aboutsummaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)AuthorFilesLines
2013-01-21ndisc: Make ndisc_fill_xxx_option() for sk_buff.YOSHIFUJI Hideaki / 吉藤英明1-18/+15
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Calculate message body length and option length separately.YOSHIFUJI Hideaki / 吉藤英明1-9/+11
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Reset skb->trasport_headner inside ndisc_alloc_send_skb().YOSHIFUJI Hideaki / 吉藤英明1-2/+1
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Defer building IPv6 header.YOSHIFUJI Hideaki / 吉藤英明1-11/+11
Build ICMPv6 message first and make buffer management easier; we can use skb->len when filling checksum in ICMPv6 header, and then build IP header with length field. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Remove dev argument for ndisc_send_skb().YOSHIFUJI Hideaki / 吉藤英明1-5/+5
Since we have skb->dev, use it. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Set skb->dev and skb->protocol inside ndisc_alloc_skb().YOSHIFUJI Hideaki / 吉藤英明1-6/+6
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Simplify arguments for ip6_nd_hdr().YOSHIFUJI Hideaki / 吉藤英明1-8/+7
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ipv6: Unshare ip6_nd_hdr() and change return type to void.YOSHIFUJI Hideaki / 吉藤英明3-35/+52
- move ip6_nd_hdr() to its users' source files. In net/ipv6/mcast.c, it will be called ip6_mc_hdr(). - make return type to void since this function never fails. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Introduce ndisc_alloc_skb() helper.YOSHIFUJI Hideaki / 吉藤英明1-25/+27
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Introduce ndisc_fill_redirect_hdr_option().YOSHIFUJI Hideaki / 吉藤英明1-6/+15
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Use skb_linearize() instead of pskb_may_pull(skb, skb->len).YOSHIFUJI Hideaki / 吉藤英明1-1/+1
Suggested by Eric Dumazet <edumazet@google.com>. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Move ndisc_opt_addr_space() to include/net/ndisc.h.YOSHIFUJI Hideaki / 吉藤英明1-6/+1
This also makes ndisc_opt_addr_data() and ndisc_fill_addr_option() use ndisc_opt_addr_space(). Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21ndisc: Reduce number of arguments for ndisc_fill_addr_option().YOSHIFUJI Hideaki / 吉藤英明1-7/+6
Add pointer to struct net_device (dev) and remove data_len (= dev->addr_len) and addr_type (= dev->type). Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-21netfilter: x_tables: add xt_bpf matchWillem de Bruijn3-0/+83
Support arbitrary linux socket filter (BPF) programs as x_tables match rules. This allows for very expressive filters, and on platforms with BPF JIT appears competitive with traditional hardcoded iptables rules using the u32 match. The size of the filter has been artificially limited to 64 instructions maximum to avoid bloating the size of each rule using this new match. Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-20ndisc: Make several arguments for ndisc_send_na() boolean.YOSHIFUJI Hideaki / 吉藤英明1-5/+5
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-20ipv6: Introduce ipv6_addr_is_solict_mult() to check Solicited Node Multicast ↵YOSHIFUJI Hideaki / 吉藤英明1-5/+1
Addresses. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-19batman-adv: Start new development cycleAntonio Quartulli1-1/+1
Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: update copyright yearsAntonio Quartulli42-42/+42
Signed-off-by: Antonio Quartulli <ordex@autistici.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
2013-01-19batman-adv: postpone sysfs removal when unregisteringSimon Wunderlich3-5/+57
When processing the unregister notify for a hard interface, removing the sysfs files may lead to a circular deadlock (rtnl mutex <-> s_active). To overcome this problem, postpone the sysfs removal in a worker. Reported-by: Sasha Levin <sasha.levin@oracle.com> Reported-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: rename random32() to prandom_u32()Akinobu Mita1-2/+2
Use more preferable function name which implies using a pseudo-random number generator. Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Acked-by: Antonio Quartulli <ordex@autistici.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Cc: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Cc: Antonio Quartulli <ordex@autistici.org> Cc: b.a.t.m.a.n@lists.open-mesh.org Cc: "David S. Miller" <davem@davemloft.net> Cc: netdev@vger.kernel.org Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: kernel doc for types.hMarek Lindner1-66/+395
Thanks to Sven Eckelmann and Simon Wunderlich for their support. Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: rename batadv_claim struct to make clear it is used by blaMarek Lindner2-21/+22
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: rename batadv_backbone_gw struct to make clear it is used by blaMarek Lindner2-27/+29
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: rename batadv_recvlist_node struct to make clear it is used by visMarek Lindner2-4/+4
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: rename batadv_if_list_entry struct to make clear it is used by visMarek Lindner2-13/+14
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: group tt type definitions togetherMarek Lindner1-25/+25
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: mark debug_log struct as bat_priv only structMarek Lindner2-18/+20
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: align kernel doc properlyMarek Lindner1-13/+12
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-01-19batman-adv: a delayed_work has to be initialised onceAntonio Quartulli6-44/+32
A delayed_work struct does not need to be initialized each every time before being enqueued. Therefore the INIT_DELAYED_WORK() macro should be used during the initialization process only. Signed-off-by: Antonio Quartulli <ordex@autistici.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
2013-01-18ipv6: remove unneeded check to pskb_may_pull in ipip6_rcvHannes Frederic Sowa1-6/+1
This is already checked by the caller (tunnel64_rcv) and brings ipip6_rcv in line with ipip_rcv. Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-18ndisc: Check NS message length before access.YOSHIFUJI Hideaki / 吉藤英明1-0/+5
Check message length before accessing "target" field, as we do for other types. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-18ipv6: Remove unused neigh argument for icmp6_dst_alloc() and its callers.YOSHIFUJI Hideaki / 吉藤英明3-13/+7
Because of rt->n removal, we do not need neigh argument any more. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-186lowpan: Handle uncompressed IPv6 packets over 6LoWPANAlan Ott1-9/+32
Handle the reception of uncompressed packets (dispatch type = IPv6). Signed-off-by: Alan Ott <alan@signal11.us> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-186lowpan: Refactor packet delivery into a functionAlan Ott1-14/+24
Refactor the handing of the skb's to the individual lowpan devices into a function. Signed-off-by: Alan Ott <alan@signal11.us> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ipv6: Complete neighbour entry removal from dst_entry.YOSHIFUJI Hideaki / 吉藤英明2-84/+1
CC: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ipv6: Do not depend on rt->n in ip6_finish_output2().YOSHIFUJI Hideaki / 吉藤英明1-5/+13
If neigh is not found, create new one. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ipv6: Do not depend on rt->n in ip6_dst_lookup_tail().YOSHIFUJI Hideaki / 吉藤英明1-2/+6
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ipv6: Do not depend on rt->n in rt6_probe().YOSHIFUJI Hideaki / 吉藤英明1-10/+16
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ipv6: Do not depend on rt->n in rt6_check_neigh().YOSHIFUJI Hideaki / 吉藤英明1-5/+9
CC: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ipv6: Do not depend on rt->n in ip6_pol_route().YOSHIFUJI Hideaki / 吉藤英明1-1/+1
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ipv6 route: Dump gateway based on RTF_GATEWAY flag and rt->rt6i_gateway.YOSHIFUJI Hideaki / 吉藤英明1-8/+4
Do not depend on rt->n. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ndisc: Remove tbl argument for __ipv6_neigh_lookup().YOSHIFUJI Hideaki / 吉藤英明1-2/+2
We can refer to nd_tbl directly. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17ndisc: Update neigh->updated with write lock.YOSHIFUJI Hideaki / 吉藤英明1-4/+8
neigh->nud_state and neigh->updated are under protection of neigh->lock. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-18netfilter: nf_ct_snmp: add include filestephen hemminger1-0/+1
Prototype for nf_nat_snmp_hook is in nf_conntrack_snmp.h therefore it should be included to get type checking. Found by sparse. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-18netfilter: ctnetlink: allow userspace to modify labelsFlorian Westphal2-0/+87
Add the ability to set/clear labels assigned to a conntrack via ctnetlink. To allow userspace to only alter specific bits, Pablo suggested to add a new CTA_LABELS_MASK attribute: The new set of active labels is then determined via active = (active & ~mask) ^ changeset i.e., the mask selects those bits in the existing set that should be changed. This follows the same method already used by MARK and CONNMARK targets. Omitting CTA_LABELS_MASK is the same as setting all bits in CTA_LABELS_MASK to 1: The existing set is replaced by the one from userspace. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-18netfilter: ctnetlink: deliver labels to userspaceFlorian Westphal2-1/+42
Introduce CTA_LABELS attribute to send a bit-vector of currently active labels to userspace. Future patch will permit userspace to also set/delete active labels. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-18netfilter: add connlabel conntrack extensionFlorian Westphal6-0/+206
similar to connmarks, except labels are bit-based; i.e. all labels may be attached to a flow at the same time. Up to 128 labels are supported. Supporting more labels is possible, but requires increasing the ct offset delta from u8 to u16 type due to increased extension sizes. Mapping of bit-identifier to label name is done in userspace. The extension is enabled at run-time once "-m connlabel" netfilter rules are added. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-17netfilter: nf_ct_sip: support Cisco 7941/7945 IP phonesKevin Cernekee2-3/+41
Most SIP devices use a source port of 5060/udp on SIP requests, so the response automatically comes back to port 5060: phone_ip:5060 -> proxy_ip:5060 REGISTER proxy_ip:5060 -> phone_ip:5060 100 Trying The newer Cisco IP phones, however, use a randomly chosen high source port for the SIP request but expect the response on port 5060: phone_ip:49173 -> proxy_ip:5060 REGISTER proxy_ip:5060 -> phone_ip:5060 100 Trying Standard Linux NAT, with or without nf_nat_sip, will send the reply back to port 49173, not 5060: phone_ip:49173 -> proxy_ip:5060 REGISTER proxy_ip:5060 -> phone_ip:49173 100 Trying But the phone is not listening on 49173, so it will never see the reply. This patch modifies nf_*_sip to work around this quirk by extracting the SIP response port from the Via: header, iff the source IP in the packet header matches the source IP in the SIP request. Signed-off-by: Kevin Cernekee <cernekee@gmail.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-01-17net: increase fragment memory usage limitsJesper Dangaard Brouer1-7/+15
Increase the amount of memory usage limits for incomplete IP fragments. Arguing for new thresh high/low values: High threshold = 4 MBytes Low threshold = 3 MBytes The fragmentation memory accounting code, tries to account for the real memory usage, by measuring both the size of frag queue struct (inet_frag_queue (ipv4:ipq/ipv6:frag_queue)) and the SKB's truesize. We want to be able to handle/hold-on-to enough fragments, to ensure good performance, without causing incomplete fragments to hurt scalability, by causing the number of inet_frag_queue to grow too much (resulting longer searches for frag queues). For IPv4, how much memory does the largest frag consume. Maximum size fragment is 64K, which is approx 44 fragments with MTU(1500) sized packets. Sizeof(struct ipq) is 200. A 1500 byte packet results in a truesize of 2944 (not 2048 as I first assumed) (44*2944)+200 = 129736 bytes The current default high thresh of 262144 bytes, is obviously problematic, as only two 64K fragments can fit in the queue at the same time. How many 64K fragment can we fit into 4 MBytes: 4*2^20/((44*2944)+200) = 32.34 fragment in queues An attacker could send a separate/distinct fake fragment packets per queue, causing us to allocate one inet_frag_queue per packet, and thus attacking the hash table and its lists. How many frag queue do we need to store, and given a current hash size of 64, what is the average list length. Using one MTU sized fragment per inet_frag_queue, each consuming (2944+200) 3144 bytes. 4*2^20/(2944+200) = 1334 frag queues -> 21 avg list length An attack could send small fragments, the smallest packet I could send resulted in a truesize of 896 bytes (I'm a little surprised by this). 4*2^20/(896+200) = 3827 frag queues -> 59 avg list length When increasing these number, we also need to followup with improvements, that is going to help scalability. Simply increasing the hash size, is not enough as the current implementation does not have a per hash bucket locking. Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17xfrm: use separated locks to protect pointers of struct xfrm_state_afinfoCong Wang1-25/+18
afinfo->type_map and afinfo->mode_map deserve separated locks, they are different things. We should just take RCU read lock to protect afinfo itself, but not for the inner pointers. Cc: Steffen Klassert <steffen.klassert@secunet.com> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: "David S. Miller" <davem@davemloft.net> Signed-off-by: Cong Wang <amwang@redhat.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Powered by cgit, Gruvboxed by Blaster4385.