Eric Lee / smarc-fsl-linux-kernel

14 Oct, 2013

3 commits

  • 20300db1b   sit: allow to use rtnl ops on fb tunnel ... Browse Code »

    [ Upstream commit 205983c43700ac3a81e7625273a3fa83cd2759b5 ]

    rtnl ops where introduced by ba3e3f50a0e5 ("sit: advertise tunnel param via
    rtnl"), but I forget to assign rtnl ops to fb tunnels.

    Now that it is done, we must remove the explicit call to
    unregister_netdevice_queue(), because the fallback tunnel is added to the queue
    in sit_destroy_tunnels() when checking rtnl_link_ops of all netdevices (this
    is valid since commit 5e6700b3bf98 ("sit: add support of x-netns")).

    Signed-off-by: Nicolas Dichtel
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Nicolas Dichtel
     
  • 6ea2edb3b   IPv6 NAT: Do not drop DNATed 6to4/6rd packets ... Browse Code »

    [ Upstream commit 7df37ff33dc122f7bd0614d707939fe84322d264 ]

    When a router is doing DNAT for 6to4/6rd packets the latest
    anti-spoofing commit 218774dc ("ipv6: add anti-spoofing checks for
    6to4 and 6rd") will drop them because the IPv6 address embedded does
    not match the IPv4 destination. This patch will allow them to pass by
    testing if we have an address that matches on 6to4/6rd interface. I
    have been hit by this problem using Fedora and IPV6TO4_IPV4ADDR.
    Also, log the dropped packets (with rate limit).

    Signed-off-by: Catalin(ux) M. BOIE
    Acked-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Catalin(ux) M. BOIE
     
  • 68a9e7078   ip: generate unique IP identificator if local fragmentation is allowed ... Browse Code »

    [ Upstream commit 703133de331a7a7df47f31fb9de51dc6f68a9de8 ]

    If local fragmentation is allowed, then ip_select_ident() and
    ip_select_ident_more() need to generate unique IDs to ensure
    correct defragmentation on the peer.

    For example, if IPsec (tunnel mode) has to encrypt large skbs
    that have local_df bit set, then all IP fragments that belonged
    to different ESP datagrams would have used the same identificator.
    If one of these IP fragments would get lost or reordered, then
    peer could possibly stitch together wrong IP fragments that did
    not belong to the same datagram. This would lead to a packet loss
    or data corruption.

    Signed-off-by: Ansis Atteka
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Ansis Atteka
     

29 Jul, 2013

1 commit

  • ce08aa042   ipv6: only apply anti-spoofing checks to not-pointopoint tunnels ... Browse Code »

    [ Upstream commit 5c29fb12e8fb8a8105ea048cb160fd79a85a52bb ]

    Because of commit 218774dc341f219bfcf940304a081b121a0e8099 ("ipv6: add
    anti-spoofing checks for 6to4 and 6rd") the sit driver dropped packets
    for 2002::/16 destinations and sources even when configured to work as a
    tunnel with fixed endpoint. We may only apply the 6rd/6to4 anti-spoofing
    checks if the device is not in pointopoint mode.

    This was an oversight from me in the above commit, sorry. Thanks to
    Roman Mamedov for reporting this!

    Reported-by: Roman Mamedov
    Cc: David Miller
    Cc: YOSHIFUJI Hideaki
    Signed-off-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Hannes Frederic Sowa
     

27 Mar, 2013

2 commits

  • f61dd388a   Tunneling: use IP Tunnel stats APIs. ... Browse Code »

    Use common function get calculate rtnl_link_stats64 stats.

    Signed-off-by: Pravin B Shelar
    Signed-off-by: David S. Miller

    Pravin B Shelar
     
  • c54419321   GRE: Refactor GRE tunneling code. ... Browse Code »

    Following patch refactors GRE code into ip tunneling code and GRE
    specific code. Common tunneling code is moved to ip_tunnel module.
    ip_tunnel module is written as generic library which can be used
    by different tunneling implementations.

    ip_tunnel module contains following components:
    - packet xmit and rcv generic code. xmit flow looks like
    (gre_xmit/ipip_xmit)->ip_tunnel_xmit->ip_local_out.
    - hash table of all devices.
    - lookup for tunnel devices.
    - control plane operations like device create, destroy, ioctl, netlink
    operations code.
    - registration for tunneling modules, like gre, ipip etc.
    - define single pcpu_tstats dev->tstats.
    - struct tnl_ptk_info added to pass parsed tunnel packet parameters.

    ipip.h header is renamed to ip_tunnel.h

    Signed-off-by: Pravin B Shelar
    Signed-off-by: David S. Miller

    Pravin B Shelar
     

10 Mar, 2013

1 commit

  • 6aed0c8bf   tunnel: use iptunnel_xmit() again ... Browse Code »

    With recent patches from Pravin, most tunnels can't use iptunnel_xmit()
    any more, due to ip_select_ident() and skb->ip_summed. But we can just
    move these operations out of iptunnel_xmit(), so that tunnels can
    use it again.

    This by the way fixes a bug in vxlan (missing nf_reset()) for net-next.

    Cc: Pravin B Shelar
    Cc: Stephen Hemminger
    Cc: "David S. Miller"
    Signed-off-by: Cong Wang
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Cong Wang
     

30 Jan, 2013

1 commit

  • 218774dc3   ipv6: add anti-spoofing checks for 6to4 and 6rd ... Browse Code »

    This patch adds anti-spoofing checks in sit.c as specified in RFC3964
    section 5.2 for 6to4 and RFC5969 section 12 for 6rd. I left out the
    checks which could easily be implemented with netfilter.

    Specifically this patch adds following logic (based loosely on the
    pseudocode in RFC3964 section 5.2):

    if prefix (inner_src_v6) == rd6_prefix (2002::/16 is the default)
    and outer_src_v4 != embedded_ipv4 (inner_src_v6)
    drop
    if prefix (inner_dst_v6) == rd6_prefix (or 2002::/16 is the default)
    and outer_dst_v4 != embedded_ipv4 (inner_dst_v6)
    drop
    accept

    To accomplish the specified security checks proposed by above RFCs,
    it is still necessary to employ uRPF filters with netfilter. These new
    checks only kick in if the employed addresses are within the 2002::/16 or
    another range specified by the 6rd-prefix (which defaults to 2002::/16).

    Cc: YOSHIFUJI Hideaki
    Cc: David Miller
    Signed-off-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller

    Hannes Frederic Sowa
     

19 Jan, 2013

1 commit

29 Nov, 2012

1 commit

  • f4e0b4c5e   ip6tnl/sit: drop packet if ECN present with not-ECT ... Browse Code »

    This patch reports the change made by Stephen Hemminger in ipip and gre[6] in
    commit eccc1bb8d4b4 (tunnel: drop packet if ECN present with not-ECT).

    Goal is to handle RFC6040, Section 4.2:

    Default Tunnel Egress Behaviour.
    o If the inner ECN field is Not-ECT, the decapsulator MUST NOT
    propagate any other ECN codepoint onwards. This is because the
    inner Not-ECT marking is set by transports that rely on dropped
    packets as an indication of congestion and would not understand or
    respond to any other ECN codepoint [RFC4774]. Specifically:

    * If the inner ECN field is Not-ECT and the outer ECN field is
    CE, the decapsulator MUST drop the packet.

    * If the inner ECN field is Not-ECT and the outer ECN field is
    Not-ECT, ECT(0), or ECT(1), the decapsulator MUST forward the
    outgoing packet with the ECN field cleared to Not-ECT.

    The patch takes benefits from common function added in net/inet_ecn.h.

    Like it was done for Xin4 tunnels, it adds logging to allow detecting broken
    systems that set ECN bits incorrectly when tunneling (or an intermediate
    router might be changing the header). Errors are also tracked via
    rx_frame_error.

    CC: Stephen Hemminger
    Signed-off-by: Nicolas Dichtel
    Signed-off-by: David S. Miller

    Nicolas Dichtel
     

21 Nov, 2012

1 commit

19 Nov, 2012

1 commit

  • af31f412c   net: Allow userns root to control ipv6 ... Browse Code »

    Allow an unpriviled user who has created a user namespace, and then
    created a network namespace to effectively use the new network
    namespace, by reducing capable(CAP_NET_ADMIN) and
    capable(CAP_NET_RAW) calls to be ns_capable(net->user_ns,
    CAP_NET_ADMIN), or capable(net->user_ns, CAP_NET_RAW) calls.

    Settings that merely control a single network device are allowed.
    Either the network device is a logical network device where
    restrictions make no difference or the network device is hardware NIC
    that has been explicity moved from the initial network namespace.

    In general policy and network stack state changes are allowed while
    resource control is left unchanged.

    Allow the SIOCSIFADDR ioctl to add ipv6 addresses.
    Allow the SIOCDIFADDR ioctl to delete ipv6 addresses.
    Allow the SIOCADDRT ioctl to add ipv6 routes.
    Allow the SIOCDELRT ioctl to delete ipv6 routes.

    Allow creation of ipv6 raw sockets.

    Allow setting the IPV6_JOIN_ANYCAST socket option.
    Allow setting the IPV6_FL_A_RENEW parameter of the IPV6_FLOWLABEL_MGR
    socket option.

    Allow setting the IPV6_TRANSPARENT socket option.
    Allow setting the IPV6_HOPOPTS socket option.
    Allow setting the IPV6_RTHDRDSTOPTS socket option.
    Allow setting the IPV6_DSTOPTS socket option.
    Allow setting the IPV6_IPSEC_POLICY socket option.
    Allow setting the IPV6_XFRM_POLICY socket option.

    Allow sending packets with the IPV6_2292HOPOPTS control message.
    Allow sending packets with the IPV6_2292DSTOPTS control message.
    Allow sending packets with the IPV6_RTHDRDSTOPTS control message.

    Allow setting the multicast routing socket options on non multicast
    routing sockets.

    Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL, and SIOCDELTUNNEL ioctls for
    setting up, changing and deleting tunnels over ipv6.

    Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL, SIOCDELTUNNEL ioctls for
    setting up, changing and deleting ipv6 over ipv4 tunnels.

    Allow the SIOCADDPRL, SIOCDELPRL, SIOCCHGPRL ioctls for adding,
    deleting, and changing the potential router list for ISATAP tunnels.

    Signed-off-by: "Eric W. Biederman"
    Signed-off-by: David S. Miller

    Eric W. Biederman
     

16 Nov, 2012

1 commit

  • d440b7206   sit: fix sparse warnings ... Browse Code »

    This change fixes several sparse warnings about endianness problem. The wrong
    nla_*() functions were used.
    It also fix a sparse warning about a flag test (field i_flags). This field is
    used in this file like a local flag only, so it is more an u16 (gre uses it as a
    be16). This sparse warning was already there before the patch that add netlink
    management, the code has just been moved.

    Reported-by: Fengguang Wu
    Signed-off-by: Nicolas Dichtel
    Signed-off-by: David S. Miller

    Nicolas Dichtel
     

15 Nov, 2012

6 commits

10 Nov, 2012

1 commit

  • ba3e3f50a   sit: advertise tunnel param via rtnl ... Browse Code »

    It is usefull for daemons that monitor link event to have the full parameters of
    these interfaces when a rtnl message is sent.
    It allows also to dump them via rtnetlink.

    It is based on what is done for GRE tunnels.

    Signed-off-by: Nicolas Dichtel
    Signed-off-by: David S. Miller

    Nicolas Dichtel
     

28 Sep, 2012

1 commit

17 Jul, 2012

1 commit

  • 6700c2709   net: Pass optional SKB and SK arguments to dst_ops->{update_pmtu,redirect}() ... Browse Code »

    This will be used so that we can compose a full flow key.

    Even though we have a route in this context, we need more. In the
    future the routes will be without destination address, source address,
    etc. keying. One ipv4 route will cover entire subnets, etc.

    In this environment we have to have a way to possess persistent storage
    for redirects and PMTU information. This persistent storage will exist
    in the FIB tables, and that's why we'll need to be able to rebuild a
    full lookup flow key here. Using that flow key will do a fib_lookup()
    and create/update the persistent entry.

    Signed-off-by: David S. Miller

    David S. Miller
     

12 Jul, 2012

1 commit

15 Jun, 2012

1 commit

  • 363933955   ipv4: Handle PMTU in all ICMP error handlers. ... Browse Code »

    With ip_rt_frag_needed() removed, we have to explicitly update PMTU
    information in every ICMP error handler.

    Create two helper functions to facilitate this.

    1) ipv4_sk_update_pmtu()

    This updates the PMTU when we have a socket context to
    work with.

    2) ipv4_update_pmtu()

    Raw version, used when no socket context is available. For this
    interface, we essentially just pass in explicit arguments for
    the flow identity information we would have extracted from the
    socket.

    And you'll notice that ipv4_sk_update_pmtu() is simply implemented
    in terms of ipv4_update_pmtu()

    Note that __ip_route_output_key() is used, rather than something like
    ip_route_output_flow() or ip_route_output_key(). This is because we
    absolutely do not want to end up with a route that does IPSEC
    encapsulation and the like. Instead, we only want the route that
    would get us to the node described by the outermost IP header.

    Reported-by: Steffen Klassert
    Signed-off-by: David S. Miller

    David S. Miller
     

16 May, 2012

2 commits

15 Apr, 2012

1 commit

02 Apr, 2012

1 commit

27 Jan, 2012

1 commit

13 Jan, 2012

1 commit

  • cf778b00e   net: reintroduce missing rcu_assign_pointer() calls ... Browse Code »

    commit a9b3cd7f32 (rcu: convert uses of rcu_assign_pointer(x, NULL) to
    RCU_INIT_POINTER) did a lot of incorrect changes, since it did a
    complete conversion of rcu_assign_pointer(x, y) to RCU_INIT_POINTER(x,
    y).

    We miss needed barriers, even on x86, when y is not NULL.

    Signed-off-by: Eric Dumazet
    CC: Stephen Hemminger
    CC: Paul E. McKenney
    Signed-off-by: David S. Miller

    Eric Dumazet
     

16 Dec, 2011

1 commit

13 Dec, 2011

1 commit

  • 72b36015b   ipip, sit: copy parms.name after register_netdevice ... Browse Code »
    1

    Same fix as 731abb9cb2 for ipip and sit tunnel.
    Commit 1c5cae815d removed an explicit call to dev_alloc_name in
    ipip_tunnel_locate and ipip6_tunnel_locate, because register_netdevice
    will now create a valid name, however the tunnel keeps a copy of the
    name in the private parms structure. Fix this by copying the name back
    after register_netdevice has successfully returned.

    This shows up if you do a simple tunnel add, followed by a tunnel show:

    $ sudo ip tunnel add mode ipip remote 10.2.20.211
    $ ip tunnel
    tunl0: ip/ip remote any local any ttl inherit nopmtudisc
    tunl%d: ip/ip remote 10.2.20.211 local any ttl inherit
    $ sudo ip tunnel add mode sit remote 10.2.20.212
    $ ip tunnel
    sit0: ipv6/ip remote any local any ttl 64 nopmtudisc 6rd-prefix 2002::/16
    sit%d: ioctl 89f8 failed: No such device
    sit%d: ipv6/ip remote 10.2.20.212 local any ttl inherit

    Cc: stable@vger.kernel.org
    Signed-off-by: Ted Feng
    Signed-off-by: David S. Miller

    Ted Feng
     

06 Dec, 2011

1 commit

23 Nov, 2011

1 commit

09 Nov, 2011

1 commit

  • 8ce120f11   net: better pcpu data alignment ... Browse Code »

    Tunnels can force an alignment of their percpu data to reduce number of
    cache lines used in fast path, or read in .ndo_get_stats()

    percpu_alloc() is a very fine grained allocator, so any small hole will
    be used anyway.

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

21 Aug, 2011

1 commit

17 Aug, 2011

1 commit

  • c2bceb3d7   sit tunnels: propagate IPv6 transport class to IPv4 Type of Service ... Browse Code »

    sit tunnels (IPv6 tunnel over IPv4) do not implement the "tos inherit"
    case to copy the IPv6 transport class byte from the inner packet to
    the IPv4 type of service byte in the outer packet. By contrast, ipip
    tunnels and GRE tunnels do.

    This patch, adapted from the similar code in net/ipv4/ipip.c and
    net/ipv4/ip_gre.c, implements that.

    This patch applies to 3.0.1, and has been tested on that version.

    Signed-off-by: Lionel Elie Mamane
    Signed-off-by: David S. Miller

    Lionel Elie Mamane
     

02 Aug, 2011

1 commit

  • a9b3cd7f3   rcu: convert uses of rcu_assign_pointer(x, NULL) to RCU_INIT_POINTER ... Browse Code »

    When assigning a NULL value to an RCU protected pointer, no barrier
    is needed. The rcu_assign_pointer, used to handle that but will soon
    change to not handle the special case.

    Convert all rcu_assign_pointer of NULL value.

    //smpl
    @@ expression P; @@

    - rcu_assign_pointer(P, NULL)
    + RCU_INIT_POINTER(P, NULL)

    //

    Signed-off-by: Stephen Hemminger
    Acked-by: Paul E. McKenney
    Signed-off-by: David S. Miller

    Stephen Hemminger
     

18 Jul, 2011

1 commit

21 May, 2011

1 commit

  • 06f4e926d   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6 ... Browse Code »

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1446 commits)
    macvlan: fix panic if lowerdev in a bond
    tg3: Add braces around 5906 workaround.
    tg3: Fix NETIF_F_LOOPBACK error
    macvlan: remove one synchronize_rcu() call
    networking: NET_CLS_ROUTE4 depends on INET
    irda: Fix error propagation in ircomm_lmp_connect_response()
    irda: Kill set but unused variable 'bytes' in irlan_check_command_param()
    irda: Kill set but unused variable 'clen' in ircomm_connect_indication()
    rxrpc: Fix set but unused variable 'usage' in rxrpc_get_transport()
    be2net: Kill set but unused variable 'req' in lancer_fw_download()
    irda: Kill set but unused vars 'saddr' and 'daddr' in irlan_provider_connect_indication()
    atl1c: atl1c_resume() is only used when CONFIG_PM_SLEEP is defined.
    rxrpc: Fix set but unused variable 'usage' in rxrpc_get_peer().
    rxrpc: Kill set but unused variable 'local' in rxrpc_UDP_error_handler()
    rxrpc: Kill set but unused variable 'sp' in rxrpc_process_connection()
    rxrpc: Kill set but unused variable 'sp' in rxrpc_rotate_tx_window()
    pkt_sched: Kill set but unused variable 'protocol' in tc_classify()
    isdn: capi: Use pr_debug() instead of ifdefs.
    tg3: Update version to 3.119
    tg3: Apply rx_discards fix to 5719/5720
    ...

    Fix up trivial conflicts in arch/x86/Kconfig and net/mac80211/agg-tx.c
    as per Davem.

    Linus Torvalds