Eric Lee / smarc-fsl-linux-kernel

05 Oct, 2020

1 commit

15 Mar, 2020

1 commit

16 Jan, 2020

10 commits

09 Dec, 2019

1 commit

05 Nov, 2019

1 commit

15 Aug, 2019

1 commit

  • 83c156d3e   netfilter: nft_bitwise: Adjust parentheses to fix memcmp size argument ... Browse Code »

    clang warns:

    net/netfilter/nft_bitwise.c:138:50: error: size argument in 'memcmp'
    call is a comparison [-Werror,-Wmemsize-comparison]
    if (memcmp(&priv->xor, &zero, sizeof(priv->xor) ||
    ~~~~~~~~~~~~~~~~~~^~
    net/netfilter/nft_bitwise.c:138:6: note: did you mean to compare the
    result of 'memcmp' instead?
    if (memcmp(&priv->xor, &zero, sizeof(priv->xor) ||
    ^
    )
    net/netfilter/nft_bitwise.c:138:32: note: explicitly cast the argument
    to size_t to silence this warning
    if (memcmp(&priv->xor, &zero, sizeof(priv->xor) ||
    ^
    (size_t)(
    1 error generated.

    Adjust the parentheses so that the result of the sizeof is used for the
    size argument in memcmp, rather than the result of the comparison (which
    would always be true because sizeof is a non-zero number).

    Fixes: bd8699e9e292 ("netfilter: nft_bitwise: add offload support")
    Link: https://github.com/ClangBuiltLinux/linux/issues/638
    Reported-by: kbuild test robot
    Signed-off-by: Nathan Chancellor
    Reviewed-by: Nick Desaulniers
    Signed-off-by: Pablo Neira Ayuso

    Nathan Chancellor
     

13 Aug, 2019

1 commit

19 Jun, 2019

1 commit

  • d2912cb15   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 ... Browse Code »

    Based on 2 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation #

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 4122 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Enrico Weigelt
    Reviewed-by: Kate Stewart
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

18 Jan, 2019

1 commit

  • 10870dd89   netfilter: nf_tables: add direct calls for all builtin expressions ... Browse Code »

    With CONFIG_RETPOLINE its faster to add an if (ptr == &foo_func)
    check and and use direct calls for all the built-in expressions.

    ~15% improvement in pathological cases.

    checkpatch doesn't like the X macro due to the embedded return statement,
    but the macro has a very limited scope so I don't think its a problem.

    I would like to avoid bugs of the form
    If (e->ops->eval == (unsigned long)nft_foo_eval)
    nft_bar_eval();

    and open-coded if ()/else if()/else cascade, thus the macro.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

15 May, 2017

2 commits

  • 591054469   netfilter: nf_tables: revisit chain/object refcounting from elements ... Browse Code »

    Andreas reports that the following incremental update using our commit
    protocol doesn't work.

    # nft -f incremental-update.nft
    delete element ip filter client_to_any { 10.180.86.22 : goto CIn_1 }
    delete chain ip filter CIn_1
    ... Error: Could not process rule: Device or resource busy

    The existing code is not well-integrated into the commit phase protocol,
    since element deletions do not result in refcount decrement from the
    preparation phase. This results in bogus EBUSY errors like the one
    above.

    Two new functions come with this patch:

    * nft_set_elem_activate() function is used from the abort path, to
    restore the set element refcounting on objects that occurred from
    the preparation phase.

    * nft_set_elem_deactivate() that is called from nft_del_setelem() to
    decrement set element refcounting on objects from the preparation
    phase in the commit protocol.

    The nft_data_uninit() has been renamed to nft_data_release() since this
    function does not uninitialize any data store in the data register,
    instead just releases the references to objects. Moreover, a new
    function nft_data_hold() has been introduced to be used from
    nft_set_elem_activate().

    Reported-by: Andreas Schultz
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • 71df14b0c   netfilter: nf_tables: missing sanitization in data from userspace ... Browse Code »

    Do not assume userspace always sends us NFT_DATA_VALUE for bitwise and
    cmp expressions. Although NFT_DATA_VERDICT does not make any sense, it
    is still possible to handcraft a netlink message using this incorrect
    data type.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

10 Nov, 2016

1 commit

  • 4e24877e6   netfilter: nf_tables: simplify the basic expressions' init routine ... Browse Code »

    Some basic expressions are built into nf_tables.ko, such as nft_cmp,
    nft_lookup, nft_range and so on. But these basic expressions' init
    routine is a little ugly, too many goto errX labels, and we forget
    to call nft_range_module_exit in the exit routine, although it is
    harmless.

    Acctually, the init and exit routines of these basic expressions
    are same, i.e. do nft_register_expr in the init routine and do
    nft_unregister_expr in the exit routine.

    So it's better to arrange them into an array and deal with them
    together.

    Signed-off-by: Liping Zhang
    Signed-off-by: Pablo Neira Ayuso

    Liping Zhang
     

23 Sep, 2016

1 commit

  • 36b701fae   netfilter: nf_tables: validate maximum value of u32 netlink attributes ... Browse Code »

    Fetch value and validate u32 netlink attribute. This validation is
    usually required when the u32 netlink attributes are being stored in a
    field whose size is smaller.

    This patch revisits 4da449ae1df9 ("netfilter: nft_exthdr: Add size check
    on u8 nft_exthdr attributes").

    Fixes: 96518518cc41 ("netfilter: add nftables")
    Suggested-by: Pablo Neira Ayuso
    Signed-off-by: Laura Garcia Liebana
    Signed-off-by: Pablo Neira Ayuso

    Laura Garcia Liebana
     

13 Apr, 2015

9 commits

14 Oct, 2013

2 commits

  • ef1f7df91   netfilter: nf_tables: expression ops overloading ... Browse Code »

    Split the expression ops into two parts and support overloading of
    the runtime expression ops based on the requested function through
    a ->select_ops() callback.

    This can be used to provide optimized implementations, for instance
    for loading small aligned amounts of data from the packet or inlining
    frequently used operations into the main evaluation loop.

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     
  • 96518518c   netfilter: add nftables ... Browse Code »

    This patch adds nftables which is the intended successor of iptables.
    This packet filtering framework reuses the existing netfilter hooks,
    the connection tracking system, the NAT subsystem, the transparent
    proxying engine, the logging infrastructure and the userspace packet
    queueing facilities.

    In a nutshell, nftables provides a pseudo-state machine with 4 general
    purpose registers of 128 bits and 1 specific purpose register to store
    verdicts. This pseudo-machine comes with an extensible instruction set,
    a.k.a. "expressions" in the nftables jargon. The expressions included
    in this patch provide the basic functionality, they are:

    * bitwise: to perform bitwise operations.
    * byteorder: to change from host/network endianess.
    * cmp: to compare data with the content of the registers.
    * counter: to enable counters on rules.
    * ct: to store conntrack keys into register.
    * exthdr: to match IPv6 extension headers.
    * immediate: to load data into registers.
    * limit: to limit matching based on packet rate.
    * log: to log packets.
    * meta: to match metainformation that usually comes with the skbuff.
    * nat: to perform Network Address Translation.
    * payload: to fetch data from the packet payload and store it into
    registers.
    * reject (IPv4 only): to explicitly close connection, eg. TCP RST.

    Using this instruction-set, the userspace utility 'nft' can transform
    the rules expressed in human-readable text representation (using a
    new syntax, inspired by tcpdump) to nftables bytecode.

    nftables also inherits the table, chain and rule objects from
    iptables, but in a more configurable way, and it also includes the
    original datatype-agnostic set infrastructure with mapping support.
    This set infrastructure is enhanced in the follow up patch (netfilter:
    nf_tables: add netlink set API).

    This patch includes the following components:

    * the netlink API: net/netfilter/nf_tables_api.c and
    include/uapi/netfilter/nf_tables.h
    * the packet filter core: net/netfilter/nf_tables_core.c
    * the expressions (described above): net/netfilter/nft_*.c
    * the filter tables: arp, IPv4, IPv6 and bridge:
    net/ipv4/netfilter/nf_tables_ipv4.c
    net/ipv6/netfilter/nf_tables_ipv6.c
    net/ipv4/netfilter/nf_tables_arp.c
    net/bridge/netfilter/nf_tables_bridge.c
    * the NAT table (IPv4 only):
    net/ipv4/netfilter/nf_table_nat_ipv4.c
    * the route table (similar to mangle):
    net/ipv4/netfilter/nf_table_route_ipv4.c
    net/ipv6/netfilter/nf_table_route_ipv6.c
    * internal definitions under:
    include/net/netfilter/nf_tables.h
    include/net/netfilter/nf_tables_core.h
    * It also includes an skeleton expression:
    net/netfilter/nft_expr_template.c
    and the preliminary implementation of the meta target
    net/netfilter/nft_meta_target.c

    It also includes a change in struct nf_hook_ops to add a new
    pointer to store private data to the hook, that is used to store
    the rule list per chain.

    This patch is based on the patch from Patrick McHardy, plus merged
    accumulated cleanups, fixes and small enhancements to the nftables
    code that has been done since 2009, which are:

    From Patrick McHardy:
    * nf_tables: adjust netlink handler function signatures
    * nf_tables: only retry table lookup after successful table module load
    * nf_tables: fix event notification echo and avoid unnecessary messages
    * nft_ct: add l3proto support
    * nf_tables: pass expression context to nft_validate_data_load()
    * nf_tables: remove redundant definition
    * nft_ct: fix maxattr initialization
    * nf_tables: fix invalid event type in nf_tables_getrule()
    * nf_tables: simplify nft_data_init() usage
    * nf_tables: build in more core modules
    * nf_tables: fix double lookup expression unregistation
    * nf_tables: move expression initialization to nf_tables_core.c
    * nf_tables: build in payload module
    * nf_tables: use NFPROTO constants
    * nf_tables: rename pid variables to portid
    * nf_tables: save 48 bits per rule
    * nf_tables: introduce chain rename
    * nf_tables: check for duplicate names on chain rename
    * nf_tables: remove ability to specify handles for new rules
    * nf_tables: return error for rule change request
    * nf_tables: return error for NLM_F_REPLACE without rule handle
    * nf_tables: include NLM_F_APPEND/NLM_F_REPLACE flags in rule notification
    * nf_tables: fix NLM_F_MULTI usage in netlink notifications
    * nf_tables: include NLM_F_APPEND in rule dumps

    From Pablo Neira Ayuso:
    * nf_tables: fix stack overflow in nf_tables_newrule
    * nf_tables: nft_ct: fix compilation warning
    * nf_tables: nft_ct: fix crash with invalid packets
    * nft_log: group and qthreshold are 2^16
    * nf_tables: nft_meta: fix socket uid,gid handling
    * nft_counter: allow to restore counters
    * nf_tables: fix module autoload
    * nf_tables: allow to remove all rules placed in one chain
    * nf_tables: use 64-bits rule handle instead of 16-bits
    * nf_tables: fix chain after rule deletion
    * nf_tables: improve deletion performance
    * nf_tables: add missing code in route chain type
    * nf_tables: rise maximum number of expressions from 12 to 128
    * nf_tables: don't delete table if in use
    * nf_tables: fix basechain release

    From Tomasz Bursztyka:
    * nf_tables: Add support for changing users chain's name
    * nf_tables: Change chain's name to be fixed sized
    * nf_tables: Add support for replacing a rule by another one
    * nf_tables: Update uapi nftables netlink header documentation

    From Florian Westphal:
    * nft_log: group is u16, snaplen u32

    From Phil Oester:
    * nf_tables: operational limit match

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy