Eric Lee / smarc-fsl-linux-kernel

05 Nov, 2016

1 commit

  • e2d118a1c   net: inet: Support UID-based routing in IP protocols. ... Browse Code »

    - Use the UID in routing lookups made by protocol connect() and
    sendmsg() functions.
    - Make sure that routing lookups triggered by incoming packets
    (e.g., Path MTU discovery) take the UID of the socket into
    account.
    - For packets not associated with a userspace socket, (e.g., ping
    replies) use UID 0 inside the user namespace corresponding to
    the network namespace the socket belongs to. This allows
    all namespaces to apply routing and iptables rules to
    kernel-originated traffic in that namespaces by matching UID 0.
    This is better than using the UID of the kernel socket that is
    sending the traffic, because the UID of kernel sockets created
    at namespace creation time (e.g., the per-processor ICMP and
    TCP sockets) is the UID of the user that created the socket,
    which might not be mapped in the namespace.

    Tested: compiles allnoconfig, allyesconfig, allmodconfig
    Tested: https://android-review.googlesource.com/253302
    Signed-off-by: Lorenzo Colitti
    Signed-off-by: David S. Miller

    Lorenzo Colitti
     

30 Sep, 2015

2 commits

12 Jun, 2015

2 commits

  • efb6de9b4   netfilter: bridge: forward IPv6 fragmented packets ... Browse Code »

    IPv6 fragmented packets are not forwarded on an ethernet bridge
    with netfilter ip6_tables loaded. e.g. steps to reproduce

    1) create a simple bridge like this

    modprobe br_netfilter
    brctl addbr br0
    brctl addif br0 eth0
    brctl addif br0 eth2
    ifconfig eth0 up
    ifconfig eth2 up
    ifconfig br0 up

    2) place a host with an IPv6 address on each side of the bridge

    set IPv6 address on host A:
    ip -6 addr add fd01:2345:6789:1::1/64 dev eth0

    set IPv6 address on host B:
    ip -6 addr add fd01:2345:6789:1::2/64 dev eth0

    3) run a simple ping command on host A with packets > MTU

    ping6 -s 4000 fd01:2345:6789:1::2

    4) wait some time and run e.g. "ip6tables -t nat -nvL" on the bridge

    IPv6 fragmented packets traverse the bridge cleanly until somebody runs.
    "ip6tables -t nat -nvL". As soon as it is run (and netfilter modules are
    loaded) IPv6 fragmented packets do not traverse the bridge any more (you
    see no more responses in ping's output).

    After applying this patch IPv6 fragmented packets traverse the bridge
    cleanly in above scenario.

    Signed-off-by: Bernhard Thaler
    [pablo@netfilter.org: small changes to br_nf_dev_queue_xmit]
    Signed-off-by: Pablo Neira Ayuso

    Bernhard Thaler
     
  • 72b31f727   netfilter: bridge: detect NAT66 correctly and change MAC address ... Browse Code »

    IPv4 iptables allows to REDIRECT/DNAT/SNAT any traffic over a bridge.

    e.g. REDIRECT
    $ sysctl -w net.bridge.bridge-nf-call-iptables=1
    $ iptables -t nat -A PREROUTING -p tcp -m tcp --dport 8080 \
    -j REDIRECT --to-ports 81

    This does not work with ip6tables on a bridge in NAT66 scenario
    because the REDIRECT/DNAT/SNAT is not correctly detected.

    The bridge pre-routing (finish) netfilter hook has to check for a possible
    redirect and then fix the destination mac address. This allows to use the
    ip6tables rules for local REDIRECT/DNAT/SNAT REDIRECT similar to the IPv4
    iptables version.

    e.g. REDIRECT
    $ sysctl -w net.bridge.bridge-nf-call-ip6tables=1
    $ ip6tables -t nat -A PREROUTING -p tcp -m tcp --dport 8080 \
    -j REDIRECT --to-ports 81

    This patch makes it possible to use IPv6 NAT66 on a bridge. It was tested
    on a bridge with two interfaces using SNAT/DNAT NAT66 rules.

    Reported-by: Artie Hamilton
    Signed-off-by: Sven Eckelmann
    [bernhard.thaler@wvnet.at: rebased, add indirect call to ip6_route_input()]
    [bernhard.thaler@wvnet.at: rebased, split into separate patches]
    Signed-off-by: Bernhard Thaler
    Signed-off-by: Pablo Neira Ayuso

    Bernhard Thaler
     

05 Apr, 2015

1 commit

12 Nov, 2014

1 commit

  • ba7a46f16   net: Convert LIMIT_NETDEBUG to net_dbg_ratelimited ... Browse Code »

    Use the more common dynamic_debug capable net_dbg_ratelimited
    and remove the LIMIT_NETDEBUG macro.

    All messages are still ratelimited.

    Some KERN_ uses are changed to KERN_DEBUG.

    This may have some negative impact on messages that were
    emitted at KERN_INFO that are not not enabled at all unless
    DEBUG is defined or dynamic_debug is enabled. Even so,
    these messages are now _not_ emitted by default.

    This also eliminates the use of the net_msg_warn sysctl
    "/proc/sys/net/core/warnings". For backward compatibility,
    the sysctl is not removed, but it has no function. The extern
    declaration of net_msg_warn is removed from sock.h and made
    static in net/core/sysctl_net_core.c

    Miscellanea:

    o Update the sysctl documentation
    o Remove the embedded uses of pr_fmt
    o Coalesce format fragments
    o Realign arguments

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches
     

09 May, 2014

1 commit

23 May, 2013

1 commit

  • 2a7851bff   netfilter: add nf_ipv6_ops hook to fix xt_addrtype with IPv6 ... Browse Code »

    Quoting https://bugzilla.netfilter.org/show_bug.cgi?id=812:

    [ ip6tables -m addrtype ]
    When I tried to use in the nat/PREROUTING it messes up the
    routing cache even if the rule didn't matched at all.
    [..]
    If I remove the --limit-iface-in from the non-working scenario, so just
    use the -m addrtype --dst-type LOCAL it works!

    This happens when LOCAL type matching is requested with --limit-iface-in,
    and the default ipv6 route is via the interface the packet we test
    arrived on.

    Because xt_addrtype uses ip6_route_output, the ipv6 routing implementation
    creates an unwanted cached entry, and the packet won't make it to the
    real/expected destination.

    Silently ignoring --limit-iface-in makes the routing work but it breaks
    rule matching (--dst-type LOCAL with limit-iface-in is supposed to only
    match if the dst address is configured on the incoming interface;
    without --limit-iface-in it will match if the address is reachable
    via lo).

    The test should call ipv6_chk_addr() instead. However, this would add
    a link-time dependency on ipv6.

    There are two possible solutions:

    1) Revert the commit that moved ipt_addrtype to xt_addrtype,
    and put ipv6 specific code into ip6t_addrtype.
    2) add new "nf_ipv6_ops" struct to register pointers to ipv6 functions.

    While the former might seem preferable, Pablo pointed out that there
    are more xt modules with link-time dependeny issues regarding ipv6,
    so lets go for 2).

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

19 Apr, 2013

1 commit

  • f229f6ce4   netfilter: add my copyright statements ... Browse Code »

    Add copyright statements to all netfilter files which have had significant
    changes done by myself in the past.

    Some notes:

    - nf_conntrack_ecache.c was incorrectly attributed to Rusty and Netfilter
    Core Team when it got split out of nf_conntrack_core.c. The copyrights
    even state a date which lies six years before it was written. It was
    written in 2005 by Harald and myself.

    - net/ipv{4,6}/netfilter.c, net/netfitler/nf_queue.c were missing copyright
    statements. I've added the copyright statement from net/netfilter/core.c,
    where this code originated

    - for nf_conntrack_proto_tcp.c I've also added Jozsef, since I didn't want
    it to give the wrong impression

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

08 Apr, 2013

1 commit

  • 58e35d147   netfilter: ipv6: propagate routing errors from ip6_route_me_harder() ... Browse Code »

    Propagate routing errors from ip_route_me_harder() when dropping a packet
    using NF_DROP_ERR(). This makes userspace get the proper error instead of
    EPERM for everything.

    # ip -6 r a unreachable default table 100
    # ip -6 ru add fwmark 0x1 lookup 100
    # ip6tables -t mangle -A OUTPUT -d 2001:4860:4860::8888 -j MARK --set-mark 0x1

    Old behaviour:

    PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
    ping: sendmsg: Operation not permitted
    ping: sendmsg: Operation not permitted
    ping: sendmsg: Operation not permitted

    New behaviour:

    PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
    ping: sendmsg: Network is unreachable
    ping: sendmsg: Network is unreachable
    ping: sendmsg: Network is unreachable

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

30 Aug, 2012

1 commit

07 Nov, 2011

1 commit

  • 32aaeffbd   Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux ... Browse Code »

    * 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits)
    Revert "tracing: Include module.h in define_trace.h"
    irq: don't put module.h into irq.h for tracking irqgen modules.
    bluetooth: macroize two small inlines to avoid module.h
    ip_vs.h: fix implicit use of module_get/module_put from module.h
    nf_conntrack.h: fix up fallout from implicit moduleparam.h presence
    include: replace linux/module.h with "struct module" wherever possible
    include: convert various register fcns to macros to avoid include chaining
    crypto.h: remove unused crypto_tfm_alg_modname() inline
    uwb.h: fix implicit use of asm/page.h for PAGE_SIZE
    pm_runtime.h: explicitly requires notifier.h
    linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h
    miscdevice.h: fix up implicit use of lists and types
    stop_machine.h: fix implicit use of smp.h for smp_processor_id
    of: fix implicit use of errno.h in include/linux/of.h
    of_platform.h: delete needless include
    acpi: remove module.h include from platform/aclinux.h
    miscdevice.h: delete unnecessary inclusion of module.h
    device_cgroup.h: delete needless include
    net: sch_generic remove redundant use of
    net: inet_timewait_sock doesnt need
    ...

    Fix up trivial conflicts (other header files, and removal of the ab3550 mfd driver) in
    - drivers/media/dvb/frontends/dibx000_common.c
    - drivers/media/video/{mt9m111.c,ov6650.c}
    - drivers/mfd/ab3550-core.c
    - include/linux/dmaengine.h

    Linus Torvalds
     

01 Nov, 2011

2 commits

23 Apr, 2011

1 commit

04 Apr, 2011

2 commits

  • 0fae2e774   netfilter: af_info: add 'strict' parameter to limit lookup to .oif ... Browse Code »

    ipv6 fib lookup can set RT6_LOOKUP_F_IFACE flag to restrict search
    to an interface, but this flag cannot be set via struct flowi.

    Also, it cannot be set via ip6_route_output: this function uses the
    passed sock struct to determine if this flag is required
    (by testing for nonzero sk_bound_dev_if).

    Work around this by passing in an artificial struct sk in case
    'strict' argument is true.

    This is required to replace the rt6_lookup call in xt_addrtype.c with
    nf_afinfo->route().

    Signed-off-by: Florian Westphal
    Acked-by: David S. Miller
    Signed-off-by: Patrick McHardy

    Florian Westphal
     
  • 31ad3dd64   netfilter: af_info: add network namespace parameter to route hook ... Browse Code »

    This is required to eventually replace the rt6_lookup call in
    xt_addrtype.c with nf_afinfo->route().

    Signed-off-by: Florian Westphal
    Acked-by: David S. Miller
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

13 Mar, 2011

2 commits

03 Mar, 2011

1 commit

18 Nov, 2010

1 commit

14 Jun, 2010

1 commit

15 Apr, 2010

1 commit

03 Jun, 2009

1 commit

  • adf30907d   net: skb->dst accessors ... Browse Code »

    Define three accessors to get/set dst attached to a skb

    struct dst_entry *skb_dst(const struct sk_buff *skb)

    void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)

    void skb_dst_drop(struct sk_buff *skb)
    This one should replace occurrences of :
    dst_release(skb->dst)
    skb->dst = NULL;

    Delete skb->dst field

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

28 Nov, 2008

1 commit

26 Nov, 2008

1 commit

  • 52479b623   netns xfrm: lookup in netns ... Browse Code »

    Pass netns to xfrm_lookup()/__xfrm_lookup(). For that pass netns
    to flow_cache_lookup() and resolver callback.

    Take it from socket or netdevice. Stub DECnet to init_net.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

25 Nov, 2008

1 commit

15 Oct, 2008

1 commit

09 Oct, 2008

1 commit

08 Oct, 2008

1 commit

  • b21f89019   netfilter: netns: fix {ip,6}_route_me_harder() in netns ... Browse Code »

    Take netns from skb->dst->dev. It should be safe because, they are called
    from LOCAL_OUT hook where dst is valid (though, I'm not exactly sure about
    IPVS and queueing packets to userspace).

    [Patrick: its safe everywhere since they already expect skb->dst to be set]

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Patrick McHardy

    Alexey Dobriyan
     

14 Apr, 2008

1 commit

  • d63a65073   [NETFILTER]: Add partial checksum validation helper ... Browse Code »

    Move the UDP-Lite conntrack checksum validation to a generic helper
    similar to nf_checksum() and make it fall back to nf_checksum()
    in case the full packet is to be checksummed and hardware checksums
    are available. This is to be used by DCCP conntrack, which also
    needs to verify partial checksums.

    Signed-off-by: Patrick McHardy

    Patrick McHardy
     

06 Mar, 2008

1 commit

29 Jan, 2008

5 commits

16 Oct, 2007

1 commit

26 Apr, 2007

1 commit