Eric Lee / smarc-ti-linux-kernel

04 Apr, 2011

1 commit

16 Mar, 2011

2 commits

03 Feb, 2011

1 commit

01 Feb, 2011

2 commits

  • d956798d8   netfilter: xtables: "set" match and "SET" target support ... Browse Code »

    The patch adds the combined module of the "SET" target and "set" match
    to netfilter. Both the previous and the current revisions are supported.

    Signed-off-by: Jozsef Kadlecsik
    Signed-off-by: Patrick McHardy

    Jozsef Kadlecsik
     
  • a7b4f989a   netfilter: ipset: IP set core support ... Browse Code »

    The patch adds the IP set core support to the kernel.

    The IP set core implements a netlink (nfnetlink) based protocol by which
    one can create, destroy, flush, rename, swap, list, save, restore sets,
    and add, delete, test elements from userspace. For simplicity (and backward
    compatibilty and for not to force ip(6)tables to be linked with a netlink
    library) reasons a small getsockopt-based protocol is also kept in order
    to communicate with the ip(6)tables match and target.

    The netlink protocol passes all u16, etc values in network order with
    NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
    NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.

    For other kernel subsystems (netfilter match and target) the API contains
    the functions to add, delete and test elements in sets and the required calls
    to get/put refereces to the sets before those operations can be performed.

    The set types (which are implemented in independent modules) are stored
    in a simple RCU protected list. A set type may have variants: for example
    without timeout or with timeout support, for IPv4 or for IPv6. The sets
    (i.e. the pointers to the sets) are stored in an array. The sets are
    identified by their index in the array, which makes possible easy and
    fast swapping of sets. The array is protected indirectly by the nfnl
    mutex from nfnetlink. The content of the sets are protected by the rwlock
    of the set.

    There are functional differences between the add/del/test functions
    for the kernel and userspace:

    - kernel add/del/test: works on the current packet (i.e. one element)
    - kernel test: may trigger an "add" operation in order to fill
    out unspecified parts of the element from the packet (like MAC address)
    - userspace add/del: works on the netlink message and thus possibly
    on multiple elements from the IPSET_ATTR_ADT container attribute.
    - userspace add: may trigger resizing of a set

    Signed-off-by: Jozsef Kadlecsik
    Signed-off-by: Patrick McHardy

    Jozsef Kadlecsik
     

19 Jan, 2011

2 commits

  • a992ca2a0   netfilter: nf_conntrack_tstamp: add flow-based timestamp extension ... Browse Code »

    This patch adds flow-based timestamping for conntracks. This
    conntrack extension is disabled by default. Basically, we use
    two 64-bits variables to store the creation timestamp once the
    conntrack has been confirmed and the other to store the deletion
    time. This extension is disabled by default, to enable it, you
    have to:

    echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp

    This patch allows to save memory for user-space flow-based
    loogers such as ulogd2. In short, ulogd2 does not need to
    keep a hashtable with the conntrack in user-space to know
    when they were created and destroyed, instead we use the
    kernel timestamp. If we want to have a sane IPFIX implementation
    in user-space, this nanosecs resolution timestamps are also
    useful. Other custom user-space applications can benefit from
    this via libnetfilter_conntrack.

    This patch modifies the /proc output to display the delta time
    in seconds since the flow start. You can also obtain the
    flow-start date by means of the conntrack-tools.

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     
  • 93557f53e   netfilter: nf_conntrack: nf_conntrack snmp helper ... Browse Code »

    Adding support for SNMP broadcast connection tracking. The SNMP
    broadcast requests are now paired with the SNMP responses.
    Thus allowing using SNMP broadcasts with firewall enabled.

    Please refer to the following conversation:
    http://marc.info/?l=netfilter-devel&m=125992205006600&w=2

    Patrick McHardy wrote:
    > > The best solution would be to add generic broadcast tracking, the
    > > use of expectations for this is a bit of abuse.
    > > The second best choice I guess would be to move the help() function
    > > to a shared module and generalize it so it can be used for both.
    This patch implements the "second best choice".

    Since the netbios-ns conntrack module uses the same helper
    functionality as the snmp, only one helper function is added
    for both snmp and netbios-ns modules into the new object -
    nf_conntrack_broadcast.

    Signed-off-by: Jiri Olsa
    Signed-off-by: Patrick McHardy

    Jiri Olsa
     

18 Jan, 2011

1 commit

17 Jan, 2011

1 commit

  • 43f393cae   netfilter: audit target to record accepted/dropped packets ... Browse Code »

    This patch adds a new netfilter target which creates audit records
    for packets traversing a certain chain.

    It can be used to record packets which are rejected administraively
    as follows:

    -N AUDIT_DROP
    -A AUDIT_DROP -j AUDIT --type DROP
    -A AUDIT_DROP -j DROP

    a rule which would typically drop or reject a packet would then
    invoke the new chain to record packets before dropping them.

    -j AUDIT_DROP

    The module is protocol independant and works for iptables, ip6tables
    and ebtables.

    The following information is logged:
    - netfilter hook
    - packet length
    - incomming/outgoing interface
    - MAC src/dst/proto for ethernet packets
    - src/dst/protocol address for IPv4/IPv6
    - src/dst port for TCP/UDP/UDPLITE
    - icmp type/code

    Cc: Patrick McHardy
    Cc: Eric Paris
    Cc: Al Viro
    Signed-off-by: Thomas Graf
    Signed-off-by: Patrick McHardy

    Thomas Graf
     

14 Jan, 2011

1 commit

  • c7066f70d   netfilter: fix Kconfig dependencies ... Browse Code »

    Fix dependencies of netfilter realm match: it depends on NET_CLS_ROUTE,
    which itself depends on NET_SCHED; this dependency is missing from netfilter.

    Since matching on realms is also useful without having NET_SCHED enabled and
    the option really only controls whether the tclassid member is included in
    route and dst entries, rename the config option to IP_ROUTE_CLASSID and move
    it outside of traffic scheduling context to get rid of the NET_SCHED dependeny.

    Reported-by: Vladis Kletnieks
    Signed-off-by: Patrick McHardy

    Patrick McHardy
     

26 Oct, 2010

1 commit

  • f6318e558   netfilter: fix module dependency issues with IPv6 defragmentation, ip6tables and xt_TPROXY ... Browse Code »

    One of the previous tproxy related patches split IPv6 defragmentation and
    connection tracking, but did not correctly add Kconfig stanzas to handle the
    new dependencies correctly. This patch fixes that by making the config options
    mirror the setup we have for IPv4: a distinct config option for defragmentation
    that is automatically selected by both connection tracking and
    xt_TPROXY/xt_socket.

    The patch also changes the #ifdefs enclosing IPv6 specific code in xt_socket
    and xt_TPROXY: we only compile these in case we have ip6tables support enabled.

    Signed-off-by: KOVACS Krisztian
    Signed-off-by: David S. Miller

    KOVACS Krisztian
     

23 Jul, 2010

2 commits

  • e8648a1fd   netfilter: add xt_cpu match ... Browse Code »

    In some situations a CPU match permits a better spreading of
    connections, or select targets only for a given cpu.

    With Remote Packet Steering or multiqueue NIC and appropriate IRQ
    affinities, we can distribute trafic on available cpus, per session.
    (all RX packets for a given flow is handled by a given cpu)

    Some legacy applications being not SMP friendly, one way to scale a
    server is to run multiple copies of them.

    Instead of randomly choosing an instance, we can use the cpu number as a
    key so that softirq handler for a whole instance is running on a single
    cpu, maximizing cache effects in TCP/UDP stacks.

    Using NAT for example, a four ways machine might run four copies of
    server application, using a separate listening port for each instance,
    but still presenting an unique external port :

    iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 0 \
    -j REDIRECT --to-port 8080

    iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 1 \
    -j REDIRECT --to-port 8081

    iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 2 \
    -j REDIRECT --to-port 8082

    iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 3 \
    -j REDIRECT --to-port 8083

    Signed-off-by: Eric Dumazet
    Signed-off-by: Patrick McHardy

    Eric Dumazet
     
  • 9c3e1c396   netfilter: xt_ipvs (netfilter matcher for IPVS) ... Browse Code »

    This implements the kernel-space side of the netfilter matcher xt_ipvs.

    [ minor fixes by Simon Horman ]
    Signed-off-by: Hannes Eder
    Signed-off-by: Simon Horman
    [ Patrick: added xt_ipvs.h to Kbuild ]
    Signed-off-by: Patrick McHardy

    Hannes Eder
     

15 Jul, 2010

1 commit

  • edf0e1fb0   netfilter: add CHECKSUM target ... Browse Code »

    This adds a `CHECKSUM' target, which can be used in the iptables mangle
    table.

    You can use this target to compute and fill in the checksum in
    a packet that lacks a checksum. This is particularly useful,
    if you need to work around old applications such as dhcp clients,
    that do not work well with checksum offloads, but don't want to
    disable checksum offload in your device.

    The problem happens in the field with virtualized applications.
    For reference, see Red Hat bz 605555, as well as
    http://www.spinics.net/lists/kvm/msg37660.html

    Typical expected use (helps old dhclient binary running in a VM):
    iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
    -j CHECKSUM --checksum-fill

    Includes fixes by Jan Engelhardt

    Signed-off-by: Michael S. Tsirkin
    Signed-off-by: Patrick McHardy

    Michael S. Tsirkin
     

25 Jun, 2010

1 commit

  • d70a011db   netfilter: complete the deprecation of CONFIG_NF_CT_ACCT ... Browse Code »

    CONFIG_NF_CT_ACCT has been deprecated for awhile and
    was originally scheduled for removal by 2.6.29.

    Removing support for this config option also stops
    this deprecation warning message in the kernel log.

    [ 61.669627] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
    [ 61.669850] CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
    [ 61.669852] nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
    [ 61.669853] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.

    Signed-off-by: Tim Gardner
    [Patrick: changed default value to 0]
    Signed-off-by: Patrick McHardy

    Tim Gardner
     

22 Jun, 2010

1 commit

15 Jun, 2010

1 commit

  • 0902b469b   netfilter: xtables: idletimer target implementation ... Browse Code »

    This patch implements an idletimer Xtables target that can be used to
    identify when interfaces have been idle for a certain period of time.

    Timers are identified by labels and are created when a rule is set with a new
    label. The rules also take a timeout value (in seconds) as an option. If
    more than one rule uses the same timer label, the timer will be restarted
    whenever any of the rules get a hit.

    One entry for each timer is created in sysfs. This attribute contains the
    timer remaining for the timer to expire. The attributes are located under
    the xt_idletimer class:

    /sys/class/xt_idletimer/timers/

    When the timer expires, the target module sends a sysfs notification to the
    userspace, which can then decide what to do (eg. disconnect to save power).

    Cc: Timo Teras
    Signed-off-by: Luciano Coelho
    Signed-off-by: Patrick McHardy

    Luciano Coelho
     

15 May, 2010

1 commit

  • 83827f6a8   netfilter: xt_TEE depends on NF_CONNTRACK ... Browse Code »

    Fix xt_TEE build for the case of NF_CONNTRACK=m and
    NETFILTER_XT_TARGET_TEE=y:

    xt_TEE.c:(.text+0x6df5c): undefined reference to `nf_conntrack_untracked'
    4x

    Built with all 4 m/y combinations.

    Signed-off-by: Randy Dunlap
    Acked-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Randy Dunlap
     

13 May, 2010

1 commit

  • 9b7ce2b76   netfilter: xtables: add missing depends for xt_TEE ... Browse Code »

    Aviod these link-time errors when IPV6=m, XT_TEE=y:

    net/built-in.o: In function `tee_tg_route6':
    xt_TEE.c:(.text+0x45ca5): undefined reference to `ip6_route_output'
    net/built-in.o: In function `tee_tg6':
    xt_TEE.c:(.text+0x45d79): undefined reference to `ip6_local_out'

    Signed-off-by: Jan Engelhardt
    Acked-by: Randy Dunlap
    Signed-off-by: David S. Miller

    Jan Engelhardt
     

19 Apr, 2010

1 commit

  • e281b1989   netfilter: xtables: inclusion of xt_TEE ... Browse Code »

    xt_TEE can be used to clone and reroute a packet. This can for
    example be used to copy traffic at a router for logging purposes
    to another dedicated machine.

    References: http://www.gossamer-threads.com/lists/iptables/devel/68781
    Signed-off-by: Jan Engelhardt
    Signed-off-by: Patrick McHardy

    Jan Engelhardt
     

18 Mar, 2010

1 commit

17 Mar, 2010

4 commits

16 Feb, 2010

1 commit

04 Feb, 2010

1 commit

  • 84f3bb9ae   netfilter: xtables: add CT target ... Browse Code »

    Add a new target for the raw table, which can be used to specify conntrack
    parameters for specific connections, f.i. the conntrack helper.

    The target attaches a "template" connection tracking entry to the skb, which
    is used by the conntrack core when initializing a new conntrack.

    Signed-off-by: Patrick McHardy

    Patrick McHardy
     

15 Jun, 2009

1 commit

13 Jun, 2009

1 commit

08 Jun, 2009

1 commit

  • 11eeef41d   netfilter: passive OS fingerprint xtables match ... Browse Code »

    Passive OS fingerprinting netfilter module allows to passively detect
    remote OS and perform various netfilter actions based on that knowledge.
    This module compares some data (WS, MSS, options and it's order, ttl, df
    and others) from packets with SYN bit set with dynamically loaded OS
    fingerprints.

    Fingerprint matching rules can be downloaded from OpenBSD source tree
    or found in archive and loaded via netfilter netlink subsystem into
    the kernel via special util found in archive.

    Archive contains library file (also attached), which was shipped
    with iptables extensions some time ago (at least when ipt_osf existed
    in patch-o-matic).

    Following changes were made in this release:
    * added NLM_F_CREATE/NLM_F_EXCL checks
    * dropped _rcu list traversing helpers in the protected add/remove calls
    * dropped unneded structures, debug prints, obscure comment and check

    Fingerprints can be downloaded from
    http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os
    or can be found in archive

    Example usage:
    -d switch removes fingerprints

    Please consider for inclusion.
    Thank you.

    Passive OS fingerprint homepage (archives, examples):
    http://www.ioremap.net/projects/osf

    Signed-off-by: Evgeniy Polyakov
    Signed-off-by: Patrick McHardy

    Evgeniy Polyakov
     

02 May, 2009

1 commit

24 Apr, 2009

1 commit

06 Apr, 2009

1 commit

30 Mar, 2009

1 commit

26 Mar, 2009

1 commit

  • a9a9adfe2   netfilter: fix xt_LED build failure ... Browse Code »

    net/netfilter/xt_LED.c:40: error: field netfilter_led_trigger has incomplete type
    net/netfilter/xt_LED.c: In function led_timeout_callback:
    net/netfilter/xt_LED.c:78: warning: unused variable ledinternal
    net/netfilter/xt_LED.c: In function led_tg_check:
    net/netfilter/xt_LED.c:102: error: implicit declaration of function led_trigger_register
    net/netfilter/xt_LED.c: In function led_tg_destroy:
    net/netfilter/xt_LED.c:135: error: implicit declaration of function led_trigger_unregister

    Fix by adding a dependency on LED_TRIGGERS.

    Reported-by: Sachin Sant
    Tested-by: Subrata Modak
    Signed-off-by: Patrick McHardy

    Patrick McHardy
     

17 Mar, 2009

1 commit

  • 0269ea493   netfilter: xtables: add cluster match ... Browse Code »

    This patch adds the iptables cluster match. This match can be used
    to deploy gateway and back-end load-sharing clusters. The cluster
    can be composed of 32 nodes maximum (although I have only tested
    this with two nodes, so I cannot tell what is the real scalability
    limit of this solution in terms of cluster nodes).

    Assuming that all the nodes see all packets (see below for an
    example on how to do that if your switch does not allow this), the
    cluster match decides if this node has to handle a packet given:

    (jhash(source IP) % total_nodes) & node_mask

    For related connections, the master conntrack is used. The following
    is an example of its use to deploy a gateway cluster composed of two
    nodes (where this is the node 1):

    iptables -I PREROUTING -t mangle -i eth1 -m cluster \
    --cluster-total-nodes 2 --cluster-local-node 1 \
    --cluster-proc-name eth1 -j MARK --set-mark 0xffff
    iptables -A PREROUTING -t mangle -i eth1 \
    -m mark ! --mark 0xffff -j DROP
    iptables -A PREROUTING -t mangle -i eth2 -m cluster \
    --cluster-total-nodes 2 --cluster-local-node 1 \
    --cluster-proc-name eth2 -j MARK --set-mark 0xffff
    iptables -A PREROUTING -t mangle -i eth2 \
    -m mark ! --mark 0xffff -j DROP

    And the following commands to make all nodes see the same packets:

    ip maddr add 01:00:5e:00:01:01 dev eth1
    ip maddr add 01:00:5e:00:01:02 dev eth2
    arptables -I OUTPUT -o eth1 --h-length 6 \
    -j mangle --mangle-mac-s 01:00:5e:00:01:01
    arptables -I INPUT -i eth1 --h-length 6 \
    --destination-mac 01:00:5e:00:01:01 \
    -j mangle --mangle-mac-d 00:zz:yy:xx:5a:27
    arptables -I OUTPUT -o eth2 --h-length 6 \
    -j mangle --mangle-mac-s 01:00:5e:00:01:02
    arptables -I INPUT -i eth2 --h-length 6 \
    --destination-mac 01:00:5e:00:01:02 \
    -j mangle --mangle-mac-d 00:zz:yy:xx:5a:27

    In the case of TCP connections, pickup facility has to be disabled
    to avoid marking TCP ACK packets coming in the reply direction as
    valid.

    echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose

    BTW, some final notes:

    * This match mangles the skbuff pkt_type in case that it detects
    PACKET_MULTICAST for a non-multicast address. This may be done in
    a PKTTYPE target for this sole purpose.
    * This match supersedes the CLUSTERIP target.

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso
     

20 Feb, 2009

1 commit

  • 268cb38e1   netfilter: x_tables: add LED trigger target ... Browse Code »

    Kernel module providing implementation of LED netfilter target. Each
    instance of the target appears as a led-trigger device, which can be
    associated with one or more LEDs in /sys/class/leds/

    Signed-off-by: Adam Nielsen
    Acked-by: Richard Purdie
    Signed-off-by: Patrick McHardy

    Adam Nielsen
     

19 Feb, 2009

2 commits