused and untested, so this patch
    removes the binary sysctl numbers.

    Which fixes the netfilter oops in 2.6.23-rc2-mm2 for me.

    Signed-off-by: Eric W. Biederman
    Cc: Patrick McHardy
    Cc: "David S. Miller"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric W. Biederman
     

11 Oct, 2007

3 commits

15 Jul, 2007

3 commits

  • 61075af51   [NETFILTER]: nf_conntrack: mark protocols __read_mostly ... Browse Code »

    Also remove two unnecessary EXPORT_SYMBOLs and move the
    nf_conntrack_l3proto_ipv4 declaration to the correct file.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • 130e7a83d   [NETFILTER]: nf_conntrack: Don't track locally generated special ICMP error ... Browse Code »

    The conntrack assigned to locally generated ICMP error is usually the one
    assigned to the original packet which has caused the error. But if
    the original packet is handled as invalid by nf_conntrack, no conntrack
    is assigned to the original packet. Then nf_ct_attach() cannot assign
    any conntrack to the ICMP error packet. In that case the current
    nf_conntrack_icmp assigns appropriate conntrack to it. But the current
    code mistakes the direction of the packet. As a result, NAT code mistakes
    the address to be mangled.

    To fix the bug, this changes nf_conntrack_icmp not to assign conntrack
    to such ICMP error. Actually no address is necessary to be mangled
    in this case.

    Spotted by Jordan Russell.

    Signed-off-by: Yasuyuki Kozakai
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Yasuyuki Kozakai
     
  • e2a3123fb   [NETFILTER]: nf_conntrack: Introduces nf_ct_get_tuplepr and uses it ... Browse Code »

    nf_ct_get_tuple() requires the offset to transport header and that bothers
    callers such as icmp[v6] l4proto modules. This introduces new function
    to simplify them.

    Signed-off-by: Yasuyuki Kozakai
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Yasuyuki Kozakai
     

11 Jul, 2007

2 commits

26 Apr, 2007

2 commits

06 Mar, 2007

1 commit