summaryrefslogtreecommitdiffstats
path: root/net
Commit message (Collapse)AuthorAgeFilesLines
* tunnels: fix netns vs proto registration orderingAlexey Dobriyan2010-02-164-62/+47
| | | | | | | | Same stuff as in ip_gre patch: receive hook can be called before netns setup is done, oopsing in net_generic(). Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* gre: fix netns vs proto registration orderingAlexey Dobriyan2010-02-161-9/+10
| | | | | | | | | | | | GRE protocol receive hook can be called right after protocol addition is done. If netns stuff is not yet initialized, we're going to oops in net_generic(). This is remotely oopsable if ip_gre is compiled as module and packet comes at unfortunate moment of module loading. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2010-02-1684-1713/+2053
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
| * netfilter: CONFIG_COMPAT: allow delta to exceed 32767Florian Westphal2010-02-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | with 32 bit userland and 64 bit kernels, it is unlikely but possible that insertion of new rules fails even tough there are only about 2000 iptables rules. This happens because the compat delta is using a short int. Easily reproducible via "iptables -m limit" ; after about 2050 rules inserting new ones fails with -ELOOP. Note that compat_delta included 2 bytes of padding on x86_64, so structure size remains the same. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ebtables: avoid explicit XT_ALIGN() in match/targetsFlorian Westphal2010-02-1517-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will cause trouble once CONFIG_COMPAT support is added to ebtables. xt_compat_*_offset() calculate the kernel/userland structure size delta using: XT_ALIGN(size) - COMPAT_XT_ALIGN(size) If the match/target sizes are aligned at registration time, delta is always zero. Should have zero effect for existing systems: xtables uses XT_ALIGN() whenever it deals with match/target sizes. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ebtables: abort if next_offset is too smallFlorian Westphal2010-02-151-0/+2
| | | | | | | | | | | | | | | | | | next_offset must be > 0, otherwise this loops forever. The offset also contains the size of the ebt_entry structure itself, so anything smaller is invalid. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: add zone supportPatrick McHardy2010-02-151-19/+73
| | | | | | | | | | | | Parse and dump the conntrack zone in ctnetlink. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: add support for "conntrack zones"Patrick McHardy2010-02-1517-78/+193
| | | | | | | | | | | | | | | | | | | | | | | | | | Normally, each connection needs a unique identity. Conntrack zones allow to specify a numerical zone using the CT target, connections in different zones can use the same identity. Example: iptables -t raw -A PREROUTING -i veth0 -j CT --zone 1 iptables -t raw -A OUTPUT -o veth1 -j CT --zone 1 Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: pass template to l4proto ->error() handlerPatrick McHardy2010-02-157-9/+13
| | | | | | | | | | | | | | The error handlers might need the template to get the conntrack zone introduced in the next patches to perform a conntrack lookup. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: add const qualifiersJan Engelhardt2010-02-154-136/+168
| | | | | | | | | | | | This should make it easier to remove redundant arguments later. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: xtables: constify args in compat copying functionsJan Engelhardt2010-02-157-16/+16
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: xtables: print details on size mismatchJan Engelhardt2010-02-151-2/+6
| | | | | | | | | | | | | | Print which revision has been used and which size are which (kernel/user) for easier debugging. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: iptables: remove unused function argumentsJan Engelhardt2010-02-152-14/+6
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * netfilter: xt_recent: inform user when hitcount is too largeJan Engelhardt2010-02-151-2/+6
| | | | | | | | | | | | | | | | | | It is one of these things that iptables cannot catch and which can cause "Invalid argument" to be printed. Without a hint in dmesg, it is not going to be helpful. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: don't use INIT_RCU_HEAD()Alexey Dobriyan2010-02-123-3/+0
| | | | | | | | | | | | | | | | call_rcu() will unconditionally reinitialize RCU head anyway. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xtables: fix mangle tablesAlexey Dobriyan2010-02-112-2/+6
| | | | | | | | | | | | | | In POST_ROUTING hook, calling dev_net(in) is going to oops. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack_sip: add T.38 FAX supportPatrick McHardy2010-02-111-5/+23
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_nat_sip: add TCP supportPatrick McHardy2010-02-112-6/+57
| | | | | | | | | | | | Add support for mangling TCP SIP packets. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_nat: support mangling a single TCP packet multiple timesPatrick McHardy2010-02-111-16/+23
| | | | | | | | | | | | | | | | | | | | | | | | nf_nat_mangle_tcp_packet() can currently only handle a single mangling per window because it only maintains two sequence adjustment positions: the one before the last adjustment and the one after. This patch makes sequence number adjustment tracking in nf_nat_mangle_tcp_packet() optional and allows a helper to manually update the offsets after the packet has been fully handled. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack_sip: add TCP supportPatrick McHardy2010-02-112-30/+177
| | | | | | | | | | | | | | | | | | | | Add TCP support, which is mandated by RFC3261 for all SIP elements. SIP over TCP is similar to UDP, except that messages are delimited by Content-Length: headers and multiple messages may appear in one packet. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack_sip: pass data offset to NAT functionsPatrick McHardy2010-02-112-88/+95
| | | | | | | | | | | | | | | | | | | | When using TCP multiple SIP messages might be present in a single packet. A following patch will parse them by setting the dptr to the beginning of each message. The NAT helper needs to reload the dptr value after mangling the packet however, so it needs to know the offset of the message to the beginning of the packet. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack_sip: fix ct_sip_parse_request() REGISTER request parsingPatrick McHardy2010-02-111-3/+4
| | | | | | | | | | | | | | | | | | | | When requests are parsed, the "sip:" part of the SIP URI should be skipped. Usually this doesn't matter because address parsing skips forward until after the username part, but in case REGISTER requests it doesn't contain a username and the address can not be parsed. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: nf_conntrack: show helper and class in /proc/net/nf_conntrack_expectPatrick McHardy2010-02-112-0/+12
| | | | | | | | | | | | | | Make the output a bit more informative by showing the helper an expectation belongs to and the expectation class. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ctnetlink: dump expectation helper namePatrick McHardy2010-02-111-0/+4
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge branch 'master' of git://dev.medozas.de/linuxPatrick McHardy2010-02-1015-825/+341
| |\
| | * netfilter: xtables: generate initial table on-demandJan Engelhardt2010-02-1015-334/+138
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The static initial tables are pretty large, and after the net namespace has been instantiated, they just hang around for nothing. This commit removes them and creates tables on-demand at runtime when needed. Size shrinks by 7735 bytes (x86_64). Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: use xt_table for hook instantiationJan Engelhardt2010-02-1010-250/+117
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The respective xt_table structures already have most of the metadata needed for hook setup. Add a 'priority' field to struct xt_table so that xt_hook_link() can be called with a reduced number of arguments. So should we be having more tables in the future, it comes at no static cost (only runtime, as before) - space saved: 6807373->6806555. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: compact table hook functions (2/2)Jan Engelhardt2010-02-107-59/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | The calls to ip6t_do_table only show minimal differences, so it seems like a good cleanup to merge them to a single one too. Space saving obtained by both patches: 6807725->6807373 ("Total" column from `size -A`.) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| | * netfilter: xtables: compact table hook functions (1/2)Jan Engelhardt2010-02-109-258/+126
| | | | | | | | | | | | | | | | | | | | | | | | This patch combines all the per-hook functions in a given table into a single function. Together with the 2nd patch, further simplifications are possible up to the point of output code reduction. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * | netfilter: ctnetlink: add missing netlink attribute policiesPatrick McHardy2010-02-101-5/+36
| | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xtables: symmetric COMPAT_XT_ALIGN definitionAlexey Dobriyan2010-02-101-2/+2
| |/ | | | | | | | | | | | | | | | | Rewrite COMPAT_XT_ALIGN in terms of dummy structure hack. Compat counters logically have nothing to do with it. Use ALIGN() macro while I'm at it for same types. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge branch 'master' of /repos/git/net-next-2.6Patrick McHardy2010-02-10188-2956/+4959
| |\ | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: fix build failure with CONNTRACK=y NAT=nFlorian Westphal2010-02-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | net/ipv4/netfilter/nf_defrag_ipv4.c: In function 'ipv4_conntrack_defrag': net/ipv4/netfilter/nf_defrag_ipv4.c:62: error: implicit declaration of function 'nf_ct_is_template' Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xtables: add CT targetPatrick McHardy2010-02-034-0/+190
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new target for the raw table, which can be used to specify conntrack parameters for specific connections, f.i. the conntrack helper. The target attaches a "template" connection tracking entry to the skb, which is used by the conntrack core when initializing a new conntrack. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_conntrack: support conntrack templatesPatrick McHardy2010-02-035-23/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support initializing selected parameters of new conntrack entries from a "conntrack template", which is a specially marked conntrack entry attached to the skb. Currently the helper and the event delivery masks can be initialized this way. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: ctnetlink: support selective event deliveryPatrick McHardy2010-02-032-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add two masks for conntrack end expectation events to struct nf_conntrack_ecache and use them to filter events. Their default value is "all events" when the event sysctl is on and "no events" when it is off. A following patch will add specific initializations. Expectation events depend on the ecache struct of their master conntrack. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_conntrack: split up IPCT_STATUS eventPatrick McHardy2010-02-037-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Split up the IPCT_STATUS event into an IPCT_REPLY event, which is generated when the IPS_SEEN_REPLY bit is set, and an IPCT_ASSURED event, which is generated when the IPS_ASSURED bit is set. In combination with a following patch to support selective event delivery, this can be used for "sparse" conntrack replication: start replicating the conntrack entry after it reached the ASSURED state and that way it's SYN-flood resistant. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: add struct net * to target parametersPatrick McHardy2010-02-033-10/+16
| | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: ctnetlink: only assign helpers for matching protocolsPatrick McHardy2010-02-032-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure not to assign a helper for a different network or transport layer protocol to a connection. Additionally change expectation deletion by helper to compare the name directly - there might be multiple helper registrations using the same name, currently one of them is chosen in an unpredictable manner and only those expectations are removed. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xt_hashlimit: fix race condition and simplify lockingPatrick McHardy2010-02-031-34/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As noticed by Shin Hong <hongshin@gmail.com>, there is a race between htable_find_get() and htable_put(): htable_put(): htable_find_get(): spin_lock_bh(&hashlimit_lock); <search entry> atomic_dec_and_test(&hinfo->use) atomic_inc(&hinfo->use) spin_unlock_bh(&hashlimit_lock) return hinfo; spin_lock_bh(&hashlimit_lock); hlist_del(&hinfo->node); spin_unlock_bh(&hashlimit_lock); htable_destroy(hinfo); The entire locking concept is overly complicated, tables are only created/referenced and released in process context, so a single mutex works just fine. Remove the hashinfo_spinlock and atomic reference count and use the mutex to protect table lookups/creation and reference count changes. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xt_TCPMSS: SYN packets are allowed to contain dataSimon Arlott2010-02-021-10/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The TCPMSS target is dropping SYN packets where: 1) There is data, or 2) The data offset makes the TCP header larger than the packet. Both of these result in an error level printk. This printk has been removed. This change avoids dropping SYN packets containing data. If there is also no MSS option (as well as data), one will not be added because of possible complications due to the increased packet size. Signed-off-by: Simon Arlott <simon@fire.lp0.eu> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfiltr: ipt_CLUSTERIP: simplify seq_file codeAAlexey Dobriyan2010-01-221-9/+5
| | | | | | | | | | | | | | | | | | | | | | | | Pass "struct clusterip_config" itself to seq_file iterators and save one dereference. Proc entry itself isn't interesting. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | IPv6: reassembly: replace magic number with macro definitionsShan Wei2010-01-202-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | Use macro to define high/low thresh value, refer to IPV6_FRAG_TIMEOUT. Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nf_conntrack_ipv6: delete the redundant macro definitionsShan Wei2010-01-201-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | The following three macro definitions are never used, so delete them. Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: nfnetlink_queue: simplify warning messageEric Leblond2010-01-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | This patch remove variable part from a debug message to have message concatenation from syslog. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xt_hashlimit: netns supportAlexey Dobriyan2010-01-181-43/+98
| | | | | | | | | | | | | | | | | | | | | | | | Make hashtable per-netns. Make proc files per-netns. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xt_recent: netns supportAlexey Dobriyan2010-01-181-41/+95
| | | | | | | | | | | | | | | | | | | | | | | | Make recent table list per-netns. Make proc files per-netns. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xtables: add struct xt_mtdtor_param::netAlexey Dobriyan2010-01-1815-50/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add ->net to match destructor list like ->net in constructor list. Make sure it's set in ebtables/iptables/ip6tables, this requires to propagate netns up to *_unregister_table(). Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xtables: add struct xt_mtchk_param::netAlexey Dobriyan2010-01-183-21/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some complex match modules (like xt_hashlimit/xt_recent) want netns information at constructor and destructor time. We propably can play games at match destruction time, because netns can be passed in object, but I think it's cleaner to explicitly pass netns. Add ->net, make sure it's set from ebtables/iptables/ip6tables code. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * | netfilter: xt_hashlimit: simplify seqfile codeAlexey Dobriyan2010-01-181-9/+5
| | | | | | | | | | | | | | | | | | | | | Simply pass hashtable to seqfile iterators, proc entry itself is not needed. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
OpenPOWER on IntegriCloud