aboutsummaryrefslogtreecommitdiff
path: root/net/ipv4
AgeCommit message (Collapse)AuthorFilesLines
2008-10-08netfilter: xtables: move extension arguments into compound structure (1/6)Jan Engelhardt5-58/+36
The function signatures for Xtables extensions have grown over time. It involves a lot of typing/replication, and also a bit of stack space even if they are not used. Realize an NFWS2008 idea and pack them into structs. The skb remains outside of the struct so gcc can continue to apply its optimizations. This patch does this for match extensions' match functions. A few ambiguities have also been addressed. The "offset" parameter for example has been renamed to "fragoff" (there are so many different offsets already) and "protoff" to "thoff" (there is more than just one protocol here, so clarify). Signed-off-by: Jan Engelhardt <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: xtables: use "if" blocks in KconfigJan Engelhardt1-20/+16
Signed-off-by: Jan Engelhardt <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: xtables: sort extensions alphabetically in KconfigJan Engelhardt1-39/+39
Signed-off-by: Jan Engelhardt <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: xtables: do centralized checkentry call (1/2)Jan Engelhardt2-20/+13
It used to be that {ip,ip6,etc}_tables called extension->checkentry themselves, but this can be moved into the xtables core. Signed-off-by: Jan Engelhardt <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: split netfilter IPv4 defragmentation into a separate moduleKOVACS Krisztian4-53/+107
Netfilter connection tracking requires all IPv4 packets to be defragmented. Both the socket match and the TPROXY target depend on this functionality, so this patch separates the Netfilter IPv4 defrag hooks into a separate module. Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nat: PPTP NAT in netnsAlexey Dobriyan1-1/+2
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: fixup DNAT in netnsAlexey Dobriyan1-3/+3
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nat: per-netns bysource hashAlexey Dobriyan1-27/+45
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nat: per-netns NAT tableAlexey Dobriyan1-11/+29
Same story as with iptable_filter, iptables_raw tables. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nat: fix ipt_MASQUERADE in netnsAlexey Dobriyan1-4/+2
First, allow entry in notifier hook. Second, start conntrack cleanup in netns to which netdevice belongs. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns ↵Alexey Dobriyan2-4/+4
net.netfilter.nf_conntrack_log_invalid sysctl Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_checksum ↵Alexey Dobriyan2-2/+2
sysctl Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns /proc/net/stat/nf_conntrack, ↵Alexey Dobriyan1-5/+9
/proc/net/stat/ip_conntrack Show correct conntrack count, while I'm at it. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns statisticsAlexey Dobriyan1-2/+2
Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: pass conntrack to nf_conntrack_event_cache() ↵Alexey Dobriyan2-2/+2
not skb This is cleaner, we already know conntrack to which event is relevant. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns /proc/net/ip_conntrack, ↵Alexey Dobriyan1-19/+38
/proc/net/stat/ip_conntrack, /proc/net/ip_conntrack_expect Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: pass netns pointer to L4 protocol's ->error hookAlexey Dobriyan1-4/+4
Again, it's deducible from skb, but we're going to use it for nf_conntrack_checksum and statistics, so just pass it from upper layer. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: pass netns pointer to nf_conntrack_in()Alexey Dobriyan1-2/+2
It's deducible from skb->dev or skb->dst->dev, but we know netns at the moment of call, so pass it down and use for finding and creating conntracks. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns expectationsAlexey Dobriyan2-3/+5
Make per-netns a) expectation hash and b) expectations count. Expectations always belongs to netns to which it's master conntrack belong. This is natural and doesn't bloat expectation. Proc files and leaf users are stubbed to init_net, this is temporary. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns: fix {ip,6}_route_me_harder() in netnsAlexey Dobriyan1-3/+4
Take netns from skb->dst->dev. It should be safe because, they are called from LOCAL_OUT hook where dst is valid (though, I'm not exactly sure about IPVS and queueing packets to userspace). [Patrick: its safe everywhere since they already expect skb->dst to be set] Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns conntrack hashAlexey Dobriyan5-6/+7
* make per-netns conntrack hash Other solution is to add ->ct_net pointer to tuplehashes and still has one hash, I tried that it's ugly and requires more code deep down in protocol modules et al. * propagate netns pointer to where needed, e. g. to conntrack iterators. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns nf_conntrack: per-netns conntrack countAlexey Dobriyan2-2/+2
Sysctls and proc files are stubbed to init_net's one. This is temporary. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: netns: remove nf_*_net() wrappersAlexey Dobriyan4-13/+13
Now that dev_net() exists, the usefullness of them is even less. Also they're a big problem in resolving circular header dependencies necessary for NOTRACK-in-netns patch. See below. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: x_tables: use NFPROTO_* in extensionsJan Engelhardt16-51/+53
Signed-off-by: Jan Engelhardt <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: rename ipt_recent to xt_recentJan Engelhardt3-515/+0
Like with other modules (such as ipt_state), ipt_recent.h is changed to forward definitions to (IOW include) xt_recent.h, and xt_recent.c is changed to use the new constant names. Signed-off-by: Jan Engelhardt <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-08netfilter: Use unsigned types for hooknum and pf varsJan Engelhardt3-4/+4
and (try to) consistently use u_int8_t for the L3 family. Signed-off-by: Jan Engelhardt <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2008-10-07tcp: Fix tcp_hybla zero congestion window growth with small rho and large cwnd.Daniele Lacamera1-1/+5
Because of rounding, in certain conditions, i.e. when in congestion avoidance state rho is smaller than 1/128 of the current cwnd, TCP Hybla congestion control starves and the cwnd is kept constant forever. This patch forces an increment by one segment after #send_cwnd calls without increments(newreno behavior). Signed-off-by: Daniele Lacamera <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07ipv4: add mc_count to in_device.Rami Rosen1-2/+5
This patch add mc_count to struct in_device and updates increment/decrement/initilaize of this field in IPv4 and in IPv6. - Also printing the vfs /proc entry (/proc/net/igmp) is adjusted to use the new mc_count. Signed-off-by: Rami Rosen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07tcp: Fix possible double-ack w/ user dmaAli Saidi1-1/+2
From: Ali Saidi <[email protected]> When TCP receive copy offload is enabled it's possible that tcp_rcv_established() will cause two acks to be sent for a single packet. In the case that a tcp_dma_early_copy() is successful, copied_early is set to true which causes tcp_cleanup_rbuf() to be called early which can send an ack. Further along in tcp_rcv_established(), __tcp_ack_snd_check() is called and will schedule a delayed ACK. If no packets are processed before the delayed ack timer expires the packet will be acked twice. Signed-off-by: David S. Miller <[email protected]>
2008-10-07netns: make udpv6 mib per/namespaceDenis V. Lunev1-3/+0
Signed-off-by: Denis V. Lunev <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07tcp: cleanup messy initializerIlpo Järvinen1-2/+2
I'm quite sure that if I give this function in its old format for you to inspect, you start to wonder what is the type of demanded or if it's a global variable. Signed-off-by: Ilpo Järvinen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07tcp: kill pointless urg_modeIlpo Järvinen4-14/+20
It all started from me noticing that this urgent check in tcp_clean_rtx_queue is unnecessarily inside the loop. Then I took a longer look to it and found out that the users of urg_mode can trivially do without, well almost, there was one gotcha. Bonus: those funny people who use urg with >= 2^31 write_seq - snd_una could now rejoice too (that's the only purpose for the between being there, otherwise a simple compare would have done the thing). Not that I assume that the rest of the tcp code happily lives with such mind-boggling numbers :-). Alas, it turned out to be impossible to set wmem to such numbers anyway, yes I really tried a big sendfile after setting some wmem but nothing happened :-). ...Tcp_wmem is int and so is sk_sndbuf... So I hacked a bit variable to long and found out that it seems to work... :-) Signed-off-by: Ilpo Järvinen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07net: wrap sk->sk_backlog_rcv()Peter Zijlstra2-2/+2
Wrap calling sk->sk_backlog_rcv() in a function. This will allow extending the generic sk_backlog_rcv behaviour. Signed-off-by: Peter Zijlstra <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07inet: Don't lookup the socket if there's a socket attached to the skbKOVACS Krisztian1-3/+7
Use the socket cached in the skb if it's present. Signed-off-by: KOVACS Krisztian <[email protected]> Acked-by: Arnaldo Carvalho de Melo <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07inet: Add udplib_lookup_skb() helpersKOVACS Krisztian1-2/+12
To be able to use the cached socket reference in the skb during input processing we add a new set of lookup functions that receive the skb on their argument list. Signed-off-by: KOVACS Krisztian <[email protected]> Acked-by: Arnaldo Carvalho de Melo <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07inet_hashtables: Add inet_lookup_skb helpersArnaldo Carvalho de Melo1-2/+1
To be able to use the cached socket reference in the skb during input processing we add a new set of lookup functions that receive the skb on their argument list. Signed-off-by: Arnaldo Carvalho de Melo <[email protected]> Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-07Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6 into ↵Simon Horman14-51/+106
lvs-next-2.6
2008-10-07IPVS: Move IPVS to net/netfilter/ipvsJulius Volz26-13979/+0
Since IPVS now has partial IPv6 support, this patch moves IPVS from net/ipv4/ipvs to net/netfilter/ipvs. It's a result of: $ git mv net/ipv4/ipvs net/netfilter and adapting the relevant Kconfigs/Makefiles to the new path. Signed-off-by: Julius Volz <[email protected]> Signed-off-by: Simon Horman <[email protected]>
2008-10-06tcp: Respect SO_RCVLOWAT in tcp_poll().David S. Miller1-4/+8
Based upon a report by Vito Caputo. Signed-off-by: David S. Miller <[email protected]>
2008-10-01udp: Export UDP socket lookup functionKOVACS Krisztian1-0/+7
The iptables tproxy code has to be able to do UDP socket hash lookups, so we have to provide an exported lookup function for this purpose. Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-01tcp: Port redirection support for TCPKOVACS Krisztian3-1/+4
Current TCP code relies on the local port of the listening socket being the same as the destination address of the incoming connection. Port redirection used by many transparent proxying techniques obviously breaks this, so we have to store the original destination port address. This patch extends struct inet_request_sock and stores the incoming destination port value there. It also modifies the handshake code to use that value as the source port when sending reply packets. Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-01ipv4: Make Netfilter's ip_route_me_harder() non-local address compatibleKOVACS Krisztian4-1/+9
Netfilter's ip_route_me_harder() tries to re-route packets either generated or re-routed by Netfilter. This patch changes ip_route_me_harder() to handle packets from non-locally-bound sockets with IP_TRANSPARENT set as local and to set the appropriate flowi flags when re-doing the routing lookup. Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-01tcp: Handle TCP SYN+ACK/ACK/RST transparencyKOVACS Krisztian1-3/+9
The TCP stack sends out SYN+ACK/ACK/RST reply packets in response to incoming packets. The non-local source address check on output bites us again, as replies for transparently redirected traffic won't have a chance to leave the node. This patch selectively sets the FLOWI_FLAG_ANYSRC flag when doing the route lookup for those replies. Transparent replies are enabled if the listening socket has the transparent socket flag set. Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-01ipv4: Make inet_sock.h independent of route.hKOVACS Krisztian1-0/+1
inet_iif() in inet_sock.h requires route.h. Since users of inet_iif() usually require other route.h functionality anyway this patch moves inet_iif() to route.h. Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-01ipv4: Allow binding to non-local addresses if IP_TRANSPARENT is setTóth László Attila1-1/+1
Setting IP_TRANSPARENT is not really useful without allowing non-local binds for the socket. To make user-space code simpler we allow these binds even if IP_TRANSPARENT is set but IP_FREEBIND is not. Signed-off-by: Tóth László Attila <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-01ipv4: Implement IP_TRANSPARENT socket optionKOVACS Krisztian2-1/+15
This patch introduces the IP_TRANSPARENT socket option: enabling that will make the IPv4 routing omit the non-local source address check on output. Setting IP_TRANSPARENT requires NET_ADMIN capability. Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-01ipv4: Loosen source address check on IPv4 outputJulian Anastasov1-7/+13
ip_route_output() contains a check to make sure that no flows with non-local source IP addresses are routed. This obviously makes using such addresses impossible. This patch introduces a flowi flag which makes omitting this check possible. The new flag provides a way of handling transparent and non-transparent connections differently. Signed-off-by: Julian Anastasov <[email protected]> Signed-off-by: KOVACS Krisztian <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-10-01Merge branch 'master' of ↵David S. Miller2-30/+34
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/wireless/ath9k/core.c drivers/net/wireless/ath9k/main.c net/core/dev.c
2008-10-01tcp: Fix NULL dereference in tcp_4_send_ack()Vitaliy Gusev1-1/+1
Fix NULL dereference in tcp_4_send_ack(). As skb->dev is reset to NULL in tcp_v4_rcv() thus OOPS occurs: BUG: unable to handle kernel NULL pointer dereference at 00000000000004d0 IP: [<ffffffff80498503>] tcp_v4_send_ack+0x203/0x250 Stack: ffff810005dbb000 ffff810015c8acc0 e77b2c6e5f861600 a01610802e90cb6d 0a08010100000000 88afffff88afffff 0000000080762be8 0000000115c872e8 0004122000000000 0000000000000001 ffffffff80762b88 0000000000000020 Call Trace: <IRQ> [<ffffffff80499c33>] tcp_v4_reqsk_send_ack+0x20/0x22 [<ffffffff8049bce5>] tcp_check_req+0x108/0x14c [<ffffffff8047aaf7>] ? rt_intern_hash+0x322/0x33c [<ffffffff80499846>] tcp_v4_do_rcv+0x399/0x4ec [<ffffffff8045ce4b>] ? skb_checksum+0x4f/0x272 [<ffffffff80485b74>] ? __inet_lookup_listener+0x14a/0x15c [<ffffffff8049babc>] tcp_v4_rcv+0x6a1/0x701 [<ffffffff8047e739>] ip_local_deliver_finish+0x157/0x24a [<ffffffff8047ec9a>] ip_local_deliver+0x72/0x7c [<ffffffff8047e5bd>] ip_rcv_finish+0x38d/0x3b2 [<ffffffff803d3548>] ? scsi_io_completion+0x19d/0x39e [<ffffffff8047ebe5>] ip_rcv+0x2a2/0x2e5 [<ffffffff80462faa>] netif_receive_skb+0x293/0x303 [<ffffffff80465a9b>] process_backlog+0x80/0xd0 [<ffffffff802630b4>] ? __rcu_process_callbacks+0x125/0x1b4 [<ffffffff8046560e>] net_rx_action+0xb9/0x17f [<ffffffff80234cc5>] __do_softirq+0xa3/0x164 [<ffffffff8020c52c>] call_softirq+0x1c/0x28 <EOI> [<ffffffff8020de1c>] do_softirq+0x34/0x72 [<ffffffff80234b8e>] local_bh_enable_ip+0x3f/0x50 [<ffffffff804d43ca>] _spin_unlock_bh+0x12/0x14 [<ffffffff804599cd>] release_sock+0xb8/0xc1 [<ffffffff804a6f9a>] inet_stream_connect+0x146/0x25c [<ffffffff80243078>] ? autoremove_wake_function+0x0/0x38 [<ffffffff8045751f>] sys_connect+0x68/0x8e [<ffffffff80291818>] ? fd_install+0x5f/0x68 [<ffffffff80457784>] ? sock_map_fd+0x55/0x62 [<ffffffff8020b39b>] system_call_after_swapgs+0x7b/0x80 Code: 41 10 11 d0 83 d0 00 4d 85 ed 89 45 c0 c7 45 c4 08 00 00 00 74 07 41 8b 45 04 89 45 c8 48 8b 43 20 8b 4d b8 48 8d 55 b0 48 89 de <48> 8b 80 d0 04 00 00 48 8b b8 60 01 00 00 e8 20 ae fe ff 65 48 RIP [<ffffffff80498503>] tcp_v4_send_ack+0x203/0x250 RSP <ffffffff80762b78> CR2: 00000000000004d0 Signed-off-by: Vitaliy Gusev <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2008-09-23tcp: Fix queue traversal in tcp_use_frto().David S. Miller1-0/+2
We must check tcp_skb_is_last() before doing a tcp_write_queue_next(). Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.