Eric Lee / smarc-fsl-linux-kernel

03 Mar, 2016

2 commits

  • b9e69e127   netfilter: xtables: don't hook tables by default ... Browse Code »

    delay hook registration until the table is being requested inside a
    namespace.

    Historically, a particular table (iptables mangle, ip6tables filter, etc)
    was registered on module load.

    When netns support was added to iptables only the ip/ip6tables ruleset was
    made namespace aware, not the actual hook points.

    This means f.e. that when ipt_filter table/module is loaded on a system,
    then each namespace on that system has an (empty) iptables filter ruleset.

    In other words, if a namespace sends a packet, such skb is 'caught' by
    netfilter machinery and fed to hooking points for that table (i.e. INPUT,
    FORWARD, etc).

    Thanks to Eric Biederman, hooks are no longer global, but per namespace.

    This means that we can avoid allocation of empty ruleset in a namespace and
    defer hook registration until we need the functionality.

    We register a tables hook entry points ONLY in the initial namespace.
    When an iptables get/setockopt is issued inside a given namespace, we check
    if the table is found in the per-namespace list.

    If not, we attempt to find it in the initial namespace, and, if found,
    create an empty default table in the requesting namespace and register the
    needed hooks.

    Hook points are destroyed only once namespace is deleted, there is no
    'usage count' (it makes no sense since there is no 'remove table' operation
    in xtables api).

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • a67dd266a   netfilter: xtables: prepare for on-demand hook register ... Browse Code »

    This change prepares for upcoming on-demand xtables hook registration.

    We change the protoypes of the register/unregister functions.
    A followup patch will then add nf_hook_register/unregister calls
    to the iptables one.

    Once a hook is registered packets will be picked up, so all assignments
    of the form

    net->ipv4.iptable_$table = new_table

    have to be moved to ip(6)t_register_table, else we can see NULL
    net->ipv4.iptable_$table later.

    This patch doesn't change functionality; without this the actual change
    simply gets too big.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

17 Oct, 2015

1 commit

  • 2ffbceb2b   netfilter: remove hook owner refcounting ... Browse Code »

    since commit 8405a8fff3f8 ("netfilter: nf_qeueue: Drop queue entries on
    nf_unregister_hook") all pending queued entries are discarded.

    So we can simply remove all of the owner handling -- when module is
    removed it also needs to unregister all its hooks.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

19 Sep, 2015

2 commits

18 Sep, 2015

1 commit

  • 9dff2c966   netfilter: Use nf_hook_state.net ... Browse Code »

    Instead of saying "net = dev_net(state->in?state->in:state->out)"
    just say "state->net". As that information is now availabe,
    much less confusing and much less error prone.

    Signed-off-by: "Eric W. Biederman"
    Signed-off-by: David S. Miller

    Eric W. Biederman
     

05 Apr, 2015

3 commits

02 Sep, 2014

1 commit

30 Apr, 2014

1 commit

14 Oct, 2013

1 commit

15 Jul, 2013

1 commit

08 Apr, 2013

2 commits

  • aaa795ad2   netfilter: nat: propagate errors from xfrm_me_harder() ... Browse Code »

    Propagate errors from ip_xfrm_me_harder() instead of returning EPERM in
    all cases.

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     
  • c9e1673a0   netfilter: ipv4: propagate routing errors from ip_route_me_harder() ... Browse Code »

    Propagate routing errors from ip_route_me_harder() when dropping a packet
    using NF_DROP_ERR(). This makes userspace get the proper error instead of
    EPERM for everything.

    Example:

    # ip r a unreachable default table 100
    # ip ru add fwmark 0x1 lookup 100
    # iptables -t mangle -A OUTPUT -d 8.8.8.8 -j MARK --set-mark 0x1

    Current behaviour:

    PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
    ping: sendmsg: Operation not permitted
    ping: sendmsg: Operation not permitted
    ping: sendmsg: Operation not permitted

    New behaviour:

    PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
    ping: sendmsg: Network is unreachable
    ping: sendmsg: Network is unreachable
    ping: sendmsg: Network is unreachable
    ping: sendmsg: Network is unreachable

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

17 Dec, 2012

1 commit

  • c65ef8dc7   netfilter: nf_nat: Also handle non-ESTABLISHED routing changes in MASQUERADE ... Browse Code »

    Since (a0ecb85 netfilter: nf_nat: Handle routing changes in MASQUERADE
    target), the MASQUERADE target handles routing changes which affect
    the output interface of a connection, but only for ESTABLISHED
    connections. It is also possible for NEW connections which
    already have a conntrack entry to be affected by routing changes.

    This adds a check to drop entries in the NEW+conntrack state
    when the oif has changed.

    Signed-off-by: Andrew Collins
    Acked-by: Jozsef Kadlecsik
    Signed-off-by: Pablo Neira Ayuso

    Andrew Collins
     

03 Dec, 2012

1 commit

  • a0ecb85a2   netfilter: nf_nat: Handle routing changes in MASQUERADE target ... Browse Code »

    When the route changes (backup default route, VPNs) which affect a
    masqueraded target, the packets were sent out with the outdated source
    address. The patch addresses the issue by comparing the outgoing interface
    directly with the masqueraded interface in the nat table.

    Events are inefficient in this case, because it'd require adding route
    events to the network core and then scanning the whole conntrack table
    and re-checking the route for all entry.

    Signed-off-by: Jozsef Kadlecsik
    Signed-off-by: Pablo Neira Ayuso

    Jozsef Kadlecsik
     

17 Nov, 2012

1 commit

29 Oct, 2012

2 commits

30 Aug, 2012

1 commit