Eric Lee / smarc-fsl-linux-kernel

05 Nov, 2016

1 commit

  • e2d118a1c   net: inet: Support UID-based routing in IP protocols. ... Browse Code »

    - Use the UID in routing lookups made by protocol connect() and
    sendmsg() functions.
    - Make sure that routing lookups triggered by incoming packets
    (e.g., Path MTU discovery) take the UID of the socket into
    account.
    - For packets not associated with a userspace socket, (e.g., ping
    replies) use UID 0 inside the user namespace corresponding to
    the network namespace the socket belongs to. This allows
    all namespaces to apply routing and iptables rules to
    kernel-originated traffic in that namespaces by matching UID 0.
    This is better than using the UID of the kernel socket that is
    sending the traffic, because the UID of kernel sockets created
    at namespace creation time (e.g., the per-processor ICMP and
    TCP sockets) is the UID of the user that created the socket,
    which might not be mapped in the namespace.

    Tested: compiles allnoconfig, allyesconfig, allmodconfig
    Tested: https://android-review.googlesource.com/253302
    Signed-off-by: Lorenzo Colitti
    Signed-off-by: David S. Miller

    Lorenzo Colitti
     

25 Aug, 2014

1 commit

  • cc24becae   ipv6: White-space cleansing : Structure layouts ... Browse Code »

    This patch makes no changes to the logic of the code but simply addresses
    coding style issues as detected by checkpatch.

    Both objdump and diff -w show no differences.

    This patch addresses structure definitions, specifically it cleanses the brace
    placement and replaces spaces with tabs in a few places.

    Signed-off-by: Ian Morris
    Signed-off-by: David S. Miller

    Ian Morris
     

14 Mar, 2014

1 commit

07 Dec, 2013

1 commit

  • a99421d9b   ipv4/ipv6: Fix FSF address in file headers ... Browse Code »

    Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: Alexey Kuznetsov
    CC: James Morris
    CC: Hideaki YOSHIFUJI
    CC: Patrick McHardy
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Jeff Kirsher
     

16 Sep, 2013

1 commit

  • b3b2b9e19   ipsec: Don't update the pmtu on ICMPV6_DEST_UNREACH ... Browse Code »

    Currently we update the pmtu in the IPsec protocol error handlers
    if icmpv6 message type is either ICMPV6_DEST_UNREACH or
    ICMPV6_PKT_TOOBIG. Updating the pmtu on ICMPV6_DEST_UNREACH
    is wrong in any case, it causes strangely fragmented packets.
    Only ICMPV6_PKT_TOOBIG signalizes pmtu discovery, so remove the
    ICMPV6_DEST_UNREACH check in the IPsec protocol error handlers.

    Signed-off-by: Steffen Klassert

    Steffen Klassert
     

06 Sep, 2013

1 commit

  • b55b76b22   ipv6:introduce function to find route for redirect ... Browse Code »

    RFC 4861 says that the IP source address of the Redirect is the
    same as the current first-hop router for the specified ICMP
    Destination Address, so the gateway should be taken into
    consideration when we find the route for redirect.

    There was once a check in commit
    a6279458c534d01ccc39498aba61c93083ee0372 ("NDISC: Search over
    all possible rules on receipt of redirect.") and the check
    went away in commit b94f1c0904da9b8bf031667afc48080ba7c3e8c9
    ("ipv6: Use icmpv6_notify() to propagate redirect, instead of
    rt6_redirect()").

    The bug is only "exploitable" on layer-2 because the source
    address of the redirect is checked to be a valid link-local
    address but it makes spoofing a lot easier in the same L2
    domain nonetheless.

    Thanks very much for Hannes's help.

    Signed-off-by: Duan Jiong
    Acked-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller

    Duan Jiong
     

12 Jul, 2012

1 commit

16 Jun, 2012

1 commit

  • 81aded246   ipv6: Handle PMTU in ICMP error handlers. ... Browse Code »

    One tricky issue on the ipv6 side vs. ipv4 is that the ICMP callouts
    to handle the error pass the 32-bit info cookie in network byte order
    whereas ipv4 passes it around in host byte order.

    Like the ipv4 side, we have two helper functions. One for when we
    have a socket context and one for when we do not.

    ip6ip6 tunnels are not handled here, because they handle PMTU events
    by essentially relaying another ICMP packet-too-big message back to
    the original sender.

    This patch allows us to get rid of rt6_do_pmtu_disc(). It handles all
    kinds of situations that simply cannot happen when we do the PMTU
    update directly using a fully resolved route.

    In fact, the "plen == 128" check in ip6_rt_update_pmtu() can very
    likely be removed or changed into a BUG_ON() check. We should never
    have a prefixed ipv6 route when we get there.

    Another piece of strange history here is that TCP and DCCP, unlike in
    ipv4, never invoke the update_pmtu() method from their ICMP error
    handlers. This is incredibly astonishing since this is the context
    where we have the most accurate context in which to make a PMTU
    update, namely we have a fully connected socket and associated cached
    socket route.

    Signed-off-by: David S. Miller

    David S. Miller
     

16 May, 2012

2 commits

23 Apr, 2011

1 commit

23 Feb, 2010

1 commit

17 Feb, 2010

2 commits

28 Jan, 2010

2 commits

15 Sep, 2009

1 commit

23 Jun, 2009

1 commit

26 Nov, 2008

2 commits

30 Oct, 2008

1 commit

29 Oct, 2008

1 commit

27 Jul, 2008

1 commit

  • 2c3abab7c   ipcomp: Fix warnings after ipcomp consolidation. ... Browse Code »

    net/ipv4/ipcomp.c: In function ‘ipcomp4_init_state’:
    net/ipv4/ipcomp.c:109: warning: unused variable ‘calg_desc’
    net/ipv4/ipcomp.c:108: warning: unused variable ‘ipcd’
    net/ipv4/ipcomp.c:107: warning: ‘err’ may be used uninitialized in this function
    net/ipv6/ipcomp6.c: In function ‘ipcomp6_init_state’:
    net/ipv6/ipcomp6.c:139: warning: unused variable ‘calg_desc’
    net/ipv6/ipcomp6.c:138: warning: unused variable ‘ipcd’
    net/ipv6/ipcomp6.c:137: warning: ‘err’ may be used uninitialized in this function

    Signed-off-by: David S. Miller

    David S. Miller
     

25 Jul, 2008

1 commit

19 Apr, 2008

1 commit

29 Feb, 2008

1 commit

  • 21e43188f   [IPCOMP]: Disable BH on output when using shared tfm ... Browse Code »

    Because we use shared tfm objects in order to conserve memory,
    (each tfm requires 128K of vmalloc memory), BH needs to be turned
    off on output as that can occur in process context.

    Previously this was done implicitly by the xfrm output code.
    That was lost when it became lockless. So we need to add the
    BH disabling to IPComp directly.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

01 Feb, 2008

2 commits

29 Jan, 2008

1 commit

  • e40b32861   [IPSEC]: Forbid BEET + ipcomp for now ... Browse Code »

    While BEET can theoretically work with IPComp the current code can't
    do that because it tries to construct a BEET mode tunnel type which
    doesn't (and cannot) exist. In fact as it is it won't even attach a
    tunnel object at all for BEET which is bogus.

    To support this fully we'd also need to change the policy checks on
    input to recognise a plain tunnel as a legal variant of an optional
    BEET transform.

    This patch simply fails such constructions for now.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

07 Nov, 2007

1 commit

02 Nov, 2007

1 commit

18 Oct, 2007

1 commit

  • ca68145f1   [IPSEC]: Disallow combinations of RO and AH/ESP/IPCOMP ... Browse Code »

    Combining RO and AH/ESP/IPCOMP does not make sense. So this patch adds a
    check in the state initialisation function to prevent this.

    This allows us to safely remove the mode input function of RO since it
    can never be called anymore. Indeed, if somehow it does get called we'll
    know about it through an OOPS instead of it slipping past silently.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

11 Oct, 2007

5 commits

  • ceb1eec82   [IPSEC]: Move IP length/checksum setting out of transforms ... Browse Code »

    This patch moves the setting of the IP length and checksum fields out of
    the transforms and into the xfrmX_output functions. This would help future
    efforts in merging the transforms themselves.

    It also adds an optimisation to ipcomp due to the fact that the transport
    offset is guaranteed to be zero.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 87bdc48d3   [IPSEC]: Get rid of ipv6_{auth,esp,comp}_hdr ... Browse Code »

    This patch removes the duplicate ipv6_{auth,esp,comp}_hdr structures since
    they're identical to the IPv4 versions. Duplicating them would only create
    problems for ourselves later when we need to add things like extended
    sequence numbers.

    I've also added transport header type conversion headers for these types
    which are now used by the transforms.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 7b277b1a5   [IPSEC]: Set skb->data to payload in x->mode->output ... Browse Code »

    This patch changes the calling convention so that on entry from
    x->mode->output and before entry into x->type->output skb->data
    will point to the payload instead of the IP header.

    This is essentially a redistribution of skb_push/skb_pull calls
    with the aim of minimising them on the common path of tunnel +
    ESP.

    It'll also let us use the same calling convention between IPv4
    and IPv6 with the next patch.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 007f0211a   [IPSEC]: Store IPv6 nh pointer in mac_header on output ... Browse Code »

    Current the x->mode->output functions store the IPv6 nh pointer in the
    skb network header. This is inconvenient because the network header then
    has to be fixed up before the packet can leave the IPsec stack. The mac
    header field is unused on output so we can use that to store this instead.

    This patch does that and removes the network header fix-up in xfrm_output.

    It also uses ipv6_hdr where appropriate in the x->type->output functions.

    There is also a minor clean-up in esp4 to make it use the same code as
    esp6 to help any subsequent effort to merge the two.

    Lastly it kills two redundant skb_set_* statements in BEET that were
    simply copied over from transport mode.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 1dfcae776   [IPV6]: Remove unneeded pointer iph from ipcomp6_input() in net/ipv6/ipcomp6.c ... Browse Code »

    This trivial patch removes the unneeded pointer iph, which is never used.

    Signed-off-by: Micah Gruber
    Signed-off-by: David S. Miller

    Micah Gruber
     

11 Jul, 2007

1 commit

  • d3d6dd3ad   [XFRM]: Add module alias for transformation type. ... Browse Code »

    It is clean-up for XFRM type modules and adds aliases with its
    protocol:
    ESP, AH, IPCOMP, IPIP and IPv6 for IPsec
    ROUTING and DSTOPTS for MIPv6

    It is almost the same thing as XFRM mode alias, but it is added
    new defines XFRM_PROTO_XXX for preprocessing since some protocols
    are defined as enum.

    Signed-off-by: Masahide NAKAMURA
    Acked-by: Ingo Oeser
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     

26 Apr, 2007

2 commits