aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-08-02netfilter: nf_conntrack_extend: introduce __nf_ct_ext_exist()Changli Gao2-12/+19
some users of nf_ct_ext_exist() know ct->ext isn't NULL. For these users, the check for ct->ext isn't necessary, the function __nf_ct_ext_exist() can be used instead. the type of the return value of nf_ct_ext_exist() is changed to bool. Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-08-02netfilter: {ip,ip6,arp}_tables: dont block bottom half more than necessaryEric Dumazet3-12/+18
We currently disable BH for the whole duration of get_counters() On machines with a lot of cpus and large tables, this might be too long. We can disable preemption during the whole function, and disable BH only while fetching counters for the current cpu. Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23netfilter: iptables: use skb->len for accountingChangli Gao1-1/+1
Use skb->len for accounting as xt_quota does. Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23netfilter: ip6tables: use skb->len for accountingChangli Gao1-3/+1
ipv6_hdr(skb)->payload_len is ZERO and can't be used for accounting, if the payload is a Jumbo Payload specified in RFC2675. Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23xt_quota: report initial quota value instead of current value to userspaceChangli Gao2-3/+1
We should copy the initial value to userspace for iptables-save and to allow removal of specific quota rules. Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23netfilter: xt_quota: use per-rule spin lockChangli Gao1-5/+5
Use per-rule spin lock to improve the scalability. Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23netfilter: arptables: use arp_hdr_len()Changli Gao1-4/+1
use arp_hdr_len(). Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23netfilter: nf_nat_core: merge the same linesChangli Gao1-7/+2
proto->unique_tuple() will be called finally, if the previous calls fail. This patch checks the false condition of (range->flags &IP_NAT_RANGE_PROTO_RANDOM) instead to avoid duplicate line of code: proto->unique_tuple(). Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23netfilter: add xt_cpu matchEric Dumazet5-1/+86
In some situations a CPU match permits a better spreading of connections, or select targets only for a given cpu. With Remote Packet Steering or multiqueue NIC and appropriate IRQ affinities, we can distribute trafic on available cpus, per session. (all RX packets for a given flow is handled by a given cpu) Some legacy applications being not SMP friendly, one way to scale a server is to run multiple copies of them. Instead of randomly choosing an instance, we can use the cpu number as a key so that softirq handler for a whole instance is running on a single cpu, maximizing cache effects in TCP/UDP stacks. Using NAT for example, a four ways machine might run four copies of server application, using a separate listening port for each instance, but still presenting an unique external port : iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 0 \ -j REDIRECT --to-port 8080 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 1 \ -j REDIRECT --to-port 8081 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 2 \ -j REDIRECT --to-port 8082 iptables -t nat -A PREROUTING -p tcp --dport 80 -m cpu --cpu 3 \ -j REDIRECT --to-port 8083 Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23IPVS: make FTP work with full NAT supportHannes Eder5-59/+165
Use nf_conntrack/nf_nat code to do the packet mangling and the TCP sequence adjusting. The function 'ip_vs_skb_replace' is now dead code, so it is removed. To SNAT FTP, use something like: % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \ --vport 21 -j SNAT --to-source 192.168.10.10 and for the data connections in passive mode: % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \ --vportctl 21 -j SNAT --to-source 192.168.10.10 using '-m state --state RELATED' would also works. Make sure the kernel modules ip_vs_ftp, nf_conntrack_ftp, and nf_nat_ftp are loaded. [ up-port and minor fixes by Simon Horman <[email protected]> ] Signed-off-by: Hannes Eder <[email protected]> Signed-off-by: Simon Horman <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23IPVS: make friends with nf_conntrackHannes Eder3-37/+30
Update the nf_conntrack tuple in reply direction, as we will see traffic from the real server (RIP) to the client (CIP). Once this is done we can use netfilters SNAT in POSTROUTING, especially with xt_ipvs, to do source NAT, e.g.: % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 --vport 80 \ -j SNAT --to-source 192.168.10.10 [ minor fixes by Simon Horman <[email protected]> ] Signed-off-by: Hannes Eder <[email protected]> Signed-off-by: Simon Horman <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-23netfilter: xt_ipvs (netfilter matcher for IPVS)Hannes Eder6-0/+229
This implements the kernel-space side of the netfilter matcher xt_ipvs. [ minor fixes by Simon Horman <[email protected]> ] Signed-off-by: Hannes Eder <[email protected]> Signed-off-by: Simon Horman <[email protected]> [ Patrick: added xt_ipvs.h to Kbuild ] Signed-off-by: Patrick McHardy <[email protected]>
2010-07-16netfilter: correct CHECKSUM header and export itMichael S. Tsirkin2-3/+6
Signed-off-by: Michael S. Tsirkin <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-15netfilter: add CHECKSUM targetMichael S. Tsirkin4-0/+105
This adds a `CHECKSUM' target, which can be used in the iptables mangle table. You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device. The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as http://www.spinics.net/lists/kvm/msg37660.html Typical expected use (helps old dhclient binary running in a VM): iptables -A POSTROUTING -t mangle -p udp --dport bootpc \ -j CHECKSUM --checksum-fill Includes fixes by Jan Engelhardt <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-15netfilter: nf_ct_tcp: fix flow recovery with TCP window tracking enabledPablo Neira Ayuso1-1/+9
This patch adds the missing bits to support the recovery of TCP flows without disabling window tracking (aka be_liberal). To ensure a successful recovery, we have to inject the window scale factor via ctnetlink. This patch has been tested with a development snapshot of conntrackd and the new clause `TCPWindowTracking' that allows to perform strict TCP window tracking recovery across fail-overs. With this patch, we don't update the receiver's window until it's not initiated. We require this to perform a successful recovery. Jozsef confirmed in a private email that this spotted a real issue since that should not happen. Signed-off-by: Pablo Neira Ayuso <[email protected]> Acked-by: Jozsef Kadlecsik <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-15nfnetlink_log: do not expose NFULNL_COPY_DISABLED to user-spacePablo Neira Ayuso2-1/+3
This patch moves NFULNL_COPY_PACKET definition from linux/netfilter/nfnetlink_log.h to net/netfilter/nfnetlink_log.h since this copy mode is only for internal use. I have also changed the value from 0x03 to 0xff. Thus, we avoid a gap from user-space that may confuse users if we add new copy modes in the future. This change was introduced in: http://www.spinics.net/lists/netfilter-devel/msg13535.html Since this change is not included in any stable Linux kernel, I think it's safe to make this change now. Anyway, this copy mode does not make any sense from user-space, so this patch should not break any existing setup. Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-09netfilter: xt_TPROXY: the length of lines should be within 80Changli Gao1-2/+4
According to the Documentation/CodingStyle, the length of lines should be within 80. Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-09ipvs: lvs sctp protocol handler is incorrectly invoked ip_vs_app_pkt_outXiaoyu Du1-1/+1
lvs sctp protocol handler is incorrectly invoked ip_vs_app_pkt_out Since there's no sctp helpers at present, it does the same thing as ip_vs_app_pkt_in. Signed-off-by: Xiaoyu Du <[email protected]> Acked-by: Simon Horman <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-05ipvs: Kconfig cleanupMichal Marek1-4/+1
IP_VS_PROTO_AH_ESP should be set iff either of IP_VS_PROTO_{AH,ESP} is selected. Express this with standard kconfig syntax. Signed-off-by: Michal Marek <[email protected]> Acked-by: Simon Horman <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-05netfilter: ipt_REJECT: avoid touching dst refEric Dumazet1-1/+1
We can avoid a pair of atomic ops in ipt_REJECT send_reset() Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-05netfilter: ipt_REJECT: postpone the checksum calculation.Changli Gao1-5/+5
postpone the checksum calculation, then if the output NIC supports checksum offloading, we can utlize it. And though the output NIC doesn't support checksum offloading, but we'll mangle this packet, this can free us from updating the checksum, as the checksum calculation occurs later. Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-05netfilter: nf_conntrack_reasm: add fast path for in-order fragmentsChangli Gao1-0/+9
As the fragments are sent in order in most of OSes, such as Windows, Darwin and FreeBSD, it is likely the new fragments are at the end of the inet_frag_queue. In the fast path, we check if the skb at the end of the inet_frag_queue is the prev we expect. Signed-off-by: Changli Gao <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-04IB/{nes, ipoib}: Pass supported flags to ethtool_op_set_flags()Ben Hutchings2-2/+13
Following commit 1437ce3983bcbc0447a0dedcd644c14fe833d266 "ethtool: Change ethtool_op_set_flags to validate flags", ethtool_op_set_flags takes a third parameter and cannot be used directly as an implementation of ethtool_ops::set_flags. Changes nes and ipoib driver to pass in the appropriate value. Signed-off-by: Ben Hutchings <[email protected]> Acked-by: Roland Dreier <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-04bnx2: Update version to 2.0.16.Michael Chan1-2/+2
Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-04bnx2: Dump some config space registers during TX timeout.Michael Chan1-3/+8
These config register values will be useful when the memory registers are returning 0xffffffff which has been reported. Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-04bnx2: Add support for skb->rxhash.Michael Chan2-1/+17
Add skb->rxhash support for TCP packets only because the bnx2 RSS hash does not hash UDP ports. Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-04bnx2: Always enable MSI-X on 5709.Michael Chan1-1/+1
Minor change to use MSI-X even if there is only one CPU. This allows the CNIC driver to always have a dedicated MSI-X vector to handle iSCSI events, instead of sharing the MSI vector. Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-04netdevice.h: Change netif_<level> macros to call netdev_<level> functionsJoe Perches1-7/+13
Reduces text ~300 bytes of text (woohoo!) in an x86 defconfig $ size vmlinux* text data bss dec hex filename 7198526 720112 1366288 9284926 8dad3e vmlinux 7198862 720112 1366288 9285262 8dae8e vmlinux.netdev Signed-off-by: Joe Perches <[email protected]> Acked-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-04netdevice.h net/core/dev.c: Convert netdev_<level> logging macros to functionsJoe Perches2-19/+79
Reduces an x86 defconfig text and data ~2k. text is smaller, data is larger. $ size vmlinux* text data bss dec hex filename 7198862 720112 1366288 9285262 8dae8e vmlinux 7205273 716016 1366288 9287577 8db799 vmlinux.device_h Uses %pV and struct va_format Format arguments are verified before printk Signed-off-by: Joe Perches <[email protected]> Acked-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-04device.h drivers/base/core.c Convert dev_<level> logging macros to functionsJoe Perches2-26/+150
Reduces an x86 defconfig text and data ~55k, .6% smaller. $ size vmlinux* text data bss dec hex filename 7205273 716016 1366288 9287577 8db799 vmlinux 7258890 719768 1366288 9344946 8e97b2 vmlinux.master Uses %pV and struct va_format Format arguments are verified before printk The dev_info macro is converted to _dev_info because there are existing uses of variables named dev_info in the kernel tree like drivers/net/pcmcia/pcnet_cs.c A dev_info macro is created to call _dev_info Signed-off-by: Joe Perches <[email protected]> Acked-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-04vsprintf: Recursive vsnprintf: Add "%pV", struct va_formatJoe Perches2-0/+14
Add the ability to print a format and va_list from a structure pointer Allows __dev_printk to be implemented as a single printk while minimizing string space duplication. %pV should not be used without some mechanism to verify the format and argument use ala __attribute__(format (printf(...))). Signed-off-by: Joe Perches <[email protected]> Acked-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-02Merge branch 'master' of ↵David S. Miller22-126/+262
git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
2010-07-02bridge: add per bridge device controls for invoking iptablesPatrick McHardy3-9/+97
Support more fine grained control of bridge netfilter iptables invocation by adding seperate brnf_call_*tables parameters for each device using the sysfs interface. Packets are passed to layer 3 netfilter when either the global parameter or the per bridge parameter is enabled. Acked-by: Stephen Hemminger <[email protected]> Acked-by: David S. Miller <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2010-07-01ixgbe: use NETIF_F_LROStanislaw Gruszka1-1/+1
Both ETH_FLAG_LRO and NETIF_F_LRO have the same value, but NETIF_F_LRO is intended to use with netdev->features. Signed-off-by: Stanislaw Gruszka <[email protected]> Acked-by: Don Skidmore <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01igb: Add commentGreg Rose1-0/+4
Add explanatory comment to avoid confusion when a pointer is set to the second word of an array instead of the customary cast of a pointer to the beginning of the array. Signed-off-by: Greg Rose <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01igb: correct link test not being run when link is downAlexander Duyck1-5/+3
The igb online link test was always reporting pass because instead of checking for if_running it was checking for netif_carrier_ok. This change corrects the test so that it is run if the interface is running instead of checking for netif carrier ok. Signed-off-by: Alexander Duyck <[email protected]> Tested-by: Emil Tantilov <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01igb: Fix Tx hangs seen when loading igb with max_vfs > 7.Emil Tantilov1-4/+1
Check the value of max_vfs at the time of assignment of vfs_allocated_count. The previous check in igb_probe_vfs was too late as by that time the rx/tx rings were initialized with the wrong offset. Signed-off-by: Emil Tantilov <[email protected]> Tested-by: Jeff Pieper <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01igb: Use only a single Tx queue in SR-IOV modeGreg Rose1-4/+4
The 82576 expects the second rx queue in any pool to receive L2 switch loop back packets sent from the second tx queue in another pool. The 82576 VF driver does not enable the second rx queue so if the PF driver sends packets destined to a VF from its second tx queue then the VF driver will never see them. In SR-IOV mode limit the number of tx queues used by the PF driver to one. This patch fixes a bug reported in which the PF cannot communciate with the VF and should be considered for 2.6.34 stable. CC: [email protected] Signed-off-by: Greg Rose <[email protected]> Tested-by: Jeff Pieper <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01igb: fix PHY config access on 82580Nick Nunley2-0/+10
82580 NICs can have up to 4 functions. This fixes phy accesses to use the correct locks for functions 2 and 3. Signed-off-by: Nicholas Nunley <[email protected]> Tested-by: Jeff Pieper <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01x86: Drop CONFIG_MCORE2 check around setting of NET_IP_ALIGNAlexander Duyck1-2/+0
This patch removes the CONFIG_MCORE2 check from around NET_IP_ALIGN. It is based on a suggestion from Andi Kleen. The assumption is that there are not any x86 cores where unaligned access is really slow, and this change would allow for a performance improvement to still exist on configurations that are not necessarily optimized for Core 2. Cc: Andi Kleen <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: "H. Peter Anvin" <[email protected]> Cc: [email protected] Signed-off-by: Alexander Duyck <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Acked-by: H. Peter Anvin <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01ll_temac: add error checking to DMA init pathDenis Kirjanov1-2/+23
Add error checking to DMA descriptor rings initialization code. Signed-off-by: Denis Kirjanov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01be2net: changes to properly provide phy detailsAjit Khaparde4-14/+104
be2net driver is currently not showing correct phy details in certain cases. This patch fixes it. Signed-off-by: Ajit Khaparde <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01ehea: Allocate stats buffer with GFP_KERNELBrian King1-1/+1
Since ehea_get_stats calls ehea_h_query_ehea_port, which can sleep, we can also sleep when allocating a page in this function. This fixes some memory allocation failure warnings seen under low memory conditions. Signed-off-by: Brian King <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-07-01Merge branch 'master' of ↵David S. Miller111-7660/+3633
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 Conflicts: drivers/net/wireless/libertas/host.h
2010-06-30x86: Align skb w/ start of cacheline on newer core 2/Xeon ArchAlexander Duyck1-0/+9
x86 architectures can handle unaligned accesses in hardware, and it has been shown that unaligned DMA accesses can be expensive on Nehalem architectures. As such we should overwrite NET_IP_ALIGN to resolve this issue. Cc: Thomas Gleixner <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: "H. Peter Anvin" <[email protected]> Cc: [email protected] Signed-off-by: Alexander Duyck <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Acked-by: H. Peter Anvin <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-06-30ixgbe: add 1g PHY support for 82599Don Skidmore5-4/+52
Add support for 1G SFP+ PHY's to 82599. Signed-off-by: Don Skidmore <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-06-30sfc: Add support for RX flow hash controlBen Hutchings5-10/+105
Allow ethtool to query the number of RX rings, the fields used in RX flow hashing and the hash indirection table. Allow ethtool to update the RX flow hash indirection table. Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-06-30ethtool: Add support for control of RX flow hash indirectionBen Hutchings2-0/+95
Many NICs use an indirection table to map an RX flow hash value to one of an arbitrary number of queues (not necessarily a power of 2). It can be useful to remove some queues from this indirection table so that they are only used for flows that are specifically filtered there. It may also be useful to weight the mapping to account for user processes with the same CPU-affinity as the RX interrupts. Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-06-30vmxnet3: Remove incorrect implementation of ethtool_ops::get_flags()Ben Hutchings1-7/+1
Only some netdev feature flags correspond directly to ethtool feature flags. ethtool_op_get_flags() does the right thing. Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: Bhavesh Davda <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-06-30netdev: Make ethtool_ops::set_flags() return -EINVAL for unsupported flagsBen Hutchings4-4/+4
The documented error code for attempts to set unsupported flags (or to clear flags that cannot be disabled) is EINVAL, not EOPNOTSUPP. Signed-off-by: Ben Hutchings <[email protected]> Acked-by: Eilon Greenstein <[email protected]> Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.