aboutsummaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)AuthorFilesLines
2013-10-01ip6tnl: allow to use rtnl ops on fb tunnelNicolas Dichtel1-2/+1
rtnl ops where introduced by c075b13098b3 ("ip6tnl: advertise tunnel param via rtnl"), but I forget to assign rtnl ops to fb tunnels. Now that it is done, we must remove the explicit call to unregister_netdevice_queue(), because the fallback tunnel is added to the queue in ip6_tnl_destroy_tunnels() when checking rtnl_link_ops of all netdevices (this is valid since commit 0bd8762824e7 ("ip6tnl: add x-netns support")). Signed-off-by: Nicolas Dichtel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-10-01sit: allow to use rtnl ops on fb tunnelNicolas Dichtel1-1/+1
rtnl ops where introduced by ba3e3f50a0e5 ("sit: advertise tunnel param via rtnl"), but I forget to assign rtnl ops to fb tunnels. Now that it is done, we must remove the explicit call to unregister_netdevice_queue(), because the fallback tunnel is added to the queue in sit_destroy_tunnels() when checking rtnl_link_ops of all netdevices (this is valid since commit 5e6700b3bf98 ("sit: add support of x-netns")). Signed-off-by: Nicolas Dichtel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-10-01ip_tunnel: Remove double unregister of the fallback deviceSteffen Klassert1-2/+0
When queueing the netdevices for removal, we queue the fallback device twice in ip_tunnel_destroy(). The first time when we queue all netdevices in the namespace and then again explicitly. Fix this by removing the explicit queueing of the fallback device. Bug was introduced when network namespace support was added with commit 6c742e714d8 ("ipip: add x-netns support"). Cc: Nicolas Dichtel <[email protected]> Signed-off-by: Steffen Klassert <[email protected]> Acked-by: Nicolas Dichtel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-10-01ip_tunnel_core: Change __skb_push back to skb_pushSteffen Klassert1-1/+1
Git commit 0e6fbc5b ("ip_tunnels: extend iptunnel_xmit()") moved the IP header installation to iptunnel_xmit() and changed skb_push() to __skb_push(). This makes possible bugs hard to track down, so change it back to skb_push(). Cc: Pravin Shelar <[email protected]> Signed-off-by: Steffen Klassert <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-10-01ip_tunnel: Add fallback tunnels to the hash listsSteffen Klassert1-1/+3
Currently we can not update the tunnel parameters of the fallback tunnels because we don't find them in the hash lists. Fix this by adding them on initialization. Bug was introduced with commit c544193214 ("GRE: Refactor GRE tunneling code.") Cc: Pravin Shelar <[email protected]> Signed-off-by: Steffen Klassert <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-10-01ip_tunnel: Fix a memory corruption in ip_tunnel_xmitSteffen Klassert1-6/+6
We might extend the used aera of a skb beyond the total headroom when we install the ipip header. Fix this by calling skb_cow_head() unconditionally. Bug was introduced with commit c544193214 ("GRE: Refactor GRE tunneling code.") Cc: Pravin Shelar <[email protected]> Signed-off-by: Steffen Klassert <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-10-01Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfDavid S. Miller11-151/+139
Pablo Neira Ayuso says: ==================== The following patchset contains Netfilter/IPVS fixes for your net tree, they are: * Fix BUG_ON splat due to malformed TCP packets seen by synproxy, from Patrick McHardy. * Fix possible weight overflow in lblc and lblcr schedulers due to 32-bits arithmetics, from Simon Kirby. * Fix possible memory access race in the lblc and lblcr schedulers, introduced when it was converted to use RCU, two patches from Julian Anastasov. * Fix hard dependency on CPU 0 when reading per-cpu stats in the rate estimator, from Julian Anastasov. * Fix race that may lead to object use after release, when invoking ipvsadm -C && ipvsadm -R, introduced when adding RCU, from Julian Anastasov. ==================== Signed-off-by: David S. Miller <[email protected]>
2013-10-01regulatory: enable channels 52-64 and 100-144 for world roamingJohannes Berg1-2/+12
If allowed in a country, these channels typically require DFS so mark them as such. Channel 144 is a bit special, it's coming into use now to allow more VHT 80 channels, but world roaming with passive scanning is acceptable anyway. It seems fairly unlikely that it'll be used as the control channel for a VHT AP, but it needs to be present to allow a full VHT connection to an AP that uses it as one of the secondary channels. Also enable VHT 160 on these channels, and also for channels 36-48 to be able to use VHT 160 there. Signed-off-by: Johannes Berg <[email protected]>
2013-10-01netfilter: cttimeout: allow to set/get default protocol timeoutsPablo Neira Ayuso1-8/+153
Default timeouts are currently set via proc/sysctl interface, the typical pattern is a file name like: /proc/sys/net/netfilter/nf_conntrack_PROTOCOL_timeout_STATE This results in one entry per default protocol state timeout. This patch simplifies this by allowing to set default protocol timeouts via cttimeout netlink interface. This should allow us to get rid of the existing proc/sysctl code in the midterm. Signed-off-by: Pablo Neira Ayuso <[email protected]>
2013-10-01nl80211: allow CAC only if no operation is going onSimon Wunderlich1-0/+3
A CAC should fail if it is triggered while the interface is already running. Signed-off-by: Simon Wunderlich <[email protected]> Signed-off-by: Mathias Kretschmer <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2013-10-01netfilter: nf_ct_sip: consolidate NAT hook functions[email protected]2-113/+49
There are currently seven different NAT hooks used in both nf_conntrack_sip and nf_nat_sip, each of the hooks is exported in nf_conntrack_sip, then set from the nf_nat_sip NAT helper. And because each of them is exported there is quite some overhead introduced due of this. By introducing nf_nat_sip_hooks I am able to reduce both text/data somewhat. For nf_conntrack_sip e. g. I get text data bss dec old 15243 5256 32 20531 new 15010 5192 32 20234 Signed-off-by: Holger Eitzenberger <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2013-10-01netfilter: nfnetlink_log: use proper net to allocate skbGao feng1-5/+6
Use proper net struct to allocate skb, otherwise netlink mmap will be of no effect. Signed-off-by: Gao feng <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2013-10-01mac80211: improve default WMM parameter settingFred Zhou1-13/+14
Move the default setting for WMM parameters outside the for loop to avoid redundant assignment multiple times. Signed-off-by: Fred Zhou <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2013-10-01mac80211: support reporting A-MSDU subframes individuallyMichal Kazior1-1/+2
Some devices may not be able to report A-MSDUs in single buffers. Drivers for such devices were forced to re-assemble A-MSDUs which would then be eventually disassembled by mac80211. This could lead to CPU cache thrashing and poor performance. Since A-MSDU has a single sequence number all subframes share it. This was in conflict with retransmission/duplication recovery (IEEE802.11-2012: 9.3.2.10). Patch introduces a new flag that is meant to be set for all individually reported A-MSDU subframes except the last one. This ensures the last_seq_ctrl is updated after the last subframe is processed. If an A-MSDU is actually a duplicate transmission all reported subframes will be properly discarded. Signed-off-by: Michal Kazior <[email protected]> [johannes: add braces that were missing even before] Signed-off-by: Johannes Berg <[email protected]>
2013-10-01mac80211: use exact-size allocation for authentication frameFred Zhou1-2/+2
The authentication frame has a fixied size of 30 bytes (including header, algo num, trans seq num, and status) followed by a variable challenge text. Allocate using exact size, instead of over-allocation by sizeof(ieee80211_mgmt). Signed-off-by: Fred Zhou <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2013-10-01netfilter: nfnetlink_queue: use proper net namespace to allocate skbGao feng1-3/+3
Use proper net struct to allocate skb, otherwise netlink mmap will have no effect. Signed-off-by: Gao feng <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2013-10-01cfg80211: parse dfs region for internal regdb optionJanusz Dziedzic1-0/+6
Add support for parsing and setting the dfs region (ETSI, FCC, JP) when the internal regulatory database is used. Before this the DFS region was being ignored even if present on the used db.txt Signed-off-by: Janusz Dziedzic <[email protected]> Reviewed-by: Luis R. Rodriguez <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2013-10-01mac80211: add explicit IBSS driver operationsJohannes Berg3-2/+82
This can be useful for drivers if they have any failure cases when joining an IBSS. Also move setting the queue parameters to before this new call, in case the new driver op needs them already. Signed-off-by: Johannes Berg <[email protected]>
2013-10-01ieee80211: fix vht cap definitionsEliad Peller1-2/+2
VHT_CAP_BEAMFORMER_ANTENNAS cap is actually defined in the draft as VHT_CAP_BEAMFORMEE_STS_MAX, and its size is 3 bits long. VHT_CAP_SOUNDING_DIMENSIONS is also 3 bits long. Fix the definitions and change the cap masking accordingly. Signed-off-by: Eliad Peller <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2013-10-01mac80211: fix some snprintf misusesEliad Peller3-50/+55
In some debugfs related functions snprintf was used while scnprintf should have been used instead. (blindly adding the return value of snprintf and supplying it to the next snprintf might result in buffer overflow when the input is too big) Signed-off-by: Eliad Peller <[email protected]> Signed-off-by: Johannes Berg <[email protected]>
2013-10-01xfrm: Simplify SA looking up when using wildcard sourceFan Du1-1/+1
__xfrm4/6_state_addr_check is a four steps check, all we need to do is checking whether the destination address match when looking SA using wildcard source address. Passing saddr from flow is worst option, as the checking needs to reach the fourth step while actually only one time checking will do the work. So, simplify this process by only checking destination address when using wildcard source address for looking up SAs. Signed-off-by: Fan Du <[email protected]> Signed-off-by: Steffen Klassert <[email protected]>
2013-10-01xfrm: Force SA to be lookup again if SA in acquire stateFan Du1-1/+1
If SA is in the process of acquiring, which indicates this SA is more promising and precise than the fall back option, i.e. using wild card source address for searching less suitable SA. So, here bail out, and try again. Signed-off-by: Fan Du <[email protected]> Signed-off-by: Steffen Klassert <[email protected]>
2013-09-30ipv6 mcast: use in6_dev_put in timer handlers instead of __in6_dev_putSalam Noureddine1-3/+3
It is possible for the timer handlers to run after the call to ipv6_mc_down so use in6_dev_put instead of __in6_dev_put in the handler function in order to do proper cleanup when the refcnt reaches 0. Otherwise, the refcnt can reach zero without the inet6_dev being destroyed and we end up leaking a reference to the net_device and see messages like the following, unregister_netdevice: waiting for eth0 to become free. Usage count = 1 Tested on linux-3.4.43. Signed-off-by: Salam Noureddine <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30ipv4 igmp: use in_dev_put in timer handlers instead of __in_dev_putSalam Noureddine1-2/+2
It is possible for the timer handlers to run after the call to ip_mc_down so use in_dev_put instead of __in_dev_put in the handler function in order to do proper cleanup when the refcnt reaches 0. Otherwise, the refcnt can reach zero without the in_device being destroyed and we end up leaking a reference to the net_device and see messages like the following, unregister_netdevice: waiting for eth0 to become free. Usage count = 1 Tested on linux-3.4.43. Signed-off-by: Salam Noureddine <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30ipv6: gre: correct calculation of max_headroomHannes Frederic Sowa1-2/+2
gre_hlen already accounts for sizeof(struct ipv6_hdr) + gre header, so initialize max_headroom to zero. Otherwise the if (encap_limit >= 0) { max_headroom += 8; mtu -= 8; } increments an uninitialized variable before max_headroom was reset. Found with coverity: 728539 Cc: Dmitry Kozlov <[email protected]> Signed-off-by: Hannes Frederic Sowa <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30net ipv4: Convert ipv4.ip_local_port_range to be per netns v3Eric W. Biederman7-38/+46
- Move sysctl_local_ports from a global variable into struct netns_ipv4. - Modify inet_get_local_port_range to take a struct net, and update all of the callers. - Move the initialization of sysctl_local_ports into sysctl_net_ipv4.c:ipv4_sysctl_init_net from inet_connection_sock.c v2: - Ensure indentation used tabs - Fixed ip.h so it applies cleanly to todays net-next v3: - Compile fixes of strange callers of inet_get_local_port_range. This patch now successfully passes an allmodconfig build. Removed manual inlining of inet_get_local_port_range in ipv4_local_port_range Originally-by: Samya <[email protected]> Acked-by: Nicolas Dichtel <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30ethernet: use likely() for common Ethernet encapstephen hemminger1-4/+5
Mark code path's likely/unlikely based on most common usage. * Very few devices use dsa tags. * Most traffic is Ethernet (not 802.2) * No sane person uses trailer type or Novell encapsulation Signed-off-by: Stephen Hemminger <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30ethernet: cleanup eth_type_transstephen hemminger1-14/+3
Remove old legacy comment and weird if condition. The comment has outlived it's stay and is throwback to some early net code (before my time). Maybe Dave remembers what it meant. Signed-off-by: Stephen Hemminger <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30tcp: TSQ can use a dynamic limitEric Dumazet1-6/+11
When TCP Small Queues was added, we used a sysctl to limit amount of packets queues on Qdisc/device queues for a given TCP flow. Problem is this limit is either too big for low rates, or too small for high rates. Now TCP stack has rate estimation in sk->sk_pacing_rate, and TSO auto sizing, it can better control number of packets in Qdisc/device queues. New limit is two packets or at least 1 to 2 ms worth of packets. Low rates flows benefit from this patch by having even smaller number of packets in queues, allowing for faster recovery, better RTT estimations. High rates flows benefit from this patch by allowing more than 2 packets in flight as we had reports this was a limiting factor to reach line rate. [ In particular if TX completion is delayed because of coalescing parameters ] Example for a single flow on 10Gbp link controlled by FQ/pacing 14 packets in flight instead of 2 $ tc -s -d qd qdisc fq 8001: dev eth0 root refcnt 32 limit 10000p flow_limit 100p buckets 1024 quantum 3028 initial_quantum 15140 Sent 1168459366606 bytes 771822841 pkt (dropped 0, overlimits 0 requeues 6822476) rate 9346Mbit 771713pps backlog 953820b 14p requeues 6822476 2047 flow, 2046 inactive, 1 throttled, delay 15673 ns 2372 gc, 0 highprio, 0 retrans, 9739249 throttled, 0 flows_plimit Note that sk_pacing_rate is currently set to twice the actual rate, but this might be refined in the future when a flow is in congestion avoidance. Additional change : skb->destructor should be set to tcp_wfree(). A future patch (for linux 3.13+) might remove tcp_limit_output_bytes Signed-off-by: Eric Dumazet <[email protected]> Cc: Wei Liu <[email protected]> Cc: Cong Wang <[email protected]> Cc: Yuchung Cheng <[email protected]> Cc: Neal Cardwell <[email protected]> Acked-by: Neal Cardwell <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30ipv6: Not need to set fl6.flowi6_flags as zeroLi RongQing1-3/+0
setting fl6.flowi6_flags as zero after memset is redundant, Remove it. Signed-off-by: Li RongQing <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30Merge branch 'for-john' of ↵John W. Linville5-14/+22
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
2013-09-30pkt_sched: fq: qdisc dismantle fixesEric Dumazet1-20/+37
fq_reset() should drops all packets in queue, including throttled flows. This patch moves code from fq_destroy() to fq_reset() to do the cleaning. fq_change() must stop calling fq_dequeue() if all remaining packets are from throttled flows. Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30qdisc: basic classifier - remove unnecessary initializationstephen hemminger1-1/+1
err is set once, then first code resets it. err = tcf_exts_validate(...) Signed-off-by: Stephen Hemminger <[email protected]> Acked-by: Jamal Hadi Salim <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30qdisc: meta return ENOMEM on alloc failurestephen hemminger1-1/+3
Rather than returning earlier value (EINVAL), return ENOMEM if kzalloc fails. Found while reviewing to find another EINVAL condition. Signed-off-by: Stephen Hemminger <[email protected]> Acked-by: Thomas Graf <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-09-30netfilter: ipset: Add hash:net,port,net module to kernel.Oliver Smith3-0/+598
This adds a new set that provides similar functionality to ip,port,net but permits arbitrary size subnets for both the first and last parameter. Signed-off-by: Oliver Smith <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfiler: ipset: Add net namespace for ipsetVitaly Lavrov8-141/+236
This patch adds netns support for ipset. Major changes were made in ip_set_core.c and ip_set.h. Global variables are moved to per net namespace. Added initialization code and the destruction of the network namespace ipset subsystem. In the prototypes of public functions ip_set_* added parameter "struct net*". The remaining corrections related to the change prototypes of public functions ip_set_*. The patch for git://git.netfilter.org/ipset.git commit 6a4ec96c0b8caac5c35474e40e319704d92ca347 Signed-off-by: Vitaly Lavrov <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Use a common function at listing the extensionsJozsef Kadlecsik4-50/+12
Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: For set:list types, replaced elements must be zeroed outJozsef Kadlecsik1-1/+3
The new extensions require zero initialization for the new element to be added into a slot from where another element was pushed away. Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Fix hash resizing with commentsJozsef Kadlecsik1-5/+5
The destroy function must take into account that resizing doesn't create new extensions so those cannot be destroyed at resize. Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Support comments in hash-type ipsets.Oliver Smith9-13/+30
This provides kernel support for creating ipsets with comment support. This does incur a penalty to flushing/destroying an ipset since all entries are walked in order to free the allocated strings, this penalty is of course less expensive than the operation of listing an ipset to userspace, so for general-purpose usage the overall impact is expected to be little to none. Signed-off-by: Oliver Smith <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Support comments in the list-type ipset.Oliver Smith1-6/+12
This provides kernel support for creating list ipsets with the comment annotation extension. Signed-off-by: Oliver Smith <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Support comments in bitmap-type ipsets.Oliver Smith4-9/+17
This provides kernel support for creating bitmap ipsets with comment support. As is the case for hashes, this incurs a penalty when flushing or destroying the entire ipset as the entries must first be walked in order to free the comment strings. This penalty is of course far less than the cost of listing an ipset to userspace. Any set created without support for comments will be flushed/destroyed as before. Signed-off-by: Oliver Smith <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Support comments for ipset entries in the core.Oliver Smith1-0/+14
This adds the core support for having comments on ipset entries. The comments are stored as standard null-terminated strings in dynamically allocated memory after being passed to the kernel. As a result of this, code has been added to the generic destroy function to iterate all extensions and call that extension's destroy task if the set has that extension activated, and if such a task is defined. Signed-off-by: Oliver Smith <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Add hash:net,net module to kernel.Oliver Smith4-9/+541
This adds a new set that provides the ability to configure pairs of subnets. A small amount of additional handling code has been added to the generic hash header file - this code is conditionally activated by a preprocessor definition. Signed-off-by: Oliver Smith <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Kconfig: ipset needs NETFILTER_NETLINKJozsef Kadlecsik1-1/+1
Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: list:set: make sure all elements are checked by the gcJozsef Kadlecsik1-2/+5
When an element timed out, the next one was skipped by the garbage collector, fixed. Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Support extensions which need a per data destroy functionJozsef Kadlecsik3-38/+90
Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Generalize extensions supportJozsef Kadlecsik13-749/+105
Get rid of the structure based extensions and introduce a blob for the extensions. Thus we can support more extension types easily. Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Move extension data to set structureJozsef Kadlecsik13-278/+244
Default timeout and extension offsets are moved to struct set, because all set types supports all extensions and it makes possible to generalize extension support. Signed-off-by: Jozsef Kadlecsik <[email protected]>
2013-09-30netfilter: ipset: Rename extension offset ids to extension idsJozsef Kadlecsik6-35/+35
Signed-off-by: Jozsef Kadlecsik <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.