Eric Lee / smarc-fsl-linux-kernel

26 Oct, 2020

1 commit

16 Oct, 2020

1 commit

  • 346e320cb   netfilter: nftables: allow re-computing sctp CRC-32C in 'payload' statements ... Browse Code »

    nftables payload statements are used to mangle SCTP headers, but they can
    only replace the Internet Checksum. As a consequence, nftables rules that
    mangle sport/dport/vtag in SCTP headers potentially generate packets that
    are discarded by the receiver, unless the CRC-32C is "offloaded" (e.g the
    rule mangles a skb having 'ip_summed' equal to 'CHECKSUM_PARTIAL'.

    Fix this extending uAPI definitions and L4 checksum update function, in a
    way that userspace programs (e.g. nft) can instruct the kernel to compute
    CRC-32C in SCTP headers. Also ensure that LIBCRC32C is built if NF_TABLES
    is 'y' or 'm' in the kernel build configuration.

    Signed-off-by: Davide Caratti
    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Jakub Kicinski

    Davide Caratti
     

07 Aug, 2020

1 commit

30 Jul, 2020

1 commit

  • 50935339c   netfilter: Replace HTTP links with HTTPS ones ... Browse Code »

    Rationale:
    Reduces attack surface on kernel devs opening the links for MITM
    as HTTPS traffic is much harder to manipulate.

    Deterministic algorithm:
    For each file:
    If not .svg:
    For each line:
    If doesn't contain `\bxmlns\b`:
    For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
    If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
    If both the HTTP and HTTPS versions
    return 200 OK and serve the same content:
    Replace HTTP with HTTPS.

    Signed-off-by: Alexander A. Klimov
    Signed-off-by: Pablo Neira Ayuso

    Alexander A. Klimov
     

25 Jun, 2020

1 commit

22 Jun, 2020

1 commit

14 Jun, 2020

1 commit

  • a7f7f6248   treewide: replace '---help---' in Kconfig files with 'help' ... Browse Code »

    Since commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over
    '---help---'"), the number of '---help---' has been gradually
    decreasing, but there are still more than 2400 instances.

    This commit finishes the conversion. While I touched the lines,
    I also fixed the indentation.

    There are a variety of indentation styles found.

    a) 4 spaces + '---help---'
    b) 7 spaces + '---help---'
    c) 8 spaces + '---help---'
    d) 1 space + 1 tab + '---help---'
    e) 1 tab + '---help---' (correct indentation)
    f) 1 tab + 1 space + '---help---'
    g) 1 tab + 2 spaces + '---help---'

    In order to convert all of them to 1 tab + 'help', I ran the
    following commend:

    $ find . -name 'Kconfig*' | xargs sed -i 's/^[[:space:]]*---help---/\thelp/'

    Signed-off-by: Masahiro Yamada

    Masahiro Yamada
     

01 May, 2020

1 commit

04 Apr, 2020

1 commit

19 Mar, 2020

1 commit

  • 357b6cc58   netfilter: revert introduction of egress hook ... Browse Code »

    This reverts the following commits:

    8537f78647c0 ("netfilter: Introduce egress hook")
    5418d3881e1f ("netfilter: Generalize ingress hook")
    b030f194aed2 ("netfilter: Rename ingress hook include file")

    >From the discussion in [0], the author's main motivation to add a hook
    in fast path is for an out of tree kernel module, which is a red flag
    to begin with. Other mentioned potential use cases like NAT{64,46}
    is on future extensions w/o concrete code in the tree yet. Revert as
    suggested [1] given the weak justification to add more hooks to critical
    fast-path.

    [0] https://lore.kernel.org/netdev/cover.1583927267.git.lukas@wunner.de/
    [1] https://lore.kernel.org/netdev/20200318.011152.72770718915606186.davem@davemloft.net/

    Signed-off-by: Daniel Borkmann
    Cc: David Miller
    Cc: Pablo Neira Ayuso
    Cc: Alexei Starovoitov
    Nacked-by: Pablo Neira Ayuso
    Signed-off-by: David S. Miller

    Daniel Borkmann
     

18 Mar, 2020

1 commit

  • 8537f7864   netfilter: Introduce egress hook ... Browse Code »

    Commit e687ad60af09 ("netfilter: add netfilter ingress hook after
    handle_ing() under unique static key") introduced the ability to
    classify packets on ingress.

    Allow the same on egress. Position the hook immediately before a packet
    is handed to tc and then sent out on an interface, thereby mirroring the
    ingress order. This order allows marking packets in the netfilter
    egress hook and subsequently using the mark in tc. Another benefit of
    this order is consistency with a lot of existing documentation which
    says that egress tc is performed after netfilter hooks.

    Egress hooks already exist for the most common protocols, such as
    NF_INET_LOCAL_OUT or NF_ARP_OUT, and those are to be preferred because
    they are executed earlier during packet processing. However for more
    exotic protocols, there is currently no provision to apply netfilter on
    egress. A common workaround is to enslave the interface to a bridge and
    use ebtables, or to resort to tc. But when the ingress hook was
    introduced, consensus was that users should be given the choice to use
    netfilter or tc, whichever tool suits their needs best:
    https://lore.kernel.org/netdev/20150430153317.GA3230@salvia/
    This hook is also useful for NAT46/NAT64, tunneling and filtering of
    locally generated af_packet traffic such as dhclient.

    There have also been occasional user requests for a netfilter egress
    hook in the past, e.g.:
    https://www.spinics.net/lists/netfilter/msg50038.html

    Performance measurements with pktgen surprisingly show a speedup rather
    than a slowdown with this commit:

    * Without this commit:
    Result: OK: 34240933(c34238375+d2558) usec, 100000000 (60byte,0frags)
    2920481pps 1401Mb/sec (1401830880bps) errors: 0

    * With this commit:
    Result: OK: 33997299(c33994193+d3106) usec, 100000000 (60byte,0frags)
    2941410pps 1411Mb/sec (1411876800bps) errors: 0

    * Without this commit + tc egress:
    Result: OK: 39022386(c39019547+d2839) usec, 100000000 (60byte,0frags)
    2562631pps 1230Mb/sec (1230062880bps) errors: 0

    * With this commit + tc egress:
    Result: OK: 37604447(c37601877+d2570) usec, 100000000 (60byte,0frags)
    2659259pps 1276Mb/sec (1276444320bps) errors: 0

    * With this commit + nft egress:
    Result: OK: 41436689(c41434088+d2600) usec, 100000000 (60byte,0frags)
    2413320pps 1158Mb/sec (1158393600bps) errors: 0

    Tested on a bare-metal Core i7-3615QM, each measurement was performed
    three times to verify that the numbers are stable.

    Commands to perform a measurement:
    modprobe pktgen
    echo "add_device lo@3" > /proc/net/pktgen/kpktgend_3
    samples/pktgen/pktgen_bench_xmit_mode_queue_xmit.sh -i 'lo@3' -n 100000000

    Commands for testing tc egress:
    tc qdisc add dev lo clsact
    tc filter add dev lo egress protocol ip prio 1 u32 match ip dst 4.3.2.1/32

    Commands for testing nft egress:
    nft add table netdev t
    nft add chain netdev t co \{ type filter hook egress device lo priority 0 \; \}
    nft add rule netdev t co ip daddr 4.3.2.1/32 drop

    All testing was performed on the loopback interface to avoid distorting
    measurements by the packet handling in the low-level Ethernet driver.

    Signed-off-by: Lukas Wunner
    Cc: Daniel Borkmann
    Signed-off-by: Pablo Neira Ayuso

    Lukas Wunner
     

15 Mar, 2020

1 commit

  • e32a4dc65   netfilter: nf_tables: make sets built-in ... Browse Code »

    Placing nftables set support in an extra module is pointless:

    1. nf_tables needs dynamic registeration interface for sake of one module
    2. nft heavily relies on sets, e.g. even simple rule like
    "nft ... tcp dport { 80, 443 }" will not work with _SETS=n.

    IOW, either nftables isn't used or both nf_tables and nf_tables_set
    modules are needed anyway.

    With extra module:
    307K net/netfilter/nf_tables.ko
    79K net/netfilter/nf_tables_set.ko

    text data bss dec filename
    146416 3072 545 150033 nf_tables.ko
    35496 1817 0 37313 nf_tables_set.ko

    This patch:
    373K net/netfilter/nf_tables.ko

    178563 4049 545 183157 nf_tables.ko

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

03 Oct, 2019

1 commit

26 Sep, 2019

1 commit

21 Sep, 2019

1 commit

  • bfa0399bc   Merge Linus's 5.4-rc1-prerelease branch into android-mainline ... Browse Code »

    This merges Linus's tree as of commit b41dae061bbd ("Merge tag
    'xfs-5.4-merge-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux")
    into android-mainline.

    This "early" merge makes it easier to test and handle merge conflicts
    instead of having to wait until the "end" of the merge window and handle
    all 10000+ commits at once.

    Signed-off-by: Greg Kroah-Hartman
    Change-Id: I6bebf55e5e2353f814e3c87f5033607b1ae5d812

    Greg Kroah-Hartman
     

13 Sep, 2019

1 commit

  • b0edba2af   netfilter: fix coding-style errors. ... Browse Code »

    Several header-files, Kconfig files and Makefiles have trailing
    white-space. Remove it.

    In netfilter/Kconfig, indent the type of CONFIG_NETFILTER_NETLINK_ACCT
    correctly.

    There are semicolons at the end of two function definitions in
    include/net/netfilter/nf_conntrack_acct.h and
    include/net/netfilter/nf_conntrack_ecache.h. Remove them.

    Fix indentation in nf_conntrack_l4proto.h.

    Signed-off-by: Jeremy Sowden
    Signed-off-by: Pablo Neira Ayuso

    Jeremy Sowden
     

29 Jul, 2019

1 commit

24 Jul, 2019

1 commit

16 Jul, 2019

1 commit

  • 05ba4c895   netfilter: Update obsolete comments referring to ip_conntrack ... Browse Code »

    In 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") the new
    generic nf_conntrack was introduced, and it came to supersede the old
    ip_conntrack.

    This change updates (some) of the obsolete comments referring to old
    file/function names of the ip_conntrack mechanism, as well as removes a
    few self-referencing comments that we shouldn't maintain anymore.

    I did not update any comments referring to historical actions (e.g,
    comments like "this file was derived from ..." were left untouched, even
    if the referenced file is no longer here).

    Signed-off-by: Yonatan Goldschmidt
    Signed-off-by: Pablo Neira Ayuso

    Yonatan Goldschmidt
     

12 Jul, 2019

1 commit

  • 237f83dfb   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next ... Browse Code »

    Pull networking updates from David Miller:
    "Some highlights from this development cycle:

    1) Big refactoring of ipv6 route and neigh handling to support
    nexthop objects configurable as units from userspace. From David
    Ahern.

    2) Convert explored_states in BPF verifier into a hash table,
    significantly decreased state held for programs with bpf2bpf
    calls, from Alexei Starovoitov.

    3) Implement bpf_send_signal() helper, from Yonghong Song.

    4) Various classifier enhancements to mvpp2 driver, from Maxime
    Chevallier.

    5) Add aRFS support to hns3 driver, from Jian Shen.

    6) Fix use after free in inet frags by allocating fqdirs dynamically
    and reworking how rhashtable dismantle occurs, from Eric Dumazet.

    7) Add act_ctinfo packet classifier action, from Kevin
    Darbyshire-Bryant.

    8) Add TFO key backup infrastructure, from Jason Baron.

    9) Remove several old and unused ISDN drivers, from Arnd Bergmann.

    10) Add devlink notifications for flash update status to mlxsw driver,
    from Jiri Pirko.

    11) Lots of kTLS offload infrastructure fixes, from Jakub Kicinski.

    12) Add support for mv88e6250 DSA chips, from Rasmus Villemoes.

    13) Various enhancements to ipv6 flow label handling, from Eric
    Dumazet and Willem de Bruijn.

    14) Support TLS offload in nfp driver, from Jakub Kicinski, Dirk van
    der Merwe, and others.

    15) Various improvements to axienet driver including converting it to
    phylink, from Robert Hancock.

    16) Add PTP support to sja1105 DSA driver, from Vladimir Oltean.

    17) Add mqprio qdisc offload support to dpaa2-eth, from Ioana
    Radulescu.

    18) Add devlink health reporting to mlx5, from Moshe Shemesh.

    19) Convert stmmac over to phylink, from Jose Abreu.

    20) Add PTP PHC (Physical Hardware Clock) support to mlxsw, from
    Shalom Toledo.

    21) Add nftables SYNPROXY support, from Fernando Fernandez Mancera.

    22) Convert tcp_fastopen over to use SipHash, from Ard Biesheuvel.

    23) Track spill/fill of constants in BPF verifier, from Alexei
    Starovoitov.

    24) Support bounded loops in BPF, from Alexei Starovoitov.

    25) Various page_pool API fixes and improvements, from Jesper Dangaard
    Brouer.

    26) Just like ipv4, support ref-countless ipv6 route handling. From
    Wei Wang.

    27) Support VLAN offloading in aquantia driver, from Igor Russkikh.

    28) Add AF_XDP zero-copy support to mlx5, from Maxim Mikityanskiy.

    29) Add flower GRE encap/decap support to nfp driver, from Pieter
    Jansen van Vuuren.

    30) Protect against stack overflow when using act_mirred, from John
    Hurley.

    31) Allow devmap map lookups from eBPF, from Toke Høiland-Jørgensen.

    32) Use page_pool API in netsec driver, Ilias Apalodimas.

    33) Add Google gve network driver, from Catherine Sullivan.

    34) More indirect call avoidance, from Paolo Abeni.

    35) Add kTLS TX HW offload support to mlx5, from Tariq Toukan.

    36) Add XDP_REDIRECT support to bnxt_en, from Andy Gospodarek.

    37) Add MPLS manipulation actions to TC, from John Hurley.

    38) Add sending a packet to connection tracking from TC actions, and
    then allow flower classifier matching on conntrack state. From
    Paul Blakey.

    39) Netfilter hw offload support, from Pablo Neira Ayuso"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2080 commits)
    net/mlx5e: Return in default case statement in tx_post_resync_params
    mlx5: Return -EINVAL when WARN_ON_ONCE triggers in mlx5e_tls_resync().
    net: dsa: add support for BRIDGE_MROUTER attribute
    pkt_sched: Include const.h
    net: netsec: remove static declaration for netsec_set_tx_de()
    net: netsec: remove superfluous if statement
    netfilter: nf_tables: add hardware offload support
    net: flow_offload: rename tc_cls_flower_offload to flow_cls_offload
    net: flow_offload: add flow_block_cb_is_busy() and use it
    net: sched: remove tcf block API
    drivers: net: use flow block API
    net: sched: use flow block API
    net: flow_offload: add flow_block_cb_{priv, incref, decref}()
    net: flow_offload: add list handling functions
    net: flow_offload: add flow_block_cb_alloc() and flow_block_cb_free()
    net: flow_offload: rename TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_*
    net: flow_offload: rename TC_BLOCK_{UN}BIND to FLOW_BLOCK_{UN}BIND
    net: flow_offload: add flow_block_cb_setup_simple()
    net: hisilicon: Add an tx_desc to adapt HI13X1_GMAC
    net: hisilicon: Add an rx_desc to adapt HI13X1_GMAC
    ...

    Linus Torvalds
     

10 Jul, 2019

1 commit

  • e9a83bd23   Merge tag 'docs-5.3' of git://git.lwn.net/linux ... Browse Code »

    Pull Documentation updates from Jonathan Corbet:
    "It's been a relatively busy cycle for docs:

    - A fair pile of RST conversions, many from Mauro. These create more
    than the usual number of simple but annoying merge conflicts with
    other trees, unfortunately. He has a lot more of these waiting on
    the wings that, I think, will go to you directly later on.

    - A new document on how to use merges and rebases in kernel repos,
    and one on Spectre vulnerabilities.

    - Various improvements to the build system, including automatic
    markup of function() references because some people, for reasons I
    will never understand, were of the opinion that
    :c:func:``function()`` is unattractive and not fun to type.

    - We now recommend using sphinx 1.7, but still support back to 1.4.

    - Lots of smaller improvements, warning fixes, typo fixes, etc"

    * tag 'docs-5.3' of git://git.lwn.net/linux: (129 commits)
    docs: automarkup.py: ignore exceptions when seeking for xrefs
    docs: Move binderfs to admin-guide
    Disable Sphinx SmartyPants in HTML output
    doc: RCU callback locks need only _bh, not necessarily _irq
    docs: format kernel-parameters -- as code
    Doc : doc-guide : Fix a typo
    platform: x86: get rid of a non-existent document
    Add the RCU docs to the core-api manual
    Documentation: RCU: Add TOC tree hooks
    Documentation: RCU: Rename txt files to rst
    Documentation: RCU: Convert RCU UP systems to reST
    Documentation: RCU: Convert RCU linked list to reST
    Documentation: RCU: Convert RCU basic concepts to reST
    docs: filesystems: Remove uneeded .rst extension on toctables
    scripts/sphinx-pre-install: fix out-of-tree build
    docs: zh_CN: submitting-drivers.rst: Remove a duplicated Documentation/
    Documentation: PGP: update for newer HW devices
    Documentation: Add section about CPU vulnerabilities for Spectre
    Documentation: platform: Delete x86-laptop-drivers.txt
    docs: Note that :c:func: should no longer be used
    ...

    Linus Torvalds
     

09 Jul, 2019

1 commit

  • 8a3367cc8   Merge tag 'leds-for-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.… ... Browse Code »

    …anaszewski/linux-leds

    Pull LED updates from Jacek Anaszewski:

    - Add a new LED common module for ti-lmu driver family

    - Modify MFD ti-lmu bindings
    - add ti,brightness-resolution
    - add the ramp up/down property

    - Add regulator support for LM36274 driver to lm363x-regulator.c

    - New LED class drivers with DT bindings:
    - leds-spi-byte
    - leds-lm36274
    - leds-lm3697 (move the support from MFD to LED subsystem)

    - Simplify getting the I2C adapter of a client:
    - leds-tca6507
    - leds-pca955x

    - Convert LED documentation to ReST

    * tag 'leds-for-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds:
    dt: leds-lm36274.txt: fix a broken reference to ti-lmu.txt
    docs: leds: convert to ReST
    leds: leds-tca6507: simplify getting the adapter of a client
    leds: leds-pca955x: simplify getting the adapter of a client
    leds: lm36274: Introduce the TI LM36274 LED driver
    dt-bindings: leds: Add LED bindings for the LM36274
    regulator: lm363x: Add support for LM36274
    mfd: ti-lmu: Add LM36274 support to the ti-lmu
    dt-bindings: mfd: Add lm36274 bindings to ti-lmu
    leds: max77650: Remove set but not used variable 'parent'
    leds: avoid flush_work in atomic context
    leds: lm3697: Introduce the lm3697 driver
    mfd: ti-lmu: Remove support for LM3697
    dt-bindings: ti-lmu: Modify dt bindings for the LM3697
    leds: TI LMU: Add common code for TI LMU devices
    leds: spi-byte: add single byte SPI LED driver
    dt-bindings: leds: Add binding for spi-byte LED.
    dt-bindings: mfd: LMU: Add ti,brightness-resolution
    dt-bindings: mfd: LMU: Add the ramp up/down property

    Linus Torvalds
     

06 Jul, 2019

1 commit

29 Jun, 2019

1 commit

  • 8dab91970   docs: leds: convert to ReST ... Browse Code »

    Rename the leds documentation files to ReST, add an
    index for them and adjust in order to produce a nice html
    output via the Sphinx build system.

    At its new index.rst, let's add a :orphan: while this is not linked to
    the main index.rst file, in order to avoid build warnings.

    Signed-off-by: Mauro Carvalho Chehab
    Acked-by: Pavel Machek
    Signed-off-by: Jacek Anaszewski

    Mauro Carvalho Chehab
     

15 Jun, 2019

1 commit

  • cd238effe   docs: kbuild: convert docs to ReST and rename to *.rst ... Browse Code »

    The kbuild documentation clearly shows that the documents
    there are written at different times: some use markdown,
    some use their own peculiar logic to split sections.

    Convert everything to ReST without affecting too much
    the author's style and avoiding adding uneeded markups.

    The conversion is actually:
    - add blank lines and identation in order to identify paragraphs;
    - fix tables markups;
    - add some lists markups;
    - mark literal blocks;
    - adjust title markups.

    At its new index.rst, let's add a :orphan: while this is not linked to
    the main index.rst file, in order to avoid build warnings.

    Signed-off-by: Mauro Carvalho Chehab
    Signed-off-by: Jonathan Corbet

    Mauro Carvalho Chehab
     

27 May, 2019

1 commit

21 May, 2019

2 commits

04 May, 2019

2 commits

12 Apr, 2019

1 commit

  • adf82accc   netfilter: x_tables: merge ip and ipv6 masquerade modules ... Browse Code »

    No need to have separate modules for this.
    before:
    text data bss dec filename
    2038 1168 0 3206 net/ipv4/netfilter/ipt_MASQUERADE.ko
    1526 1024 0 2550 net/ipv6/netfilter/ip6t_MASQUERADE.ko
    after:
    text data bss dec filename
    2521 1296 0 3817 net/netfilter/xt_MASQUERADE.ko

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

09 Apr, 2019

1 commit

18 Mar, 2019

1 commit

  • d1fa38103   netfilter: fix NETFILTER_XT_TARGET_TEE dependencies ... Browse Code »

    With NETFILTER_XT_TARGET_TEE=y and IP6_NF_IPTABLES=m, we get a link
    error when referencing the NF_DUP_IPV6 module:

    net/netfilter/xt_TEE.o: In function `tee_tg6':
    xt_TEE.c:(.text+0x14): undefined reference to `nf_dup_ipv6'

    The problem here is the 'select NF_DUP_IPV6 if IP6_NF_IPTABLES'
    that forces NF_DUP_IPV6 to be =m as well rather than setting it
    to =y as was intended here. Adding a soft dependency on
    IP6_NF_IPTABLES avoids that broken configuration.

    Fixes: 5d400a4933e8 ("netfilter: Kconfig: Change select IPv6 dependencies")
    Cc: Máté Eckl
    Cc: Taehee Yoo
    Link: https://patchwork.ozlabs.org/patch/999498/
    Link: https://lore.kernel.org/patchwork/patch/960062/
    Reported-by: Randy Dunlap
    Reported-by: Stephen Rothwell
    Signed-off-by: Arnd Bergmann
    Signed-off-by: Pablo Neira Ayuso

    Arnd Bergmann
     

01 Mar, 2019

3 commits

  • db8ab3888   netfilter: nf_tables: merge ipv4 and ipv6 nat chain types ... Browse Code »

    Merge the ipv4 and ipv6 nat chain type. This is the last
    missing piece which allows to provide inet family support
    for nat in a follow patch.

    The kconfig knobs for ipv4/ipv6 nat chain are removed, the
    nat chain type will be built unconditionally if NFT_NAT
    expression is enabled.

    Before:
    text data bss dec hex filename
    1576 896 0 2472 9a8 nft_chain_nat_ipv4.ko
    1697 896 0 2593 a21 nft_chain_nat_ipv6.ko

    After:
    text data bss dec hex filename
    1832 896 0 2728 aa8 nft_chain_nat.ko

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • a9ce849e7   netfilter: nf_tables: nat: merge nft_masq protocol specific modules ... Browse Code »

    The family specific masq modules are way too small to warrant
    an extra module, just place all of them in nft_masq.

    before:
    text data bss dec hex filename
    1001 832 0 1833 729 nft_masq.ko
    766 896 0 1662 67e nft_masq_ipv4.ko
    764 896 0 1660 67c nft_masq_ipv6.ko

    after:
    2010 960 0 2970 b9a nft_masq.ko

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • c78efc99c   netfilter: nf_tables: nat: merge nft_redir protocol specific modules ... Browse Code »

    before:
    text data bss dec hex filename
    990 832 0 1822 71e nft_redir.ko
    697 896 0 1593 639 nft_redir_ipv4.ko
    713 896 0 1609 649 nft_redir_ipv6.ko

    after:
    text data bss dec hex filename
    1910 960 0 2870 b36 nft_redir.ko

    size is reduced, all helpers from nft_redir.ko can be made static.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

27 Feb, 2019

2 commits

  • 3bf195ae6   netfilter: nat: merge nf_nat_ipv4,6 into nat core ... Browse Code »

    before:
    text data bss dec hex filename
    16566 1576 4136 22278 5706 nf_nat.ko
    3598 844 0 4442 115a nf_nat_ipv6.ko
    3187 844 0 4031 fbf nf_nat_ipv4.ko

    after:
    text data bss dec hex filename
    22948 1612 4136 28696 7018 nf_nat.ko

    ... with ipv4/v6 nat now provided directly via nf_nat.ko.

    Also changes:
    ret = nf_nat_ipv4_fn(priv, skb, state);
    if (ret != NF_DROP && ret != NF_STOLEN &&
    into
    if (ret != NF_ACCEPT)
    return ret;

    everywhere.

    The nat hooks never should return anything other than
    ACCEPT or DROP (and the latter only in rare error cases).

    The original code uses multi-line ANDing including assignment-in-if:
    if (ret != NF_DROP && ret != NF_STOLEN &&
    !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {

    I removed this while moving, breaking those in separate conditionals
    and moving the assignments into extra lines.

    checkpatch still generates some warnings:
    1. Overly long lines (of moved code).
    Breaking them is even more ugly. so I kept this as-is.
    2. use of extern function declarations in a .c file.
    This is necessary evil, we must call
    nf_nat_l3proto_register() from the nat core now.
    All l3proto related functions are removed later in this series,
    those prototypes are then removed as well.

    v2: keep empty nf_nat_ipv6_csum_update stub for CONFIG_IPV6=n case.
    v3: remove IS_ENABLED(NF_NAT_IPV4/6) tests, NF_NAT_IPVx toggles
    are removed here.
    v4: also get rid of the assignments in conditionals.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • d1aca8ab3   netfilter: nat: merge ipv4 and ipv6 masquerade functionality ... Browse Code »

    Before:
    text data bss dec hex filename
    13916 1412 4128 19456 4c00 nf_nat.ko
    4510 968 4 5482 156a nf_nat_ipv4.ko
    5146 944 8 6098 17d2 nf_nat_ipv6.ko

    After:
    text data bss dec hex filename
    16566 1576 4136 22278 5706 nf_nat.ko
    3187 844 0 4031 fbf nf_nat_ipv4.ko
    3598 844 0 4442 115a nf_nat_ipv6.ko

    ... so no drastic changes in combined size.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

18 Jan, 2019

1 commit

  • 22fc4c4c9   netfilter: conntrack: gre: switch module to be built-in ... Browse Code »

    This makes the last of the modular l4 trackers 'bool'.

    After this, all infrastructure to handle dynamic l4 protocol registration
    becomes obsolete and can be removed in followup patches.

    Old:
    302824 net/netfilter/nf_conntrack.ko
    21504 net/netfilter/nf_conntrack_proto_gre.ko

    New:
    313728 net/netfilter/nf_conntrack.ko

    Old:
    text data bss dec hex filename
    6281 1732 4 8017 1f51 nf_conntrack_proto_gre.ko
    108356 20613 236 129205 1f8b5 nf_conntrack.ko
    New:
    112095 21381 240 133716 20a54 nf_conntrack.ko

    The size increase is only temporary.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

18 Dec, 2018

1 commit

  • faec18dbb   netfilter: nat: remove l4proto->manip_pkt ... Browse Code »

    This removes the last l4proto indirection, the two callers, the l3proto
    packet mangling helpers for ipv4 and ipv6, now call the
    nf_nat_l4proto_manip_pkt() helper.

    nf_nat_proto_{dccp,tcp,sctp,gre,icmp,icmpv6} are left behind, even though
    they contain no functionality anymore to not clutter this patch.

    Next patch will remove the empty files and the nf_nat_l4proto
    struct.

    nf_nat_proto_udp.c is renamed to nf_nat_proto.c, as it now contains the
    other nat manip functionality as well, not just udp and udplite.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal