aboutsummaryrefslogtreecommitdiffstats
path: root/net
Commit message (Collapse)AuthorAge
* Merge branch 'for-linus' of ↵Linus Torvalds2008-01-30
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6: security: compile capabilities by default selinux: make selinux_set_mnt_opts() static SELinux: Add warning messages on network denial due to error SELinux: Add network ingress and egress control permission checks NetLabel: Add auditing to the static labeling mechanism NetLabel: Introduce static network labels for unlabeled connections SELinux: Allow NetLabel to directly cache SIDs SELinux: Enable dynamic enable/disable of the network access checks SELinux: Better integration between peer labeling subsystems SELinux: Add a new peer class and permissions to the Flask definitions SELinux: Add a capabilities bitmap to SELinux policy version 22 SELinux: Add a network node caching mechanism similar to the sel_netif_*() functions SELinux: Only store the network interface's ifindex SELinux: Convert the netif code to use ifindex values NetLabel: Add IP address family information to the netlbl_skbuff_getattr() function NetLabel: Add secid token support to the NetLabel secattr struct NetLabel: Consolidate the LSM domain mapping/hashing locks NetLabel: Cleanup the LSM domain hash functions NetLabel: Remove unneeded RCU read locks
| * NetLabel: Add auditing to the static labeling mechanismPaul Moore2008-01-29
| | | | | | | | | | | | | | This patch adds auditing support to the NetLabel static labeling mechanism. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
| * NetLabel: Introduce static network labels for unlabeled connectionsPaul Moore2008-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most trusted OSs, with the exception of Linux, have the ability to specify static security labels for unlabeled networks. This patch adds this ability to the NetLabel packet labeling framework. If the NetLabel subsystem is called to determine the security attributes of an incoming packet it first checks to see if any recognized NetLabel packet labeling protocols are in-use on the packet. If none can be found then the unlabled connection table is queried and based on the packets incoming interface and address it is matched with a security label as configured by the administrator using the netlabel_tools package. The matching security label is returned to the caller just as if the packet was explicitly labeled using a labeling protocol. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
| * SELinux: Enable dynamic enable/disable of the network access checksPaul Moore2008-01-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a mechanism for checking when labeled IPsec or SECMARK are in use by keeping introducing a configuration reference counter for each subsystem. In the case of labeled IPsec, whenever a labeled SA or SPD entry is created the labeled IPsec/XFRM reference count is increased and when the entry is removed it is decreased. In the case of SECMARK, when a SECMARK target is created the reference count is increased and later decreased when the target is removed. These reference counters allow SELinux to quickly determine if either of these subsystems are enabled. NetLabel already has a similar mechanism which provides the netlbl_enabled() function. This patch also renames the selinux_relabel_packet_permission() function to selinux_secmark_relabel_packet_permission() as the original name and description were misleading in that they referenced a single packet label which is not the case. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
| * NetLabel: Add IP address family information to the netlbl_skbuff_getattr() ↵Paul Moore2008-01-29
| | | | | | | | | | | | | | | | | | | | | | | | function In order to do any sort of IP header inspection of incoming packets we need to know which address family, AF_INET/AF_INET6/etc., it belongs to and since the sk_buff structure does not store this information we need to pass along the address family separate from the packet itself. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
| * NetLabel: Add secid token support to the NetLabel secattr structPaul Moore2008-01-29
| | | | | | | | | | | | | | | | | | | | | | This patch adds support to the NetLabel LSM secattr struct for a secid token and a type field, paving the way for full LSM/SELinux context support and "static" or "fallback" labels. In addition, this patch adds a fair amount of documentation to the core NetLabel structures used as part of the NetLabel kernel API. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
| * NetLabel: Consolidate the LSM domain mapping/hashing locksPaul Moore2008-01-29
| | | | | | | | | | | | | | | | | | | | | | Currently we use two separate spinlocks to protect both the hash/mapping table and the default entry. This could be considered a bit foolish because it adds complexity without offering any real performance advantage. This patch removes the dedicated default spinlock and protects the default entry with the hash/mapping table spinlock. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
| * NetLabel: Cleanup the LSM domain hash functionsPaul Moore2008-01-29
| | | | | | | | | | | | | | | | | | | | The NetLabel/LSM domain hash table search function used an argument to specify if the default entry should be returned if an exact match couldn't be found in the hash table. This is a bit against the kernel's style so make two separate functions to represent the separate behaviors. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
| * NetLabel: Remove unneeded RCU read locksPaul Moore2008-01-29
| | | | | | | | | | | | | | | | | | | | This patch removes some unneeded RCU read locks as we can treat the reads as "safe" even without RCU. It also converts the NetLabel configuration refcount from a spinlock protected u32 into atomic_t to be more consistent with the rest of the kernel. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
* | Merge git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86Linus Torvalds2008-01-30
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86: (890 commits) x86: fix nodemap_size according to nodeid bits x86: fix overlap between pagetable with bss section x86: add PCI IDs to k8topology_64.c x86: fix early_ioremap pagetable ops x86: use the same pgd_list for PAE and 64-bit x86: defer cr3 reload when doing pud_clear() x86: early boot debugging via FireWire (ohci1394_dma=early) x86: don't special-case pmd allocations as much x86: shrink some ifdefs in fault.c x86: ignore spurious faults x86: remove nx_enabled from fault.c x86: unify fault_32|64.c x86: unify fault_32|64.c with ifdefs x86: unify fault_32|64.c by ifdef'd function bodies x86: arch/x86/mm/init_32.c printk fixes x86: arch/x86/mm/init_32.c cleanup x86: arch/x86/mm/init_64.c printk fixes x86: unify ioremap x86: fixes some bugs about EFI memory map handling x86: use reboot_type on EFI 32 ...
| * | x86: change NR_CPUS arrays in numa_64travis@sgi.com2008-01-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change the following static arrays sized by NR_CPUS to per_cpu data variables: char cpu_to_node_map[NR_CPUS]; Signed-off-by: Mike Travis <travis@sgi.com> Reviewed-by: Christoph Lameter <clameter@sgi.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
* | | Make !NETFILTER_ADVANCED enable IP6_NF_MATCH_IPV6HEADERLinus Torvalds2008-01-30
|/ / | | | | | | | | | | | | | | | | | | | | | | We want IPV6HEADER matching for the non-advanced default netfilter configuration, since it's part of the standard netfilter setup of at least some distributions (eg Fedora). Otherwise NETFILTER_ADVANCED loses much of its point, since even non-advanced users would have to enable all the advanced options just to get a working IPv6 netfilter setup. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | SUNRPC: Don't bother changing the sigmask for asynchronous RPC callsTrond Myklebust2008-01-30
| | | | | | | | | | | | | | The caller will never sleep in rpc_execute, so don't bother setting the sigmask. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: rpcb_getport_sync() passes incorrect address size to rpc_create()Chuck Lever2008-01-30
| | | | | | | | | | | | | | | | The variable "sin" is a pointer, so sizeof(sin) is the size of a pointer, not the size of thing that sin points to. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Clean up block comment preceding rpcb_getport_sync()Chuck Lever2008-01-30
| | | | | | | | | | Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Use appropriate argument types in rpcb clientChuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | Clean up: Follow recommendations of Chapter 5 of Documentation/CodingStyle and use "u32" instead of "__u32" for types in definitions that are not shared with user space. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: rpcb_getport_sync() should use built-in hostname generatorChuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | rpc_create() can already fill in the hostname with a string representation of the server's IP address, so remove redundant logic in in rpcb_getport_sync() that does that. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Clean up functions that free address_strings arrayChuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | Clean up: document the rule (kfree) and the exceptions (RPC_DISPLAY_PROTO and RPC_DISPLAY_NETID) when freeing the objects in a transport's address_strings array. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Fix up constant string declarations in struct rpcbind_argsTrond Myklebust2008-01-30
| | | | | | | | | | | | ...and eliminate an unnecessary cast. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: fewer conditionals in the format_ip_address routinesChuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | | | | | Clean up: have the set up routines explicitly pass the strings to be used for the transport name and NETID. This removes a number of conditionals and dependencies on rpc_xprt.prot, which is overloaded. Tighten up type checking on the address_strings array while we're at it. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Fix use of copy_to_user() in gss_pipe_upcall()Chuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | | | | | | | | | The gss_pipe_upcall() function expects the copy_to_user() function to return a negative error value if the call fails, but copy_to_user() returns an unsigned long number of bytes that couldn't be copied. Can rpc_pipefs actually retry a partially completed upcall read? If not, then gss_pipe_upcall() should punt any partial read, just like the upcall logic in net/sunrpc/cache.c. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Add support for per-client timeout valuesTrond Myklebust2008-01-30
| | | | | | | | | | | | | | | | In order to be able to support setting the timeo and retrans parameters on a per-mountpoint basis, we move the rpc_timeout structure into the rpc_clnt. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Clean up the transport timeout initialisationTrond Myklebust2008-01-30
| | | | | | | | Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: cleanup for rpc_new_client()Trond Myklebust2008-01-30
| | | | | | | | | | | | There is no reason why we shouldn't just pass the rpc_create_args. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Move universal address definitions to global headerChuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | | | Universal addresses are defined in RFC 1833 and clarified in RFC 3530. We need to use them in several places in the NFS and RPC clients, so move the relevant definition and block comment to an appropriate global include file. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: RPC version numbers are u32Chuck Lever2008-01-30
| | | | | | | | | | | | | | Clean up: use correct type for RPC version numbers in rpcbind client. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Fix socket address handling in rpcb_clntChuck Lever2008-01-30
| | | | | | | | | | | | | | Make sure rpcb_clnt passes the correct address length to rpc_create(). Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: rpc_create() default hostname should support AF_INET6 addressesChuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | | | | | | | If the ULP doesn't pass a hostname string to rpc_create(), it manufactures one based on the passed-in address. Be smart enough to handle an AF_INET6 address properly in this case. Move the default servername logic before the xprt_create_transport() call to simplify error handling in rpc_create(). Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Remove an unneeded implicit type cast when calling rpc_depopulate()Chuck Lever2008-01-30
| | | | | | | | | | | | | | | | The two arguments of rpc_depopulate() that pass in inode numbers should use the same type as inode->i_ino: unsigned long. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: temp var should match return type of xdr_skb_read_actorChuck Lever2008-01-30
| | | | | | | | | | | | | | | | The return type of xdr_skb_read_actor functions is size_t. This fixes a nit I unwittingly overlooked in commit dd456471. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Check a return resultChuck Lever2008-01-30
| | | | | | | | | | | | | | | | Minor: Replace an empty if statement with a debugging dprintk. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Cc: Thomas Talpey <Thomas.Talpey@netapp.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Fix an unnecessary implicit type cast in rpcrdma_count_chunks()Chuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | | | Nit: rl_nchunks is an unsigned integer, so pass it into rpcrdma_count_chunks() via an unsigned integer argument. This eliminates a harmless mixed sign comparison in rpcrdma_count_chunks() Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Cc: Thomas Talpey <Thomas.Talpey@netapp.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Prevent mixed sign comparisons in rpcrdma_convert_iovs()Chuck Lever2008-01-30
| | | | | | | | | | | | | | | | | | | | Keep the type of the buffer position the same during iovec conversion to reduce the likelihood of unexpected results from comparisons and length computations. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Cc: Thomas Talpey <Thomas.Talpey@netapp.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Cleanup to remove the last users of the RPC_WAITQ declarationTrond Myklebust2008-01-30
| | | | | | | | Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Unexport rpc_init_task() and rpc_execute()Trond Myklebust2008-01-30
| | | | | | | | Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: allow the caller of rpc_run_task to preallocate the struct rpc_taskTrond Myklebust2008-01-30
| | | | | | | | Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Remove the now unused function rpc_call_setup()Trond Myklebust2008-01-30
| | | | | | | | Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | NFS/SUNRPC: Convert all users of rpc_call_setup()Trond Myklebust2008-01-30
| | | | | | | | | | | | | | Replace use of rpc_call_setup() with rpc_init_task(), and in cases where we need to initialise task->tk_action, with rpc_call_start(). Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Allow rpc_init_task() to initialise the rpc_task->tk_msgTrond Myklebust2008-01-30
| | | | | | | | | | | | In preparation for the removal of rpc_call_setup(). Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Add a helper rpc_call_start() that initialises task->tk_actionTrond Myklebust2008-01-30
| | | | | | | | Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Mask signals across the call to rpc_call_setup() in rpc_run_taskTrond Myklebust2008-01-30
| | | | | | | | | | | | To ensure that the RPCSEC_GSS upcall is performed with the correct sigmask. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Clean up the initialisation of priority queue scheduling info.Trond Myklebust2008-01-30
| | | | | | | | | | | | | | | | | | | | We want the default scheduling priority (priority == 0) to remain RPC_PRIORITY_NORMAL. Also ensure that the priority wait queue scheduling is per process id instead of sometimes being per thread, and sometimes being per inode. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Clean up rpc_run_taskTrond Myklebust2008-01-30
| | | | | | | | | | | | | | Make it use the new task initialiser structure instead of acting as a wrapper. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Cleanup of rpc_task initialisationTrond Myklebust2008-01-30
| | | | | | | | Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Restrict sunrpc client exportsTrond Myklebust2008-01-30
| | | | | | | | | | | | | | | | The sunrpc client exports are not meant to be part of any official kernel API: they can change at the drop of a hat. Mark them as internal functions using EXPORT_SYMBOL_GPL. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Move exported declarations to the function declarationsTrond Myklebust2008-01-30
| | | | | | | | | | | | Do this for all RPC client related functions and XDR functions. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | sunrpc: document the rpc_pipefs kernel apiJ. Bruce Fields2008-01-30
| | | | | | | | | | | | | | Add kerneldoc comments for the rpc_pipefs.c functions that are exported. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Reconnect immediately whenever the server isn't refusing it.Trond Myklebust2008-01-30
| | | | | | | | | | | | | | If we've disconnected from the server, rather than the other way round, then it makes little sense to wait 3 seconds before reconnecting. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Rename xprt_disconnect()Trond Myklebust2008-01-30
| | | | | | | | | | | | | | | | xprt_disconnect() should really only be called when the transport shutdown is completed, and it is time to wake up any pending tasks. Rename it to xprt_disconnect_done() in order to reflect the semantical change. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | SUNRPC: Make call_status()/call_decode() call xprt_force_disconnect()Trond Myklebust2008-01-30
| | | | | | | | | | | | | | | | | | Move the calls to xprt_disconnect() over to xprt_force_disconnect() in order to enable the transport layer to manage the state of the XPRT_CONNECTED flag. Ditto in xs_tcp_read_fraghdr(). Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-16 21:07:49 -0500