25 Apr, 2007
2 commits
-
Oops, thinko. The test for accempting a RH0 was exatly the wrong way
around.Signed-off-by: YOSHIFUJI Hideaki
Signed-off-by: Linus Torvalds -
A security issue is emerging. Disallow Routing Header Type 0 by default
as we have been doing for IPv4.
Note: We allow RH2 by default because it is harmless.Signed-off-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller
14 Apr, 2007
1 commit
-
A packet which is being discarded because of no routes in the
forwarding path should not be counted as OutNoRoutes but as
InNoRoutes.
Additionally, on this occasion, a packet whose destinaion is
not valid should be counted as InAddrErrors separately.Based on patch from Mitsuru Chinen .
Signed-off-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller
07 Apr, 2007
1 commit
-
This reverts a0d78ebf3a0e33a1aeacf2fc518ad9273d6a1c2f
It causes pings to link-local addresses to fail.
Signed-off-by: David S. Miller
05 Apr, 2007
1 commit
-
Incoming trancated packets are counted as not only InTruncatedPkts but
also InHdrErrors. They should be counted as InTruncatedPkts only.Signed-off-by: Mitsuru Chinen
Acked-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller
03 Apr, 2007
1 commit
-
In article (at Thu, 29 Mar 2007 14:26:44 -0700 (PDT)), David Miller says:
> From: Sridhar Samudrala
> Date: Thu, 29 Mar 2007 14:17:28 -0700
>
> > The check for length in rawv6_sendmsg() is incorrect.
> > As len is an unsigned int, (len < 0) will never be TRUE.
> > I think checking for IPV6_MAXPLEN(65535) is better.
> >
> > Is it possible to send ipv6 jumbo packets using raw
> > sockets? If so, we can remove this check.
>
> I don't see why such a limitation against jumbo would exist,
> does anyone else?
>
> Thanks for catching this Sridhar. A good compiler should simply
> fail to compile "if (x < 0)" when 'x' is an unsigned type, don't
> you think :-)Dave, we use "int" for returning value,
so we should fix this anyway, IMHO;
we should not allow len > INT_MAX.Signed-off-by: YOSHIFUJI Hideaki
Acked-by: Sridhar Samudrala
Signed-off-by: David S. Miller
28 Mar, 2007
1 commit
-
We still need to set the IF_READY flag in ipv6_add_dev for the case
where all addresses (including the link-local) are deleted and then
recreated. In that case the IPv6 device too will be destroyed and
then recreated.In order to prevent the original problem, we simply ensure that
the device is up before setting IF_READY.Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller
26 Mar, 2007
2 commits
-
As per RFC2461, section 6.3.6, item #2, when no routers on the
matching list are known to be reachable or probably reachable we
do round robin on those available routes so that we make sure
to probe as many of them as possible to detect when one becomes
reachable faster.Each routing table has a rwlock protecting the tree and the linked
list of routes at each leaf. The round robin code executes during
lookup and thus with the rwlock taken as a reader. A small local
spinlock tries to provide protection but this does not work at all
for two reasons:1) The round-robin list manipulation, as coded, goes like this (with
read lock held):walk routes finding head and tail
spin_lock();
rotate list using head and tail
spin_unlock();While one thread is rotating the list, another thread can
end up with stale values of head and tail and then proceed
to corrupt the list when it gets the lock. This ends up causing
the OOPS in fib6_add() later onthat many people have been hitting.2) All the other code paths that run with the rwlock held as
a reader do not expect the list to change on them, they
expect it to remain completely fixed while they hold the
lock in that way.So, simply stated, it is impossible to implement this correctly using
a manipulation of the list without violating the rwlock locking
semantics.Reimplement using a per-fib6_node round-robin pointer. This way we
don't need to manipulate the list at all, and since the round-robin
pointer can only ever point to real existing entries we don't need
to perform any locking on the changing of the round-robin pointer
itself. We only need to reset the round-robin pointer to NULL when
the entry it is pointing to is removed.The idea is from Thomas Graf and it is very similar to how this
was implemented before the advanced router selection code when in.Signed-off-by: David S. Miller
-
Based upon a patch from Patrick McHardy.
The fib_rules netlink attribute policy introduced in 2.6.19 broke
userspace compatibilty. When specifying a rule with "from all"
or "to all", iproute adds a zero byte long netlink attribute,
but the policy requires all addresses to have a size equal to
sizeof(struct in_addr)/sizeof(struct in6_addr), resulting in a
validation error.Check attribute length of FRA_SRC/FRA_DST in the generic framework
by letting the family specific rules implementation provide the
length of an address. Report an error if address length is non
zero but no address attribute is provided. Fix actual bug by
checking address length for non-zero instead of relying on
availability of attribute.Signed-off-by: Thomas Graf
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
23 Mar, 2007
1 commit
-
Turning up the warnings on gcc makes it emit warnings
about the placement of 'inline' in function declarations.
Here's everything that was under net/Signed-off-by: Dave Jones
Signed-off-by: David S. Miller
17 Mar, 2007
1 commit
-
The ipv6_fl_socklist from listening socket is inadvertently shared
with new socket created for connection. This leads to a variety of
interesting, but fatal, bugs. For example, removing one of the
sockets may lead to the other socket's encountering a page fault
when the now freed list is referenced.The fix is to not share the flow label list with the new socket.
Signed-off-by: Masayuki Nakagawa
Signed-off-by: David S. Miller
10 Mar, 2007
2 commits
-
User supplied len < 0 can cause leak of kernel memory.
Use unsigned compare instead.Signed-off-by: Chris Wright
Signed-off-by: David S. Miller -
I came across this bug in http://bugzilla.kernel.org/show_bug.cgi?id=8155
Signed-off-by: Olaf Kirch
Acked-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller
08 Mar, 2007
3 commits
-
Now that we add the IPv6 device at registration time we don't need
to set IF_READY in ipv6_add_dev anymore because we will always get
a NETDEV_UP event later on should the device ever become ready.Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller -
Signed-off-by: David S. Miller
-
The individual fragments of a packet reassembled by conntrack have the
conntrack reference from the reassembled packet attached, but nfctinfo
is not copied. This leaves it initialized to 0, which unfortunately is
the value of IP_CT_ESTABLISHED.The result is that all IPv6 fragments are tracked as ESTABLISHED,
allowing them to bypass a usual ruleset which accepts ESTABLISHED
packets early.Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
06 Mar, 2007
2 commits
-
Signed-off-by: Yasuyuki Kozakai
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
The nf_conntrack_netlink config option is named CONFIG_NF_CT_NETLINK,
but multiple files use CONFIG_IP_NF_CONNTRACK_NETLINK or
CONFIG_NF_CONNTRACK_NETLINK for ifdefs.Fix this and reformat all CONFIG_NF_CT_NETLINK ifdefs to only use a line.
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
01 Mar, 2007
2 commits
-
Reading /proc/net/anycast6 when there is no anycast address
on an interface results in an ever-increasing inet6_dev reference
count, as well as a reference to the netdevice you can't get rid of.Signed-off-by: David S. Miller
-
This patch fixes a bug in Linux IPv6 stack which caused anycast address
to be added to a device prior DAD has been completed. This led to
incorrect reference count which resulted in infinite wait for
unregister_netdevice completion on interface removal.Signed-off-by: Michal Wrobel
Signed-off-by: David S. Miller
27 Feb, 2007
7 commits
-
It needs to be in net/ipv6/addrconf_core.c
Signed-off-by: David S. Miller
-
Allocate inet6_dev earlier to allow users to set up per-interface variables.
Signed-off-by: YOSHIFUJI Hideaki
-
It is more natural to manage prefix routes corresponding to address which is
being added manually.With help from Masafumi Aramoto .
Signed-off-by: YOSHIFUJI Hideaki
-
Signed-off-by: Yasuyuki Kozakai
Signed-off-by: YOSHIFUJI Hideaki -
Link __ipv6_addr_type() statically for sunrpc code even if IPv6 is
built as module.Signed-off-by: YOSHIFUJI Hidaki
-
This patch for adjust inet6_exit() to inverse sequence to inet6_init().
At ipv6_init, it first create proc_root/net/dev_snmp6 entry by call
ipv6_misc_proc_init(), then call addrconf_init() to create the corresponding
device entry at this directory, but at inet6_exit, ipv6_misc_proc_exit()
called first, then call addrconf_init().Signed-off-by: Joe Jin
Signed-off-by: David S. Miller -
Fixed to set fl_tunnel.fl6_src correctly in xfrm6_bundle_create().
Signed-off-by: Noriaki TAKAMIYA
Acked-by: Masahide NAKAMURA
Signed-off-by: David S. Miller
15 Feb, 2007
3 commits
-
It isn't needed anymore, all of the users are gone, and all of the ctl_table
initializers have been converted to use explicit names of the fields they are
initializing.[akpm@osdl.org: NTFS fix]
Signed-off-by: Eric W. Biederman
Acked-by: Stephen Smalley
Cc: James Morris
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
The semantic effect of insert_at_head is that it would allow new registered
sysctl entries to override existing sysctl entries of the same name. Which is
pain for caching and the proc interface never implemented.I have done an audit and discovered that none of the current users of
register_sysctl care as (excpet for directories) they do not register
duplicate sysctl entries.So this patch simply removes the support for overriding existing entries in
the sys_sysctl interface since no one uses it or cares and it makes future
enhancments harder.Signed-off-by: Eric W. Biederman
Acked-by: Ralf Baechle
Acked-by: Martin Schwidefsky
Cc: Russell King
Cc: David Howells
Cc: "Luck, Tony"
Cc: Ralf Baechle
Cc: Paul Mackerras
Cc: Martin Schwidefsky
Cc: Andi Kleen
Cc: Jens Axboe
Cc: Corey Minyard
Cc: Neil Brown
Cc: "John W. Linville"
Cc: James Bottomley
Cc: Jan Kara
Cc: Trond Myklebust
Cc: Mark Fasheh
Cc: David Chinner
Cc: "David S. Miller"
Cc: Patrick McHardy
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
After Al Viro (finally) succeeded in removing the sched.h #include in module.h
recently, it makes sense again to remove other superfluous sched.h includes.
There are quite a lot of files which include it but don't actually need
anything defined in there. Presumably these includes were once needed for
macros that used to live in sched.h, but moved to other header files in the
course of cleaning it up.To ease the pain, this time I did not fiddle with any header files and only
removed #includes from .c-files, which tend to cause less trouble.Compile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,
arm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,
allmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all
configs in arch/arm/configs on arm. I also checked that no new warnings were
introduced by the patch (actually, some warnings are removed that were emitted
by unnecessarily included header files).Signed-off-by: Tim Schmielau
Acked-by: Russell King
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
14 Feb, 2007
2 commits
-
This patch changes xfrm6_tunnel register and deregister
interface to prepare for solving the conflict of device
tunnels with inter address family IPsec tunnel.
There is no device which conflicts with IPv4 over IPv6
IPsec tunnel.Signed-off-by: Kazunori MIYAZAWA
Signed-off-by: David S. Miller -
This patch makes sit use xfrm4_tunnel_register instead of
inet_add_protocol. It solves conflict of sit device with
inter address family IPsec tunnel.Signed-off-by: Kazunori MIYAZAWA
Signed-off-by: David S. Miller
13 Feb, 2007
7 commits
-
Tetsuo Handa told me that connect(2) with TCPv6
socket almost always took a few minutes to return when we did not have any
ports available in the range of net.ipv4.ip_local_port_range.The reason was that we used incorrect seed for calculating index of
hash when we check established sockets in __inet6_check_established().Signed-off-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller -
Regarding RFC3775, MH payload proto field should be IPPROTO_NONE. Otherwise
it must be discarded (and the receiver should send ICMP error).We assume filter should drop such piggyback everytime to disallow slipping
through firewall rules, even the final receiver will discard it.Signed-off-by: Masahide NAKAMURA
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Instead of depending on internally needed options and letting users
figure out what is needed, select them when needed:- IP_NF_IPTABLES, IP_NF_ARPTABLES and IP6_NF_IPTABLES select
NETFILTER_XTABLES- NETFILTER_XT_TARGET_CONNMARK, NETFILTER_XT_MATCH_CONNMARK and
IP_NF_TARGET_CLUSTERIP select NF_CONNTRACK_MARK- NETFILTER_XT_MATCH_CONNBYTES selects NF_CT_ACCT
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
NF_CT_STAT_INC assumes rcu_read_lock in nf_hook_slow disables
preemption as well, making it legal to use __get_cpu_var without
disabling preemption manually. The assumption is not correct anymore
with preemptable RCU, additionally we need to protect against softirqs
when not holding nf_conntrack_lock.Add NF_CT_STAT_INC_ATOMIC macro, which disables local softirqs,
and use where necessary.Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Replace preempt_{enable,disable} based RCU by proper use of the
RCU API and add missing rcu_read_lock/rcu_read_unlock calls in
all paths not obviously only used within packet process context
(nfnetlink_conntrack).Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
- rename nf_logging to nf_loggers since its an array of registered loggers
- rename nf_log_unregister_logger() to nf_log_unregister() to make it
symetrical to nf_log_register() and convert all usersSigned-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Many struct file_operations in the kernel can be "const". Marking them const
moves these to the .rodata section, which avoids false sharing with potential
dirty data. In addition it'll catch accidental writes at compile time to
these shared resources.Signed-off-by: Arjan van de Ven
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
12 Feb, 2007
1 commit
-
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (45 commits)
[IPV4]: Restore multipath routing after rt_next changes.
[XFRM] IPV6: Fix outbound RO transformation which is broken by IPsec tunnel patch.
[NET]: Reorder fields of struct dst_entry
[DECNET]: Convert decnet route to use the new dst_entry 'next' pointer
[IPV6]: Convert ipv6 route to use the new dst_entry 'next' pointer
[IPV4]: Convert ipv4 route to use the new dst_entry 'next' pointer
[NET]: Introduce union in struct dst_entry to hold 'next' pointer
[DECNET]: fix misannotation of linkinfo_dn
[DECNET]: FRA_{DST,SRC} are le16 for decnet
[UDP]: UDP can use sk_hash to speedup lookups
[NET]: Fix whitespace errors.
[NET] XFRM: Fix whitespace errors.
[NET] X25: Fix whitespace errors.
[NET] WANROUTER: Fix whitespace errors.
[NET] UNIX: Fix whitespace errors.
[NET] TIPC: Fix whitespace errors.
[NET] SUNRPC: Fix whitespace errors.
[NET] SCTP: Fix whitespace errors.
[NET] SCHED: Fix whitespace errors.
[NET] RXRPC: Fix whitespace errors.
...
