aboutsummaryrefslogtreecommitdiffstats
path: root/net
Commit message (Collapse)AuthorAge
* Merge branch 'master' of ↵David S. Miller2009-09-10
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * netfilter: ebt_ulog: fix checkentry return valuePatrick McHardy2009-09-01
| | | | | | | | | | | | | | | | Commit 19eda87 (netfilter: change return types of check functions for Ebtables extensions) broke the ebtables ulog module by missing a return value conversion. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * IPVS: Add handling of incoming ICMPV6 messagesJulius Volz2009-08-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add handling of incoming ICMPv6 messages. This follows the handling of IPv4 ICMP messages. Amongst ther things this problem allows IPVS to behave sensibly when an ICMPV6_PKT_TOOBIG message is received: This message is received when a realserver sends a packet >PMTU to the client. The hop on this path with insufficient MTU will generate an ICMPv6 Packet Too Big message back to the VIP. The LVS server receives this message, but the call to the function handling this has been missing. Thus, IPVS fails to forward the message to the real server, which then does not adjust the path MTU. This patch adds the missing call to ip_vs_in_icmp_v6() in ip_vs_in() to handle this situation. Thanks to Rob Gallagher from HEAnet for reporting this issue and for testing this patch in production (with direct routing mode). [horms@verge.net.au: tweaked changelog] Signed-off-by: Julius Volz <julius.volz@gmail.com> Tested-by: Rob Gallagher <robert.gallagher@heanet.ie> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ip6t_eui: fix read outside array boundsPatrick McHardy2009-08-31
| | | | | | | | | | | | | | | | | | Use memcmp() instead of open coded comparison that reads one byte past the intended end. Based on patch from Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: netns fix re reliable conntrack event deliveryAlexey Dobriyan2009-08-31
| | | | | | | | | | | | | | | | Conntracks in netns other than init_net dying list were never killed. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * ipvs: Use atomic operations atomiclySimon Horman2009-08-31
| | | | | | | | | | | | | | | | | | | | A pointed out by Shin Hong, IPVS doesn't always use atomic operations in an atomic manner. While this seems unlikely to be manifest in strange behaviour, it seems appropriate to clean this up. Cc: shin hong <hongshin@gmail.com> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nfnetlink: constify message attributes and headersPatrick McHardy2009-08-25
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink: constify nlmsghdr argumentsPatrick McHardy2009-08-25
| | | | | | | | | | | | | | | | Consitfy nlmsghdr arguments to a couple of functions as preparation for the next patch, which will constify the netlink message data in all nfnetlink users. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: log packets dropped by helpersPatrick McHardy2009-08-25
| | | | | | | | | | | | | | | | Log packets dropped by helpers using the netfilter logging API. This is useful in combination with nfnetlink_log to analyze those packets in userspace for debugging. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: bridge: refcount fixEric Dumazet2009-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | commit f216f082b2b37c4943f1e7c393e2786648d48f6f ([NETFILTER]: bridge netfilter: deal with martians correctly) added a refcount leak on in_dev. Instead of using in_dev_get(), we can use __in_dev_get_rcu(), as netfilter hooks are running under rcu_read_lock(), as pointed by Patrick. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_nat: fix inverted logic for persistent NAT mappingsMaximilian Engelhardt2009-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel 2.6.30 introduced a patch [1] for the persistent option in the netfilter SNAT target. This is exactly what we need here so I had a quick look at the code and noticed that the patch is wrong. The logic is simply inverted. The patch below fixes this. Also note that because of this the default behavior of the SNAT target has changed since kernel 2.6.30 as it now ignores the destination IP in choosing the source IP for nating (which should only be the case if the persistent option is set). [1] http://git.eu.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=98d500d66cb7940747b424b245fc6a51ecfbf005 Signed-off-by: Maximilian Engelhardt <maxi@daemonizer.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: mark initial tables constantJan Engelhardt2009-08-24
| | | | | | | | | | | | | | The inputted table is never modified, so should be considered const. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge branch 'master' of git://dev.medozas.de/linuxPatrick McHardy2009-08-10
| |\
| | * netfilter: xtables: check for standard verdicts in policiesJan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the second check that Rusty wanted to have a long time ago. :-) Base chain policies must have absolute verdicts that cease processing in the table, otherwise rule execution may continue in an unexpected spurious fashion (e.g. next chain that follows in memory). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: check for unconditionality of policiesJan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a check that iptables's original author Rusty set forth in a FIXME comment. Underflows in iptables are better known as chain policies, and are required to be unconditional or there would be a stochastical chance for the policy rule to be skipped if it does not match. If that were to happen, rule execution would continue in an unexpected spurious fashion. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: ignore unassigned hooks in check_entry_size_and_hooksJan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "hook_entry" and "underflow" array contains values even for hooks not provided, such as PREROUTING in conjunction with the "filter" table. Usually, the values point to whatever the next rule is. For the upcoming unconditionality and underflow checking patches however, we must not inspect that arbitrary rule. Skipping unassigned hooks seems like a good idea, also because newinfo->hook_entry and newinfo->underflow will then continue to have the poison value for detecting abnormalities. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: use memcmp in unconditional checkJan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of inspecting each u32/char open-coded, clean up and make use of memcmp. On some arches, memcmp is implemented as assembly or GCC's __builtin_memcmp which can possibly take advantages of known alignment. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: iptables: remove unused datalen variableJan Engelhardt2009-08-10
| | | | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: switch table AFs to nfprotoJan Engelhardt2009-08-10
| | | | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: switch hook PFs to nfprotoJan Engelhardt2009-08-10
| | | | | | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: conntrack: switch hook PFs to nfprotoJan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | | | | Simple substitution to indicate that the fields indeed use the NFPROTO_ space. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: remove xt_owner v0Jan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | Superseded by xt_owner v1 (v2.6.24-2388-g0265ab4). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: remove xt_mark v0Jan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | Superseded by xt_mark v1 (v2.6.24-2922-g17b0d7e). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: remove xt_iprange v0Jan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | Superseded by xt_iprange v1 (v2.6.24-2928-g1a50c5a1). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: remove xt_conntrack v0Jan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | Superseded by xt_conntrack v1 (v2.6.24-2921-g64eb12f). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: remove xt_connmark v0Jan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | Superseded by xt_connmark v1 (v2.6.24-2919-g96e3227). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: remove xt_MARK v0, v1Jan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | Superseded by xt_MARK v2 (v2.6.24-2918-ge0a812a). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: remove xt_CONNMARK v0Jan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | Superseded by xt_CONNMARK v1 (v2.6.24-2917-g0dc8c76). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: remove xt_TOS v0Jan Engelhardt2009-08-10
| | | | | | | | | | | | | | | | | | Superseded by xt_TOS v1 (v2.6.24-2396-g5c350e5). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * | netfilter: ebtables: Use %pM conversion specifierTobias Klauser2009-08-10
| | | | | | | | | | | | | | | | | | | | | | | | ebt_log uses its own implementation of print_mac to print MAC addresses. This patch converts it to use the %pM conversion specifier for printk. Signed-off-by: Tobias Klauser <klto@zhaw.ch> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_conntrack: add SCTP support for SO_ORIGINAL_DSTRafael Laufer2009-08-10
| |/ | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | net_sched: fix estimator lock selection for mq child qdiscsPatrick McHardy2009-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When new child qdiscs are attached to the mq qdisc, they are actually attached as root qdiscs to the device queues. The lock selection for new estimators incorrectly picks the root lock of the existing and to be replaced qdisc, which results in a use-after-free once the old qdisc has been destroyed. Mark mq qdisc instances with a new flag and treat qdiscs attached to mq as children similar to regular root qdiscs. Additionally prevent estimators from being attached to the mq qdisc itself since it only updates its byte and packet counters during dumps. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'master' of ↵David S. Miller2009-09-09
|\ \ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6
| * | cfg80211: allow scanning on specified frequencies when using wext-compatibilityHolger Schurig2009-09-09
| | | | | | | | | | | | | | | | | | | | | | | | Handles the case when SIOCSIWSCAN specified iw_scan_req.num_channels and iw_scan_req.channels[]. Signed-off-by: Holger Schurig <hs4233@mail.mn-solutions.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * | wireless: update cfg80211 kconfig entryLuis R. Rodriguez2009-09-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cfg80211 is now *the* wireless configuration API. Lets also give a little explanation as to what it is and refer people to the wireless wiki for more information. Cc: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* | | headers: net/ipv[46]/protocol.c header trimAlexey Dobriyan2009-09-09
|/ / | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: add classful multiqueue dummy schedulerDavid S. Miller2009-09-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a classful dummy scheduler which can be used as root qdisc for multiqueue devices and exposes each device queue as a child class. This allows to address queues individually and graft them similar to regular classes. Additionally it presents an accumulated view of the statistics of all real root qdiscs in the dummy root. Two new callbacks are added to the qdisc_ops and qdisc_class_ops: - cl_ops->select_queue selects the tx queue number for new child classes. - qdisc_ops->attach() overrides root qdisc device grafting to attach non-shared qdiscs to the queues. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: move dev_graft_qdisc() to sch_generic.cPatrick McHardy2009-09-06
| | | | | | | | | | | | | | It will be used in a following patch by the multiqueue qdisc. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: reintroduce dev->qdisc for use by sch_apiPatrick McHardy2009-09-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the multiqueue integration with the qdisc API suffers from a few problems: - with multiple queues, all root qdiscs use the same handle. This means they can't be exposed to userspace in a backwards compatible fashion. - all API operations always refer to queue number 0. Newly created qdiscs are automatically shared between all queues, its not possible to address individual queues or restore multiqueue behaviour once a shared qdisc has been attached. - Dumps only contain the root qdisc of queue 0, in case of non-shared qdiscs this means the statistics are incomplete. This patch reintroduces dev->qdisc, which points to the (single) root qdisc from userspace's point of view. Currently it either points to the first (non-shared) default qdisc, or a qdisc shared between all queues. The following patches will introduce a classful dummy qdisc, which will be used as root qdisc and contain the per-queue qdiscs as children. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: remove some unnecessary checks in classful schedulersPatrick McHardy2009-09-06
| | | | | | | | | | | | | | | | | | | | The class argument to the ->graft(), ->leaf(), ->dump(), ->dump_stats() all originate from either ->get() or ->walk() and are always valid. Remove unnecessary checks. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: make cls_ops->change and cls_ops->delete optionalPatrick McHardy2009-09-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some schedulers don't support creating, changing or deleting classes. Make the respective callbacks optionally and consistently return -EOPNOTSUPP for unsupported operations, instead of currently either -EOPNOTSUPP, -ENOSYS or no error. In case of sch_prio and sch_multiq, the removed operations additionally checked for an invalid class. This is not necessary since the class argument can only orginate from ->get() or in case of ->change is 0 for creation of new classes, in which case ->change() incorrectly returned -ENOENT. As a side-effect, this patch fixes a possible (root-only) NULL pointer function call in sch_ingress, which didn't implement a so far mandatory ->delete() operation. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: make cls_ops->tcf_chain() optionalPatrick McHardy2009-09-06
| | | | | | | | | | | | | | | | Some qdiscs don't support attaching filters. Handle this centrally in cls_api and return a proper errno code (EOPNOTSUPP) instead of EINVAL. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: fix class grafting errno codesPatrick McHardy2009-09-05
| | | | | | | | | | | | | | | | | | | | | | | | If the parent qdisc doesn't support classes, use EOPNOTSUPP. If the parent class doesn't exist, use ENOENT. Currently EINVAL is returned in both cases. Additionally check whether grafting is supported and remove a now unnecessary graft function from sch_ingress. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netlink: silence compiler warningBrian Haley2009-09-04
| | | | | | | | | | | | | | | | | | | | | | | | CC net/netlink/genetlink.o net/netlink/genetlink.c: In function ‘genl_register_mc_group’: net/netlink/genetlink.c:139: warning: ‘err’ may be used uninitialized in this function From following the code 'err' is initialized, but set it to zero to silence the warning. Signed-off-by: Brian Haley <brian.haley@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | sctp: Catch bogus stream sequence numbersVlad Yasevich2009-09-04
| | | | | | | | | | | | | | | | | | | | Since our TSN map is capable of holding at most a 4K chunk gap, there is no way that during this gap, a stream sequence number (unsigned short) can wrap such that the new number is smaller then the next expected one. If such a case is encountered, this is a protocol violation. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
* | sctp: remove dup code in net/sctp/output.cWei Yongjun2009-09-04
| | | | | | | | | | | | | | Use sctp_packet_reset() instead of dup code. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
* | sctp: Sysctl configuration for IPv4 Address ScopingBhaskar Dutta2009-09-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a new sysctl option to make IPv4 Address Scoping configurable <draft-stewart-tsvwg-sctp-ipv4-00.txt>. In networking environments where DNAT rules in iptables prerouting chains convert destination IP's to link-local/private IP addresses, SCTP connections fail to establish as the INIT chunk is dropped by the kernel due to address scope match failure. For example to support overlapping IP addresses (same IP address with different vlan id) a Layer-5 application listens on link local IP's, and there is a DNAT rule that maps the destination IP to a link local IP. Such applications never get the SCTP INIT if the address-scoping draft is strictly followed. This sysctl configuration allows SCTP to function in such unconventional networking environments. Sysctl options: 0 - Disable IPv4 address scoping draft altogether 1 - Enable IPv4 address scoping (default, current behavior) 2 - Enable address scoping but allow IPv4 private addresses in init/init-ack 3 - Enable address scoping but allow IPv4 link local address in init/init-ack Signed-off-by: Bhaskar Dutta <bhaskar.dutta@globallogic.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
* | sctp: Get rid of an extra routing lookup when adding a transport.Vlad Yasevich2009-09-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We used to perform 2 routing lookups for a new transport: one just for path mtu detection, and one to actually route to destination and path mtu update when sending a packet. There is no point in doing both of them, especially since the first one just for path mtu doesn't take into account source address and sometimes gives the wrong route, causing path mtu updates anyway. We now do just the one call to do both route to destination and get path mtu updates. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
* | sctp: Correctly track if AUTH has been bundled.Vlad Yasevich2009-09-04
| | | | | | | | | | | | | | | | | | We currently track if AUTH has been bundled using the 'auth' pointer to the chunk. However, AUTH is disallowed after DATA is already in the packet, so we need to instead use the 'has_auth' field. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
* | sctp: fix to reset packet information after packet transmitWei Yongjun2009-09-04
| | | | | | | | | | | | | | | | | | | | The packet information does not reset after packet transmit, this may cause some problems such as following DATA chunk be sent without AUTH chunk, even if the authentication of DATA chunk has been requested by the peer. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
generated by cgit v1.2.2 (git 2.25.0) at 2025-02-11 06:09:29 -0500