aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* netfilter: xt_connlimit: honor conntrack zone if availableFlorian Westphal2014-11-17
| | | | | | | | | | Currently all the conntrack lookups are done using default zone. In case the skb has a ct attached (e.g. template) we should use this zone for lookups instead. This makes connlimit work with connections assigned to other zones. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nfnetlink_log: remove unnecessary error messagesPablo Neira Ayuso2014-11-13
| | | | | | | | | | In case of OOM, there's nothing userspace can do. If there's no room to put the payload in __build_packet_message(), jump to nla_put_failure which already performs the corresponding error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: fix various sparse warningsFlorian Westphal2014-11-13
| | | | | | | | | | | | | | | | | | | | | | | net/bridge/br_netfilter.c:870:6: symbol 'br_netfilter_enable' was not declared. Should it be static? no; add include net/ipv4/netfilter/nft_reject_ipv4.c:22:6: symbol 'nft_reject_ipv4_eval' was not declared. Should it be static? yes net/ipv6/netfilter/nf_reject_ipv6.c:16:6: symbol 'nf_send_reset6' was not declared. Should it be static? no; add include net/ipv6/netfilter/nft_reject_ipv6.c:22:6: symbol 'nft_reject_ipv6_eval' was not declared. Should it be static? yes net/netfilter/core.c:33:32: symbol 'nf_ipv6_ops' was not declared. Should it be static? no; add include net/netfilter/xt_DSCP.c:40:57: cast truncates bits from constant value (ffffff03 becomes 3) net/netfilter/xt_DSCP.c:57:59: cast truncates bits from constant value (ffffff03 becomes 3) add __force, 3 is what we want. net/ipv4/netfilter/nf_log_arp.c:77:6: symbol 'nf_log_arp_packet' was not declared. Should it be static? yes net/ipv4/netfilter/nf_reject_ipv4.c:17:6: symbol 'nf_send_reset' was not declared. Should it be static? no; add include Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nft_redir: fix sparse warningsPablo Neira Ayuso2014-11-12
| | | | | | | | | | | | | | | | | | | | | | | | | >> net/netfilter/nft_redir.c:39:26: sparse: incorrect type in assignment (different base types) net/netfilter/nft_redir.c:39:26: expected unsigned int [unsigned] [usertype] nla_be32 net/netfilter/nft_redir.c:39:26: got restricted __be32 >> net/netfilter/nft_redir.c:40:40: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:40:40: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:40:40: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:40:40: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:40:40: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:40:40: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:46:34: sparse: incorrect type in assignment (different base types) net/netfilter/nft_redir.c:46:34: expected unsigned int [unsigned] [usertype] nla_be32 net/netfilter/nft_redir.c:46:34: got restricted __be32 >> net/netfilter/nft_redir.c:47:48: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:47:48: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:47:48: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:47:48: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:47:48: sparse: cast to restricted __be32 >> net/netfilter/nft_redir.c:47:48: sparse: cast to restricted __be32 Fixes: e9105f1 ("netfilter: nf_tables: add new expression nft_redir") Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: fix unmet dependencies in NETFILTER_XT_TARGET_REDIRECTPablo Neira Ayuso2014-11-12
| | | | | | | | | | | warning: (NETFILTER_XT_TARGET_REDIRECT) selects NF_NAT_REDIRECT_IPV4 which has unmet direct dependencies (NET && INET && NETFILTER && NF_NAT_IPV4) warning: (NETFILTER_XT_TARGET_REDIRECT) selects NF_NAT_REDIRECT_IPV6 which has unmet direct dependencies (NET && INET && IPV6 && NETFILTER && NF_NAT_IPV6) Fixes: 8b13edd ("netfilter: refactor NAT redirect IPv4 to use it from nf_tables") Fixes: 9de920e ("netfilter: refactor NAT redirect IPv6 code to use it from nf_tables") Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nft_meta: add cgroup supportAna Rey2014-11-09
| | | | | | | This allows you to filter traffic by process control group (cgroup). Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: nf_log: fix sparse warning in nf_logger_find_get()Pablo Neira Ayuso2014-11-04
| | | | | | | | net/netfilter/nf_log.c:157:16: warning: incorrect type in assignment (different address spaces) net/netfilter/nf_log.c:157:16: expected struct nf_logger *logger net/netfilter/nf_log.c:157:16: got struct nf_logger [noderef] <asn:4>*<noident> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: fix spelling errorsstephen hemminger2014-10-30
| | | | | Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'ipvs-next'Pablo Neira Ayuso2014-10-30
|\ | | | | | | | | | | | | | | | | | | | | | | | | Simon Horman says: ==================== The single patch in this series fixes some minor fallout from adding support IPv6 real servers in IPv4 virtual-services and vice versa. It should not have any run-time affect other than perhaps saving a few cycles. ==================== Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ipvs: remove unnecessary assignment in __ip_vs_get_out_rtAlex Gartrell2014-10-27
| | | | | | | | | | | | | | | | | | It is a precondition of the function that daddr be equal to dest->addr.ip if dest is non-NULL, so this additional assignment is just confusing for stupid engineers like me. Signed-off-by: Alex Gartrell <agartrell@fb.com> Signed-off-by: Simon Horman <horms@verge.net.au>
* | netfilter: log: protect nf_log_register against double registeringMarcelo Leitner2014-10-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, despite the comment right before the function, nf_log_register allows registering two loggers on with the same type and end up overwriting the previous register. Not a real issue today as current tree doesn't have two loggers for the same type but it's better to get this protected. Also make sure that all of its callers do error checking. Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netfilter: nf_log: Introduce nft_log_dereference() macroMarcelo Leitner2014-10-30
| | | | | | | | | | | | | | Wrap up a common call pattern in an easier to handle call. Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netfilter: nf_tables: add new expression nft_redirArturo Borrero2014-10-27
| | | | | | | | | | | | | | | | This new expression provides NAT in the redirect flavour, which is to redirect packets to local machine. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netfilter: refactor NAT redirect IPv6 code to use it from nf_tablesArturo Borrero2014-10-27
| | | | | | | | | | | | | | | | This patch refactors the IPv6 code so it can be usable both from xt and nf_tables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netfilter: refactor NAT redirect IPv4 to use it from nf_tablesArturo Borrero2014-10-27
| | | | | | | | | | | | | | | | | | | | This patch refactors the IPv4 code so it can be usable both from xt and nf_tables. A similar patch follows-up to handle IPv6. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ipx: remove __inline__ in c file on staticFabian Frederick2014-10-27
| | | | | | | | | | | | | | | | Let compiler decide what to do with static void __ipxitf_put() Suggested-by: David S. Miller <davem@davemloft.net> Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipx: remove unnecessary casting on ntohlFabian Frederick2014-10-27
| | | | | | | | | | | | | | | | use %08X instead of %08lX and remove casting. Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipx: move extern sysctl_ipx_pprop_broadcasting to header fileFabian Frederick2014-10-27
| | | | | | | | | | | | | | include ipx.h from sysctl_net_ipx.c Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipv6: include linux/uaccess.h instead of asm/uaccess.hFabian Frederick2014-10-27
| | | | | | | | | | Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipv6: replace min/casting by min_tFabian Frederick2014-10-27
| | | | | | | | | | Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipv4: remove set but unused variable shaFabian Frederick2014-10-27
| | | | | | | | | | | | | | | | unsigned char *sha (source) was already in original git version but was never used. Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 's390-next'David S. Miller2014-10-26
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Frank Blaschka says: ==================== s390: network patches for net-next looks like there was a problem with my previous posting. Hope this time it will work. Sorry for any inconvenience. The patches are mostly cleanups and small enhancements for net-next ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * | ctcm: replace sscanf by kstrto functionThomas Richter2014-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | Since a single integer value is read from the supplied buffer use the kstrto functions instead of sscanf. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | lcs: replace sscanf by kstrto functionThomas Richter2014-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | Since a single integer value is read from the supplied buffer use the kstrto functions instead of sscanf. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | qeth: s390 ethernet device driver dependencyThomas Richter2014-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compile the s390 10GB ethernet device driver only when ETHERNET has been defined in the kernel configuration file. Right now the qeth device driver is always built regardless of which network connectivity is active. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | qeth: make local functions static in qeth_l3 moduleThomas Richter2014-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch makes 4 local functions static and removes the prototypes from the header file. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | qeth: fix some trace formating issuesThomas Richter2014-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes trace formatting issues using the QETH_CARD_TEXT_ macro. The total size of each trace entry is 8 bytes. Some of the sprintf formats exceed these 8 bytes (for example using abcd:%d and the converted value needs more than 3 bytes). The solution is to shorten the text prepending the value or use a different format (%x). Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | qeth: qeth_core_main make local functions staticThomas Richter2014-10-26
|/ / | | | | | | | | | | | | | | | | | | | | | | This patch makes some global functions static and removes the prototypes from the header file. Also function qeth_query_card_info is not exported anymore, there is no external user for it, this function should never have been exported in the first place. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | xen-netfront: always keep the Rx ring full of requestsDavid Vrabel2014-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A full Rx ring only requires 1 MiB of memory. This is not enough memory that it is useful to dynamically scale the number of Rx requests in the ring based on traffic rates, because: a) Even the full 1 MiB is a tiny fraction of a typically modern Linux VM (for example, the AWS micro instance still has 1 GiB of memory). b) Netfront would have used up to 1 MiB already even with moderate data rates (there was no adjustment of target based on memory pressure). c) Small VMs are going to typically have one VCPU and hence only one queue. Keeping the ring full of Rx requests handles bursty traffic better than trying to converge on an optimal number of requests to keep filled. On a 4 core host, an iperf -P 64 -t 60 run from dom0 to a 4 VCPU guest improved from 5.1 Gbit/s to 5.6 Gbit/s. Gains with more bursty traffic are expected to be higher. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'sunvnet-napi'David S. Miller2014-10-25
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sowmini Varadhan says: ==================== sunvnet: NAPIfy sunvnet This patchset converts the sunvnet driver to use the NAPI framework. Changes since v4 to Patch1: vnet_event accumulates LDC_EVENT_* bits into rx_event. vnet_event_napi() unrolls send_events() logic to process all rx_event bits. Changes since v5: Patch 1: use net_device.h definition for NAPI_POLL_WEIGHT. Drop sparclinux changes (patch3) per David Miller feedback Patch 1 in the series addresses the packet-receive path- all the vnet_event() processing is moved into NAPI context. This patch is dependant on the sparc-next commit: "sparc64: Add vio_set_intr() to enable/disable Rx interrupts" (sparc commit id ca605b7dd740c8909408d67911d8ddd272c2b320) Patch 2 uses RCU to fix race conditions between vnet_port_remove and paths that access/modify port-related state, such as vnet_start_xmit. Patch 3 leverages from the NAPIfied Rx path, dropping superfluous usage of the irqsave/irqrestores on the vio.lock where possible. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * | sunvnet: Remove irqsave/irqrestore on vio.lockSowmini Varadhan2014-10-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After the NAPIfication of sunvnet, we no longer need to synchronize by doing irqsave/restore on vio.lock in the I/O fastpath. NAPI ->poll() is non-reentrant, so all RX processing occurs strictly in a serialized environment. TX reclaim is done in NAPI context, so the netif_tx_lock can be used to serialize critical sections between Tx and Rx paths. Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | sunvnet: Use RCU to synchronize port usage with vnet_port_remove()Sowmini Varadhan2014-10-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A vnet_port_remove could be triggered as a result of an ldm-unbind operation by the peer, module unload, or other changes to the inter-vnet-link configuration. When this is concurrent with vnet_start_xmit(), there are several race sequences possible, such as thread 1 thread 2 vnet_start_xmit -> tx_port_find spin_lock_irqsave(&vp->lock..) ret = __tx_port_find(..) spin_lock_irqrestore(&vp->lock..) vio_remove -> .. ->vnet_port_remove spin_lock_irqsave(&vp->lock..) cleanup spin_lock_irqrestore(&vp->lock..) kfree(port) /* attempt to use ret will bomb */ This patch adds RCU locking for port access so that vnet_port_remove will correctly clean up port-related state. Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Acked-by: Dwight Engen <dwight.engen@oracle.com> Acked-by: Bob Picco <bob.picco@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | sunvnet: NAPIfy sunvnetSowmini Varadhan2014-10-25
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move Rx packet procssing to the NAPI poll callback. Disable VIO interrupt and unconditioanlly go into NAPI context from vnet_event. Note that we want to minimize the number of LDC STOP/START messages sent. Specifically, do not send a STOP message if vnet_walk_rx does not read all the av