Eric Lee / smarc-fsl-linux-kernel

04 Sep, 2017

1 commit

25 Aug, 2017

2 commits

02 Feb, 2017

1 commit

03 Jan, 2017

1 commit

  • e4781421e   netfilter: merge udp and udplite conntrack helpers ... Browse Code »

    udplite was copied from udp, they are virtually 100% identical.

    This adds udplite tracker to udp instead, removes udplite module,
    and then makes the udplite tracker builtin.

    udplite will then simply re-use udp timeout settings.
    It makes little sense to add separate sysctls, nowadays we have
    fine-grained timeout policy support via the CT target.

    old:
    text data bss dec hex filename
    1633 672 0 2305 901 nf_conntrack_proto_udp.o
    1756 672 0 2428 97c nf_conntrack_proto_udplite.o
    69526 17937 268 87731 156b3 nf_conntrack.ko

    new:
    text data bss dec hex filename
    2442 1184 0 3626 e2a nf_conntrack_proto_udp.o
    68565 17721 268 86554 1521a nf_conntrack.ko

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

13 Aug, 2016

1 commit

  • adf051684   netfilter: remove ip_conntrack* sysctl compat code ... Browse Code »

    This backward compatibility has been around for more than ten years,
    since Yasuyuki Kozakai introduced IPv6 in conntrack. These days, we have
    alternate /proc/net/nf_conntrack* entries, the ctnetlink interface and
    the conntrack utility got adopted by many people in the user community
    according to what I observed on the netfilter user mailing list.

    So let's get rid of this.

    Note that nf_conntrack_htable_size and unsigned int nf_conntrack_max do
    not need to be exported as symbol anymore.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

12 Aug, 2016

1 commit

05 May, 2016

1 commit

  • 71d8c47fc   netfilter: conntrack: introduce clash resolution on insertion race ... Browse Code »

    This patch introduces nf_ct_resolve_clash() to resolve race condition on
    conntrack insertions.

    This is particularly a problem for connection-less protocols such as
    UDP, with no initial handshake. Two or more packets may race to insert
    the entry resulting in packet drops.

    Another problematic scenario are packets enqueued to userspace via
    NFQUEUE after the raw table, that make it easier to trigger this
    race.

    To resolve this, the idea is to reset the conntrack entry to the one
    that won race. Packet and bytes counters are also merged.

    The 'insert_failed' stats still accounts for this situation, after
    this patch, the drop counter is bumped whenever we drop packets, so we
    can watch for unresolved clashes.

    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

19 Sep, 2015

1 commit

06 Nov, 2014

1 commit

  • 824f1fbee   netfilter: Convert print_tuple functions to return void ... Browse Code »

    Since adding a new function to seq_file (seq_has_overflowed())
    there isn't any value for functions called from seq_show to
    return anything. Remove the int returns of the various
    print_tuple/_print_tuple functions.

    Link: http://lkml.kernel.org/p/f2e8cf8df433a197daa62cbaf124c900c708edc7.1412031505.git.joe@perches.com

    Cc: Pablo Neira Ayuso
    Cc: Patrick McHardy
    Cc: Jozsef Kadlecsik
    Cc: netfilter-devel@vger.kernel.org
    Cc: coreteam@netfilter.org
    Signed-off-by: Joe Perches
    Signed-off-by: Steven Rostedt

    Joe Perches
     

19 Apr, 2013

1 commit

  • f229f6ce4   netfilter: add my copyright statements ... Browse Code »

    Add copyright statements to all netfilter files which have had significant
    changes done by myself in the past.

    Some notes:

    - nf_conntrack_ecache.c was incorrectly attributed to Rusty and Netfilter
    Core Team when it got split out of nf_conntrack_core.c. The copyrights
    even state a date which lies six years before it was written. It was
    written in 2005 by Harald and myself.

    - net/ipv{4,6}/netfilter.c, net/netfitler/nf_queue.c were missing copyright
    statements. I've added the copyright statement from net/netfilter/core.c,
    where this code originated

    - for nf_conntrack_proto_tcp.c I've also added Jozsef, since I didn't want
    it to give the wrong impression

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

06 Apr, 2013

1 commit

  • 30e0c6a6b   netfilter: nf_log: prepare net namespace support for loggers ... Browse Code »

    This patch adds netns support to nf_log and it prepares netns
    support for existing loggers. It is composed of four major
    changes.

    1) nf_log_register has been split to two functions: nf_log_register
    and nf_log_set. The new nf_log_register is used to globally
    register the nf_logger and nf_log_set is used for enabling
    pernet support from nf_loggers.

    Per netns is not yet complete after this patch, it comes in
    separate follow up patches.

    2) Add net as a parameter of nf_log_bind_pf. Per netns is not
    yet complete after this patch, it only allows to bind the
    nf_logger to the protocol family from init_net and it skips
    other cases.

    3) Adapt all nf_log_packet callers to pass netns as parameter.
    After this patch, this function only works for init_net.

    4) Make the sysctl net/netfilter/nf_log pernet.

    Signed-off-by: Gao feng
    Signed-off-by: Pablo Neira Ayuso

    Gao feng
     

05 Jul, 2012

1 commit

  • 08911475d   netfilter: nf_conntrack: generalize nf_ct_l4proto_net ... Browse Code »

    This patch generalizes nf_ct_l4proto_net by splitting it into chunks and
    moving the corresponding protocol part to where it really belongs to.

    To clarify, note that we follow two different approaches to support per-net
    depending if it's built-in or run-time loadable protocol tracker.

    Signed-off-by: Pablo Neira Ayuso
    Acked-by: Gao feng

    Pablo Neira Ayuso
     

28 Jun, 2012

2 commits

12 Jun, 2012

1 commit

  • 352e04b91   netfilter: nf_ct_tcp, udp: fix compilation with sysctl disabled ... Browse Code »

    This patch fixes the compilation of the TCP and UDP trackers with sysctl
    compilation disabled:

    net/netfilter/nf_conntrack_proto_udp.c: In function ‘udp_init_net_data’:
    net/netfilter/nf_conntrack_proto_udp.c:279:13: error: ‘struct nf_proto_net’ has no member named
    ‘user’
    net/netfilter/nf_conntrack_proto_tcp.c:1606:9: error: ‘struct nf_proto_net’ has no member named
    ‘user’
    net/netfilter/nf_conntrack_proto_tcp.c:1643:9: error: ‘struct nf_proto_net’ has no member named
    ‘user’

    Reported-by: Fengguang Wu
    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: David S. Miller

    Pablo Neira Ayuso
     

07 Jun, 2012

3 commits

02 Apr, 2012

1 commit

08 Mar, 2012

3 commits

17 Dec, 2011

1 commit

16 Feb, 2010

1 commit

03 Feb, 2010

1 commit

  • 858b31330   netfilter: nf_conntrack: split up IPCT_STATUS event ... Browse Code »

    Split up the IPCT_STATUS event into an IPCT_REPLY event, which is generated
    when the IPS_SEEN_REPLY bit is set, and an IPCT_ASSURED event, which is
    generated when the IPS_ASSURED bit is set.

    In combination with a following patch to support selective event delivery,
    this can be used for "sparse" conntrack replication: start replicating the
    conntrack entry after it reached the ASSURED state and that way it's SYN-flood
    resistant.

    Signed-off-by: Patrick McHardy

    Patrick McHardy
     

12 Nov, 2009

1 commit

  • f8572d8f2   sysctl net: Remove unused binary sysctl code ... Browse Code »

    Now that sys_sysctl is a compatiblity wrapper around /proc/sys
    all sysctl strategy routines, and all ctl_name and strategy
    entries in the sysctl tables are unused, and can be
    revmoed.

    In addition neigh_sysctl_register has been modified to no longer
    take a strategy argument and it's callers have been modified not
    to pass one.

    Cc: "David Miller"
    Cc: Hideaki YOSHIFUJI
    Cc: netdev@vger.kernel.org
    Signed-off-by: Eric W. Biederman

    Eric W. Biederman
     

26 Mar, 2009

1 commit

16 Mar, 2009

1 commit

04 Nov, 2008

1 commit

  • 6d9f239a1   net: '&' redux ... Browse Code »

    I want to compile out proc_* and sysctl_* handlers totally and
    stub them to NULL depending on config options, however usage of &
    will prevent this, since taking adress of NULL pointer will break
    compilation.

    So, drop & in front of every ->proc_handler and every ->strategy
    handler, it was never needed in fact.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: David S. Miller

    Alexey Dobriyan
     

08 Oct, 2008

5 commits

14 Apr, 2008

1 commit

01 Feb, 2008

2 commits

29 Jan, 2008

2 commits