* [PATCH] move conntrack helper buffers out of BSS
From: Harald Welte @ 2005-08-07 22:39 UTC (permalink / raw)
To: David Miller; +Cc: Linux Netdev List, Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 467 bytes --]
Hi Dave,
I guess you will enjoy the following patch ;)
Please apply to net-2.6.14, thanks.
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 36-conntrack_helper-nobss.patch --]
[-- Type: text/plain, Size: 3917 bytes --]
[NETFILTER] move conntrack helper buffers from BSS to kmalloc()ed memory
According to DaveM, it is preferrable to have large data structures be
allocated dynamically from the module init() function rather than putting
them as static global variables into BSS.
This patch moves the conntrack helper packet buffers into dynamically
allocated memory.
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 6a85f7cafea91c2eea692828c7c1602d2da4f4c4
tree 66716ca9e7565377dcd42552a69189c8300f8182
parent 56ca768cb5d27e3b1929656cb186976c3b9af5ec
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 00:31:23 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 00:31:23 +0200
net/ipv4/netfilter/ip_conntrack_amanda.c | 18 ++++++++++++++++--
net/ipv4/netfilter/ip_conntrack_ftp.c | 9 +++++++--
net/ipv4/netfilter/ip_conntrack_irc.c | 7 ++++++-
3 files changed, 29 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -40,7 +40,7 @@ MODULE_PARM_DESC(master_timeout, "timeou
static char *conns[] = { "DATA ", "MESG ", "INDEX " };
/* This is slow, but it's simple. --RR */
-static char amanda_buffer[65536];
+static char *amanda_buffer;
static DEFINE_SPINLOCK(amanda_buffer_lock);
unsigned int (*ip_nat_amanda_hook)(struct sk_buff **pskb,
@@ -153,11 +153,25 @@ static struct ip_conntrack_helper amanda
static void __exit fini(void)
{
ip_conntrack_helper_unregister(&amanda_helper);
+ kfree(amanda_buffer);
}
static int __init init(void)
{
- return ip_conntrack_helper_register(&amanda_helper);
+ int ret;
+
+ amanda_buffer = kmalloc(65536, GFP_KERNEL);
+ if (!amanda_buffer)
+ return -ENOMEM;
+
+ ret = ip_conntrack_helper_register(&amanda_helper);
+ if (ret < 0) {
+ kfree(amanda_buffer);
+ return ret;
+ }
+ return 0;
+
+
}
module_init(init);
diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -25,8 +25,7 @@ MODULE_AUTHOR("Rusty Russell <rusty@rust
MODULE_DESCRIPTION("ftp connection tracking helper");
/* This is slow, but it's simple. --RR */
-static char ftp_buffer[65536];
-
+static char *ftp_buffer;
static DEFINE_SPINLOCK(ip_ftp_lock);
#define MAX_PORTS 8
@@ -461,6 +460,8 @@ static void fini(void)
ports[i]);
ip_conntrack_helper_unregister(&ftp[i]);
}
+
+ kfree(ftp_buffer);
}
static int __init init(void)
@@ -468,6 +469,10 @@ static int __init init(void)
int i, ret;
char *tmpname;
+ ftp_buffer = kmalloc(65536, GFP_KERNEL);
+ if (!ftp_buffer)
+ return -ENOMEM;
+
if (ports_c == 0)
ports[ports_c++] = FTP_PORT;
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c
--- a/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -39,7 +39,7 @@ static int ports_c;
static int max_dcc_channels = 8;
static unsigned int dcc_timeout = 300;
/* This is slow, but it's simple. --RR */
-static char irc_buffer[65536];
+static char *irc_buffer;
static DEFINE_SPINLOCK(irc_buffer_lock);
unsigned int (*ip_nat_irc_hook)(struct sk_buff **pskb,
@@ -257,6 +257,10 @@ static int __init init(void)
printk("ip_conntrack_irc: dcc_timeout must be a positive integer\n");
return -EBUSY;
}
+
+ irc_buffer = kmalloc(65536, GFP_KERNEL);
+ if (!irc_buffer)
+ return -ENOMEM;
/* If no port given, default to standard irc port */
if (ports_c == 0)
@@ -304,6 +308,7 @@ static void fini(void)
ports[i]);
ip_conntrack_helper_unregister(&irc_helpers[i]);
}
+ kfree(irc_buffer);
}
module_init(init);
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [RFC PATCH] convert ebt_ulog to nfnetlink_log
From: Bart De Schuymer @ 2005-08-08 6:57 UTC (permalink / raw)
To: Harald Welte; +Cc: Linux Netdev List, Netfilter Development Mailinglist, kaber
In-Reply-To: <20050807213340.GA4508@rama.de.gnumonks.org>
Op zo, 07-08-2005 te 23:33 +0200, schreef Harald Welte:
> > indev->br_port->br->dev->ifindex points to the ifindex of the bridge br0
> > when indev is a bridge port (eth0). So you need this to fill in the
> > input device (assuming we agree that the bridge is called the input
> > device, and the bridge port is called the physical input device).
> > Filling in the physical input device is done with indev (in case
> > indev->br_port is not NULL).
>
> I'm not sure if I can follow you. What basically happens is:
>
> ebt_ulog calls nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, ...) where
> "in" and "out" are struct net_device as passed to the ebt_ulog function
> (which is part of the ebt_watcher).
>
> [...]
>
> the code ends up at the function you are quoting above. "indev"
> is "in" and "outdev" is "out", transparently passed from
> nf_log_packet().
>
> So I think it should reflect exactly what you currently do in ebt_ulog.
> The only diference is that you now get the ifindex and not the device
> name string.
ebt_ulog code snippet:
strcpy(pm->physindev, in->name);
/* If in isn't a bridge, then physindev==indev */
if (in->br_port)
strcpy(pm->indev, in->br_port->br->dev->name);
else
strcpy(pm->indev, in->name);
Your code snippet:
if (indev->br_port) {
tmp_uint = htonl(indev->br_port->br->dev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
sizeof(tmp_uint), &tmp_uint);
}
These two code fragments do not do the same thing. If indev is a bridge
port (meaning indev->br_port != NULL), then the NFULA_IFINDEX_PHYSINDEV
must be indev, while the NFULA_IFINDEX_INDEV must be in->br_port->br-
>dev->name.
If indev is not a bridge port, the ebt_ulog code makes
NFULA_IFINDEX_PHYSINDEV and NFULA_IFINDEX_INDEV the same (indev).
cheers,
Bart
^ permalink raw reply
* Re: [RFC PATCH] convert ebt_ulog to nfnetlink_log
From: Harald Welte @ 2005-08-08 8:16 UTC (permalink / raw)
To: Bart De Schuymer; +Cc: Linux Netdev List, Netfilter Development Mailinglist
In-Reply-To: <1123484260.3686.1.camel@localhost.localdomain>
[-- Attachment #1.1: Type: text/plain, Size: 1678 bytes --]
[removing kaber and davem from cc list]
On Mon, Aug 08, 2005 at 06:57:40AM +0000, Bart De Schuymer wrote:
> > So I think it should reflect exactly what you currently do in ebt_ulog.
> > The only diference is that you now get the ifindex and not the device
> > name string.
>
> These two code fragments do not do the same thing. If indev is a bridge
> port (meaning indev->br_port != NULL), then the NFULA_IFINDEX_PHYSINDEV
> must be indev, while the NFULA_IFINDEX_INDEV must be in->br_port->br-
> >dev->name.
> If indev is not a bridge port, the ebt_ulog code makes
> NFULA_IFINDEX_PHYSINDEV and NFULA_IFINDEX_INDEV the same (indev).
Ok, so this is actually the opposite problem of the ipt_physdev.c
problem. Here we have the physical device, but not the bridge group.
This means we have to handle two separate cases:
1) when nf_log_packet() gets called from the bridging code
indev == eth0
outdev == eth1
-> we need to resolve br0 from dev->br_port member
2) when nf_log_packet() gets called from the ipv4 code:
indev == br0
outdev == br0
-> we need to resolve ethX from skb->nf_bridge member
If I'm now correct, what about the following [reverse] patch (also
attached the whole resulting file for your reference, since you don't
have access to the tree).
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: bridge2.diff --]
[-- Type: text/plain, Size: 7460 bytes --]
diff --git a/include/linux/netfilter/nfnetlink_log.h b/include/linux/netfilter/nfnetlink_log.h
--- a/include/linux/netfilter/nfnetlink_log.h
+++ b/include/linux/netfilter/nfnetlink_log.h
@@ -40,8 +40,6 @@ enum nfulnl_attr_type {
NFULA_TIMESTAMP, /* nfulnl_msg_packet_timestamp */
NFULA_IFINDEX_INDEV, /* u_int32_t ifindex */
NFULA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
- NFULA_IFINDEX_PHYSINDEV, /* u_int32_t ifindex */
- NFULA_IFINDEX_PHYSOUTDEV, /* u_int32_t ifindex */
NFULA_HWADDR, /* nfulnl_msg_packet_hw */
NFULA_PAYLOAD, /* opaque data payload */
NFULA_PREFIX, /* string prefix */
diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -36,8 +36,6 @@ enum nfqnl_attr_type {
NFQA_TIMESTAMP, /* nfqnl_msg_packet_timestamp */
NFQA_IFINDEX_INDEV, /* u_int32_t ifindex */
NFQA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
- NFQA_IFINDEX_PHYSINDEV, /* u_int32_t ifindex */
- NFQA_IFINDEX_PHYSOUTDEV, /* u_int32_t ifindex */
NFQA_HWADDR, /* nfqnl_msg_packet_hw */
NFQA_PAYLOAD, /* opaque data payload */
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -33,10 +33,6 @@
#include <asm/atomic.h>
-#ifdef CONFIG_BRIDGE_NETFILTER
-#include "../bridge/br_private.h"
-#endif
-
#define NFULNL_NLBUFSIZ_DEFAULT 4096
#define NFULNL_TIMEOUT_DEFAULT 100 /* every second */
#define NFULNL_QTHRESH_DEFAULT 100 /* 100 packets */
@@ -416,64 +412,14 @@ __build_packet_message(struct nfulnl_ins
if (indev) {
tmp_uint = htonl(indev->ifindex);
-#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV, sizeof(tmp_uint),
&tmp_uint);
-#else
- if (indev->br_port) {
- /* Case 1: indev is physical input device, we need to
- * look for bridge group (when called from
- * netfilter_bridge) */
- NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
- sizeof(tmp_uint), &tmp_uint);
- /* this is the bridge group "brX" */
- tmp_uint = htonl(indev->br_port->br->dev->ifindex);
- NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
- sizeof(tmp_uint), &tmp_uint);
- } else {
- /* Case 2: indev is bridge group, we need to look for
- * physical device (when called from ipv4) */
- NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
- sizeof(tmp_uint), &tmp_uint);
- if (skb->nf_bridge && skb->nf_bridge->physindev) {
- tmp_uint =
- htonl(skb->nf_bridge->physindev->ifindex);
- NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
- sizeof(tmp_uint), &tmp_uint);
- }
- }
-#endif
}
if (outdev) {
tmp_uint = htonl(outdev->ifindex);
-#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV, sizeof(tmp_uint),
&tmp_uint);
-#else
- if (outdev->br_port) {
- /* Case 1: outdev is physical output device, we need to
- * look for bridge group (when called from
- * netfilter_bridge) */
- NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
- sizeof(tmp_uint), &tmp_uint);
- /* this is the bridge group "brX" */
- tmp_uint = htonl(outdev->br_port->br->dev->ifindex);
- NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
- sizeof(tmp_uint), &tmp_uint);
- } else {
- /* Case 2: indev is a bridge group, we need to look
- * for physical device (when called from ipv4) */
- NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
- sizeof(tmp_uint), &tmp_uint);
- if (skb->nf_bridge) {
- tmp_uint =
- htonl(skb->nf_bridge->physoutdev->ifindex);
- NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
- sizeof(tmp_uint), &tmp_uint);
- }
- }
-#endif
}
if (skb->nfmark) {
@@ -590,10 +536,6 @@ nfulnl_log_packet(unsigned int pf,
+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_hdr))
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
-#ifdef CONFIG_BRIDGE_NETFILTER
- + NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
- + NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
-#endif
+ NFA_SPACE(sizeof(u_int32_t)) /* mark */
+ NFA_SPACE(sizeof(u_int32_t)) /* uid */
+ NFA_SPACE(NFULNL_PREFIXLEN) /* prefix */
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -30,10 +30,6 @@
#include <asm/atomic.h>
-#ifdef CONFIG_BRIDGE_NETFILTER
-#include "../bridge/br_private.h"
-#endif
-
#define NFQNL_QMAX_DEFAULT 1024
#if 0
@@ -365,10 +361,6 @@ nfqnl_build_packet_message(struct nfqnl_
size = NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hdr))
+ NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+ NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
-#ifdef CONFIG_BRIDGE_NETFILTER
- + NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
- + NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
-#endif
+ NLMSG_SPACE(sizeof(u_int32_t)) /* mark */
+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hw))
+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_timestamp));
@@ -420,62 +412,12 @@ nfqnl_build_packet_message(struct nfqnl_
if (entry->info->indev) {
tmp_uint = htonl(entry->info->indev->ifindex);
-#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);
-#else
- if (entry->info->indev->br_port) {
- /* Case 1: indev is physical input device, we need to
- * look for bridge group (when called from
- * netfilter_bridge) */
- NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV, sizeof(tmp_uint),
- &tmp_uint);
- /* this is the bridge group "brX" */
- tmp_uint = htonl(entry->info->indev->br_port->br->dev->ifindex);
- NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
- &tmp_uint);
- } else {
- /* Case 2: indev is bridge group, we need to look for
- * physical device (when called from ipv4) */
- NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
- &tmp_uint);
- if (entry->skb->nf_bridge
- && entry->skb->nf_bridge->physindev) {
- tmp_uint = htonl(entry->skb->nf_bridge->physindev->ifindex);
- NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV,
- sizeof(tmp_uint), &tmp_uint);
- }
- }
-#endif
}
if (entry->info->outdev) {
tmp_uint = htonl(entry->info->outdev->ifindex);
-#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);
-#else
- if (entry->info->outdev->br_port) {
- /* Case 1: outdev is physical output device, we need to
- * look for bridge group (when called from
- * netfilter_bridge) */
- NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV, sizeof(tmp_uint),
- &tmp_uint);
- /* this is the bridge group "brX" */
- tmp_uint = htonl(entry->info->outdev->br_port->br->dev->ifindex);
- NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
- &tmp_uint);
- } else {
- /* Case 2: outdev is bridge group, we need to look for
- * physical output device (when called from ipv4) */
- NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
- &tmp_uint);
- if (entry->skb->nf_bridge
- && entry->skb->nf_bridge->physoutdev) {
- tmp_uint = htonl(entry->skb->nf_bridge->physoutdev->ifindex);
- NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV,
- sizeof(tmp_uint), &tmp_uint);
- }
- }
-#endif
}
if (entry->skb->nfmark) {
[-- Attachment #1.3: nfnetlink_log.c --]
[-- Type: text/plain, Size: 26276 bytes --]
/*
* This is a module which is used for logging packets to userspace via
* nfetlink.
*
* (C) 2005 by Harald Welte <laforge@netfilter.org>
*
* Based on the old ipv4-only ipt_ULOG.c:
* (C) 2000-2004 by Harald Welte <laforge@netfilter.org>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
*/
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/init.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/netdevice.h>
#include <linux/netfilter.h>
#include <linux/netlink.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_log.h>
#include <linux/spinlock.h>
#include <linux/sysctl.h>
#include <linux/proc_fs.h>
#include <linux/security.h>
#include <linux/list.h>
#include <linux/jhash.h>
#include <linux/random.h>
#include <net/sock.h>
#include <asm/atomic.h>
#ifdef CONFIG_BRIDGE_NETFILTER
#include "../bridge/br_private.h"
#endif
#define NFULNL_NLBUFSIZ_DEFAULT 4096
#define NFULNL_TIMEOUT_DEFAULT 100 /* every second */
#define NFULNL_QTHRESH_DEFAULT 100 /* 100 packets */
#define PRINTR(x, args...) do { if (net_ratelimit()) \
printk(x, ## args); } while (0);
#if 0
#define UDEBUG(x, args ...) printk(KERN_DEBUG "%s(%d):%s(): " x, \
__FILE__, __LINE__, __FUNCTION__, \
## args)
#else
#define UDEBUG(x, ...)
#endif
struct nfulnl_instance {
struct hlist_node hlist; /* global list of instances */
spinlock_t lock;
atomic_t use; /* use count */
unsigned int qlen; /* number of nlmsgs in skb */
struct sk_buff *skb; /* pre-allocatd skb */
struct nlmsghdr *lastnlh; /* netlink header of last msg in skb */
struct timer_list timer;
int peer_pid; /* PID of the peer process */
/* configurable parameters */
unsigned int flushtimeout; /* timeout until queue flush */
unsigned int nlbufsiz; /* netlink buffer allocation size */
unsigned int qthreshold; /* threshold of the queue */
u_int32_t copy_range;
u_int16_t group_num; /* number of this queue */
u_int8_t copy_mode;
};
static DEFINE_RWLOCK(instances_lock);
#define INSTANCE_BUCKETS 16
static struct hlist_head instance_table[INSTANCE_BUCKETS];
static unsigned int hash_init;
static inline u_int8_t instance_hashfn(u_int16_t group_num)
{
return ((group_num & 0xff) % INSTANCE_BUCKETS);
}
static struct nfulnl_instance *
__instance_lookup(u_int16_t group_num)
{
struct hlist_head *head;
struct hlist_node *pos;
struct nfulnl_instance *inst;
UDEBUG("entering (group_num=%u)\n", group_num);
head = &instance_table[instance_hashfn(group_num)];
hlist_for_each_entry(inst, pos, head, hlist) {
if (inst->group_num == group_num)
return inst;
}
return NULL;
}
static inline void
instance_get(struct nfulnl_instance *inst)
{
atomic_inc(&inst->use);
}
static struct nfulnl_instance *
instance_lookup_get(u_int16_t group_num)
{
struct nfulnl_instance *inst;
read_lock_bh(&instances_lock);
inst = __instance_lookup(group_num);
if (inst)
instance_get(inst);
read_unlock_bh(&instances_lock);
return inst;
}
static void
instance_put(struct nfulnl_instance *inst)
{
if (inst && atomic_dec_and_test(&inst->use)) {
UDEBUG("kfree(inst=%p)\n", inst);
kfree(inst);
}
}
static void nfulnl_timer(unsigned long data);
static struct nfulnl_instance *
instance_create(u_int16_t group_num, int pid)
{
struct nfulnl_instance *inst;
UDEBUG("entering (group_num=%u, pid=%d)\n", group_num,
pid);
write_lock_bh(&instances_lock);
if (__instance_lookup(group_num)) {
inst = NULL;
UDEBUG("aborting, instance already exists\n");
goto out_unlock;
}
inst = kmalloc(sizeof(*inst), GFP_ATOMIC);
if (!inst)
goto out_unlock;
memset(inst, 0, sizeof(*inst));
INIT_HLIST_NODE(&inst->hlist);
inst->lock = SPIN_LOCK_UNLOCKED;
/* needs to be two, since we _put() after creation */
atomic_set(&inst->use, 2);
init_timer(&inst->timer);
inst->timer.function = nfulnl_timer;
inst->timer.data = (unsigned long)inst;
/* don't start timer yet. (re)start it with every packet */
inst->peer_pid = pid;
inst->group_num = group_num;
inst->qthreshold = NFULNL_QTHRESH_DEFAULT;
inst->flushtimeout = NFULNL_TIMEOUT_DEFAULT;
inst->nlbufsiz = NFULNL_NLBUFSIZ_DEFAULT;
inst->copy_mode = NFULNL_COPY_PACKET;
inst->copy_range = 0xffff;
if (!try_module_get(THIS_MODULE))
goto out_free;
hlist_add_head(&inst->hlist,
&instance_table[instance_hashfn(group_num)]);
UDEBUG("newly added node: %p, next=%p\n", &inst->hlist,
inst->hlist.next);
write_unlock_bh(&instances_lock);
return inst;
out_free:
instance_put(inst);
out_unlock:
write_unlock_bh(&instances_lock);
return NULL;
}
static int __nfulnl_send(struct nfulnl_instance *inst);
static void
_instance_destroy2(struct nfulnl_instance *inst, int lock)
{
/* first pull it out of the global list */
if (lock)
write_lock_bh(&instances_lock);
UDEBUG("removing instance %p (queuenum=%u) from hash\n",
inst, inst->group_num);
hlist_del(&inst->hlist);
if (lock)
write_unlock_bh(&instances_lock);
/* then flush all pending packets from skb */
spin_lock_bh(&inst->lock);
if (inst->skb) {
if (inst->qlen)
__nfulnl_send(inst);
if (inst->skb) {
kfree_skb(inst->skb);
inst->skb = NULL;
}
}
spin_unlock_bh(&inst->lock);
/* and finally put the refcount */
instance_put(inst);
module_put(THIS_MODULE);
}
static inline void
__instance_destroy(struct nfulnl_instance *inst)
{
_instance_destroy2(inst, 0);
}
static inline void
instance_destroy(struct nfulnl_instance *inst)
{
_instance_destroy2(inst, 1);
}
static int
nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode,
unsigned int range)
{
int status = 0;
spin_lock_bh(&inst->lock);
switch (mode) {
case NFULNL_COPY_NONE:
case NFULNL_COPY_META:
inst->copy_mode = mode;
inst->copy_range = 0;
break;
case NFULNL_COPY_PACKET:
inst->copy_mode = mode;
/* we're using struct nfattr which has 16bit nfa_len */
if (range > 0xffff)
inst->copy_range = 0xffff;
else
inst->copy_range = range;
break;
default:
status = -EINVAL;
break;
}
spin_unlock_bh(&inst->lock);
return status;
}
static int
nfulnl_set_nlbufsiz(struct nfulnl_instance *inst, u_int32_t nlbufsiz)
{
int status;
spin_lock_bh(&inst->lock);
if (nlbufsiz < NFULNL_NLBUFSIZ_DEFAULT)
status = -ERANGE;
else if (nlbufsiz > 131072)
status = -ERANGE;
else {
inst->nlbufsiz = nlbufsiz;
status = 0;
}
spin_unlock_bh(&inst->lock);
return status;
}
static int
nfulnl_set_timeout(struct nfulnl_instance *inst, u_int32_t timeout)
{
spin_lock_bh(&inst->lock);
inst->flushtimeout = timeout;
spin_unlock_bh(&inst->lock);
return 0;
}
static int
nfulnl_set_qthresh(struct nfulnl_instance *inst, u_int32_t qthresh)
{
spin_lock_bh(&inst->lock);
inst->qthreshold = qthresh;
spin_unlock_bh(&inst->lock);
return 0;
}
static struct sk_buff *nfulnl_alloc_skb(unsigned int inst_size,
unsigned int pkt_size)
{
struct sk_buff *skb;
UDEBUG("entered (%u, %u)\n", inst_size, pkt_size);
/* alloc skb which should be big enough for a whole multipart
* message. WARNING: has to be <= 128k due to slab restrictions */
skb = alloc_skb(inst_size, GFP_ATOMIC);
if (!skb) {
PRINTR("nfnetlink_log: can't alloc whole buffer (%u bytes)\n",
inst_size);
/* try to allocate only as much as we need for current
* packet */
skb = alloc_skb(pkt_size, GFP_ATOMIC);
if (!skb)
PRINTR("nfnetlink_log: can't even alloc %u bytes\n",
pkt_size);
}
return skb;
}
static int
__nfulnl_send(struct nfulnl_instance *inst)
{
int status;
if (timer_pending(&inst->timer))
del_timer(&inst->timer);
if (inst->qlen > 1)
inst->lastnlh->nlmsg_type = NLMSG_DONE;
status = nfnetlink_unicast(inst->skb, inst->peer_pid, MSG_DONTWAIT);
if (status < 0) {
UDEBUG("netlink_unicast() failed\n");
/* FIXME: statistics */
}
inst->qlen = 0;
inst->skb = NULL;
inst->lastnlh = NULL;
return status;
}
static void nfulnl_timer(unsigned long data)
{
struct nfulnl_instance *inst = (struct nfulnl_instance *)data;
UDEBUG("timer function called, flushing buffer\n");
spin_lock_bh(&inst->lock);
__nfulnl_send(inst);
instance_put(inst);
spin_unlock_bh(&inst->lock);
}
static inline int
__build_packet_message(struct nfulnl_instance *inst,
const struct sk_buff *skb,
unsigned int data_len,
unsigned int pf,
unsigned int hooknum,
const struct net_device *indev,
const struct net_device *outdev,
const struct nf_loginfo *li,
const char *prefix)
{
unsigned char *old_tail;
struct nfulnl_msg_packet_hdr pmsg;
struct nlmsghdr *nlh;
struct nfgenmsg *nfmsg;
u_int32_t tmp_uint;
UDEBUG("entered\n");
old_tail = inst->skb->tail;
nlh = NLMSG_PUT(inst->skb, 0, 0,
NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
sizeof(struct nfgenmsg));
nfmsg = NLMSG_DATA(nlh);
nfmsg->nfgen_family = pf;
nfmsg->version = NFNETLINK_V0;
nfmsg->res_id = htons(inst->group_num);
pmsg.hw_protocol = htons(skb->protocol);
pmsg.hook = hooknum;
NFA_PUT(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg);
if (prefix) {
int slen = strlen(prefix);
if (slen > NFULNL_PREFIXLEN)
slen = NFULNL_PREFIXLEN;
NFA_PUT(inst->skb, NFULA_PREFIX, slen, prefix);
}
if (indev) {
tmp_uint = htonl(indev->ifindex);
#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV, sizeof(tmp_uint),
&tmp_uint);
#else
if (indev->br_port) {
/* Case 1: indev is physical input device, we need to
* look for bridge group (when called from
* netfilter_bridge) */
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
sizeof(tmp_uint), &tmp_uint);
/* this is the bridge group "brX" */
tmp_uint = htonl(indev->br_port->br->dev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
sizeof(tmp_uint), &tmp_uint);
} else {
/* Case 2: indev is bridge group, we need to look for
* physical device (when called from ipv4) */
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
sizeof(tmp_uint), &tmp_uint);
if (skb->nf_bridge && skb->nf_bridge->physindev) {
tmp_uint =
htonl(skb->nf_bridge->physindev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
sizeof(tmp_uint), &tmp_uint);
}
}
#endif
}
if (outdev) {
tmp_uint = htonl(outdev->ifindex);
#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV, sizeof(tmp_uint),
&tmp_uint);
#else
if (outdev->br_port) {
/* Case 1: outdev is physical output device, we need to
* look for bridge group (when called from
* netfilter_bridge) */
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
sizeof(tmp_uint), &tmp_uint);
/* this is the bridge group "brX" */
tmp_uint = htonl(outdev->br_port->br->dev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
sizeof(tmp_uint), &tmp_uint);
} else {
/* Case 2: indev is a bridge group, we need to look
* for physical device (when called from ipv4) */
NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
sizeof(tmp_uint), &tmp_uint);
if (skb->nf_bridge) {
tmp_uint =
htonl(skb->nf_bridge->physoutdev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
sizeof(tmp_uint), &tmp_uint);
}
}
#endif
}
if (skb->nfmark) {
tmp_uint = htonl(skb->nfmark);
NFA_PUT(inst->skb, NFULA_MARK, sizeof(tmp_uint), &tmp_uint);
}
if (indev && skb->dev && skb->dev->hard_header_parse) {
struct nfulnl_msg_packet_hw phw;
phw.hw_addrlen =
skb->dev->hard_header_parse((struct sk_buff *)skb,
phw.hw_addr);
phw.hw_addrlen = htons(phw.hw_addrlen);
NFA_PUT(inst->skb, NFULA_HWADDR, sizeof(phw), &phw);
}
if (skb->stamp.tv_sec) {
struct nfulnl_msg_packet_timestamp ts;
ts.sec = cpu_to_be64(skb->stamp.tv_sec);
ts.usec = cpu_to_be64(skb->stamp.tv_usec);
NFA_PUT(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts);
}
/* UID */
if (skb->sk) {
read_lock_bh(&skb->sk->sk_callback_lock);
if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
u_int32_t uid = htonl(skb->sk->sk_socket->file->f_uid);
/* need to unlock here since NFA_PUT may goto */
read_unlock_bh(&skb->sk->sk_callback_lock);
NFA_PUT(inst->skb, NFULA_UID, sizeof(uid), &uid);
} else
read_unlock_bh(&skb->sk->sk_callback_lock);
}
if (data_len) {
struct nfattr *nfa;
int size = NFA_LENGTH(data_len);
if (skb_tailroom(inst->skb) < (int)NFA_SPACE(data_len)) {
printk(KERN_WARNING "nfnetlink_log: no tailroom!\n");
goto nlmsg_failure;
}
nfa = (struct nfattr *)skb_put(inst->skb, NFA_ALIGN(size));
nfa->nfa_type = NFULA_PAYLOAD;
nfa->nfa_len = size;
if (skb_copy_bits(skb, 0, NFA_DATA(nfa), data_len))
BUG();
}
nlh->nlmsg_len = inst->skb->tail - old_tail;
return 0;
nlmsg_failure:
UDEBUG("nlmsg_failure\n");
nfattr_failure:
PRINTR(KERN_ERR "nfnetlink_log: error creating log nlmsg\n");
return -1;
}
#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
static struct nf_loginfo default_loginfo = {
.type = NF_LOG_TYPE_ULOG,
.u = {
.ulog = {
.copy_len = 0xffff,
.group = 0,
.qthreshold = 1,
},
},
};
/* log handler for internal netfilter logging api */
static void
nfulnl_log_packet(unsigned int pf,
unsigned int hooknum,
const struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
const struct nf_loginfo *li_user,
const char *prefix)
{
unsigned int size, data_len;
struct nfulnl_instance *inst;
const struct nf_loginfo *li;
unsigned int qthreshold;
unsigned int nlbufsiz;
if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
li = li_user;
else
li = &default_loginfo;
inst = instance_lookup_get(li->u.ulog.group);
if (!inst)
inst = instance_lookup_get(0);
if (!inst) {
PRINTR("nfnetlink_log: trying to log packet, "
"but no instance for group %u\n", li->u.ulog.group);
return;
}
/* all macros expand to constant values at compile time */
/* FIXME: do we want to make the size calculation conditional based on
* what is actually present? way more branches and checks, but more
* memory efficient... */
size = NLMSG_SPACE(sizeof(struct nfgenmsg))
+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_hdr))
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
#ifdef CONFIG_BRIDGE_NETFILTER
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
#endif
+ NFA_SPACE(sizeof(u_int32_t)) /* mark */
+ NFA_SPACE(sizeof(u_int32_t)) /* uid */
+ NFA_SPACE(NFULNL_PREFIXLEN) /* prefix */
+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_hw))
+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_timestamp));
UDEBUG("initial size=%u\n", size);
spin_lock_bh(&inst->lock);
qthreshold = inst->qthreshold;
/* per-rule qthreshold overrides per-instance */
if (qthreshold > li->u.ulog.qthreshold)
qthreshold = li->u.ulog.qthreshold;
switch (inst->copy_mode) {
case NFULNL_COPY_META:
case NFULNL_COPY_NONE:
data_len = 0;
break;
case NFULNL_COPY_PACKET:
if (inst->copy_range == 0
|| inst->copy_range > skb->len)
data_len = skb->len;
else
data_len = inst->copy_range;
size += NFA_SPACE(data_len);
UDEBUG("copy_packet, therefore size now %u\n", size);
break;
default:
spin_unlock_bh(&inst->lock);
instance_put(inst);
return;
}
if (size > inst->nlbufsiz)
nlbufsiz = size;
else
nlbufsiz = inst->nlbufsiz;
if (!inst->skb) {
if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) {
UDEBUG("error in nfulnl_alloc_skb(%u, %u)\n",
inst->nlbufsiz, size);
goto alloc_failure;
}
} else if (inst->qlen >= qthreshold ||
size > skb_tailroom(inst->skb)) {
/* either the queue len is too high or we don't have
* enough room in the skb left. flush to userspace. */
UDEBUG("flushing old skb\n");
__nfulnl_send(inst);
if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) {
UDEBUG("error in nfulnl_alloc_skb(%u, %u)\n",
inst->nlbufsiz, size);
goto alloc_failure;
}
}
UDEBUG("qlen %d, qthreshold %d\n", inst->qlen, qthreshold);
inst->qlen++;
__build_packet_message(inst, skb, data_len, pf,
hooknum, in, out, li, prefix);
/* timer_pending always called within inst->lock, so there
* is no chance of a race here */
if (!timer_pending(&inst->timer)) {
instance_get(inst);
inst->timer.expires = jiffies + (inst->flushtimeout*HZ/100);
add_timer(&inst->timer);
}
spin_unlock_bh(&inst->lock);
return;
alloc_failure:
spin_unlock_bh(&inst->lock);
instance_put(inst);
UDEBUG("error allocating skb\n");
/* FIXME: statistics */
}
static int
nfulnl_rcv_nl_event(struct notifier_block *this,
unsigned long event, void *ptr)
{
struct netlink_notify *n = ptr;
if (event == NETLINK_URELEASE &&
n->protocol == NETLINK_NETFILTER && n->pid) {
int i;
/* destroy all instances for this pid */
write_lock_bh(&instances_lock);
for (i = 0; i < INSTANCE_BUCKETS; i++) {
struct hlist_node *tmp, *t2;
struct nfulnl_instance *inst;
struct hlist_head *head = &instance_table[i];
hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
UDEBUG("node = %p\n", inst);
if (n->pid == inst->peer_pid)
__instance_destroy(inst);
}
}
write_unlock_bh(&instances_lock);
}
return NOTIFY_DONE;
}
static struct notifier_block nfulnl_rtnl_notifier = {
.notifier_call = nfulnl_rcv_nl_event,
};
static int
nfulnl_recv_unsupp(struct sock *ctnl, struct sk_buff *skb,
struct nlmsghdr *nlh, struct nfattr *nfqa[], int *errp)
{
return -ENOTSUPP;
}
static struct nf_logger nfulnl_logger = {
.name = "nfnetlink_log",
.logfn = &nfulnl_log_packet,
.me = THIS_MODULE,
};
static const int nfula_min[NFULA_MAX] = {
[NFULA_PACKET_HDR-1] = sizeof(struct nfulnl_msg_packet_hdr),
[NFULA_MARK-1] = sizeof(u_int32_t),
[NFULA_TIMESTAMP-1] = sizeof(struct nfulnl_msg_packet_timestamp),
[NFULA_IFINDEX_INDEV-1] = sizeof(u_int32_t),
[NFULA_IFINDEX_OUTDEV-1]= sizeof(u_int32_t),
[NFULA_HWADDR-1] = sizeof(struct nfulnl_msg_packet_hw),
[NFULA_PAYLOAD-1] = 0,
[NFULA_PREFIX-1] = 0,
[NFULA_UID-1] = sizeof(u_int32_t),
};
static const int nfula_cfg_min[NFULA_CFG_MAX] = {
[NFULA_CFG_CMD-1] = sizeof(struct nfulnl_msg_config_cmd),
[NFULA_CFG_MODE-1] = sizeof(struct nfulnl_msg_config_mode),
[NFULA_CFG_TIMEOUT-1] = sizeof(u_int32_t),
[NFULA_CFG_QTHRESH-1] = sizeof(u_int32_t),
[NFULA_CFG_NLBUFSIZ-1] = sizeof(u_int32_t),
};
static int
nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
struct nlmsghdr *nlh, struct nfattr *nfula[], int *errp)
{
struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
u_int16_t group_num = ntohs(nfmsg->res_id);
struct nfulnl_instance *inst;
int ret = 0;
UDEBUG("entering for msg %u\n", NFNL_MSG_TYPE(nlh->nlmsg_type));
if (nfattr_bad_size(nfula, NFULA_CFG_MAX, nfula_cfg_min)) {
UDEBUG("bad attribute size\n");
return -EINVAL;
}
inst = instance_lookup_get(group_num);
if (nfula[NFULA_CFG_CMD-1]) {
u_int8_t pf = nfmsg->nfgen_family;
struct nfulnl_msg_config_cmd *cmd;
cmd = NFA_DATA(nfula[NFULA_CFG_CMD-1]);
UDEBUG("found CFG_CMD for\n");
switch (cmd->command) {
case NFULNL_CFG_CMD_BIND:
if (inst) {
ret = -EBUSY;
goto out_put;
}
inst = instance_create(group_num,
NETLINK_CB(skb).pid);
if (!inst) {
ret = -EINVAL;
goto out_put;
}
break;
case NFULNL_CFG_CMD_UNBIND:
if (!inst) {
ret = -ENODEV;
goto out_put;
}
if (inst->peer_pid != NETLINK_CB(skb).pid) {
ret = -EPERM;
goto out_put;
}
instance_destroy(inst);
break;
case NFULNL_CFG_CMD_PF_BIND:
UDEBUG("registering log handler for pf=%u\n", pf);
ret = nf_log_register(pf, &nfulnl_logger);
break;
case NFULNL_CFG_CMD_PF_UNBIND:
UDEBUG("unregistering log handler for pf=%u\n", pf);
/* This is a bug and a feature. We cannot unregister
* other handlers, like nfnetlink_inst can */
nf_log_unregister_pf(pf);
break;
default:
ret = -EINVAL;
break;
}
} else {
if (!inst) {
UDEBUG("no config command, and no instance for "
"group=%u pid=%u =>ENOENT\n",
group_num, NETLINK_CB(skb).pid);
ret = -ENOENT;
goto out_put;
}
if (inst->peer_pid != NETLINK_CB(skb).pid) {
UDEBUG("no config command, and wrong pid\n");
ret = -EPERM;
goto out_put;
}
}
if (nfula[NFULA_CFG_MODE-1]) {
struct nfulnl_msg_config_mode *params;
params = NFA_DATA(nfula[NFULA_CFG_MODE-1]);
nfulnl_set_mode(inst, params->copy_mode,
ntohs(params->copy_range));
}
if (nfula[NFULA_CFG_TIMEOUT-1]) {
u_int32_t timeout =
*(u_int32_t *)NFA_DATA(nfula[NFULA_CFG_TIMEOUT-1]);
nfulnl_set_timeout(inst, ntohl(timeout));
}
if (nfula[NFULA_CFG_NLBUFSIZ-1]) {
u_int32_t nlbufsiz =
*(u_int32_t *)NFA_DATA(nfula[NFULA_CFG_NLBUFSIZ-1]);
nfulnl_set_nlbufsiz(inst, ntohl(nlbufsiz));
}
if (nfula[NFULA_CFG_QTHRESH-1]) {
u_int32_t qthresh =
*(u_int16_t *)NFA_DATA(nfula[NFULA_CFG_QTHRESH-1]);
nfulnl_set_qthresh(inst, ntohl(qthresh));
}
out_put:
instance_put(inst);
return ret;
}
static struct nfnl_callback nfulnl_cb[NFULNL_MSG_MAX] = {
[NFULNL_MSG_PACKET] = { .call = nfulnl_recv_unsupp,
.attr_count = NFULA_MAX,
.cap_required = CAP_NET_ADMIN, },
[NFULNL_MSG_CONFIG] = { .call = nfulnl_recv_config,
.attr_count = NFULA_CFG_MAX,
.cap_required = CAP_NET_ADMIN },
};
static struct nfnetlink_subsystem nfulnl_subsys = {
.name = "log",
.subsys_id = NFNL_SUBSYS_ULOG,
.cb_count = NFULNL_MSG_MAX,
.cb = nfulnl_cb,
};
#ifdef CONFIG_PROC_FS
struct iter_state {
unsigned int bucket;
};
static struct hlist_node *get_first(struct seq_file *seq)
{
struct iter_state *st = seq->private;
if (!st)
return NULL;
for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) {
if (!hlist_empty(&instance_table[st->bucket]))
return instance_table[st->bucket].first;
}
return NULL;
}
static struct hlist_node *get_next(struct seq_file *seq, struct hlist_node *h)
{
struct iter_state *st = seq->private;
h = h->next;
while (!h) {
if (++st->bucket >= INSTANCE_BUCKETS)
return NULL;
h = instance_table[st->bucket].first;
}
return h;
}
static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
{
struct hlist_node *head;
head = get_first(seq);
if (head)
while (pos && (head = get_next(seq, head)))
pos--;
return pos ? NULL : head;
}
static void *seq_start(struct seq_file *seq, loff_t *pos)
{
read_lock_bh(&instances_lock);
return get_idx(seq, *pos);
}
static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
{
(*pos)++;
return get_next(s, v);
}
static void seq_stop(struct seq_file *s, void *v)
{
read_unlock_bh(&instances_lock);
}
static int seq_show(struct seq_file *s, void *v)
{
const struct nfulnl_instance *inst = v;
return seq_printf(s, "%5d %6d %5d %1d %5d %6d %2d\n",
inst->group_num,
inst->peer_pid, inst->qlen,
inst->copy_mode, inst->copy_range,
inst->flushtimeout, atomic_read(&inst->use));
}
static struct seq_operations nful_seq_ops = {
.start = seq_start,
.next = seq_next,
.stop = seq_stop,
.show = seq_show,
};
static int nful_open(struct inode *inode, struct file *file)
{
struct seq_file *seq;
struct iter_state *is;
int ret;
is = kmalloc(sizeof(*is), GFP_KERNEL);
if (!is)
return -ENOMEM;
memset(is, 0, sizeof(*is));
ret = seq_open(file, &nful_seq_ops);
if (ret < 0)
goto out_free;
seq = file->private_data;
seq->private = is;
return ret;
out_free:
kfree(is);
return ret;
}
static struct file_operations nful_file_ops = {
.owner = THIS_MODULE,
.open = nful_open,
.read = seq_read,
.llseek = seq_lseek,
.release = seq_release_private,
};
#endif /* PROC_FS */
static int
init_or_cleanup(int init)
{
int i, status = -ENOMEM;
#ifdef CONFIG_PROC_FS
struct proc_dir_entry *proc_nful;
#endif
if (!init)
goto cleanup;
for (i = 0; i < INSTANCE_BUCKETS; i++)
INIT_HLIST_HEAD(&instance_table[i]);
/* it's not really all that important to have a random value, so
* we can do this from the init function, even if there hasn't
* been that much entropy yet */
get_random_bytes(&hash_init, sizeof(hash_init));
netlink_register_notifier(&nfulnl_rtnl_notifier);
status = nfnetlink_subsys_register(&nfulnl_subsys);
if (status < 0) {
printk(KERN_ERR "log: failed to create netlink socket\n");
goto cleanup_netlink_notifier;
}
#ifdef CONFIG_PROC_FS
proc_nful = create_proc_entry("nfnetlink_log", 0440,
proc_net_netfilter);
if (!proc_nful)
goto cleanup_subsys;
proc_nful->proc_fops = &nful_file_ops;
#endif
return status;
cleanup:
nf_log_unregister_logger(&nfulnl_logger);
#ifdef CONFIG_PROC_FS
remove_proc_entry("nfnetlink_log", proc_net_netfilter);
cleanup_subsys:
#endif
nfnetlink_subsys_unregister(&nfulnl_subsys);
cleanup_netlink_notifier:
netlink_unregister_notifier(&nfulnl_rtnl_notifier);
return status;
}
static int __init init(void)
{
return init_or_cleanup(1);
}
static void __exit fini(void)
{
init_or_cleanup(0);
}
MODULE_DESCRIPTION("netfilter userspace logging");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_LICENSE("GPL");
MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG);
module_init(init);
module_exit(fini);
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [RFC PATCH] convert ebt_ulog to nfnetlink_log
From: bdschuym@pandora.be @ 2005-08-08 9:06 UTC (permalink / raw)
To: Harald Welte; +Cc: Linux Netdev List, Netfilter Development Mailinglist
(using webmail)
>----- Oorspronkelijk bericht -----
>Van: Harald Welte [mailto:laforge@netfilter.org]
>Ok, so this is actually the opposite problem of the ipt_physdev.c
>problem. Here we have the physical device, but not the bridge group.
>
>This means we have to handle two separate cases:
>
>1) when nf_log_packet() gets called from the bridging code
> indev == eth0
> outdev == eth1
> -> we need to resolve br0 from dev->br_port member
>
>2) when nf_log_packet() gets called from the ipv4 code:
> indev == br0
> outdev == br0
> -> we need to resolve ethX from skb->nf_bridge member
>
>If I'm now correct, what about the following [reverse] patch (also
>attached the whole resulting file for your reference, since you don't
>have access to the tree).
There is one case missing: the brouter case. If br0=eth0+eth1 and a packet arrives at eth0 (not br0) in the IP code (not the bridge code), then the indev must be eth0, not br0.
How about something like this?
if (pf == PF_BRIDGE) { /* Called from ebtables */
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
sizeof(tmp_uint), &tmp_uint);
tmp_uint = htonl(indev->br_port->br->dev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
sizeof(tmp_uint), &tmp_uint);
} else {
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
sizeof(tmp_uint), &tmp_uint);
if (skb->nf_bridge && skb->nf_bridge->physindev)
/* Called inside bridge code, but not from ebtables. */
tmp_uint = htonl(skb->nf_bridge->physindev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
sizeof(tmp_uint), &tmp_uint);
}
cheers,
Bart
^ permalink raw reply
* [PATCH] add bridging support to nfnetlink_{log,queue}
From: Harald Welte @ 2005-08-08 13:24 UTC (permalink / raw)
To: David Miller
Cc: bdschuym@pandora.be, Linux Netdev List,
Netfilter Development Mailinglist
In-Reply-To: <W911141491296841123491979@kostunerix.telenet-ops.be>
[-- Attachment #1.1: Type: text/plain, Size: 704 bytes --]
> There is one case missing: the brouter case. If br0=eth0+eth1 and a
> packet arrives at eth0 (not br0) in the IP code (not the bridge code),
> then the indev must be eth0, not br0. How about something like this?
Ok, I've implemented your suggested modifications now.
Dave: Please apply to your net-2.6.14 tree. Thanks!
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 38-nfnetlink_queue_log-bridge.patch --]
[-- Type: text/plain, Size: 8495 bytes --]
[NETFILTER] add correct bridging support to nfnetlink_{queue,log}
This patch adds support for passing the real 'physical' device ifindex down
to userspace via nfnetlink_log and nfnetlink_queue.
This feature basically obsoletes net/bridge/netfilter/ebt_ulog.c, and it
is likely ebt_ulog.c will die with one of the next couple of patches.
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 5f748d529c9bf1f0f52453d02a5e3aa9eca351e3
tree f337de87d43b721ba0653e759c7d54d5daa27c52
parent e9d42778324d0432fe18b1a26d915d342a067351
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 15:20:14 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 15:20:14 +0200
include/linux/netfilter/nfnetlink_log.h | 2 +
include/linux/netfilter/nfnetlink_queue.h | 2 +
net/netfilter/nfnetlink_log.c | 58 +++++++++++++++++++++++++++++
net/netfilter/nfnetlink_queue.c | 58 +++++++++++++++++++++++++++++
4 files changed, 120 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/nfnetlink_log.h b/include/linux/netfilter/nfnetlink_log.h
--- a/include/linux/netfilter/nfnetlink_log.h
+++ b/include/linux/netfilter/nfnetlink_log.h
@@ -40,6 +40,8 @@ enum nfulnl_attr_type {
NFULA_TIMESTAMP, /* nfulnl_msg_packet_timestamp */
NFULA_IFINDEX_INDEV, /* u_int32_t ifindex */
NFULA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
+ NFULA_IFINDEX_PHYSINDEV, /* u_int32_t ifindex */
+ NFULA_IFINDEX_PHYSOUTDEV, /* u_int32_t ifindex */
NFULA_HWADDR, /* nfulnl_msg_packet_hw */
NFULA_PAYLOAD, /* opaque data payload */
NFULA_PREFIX, /* string prefix */
diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -36,6 +36,8 @@ enum nfqnl_attr_type {
NFQA_TIMESTAMP, /* nfqnl_msg_packet_timestamp */
NFQA_IFINDEX_INDEV, /* u_int32_t ifindex */
NFQA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
+ NFQA_IFINDEX_PHYSINDEV, /* u_int32_t ifindex */
+ NFQA_IFINDEX_PHYSOUTDEV, /* u_int32_t ifindex */
NFQA_HWADDR, /* nfqnl_msg_packet_hw */
NFQA_PAYLOAD, /* opaque data payload */
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -33,6 +33,10 @@
#include <asm/atomic.h>
+#ifdef CONFIG_BRIDGE_NETFILTER
+#include "../bridge/br_private.h"
+#endif
+
#define NFULNL_NLBUFSIZ_DEFAULT 4096
#define NFULNL_TIMEOUT_DEFAULT 100 /* every second */
#define NFULNL_QTHRESH_DEFAULT 100 /* 100 packets */
@@ -412,14 +416,64 @@ __build_packet_message(struct nfulnl_ins
if (indev) {
tmp_uint = htonl(indev->ifindex);
+#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV, sizeof(tmp_uint),
&tmp_uint);
+#else
+ if (pf == PF_BRIDGE) {
+ /* Case 1: outdev is physical input device, we need to
+ * look for bridge group (when called from
+ * netfilter_bridge) */
+ NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ /* this is the bridge group "brX" */
+ tmp_uint = htonl(indev->br_port->br->dev->ifindex);
+ NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ } else {
+ /* Case 2: indev is bridge group, we need to look for
+ * physical device (when called from ipv4) */
+ NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ if (skb->nf_bridge && skb->nf_bridge->physindev) {
+ tmp_uint =
+ htonl(skb->nf_bridge->physindev->ifindex);
+ NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ }
+ }
+#endif
}
if (outdev) {
tmp_uint = htonl(outdev->ifindex);
+#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV, sizeof(tmp_uint),
&tmp_uint);
+#else
+ if (pf == PF_BRIDGE) {
+ /* Case 1: outdev is physical output device, we need to
+ * look for bridge group (when called from
+ * netfilter_bridge) */
+ NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ /* this is the bridge group "brX" */
+ tmp_uint = htonl(outdev->br_port->br->dev->ifindex);
+ NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ } else {
+ /* Case 2: indev is a bridge group, we need to look
+ * for physical device (when called from ipv4) */
+ NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ if (skb->nf_bridge) {
+ tmp_uint =
+ htonl(skb->nf_bridge->physoutdev->ifindex);
+ NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ }
+ }
+#endif
}
if (skb->nfmark) {
@@ -536,6 +590,10 @@ nfulnl_log_packet(unsigned int pf,
+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_hdr))
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+#ifdef CONFIG_BRIDGE_NETFILTER
+ + NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+ + NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+#endif
+ NFA_SPACE(sizeof(u_int32_t)) /* mark */
+ NFA_SPACE(sizeof(u_int32_t)) /* uid */
+ NFA_SPACE(NFULNL_PREFIXLEN) /* prefix */
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -30,6 +30,10 @@
#include <asm/atomic.h>
+#ifdef CONFIG_BRIDGE_NETFILTER
+#include "../bridge/br_private.h"
+#endif
+
#define NFQNL_QMAX_DEFAULT 1024
#if 0
@@ -361,6 +365,10 @@ nfqnl_build_packet_message(struct nfqnl_
size = NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hdr))
+ NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+ NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+#ifdef CONFIG_BRIDGE_NETFILTER
+ + NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+ + NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+#endif
+ NLMSG_SPACE(sizeof(u_int32_t)) /* mark */
+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hw))
+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_timestamp));
@@ -412,12 +420,62 @@ nfqnl_build_packet_message(struct nfqnl_
if (entry->info->indev) {
tmp_uint = htonl(entry->info->indev->ifindex);
+#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);
+#else
+ if (entry->info->pf == PF_BRIDGE) {
+ /* Case 1: indev is physical input device, we need to
+ * look for bridge group (when called from
+ * netfilter_bridge) */
+ NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ /* this is the bridge group "brX" */
+ tmp_uint = htonl(entry->info->indev->br_port->br->dev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ } else {
+ /* Case 2: indev is bridge group, we need to look for
+ * physical device (when called from ipv4) */
+ NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ if (entry->skb->nf_bridge
+ && entry->skb->nf_bridge->physindev) {
+ tmp_uint = htonl(entry->skb->nf_bridge->physindev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ }
+ }
+#endif
}
if (entry->info->outdev) {
tmp_uint = htonl(entry->info->outdev->ifindex);
+#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);
+#else
+ if (entry->info->pf == PF_BRIDGE) {
+ /* Case 1: outdev is physical output device, we need to
+ * look for bridge group (when called from
+ * netfilter_bridge) */
+ NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ /* this is the bridge group "brX" */
+ tmp_uint = htonl(entry->info->outdev->br_port->br->dev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ } else {
+ /* Case 2: outdev is bridge group, we need to look for
+ * physical output device (when called from ipv4) */
+ NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ if (entry->skb->nf_bridge
+ && entry->skb->nf_bridge->physoutdev) {
+ tmp_uint = htonl(entry->skb->nf_bridge->physoutdev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ }
+ }
+#endif
}
if (entry->skb->nfmark) {
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [PATCH] move conntrack helper buffers out of BSS
From: David S. Miller @ 2005-08-08 13:45 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel
In-Reply-To: <20050807223934.GA4066@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 00:39:34 +0200
> [NETFILTER] move conntrack helper buffers from BSS to kmalloc()ed memory
Patch applied, thanks :-)
^ permalink raw reply
* [PATCH] nf_{log,queue}: more verbose error reporting
From: Harald Welte @ 2005-08-08 17:03 UTC (permalink / raw)
To: David Miller; +Cc: Linux Netdev List, Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 426 bytes --]
Hi Dave!
Please apply to your net-2.6.14, thanks
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 39-nf_log_register-EBUSY.patch --]
[-- Type: text/plain, Size: 2286 bytes --]
[NETFILTER] more verbose return codes from nf_{log,queue}
This adds EEXIST to distinguish between the following return values:
0: nobody was registered, registration successful
EEXIST: the exact same handler was already registered, no registration
required
EBUSY: somebody else is registered, registration unsuccessful.
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 2f20e47c7aaf09749b1bb0684fbd30a1921d2de2
tree d8bf732f6a40d56f1a1e8b54a421473e2d40df98
parent 5f748d529c9bf1f0f52453d02a5e3aa9eca351e3
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 18:55:39 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 18:55:39 +0200
net/netfilter/nf_log.c | 6 +++++-
net/netfilter/nf_queue.c | 6 +++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -17,6 +17,8 @@
static struct nf_logger *nf_logging[NPROTO]; /* = NULL */
static DEFINE_SPINLOCK(nf_log_lock);
+/* return EBUSY if somebody else is registered, EEXIST if the same logger
+ * is registred, 0 on success. */
int nf_log_register(int pf, struct nf_logger *logger)
{
int ret = -EBUSY;
@@ -27,7 +29,9 @@ int nf_log_register(int pf, struct nf_lo
if (!nf_logging[pf]) {
rcu_assign_pointer(nf_logging[pf], logger);
ret = 0;
- }
+ } else if (nf_logging[pf] == logger)
+ ret = -EEXIST;
+
spin_unlock(&nf_log_lock);
return ret;
}
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -19,6 +19,8 @@ static struct nf_queue_rerouter *queue_r
static DEFINE_RWLOCK(queue_handler_lock);
+/* return EBUSY when somebody else is registered, return EEXIST if the
+ * same handler is registered, return 0 in case of success. */
int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
{
int ret;
@@ -27,7 +29,9 @@ int nf_register_queue_handler(int pf, st
return -EINVAL;
write_lock_bh(&queue_handler_lock);
- if (queue_handler[pf])
+ if (queue_handler[pf] == qh)
+ ret = -EEXIST;
+ else if (queue_handler[pf])
ret = -EBUSY;
else {
queue_handler[pf] = qh;
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* [PATCH] nf_log: check function arguments
From: Harald Welte @ 2005-08-08 17:04 UTC (permalink / raw)
To: David Miller; +Cc: Linux Netdev List, Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 522 bytes --]
Hi Dave!
Please apply to your net-2.6.14, thanks
Ok, this will be my last patch for some time, I promise. Guess you must
be bored by now...
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 40-nf_log-nproto-check.patch --]
[-- Type: text/plain, Size: 1903 bytes --]
[NETFILTER] check nf_log function call arguments
Check whether pf is too large in order to prevent array overflow.
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 041cf7f2c1158ae8e9b6d8173b77cbcc878cb54c
tree dd3f91ef47ed9867f4baaaa240161f9ee2210d3c
parent 2f20e47c7aaf09749b1bb0684fbd30a1921d2de2
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 19:02:07 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 19:02:07 +0200
include/linux/netfilter.h | 2 +-
net/netfilter/nf_log.c | 10 +++++++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -157,7 +157,7 @@ struct nf_logger {
/* Function to register/unregister log function. */
int nf_log_register(int pf, struct nf_logger *logger);
-void nf_log_unregister_pf(int pf);
+int nf_log_unregister_pf(int pf);
void nf_log_unregister_logger(struct nf_logger *logger);
/* Calls the registered backend logging function */
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -23,6 +23,9 @@ int nf_log_register(int pf, struct nf_lo
{
int ret = -EBUSY;
+ if (pf >= NPROTO)
+ return -EINVAL;
+
/* Any setup of logging members must be done before
* substituting pointer. */
spin_lock(&nf_log_lock);
@@ -37,14 +40,19 @@ int nf_log_register(int pf, struct nf_lo
}
EXPORT_SYMBOL(nf_log_register);
-void nf_log_unregister_pf(int pf)
+int nf_log_unregister_pf(int pf)
{
+ if (pf >= NPROTO)
+ return -EINVAL;
+
spin_lock(&nf_log_lock);
nf_logging[pf] = NULL;
spin_unlock(&nf_log_lock);
/* Give time to concurrent readers. */
synchronize_net();
+
+ return 0;
}
EXPORT_SYMBOL(nf_log_unregister_pf);
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [PATCH] add bridging support to nfnetlink_{log,queue}
From: Harald Welte @ 2005-08-08 17:36 UTC (permalink / raw)
To: Bart De Schuymer
Cc: bdschuym@pandora.be, Linux Netdev List,
Netfilter Development Mailinglist
In-Reply-To: <1123523010.3384.19.camel@localhost.localdomain>
[-- Attachment #1: Type: text/plain, Size: 1677 bytes --]
On Mon, Aug 08, 2005 at 05:43:29PM +0000, Bart De Schuymer wrote:
> Op ma, 08-08-2005 te 15:24 +0200, schreef Harald Welte:
> > > There is one case missing: the brouter case. If br0=eth0+eth1 and a
> > > packet arrives at eth0 (not br0) in the IP code (not the bridge code),
> > > then the indev must be eth0, not br0. How about something like this?
> >
> > Ok, I've implemented your suggested modifications now.
>
> There's still one small issue: if CONFIG_BRIDGE_NETFILTER isn't set in
> the kernel configuration but ebtables is enabled,
Doesn't ebtables attach to netfilter hooks? Ah, BRIDGE_NETFILTER
actually only selects the {ip,ip6,arp}tables emulation, not netfilter
support in bridging.
> then the physindev should still be filled in if ebt_ulog is used. I'm
> afraid this will result in more ugly ifdef's.
well, If you can send me a patch for those ugly ifdef's after you get
back from holidays, I'll apply it. Until then I think we can live
without that missing bit.
> I don't mind making CONFIG_BRIDGE_NETFILTER mandatory for people wanting
> to log the logical {in,out}put device, if you feel it would uglify the
> code too much otherwise...
No, I don't think we should force people to use certain config options
if they're technically not required.
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [PATCH] add bridging support to nfnetlink_{log,queue}
From: Bart De Schuymer @ 2005-08-08 17:43 UTC (permalink / raw)
To: Harald Welte
Cc: bdschuym@pandora.be, Linux Netdev List,
Netfilter Development Mailinglist
In-Reply-To: <20050808132413.GA25303@rama.de.gnumonks.org>
Op ma, 08-08-2005 te 15:24 +0200, schreef Harald Welte:
> > There is one case missing: the brouter case. If br0=eth0+eth1 and a
> > packet arrives at eth0 (not br0) in the IP code (not the bridge code),
> > then the indev must be eth0, not br0. How about something like this?
>
> Ok, I've implemented your suggested modifications now.
There's still one small issue: if CONFIG_BRIDGE_NETFILTER isn't set in
the kernel configuration but ebtables is enabled, then the physindev
should still be filled in if ebt_ulog is used. I'm afraid this will
result in more ugly ifdef's.
I don't mind making CONFIG_BRIDGE_NETFILTER mandatory for people wanting
to log the logical {in,out}put device, if you feel it would uglify the
code too much otherwise... The {in,out}dev sent to userspace will then
be different depending on whether CONFIG_BRIDGE_NETFILTER is set or not.
People can still disable bridge-nf at runtime with the right /proc
entry. This should then be stated somewhere very clearly.
cheers,
Bart
^ permalink raw reply
* [PATCH] ip_conntrack: fix handling of OOM
From: Harald Welte @ 2005-08-08 20:05 UTC (permalink / raw)
To: David Miller; +Cc: Linux Netdev List, Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 435 bytes --]
Hi Dave, please apply to net-2.6.14,
[ok, now back to vdev]
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 41-conntrack_alloc-errptr.patch --]
[-- Type: text/plain, Size: 1857 bytes --]
[NETFILTER] return ENOMEM when ip_conntrack_alloc() fails.
This patch fixes the bug which doesn't return ERR_PTR(-ENOMEM) if it failed
to allocate memory space from slab cache. This bug leads to erroneously
not dropped packets under stress, and wrong statistic counters ('invalid'
is incremented instead of 'drop'). It was introduced during the ctnetlink
merge in the net-2.6.14 tree, so no stable or mainline releases affected.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 5fd482be95fb5c0f60e1dc51bcd956ed535c33cb
tree 64c3930d4f4e701db945b27ebfe972d83ee1ed30
parent 041cf7f2c1158ae8e9b6d8173b77cbcc878cb54c
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 21:57:59 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 21:57:59 +0200
net/ipv4/netfilter/ip_conntrack_core.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -655,7 +655,7 @@ struct ip_conntrack *ip_conntrack_alloc(
conntrack = kmem_cache_alloc(ip_conntrack_cachep, GFP_ATOMIC);
if (!conntrack) {
DEBUGP("Can't allocate conntrack.\n");
- return NULL;
+ return ERR_PTR(-ENOMEM);
}
memset(conntrack, 0, sizeof(*conntrack));
@@ -696,8 +696,9 @@ init_conntrack(struct ip_conntrack_tuple
return NULL;
}
- if (!(conntrack = ip_conntrack_alloc(tuple, &repl_tuple)))
- return NULL;
+ conntrack = ip_conntrack_alloc(tuple, &repl_tuple);
+ if (conntrack == NULL || IS_ERR(conntrack))
+ return (struct ip_conntrack_tuple_hash *)conntrack;
if (!protocol->new(conntrack, skb)) {
ip_conntrack_free(conntrack);
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Netlink allocation for iSCSI and others
From: David S. Miller @ 2005-08-08 20:47 UTC (permalink / raw)
To: netdev; +Cc: James.Bottomley, itn780, linux-scsi, hch, kaber, akpm
Ok, here is what I'm going to do for 2.6.13 and in the longer
term.
First, we can give the current NETLINK_ARPD value to iSCSI
as it is unused since before I can even remember.
Second, ROUTE6 and TAPBASE we can kill from the header file
as both are unused as well.
In the longer term, Patrick is right in that there is no
connection between MAX_LINKS and NPROTO as I had claimed.
So we can increase MAX_LINKS to 256 and that's what I think I will do
for 2.6.14 unless there is a very serious objection. The tables sized
by MAX_LINKS in af_netlink.c are dynamically allocated, and the only
linear iterations over MAX_LINKS are for the netlink socket procfs
seq-file dumper, so it's not a performance issue either.
So, for 2.6.13 I'm going to push the following to Linus so that
everyone gets what they need for the time being.
[NETLINK]: Allocate and kill some netlink numbers.
NETLINK_ARPD is unused, allocate it to the Open-iSCSI folks.
NETLINK_ROUTE6 and NETLINK_TAPBASE are no longer used, delete
them.
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -12,15 +12,13 @@
#define NETLINK_NFLOG 5 /* netfilter/iptables ULOG */
#define NETLINK_XFRM 6 /* ipsec */
#define NETLINK_SELINUX 7 /* SELinux event notifications */
-#define NETLINK_ARPD 8
+#define NETLINK_ISCSI 8 /* Open-iSCSI */
#define NETLINK_AUDIT 9 /* auditing */
#define NETLINK_FIB_LOOKUP 10
-#define NETLINK_ROUTE6 11 /* af_inet6 route comm channel */
#define NETLINK_NETFILTER 12 /* netfilter subsystem */
#define NETLINK_IP6_FW 13
#define NETLINK_DNRTMSG 14 /* DECnet routing messages */
#define NETLINK_KOBJECT_UEVENT 15 /* Kernel messages to userspace */
-#define NETLINK_TAPBASE 16 /* 16 to 31 are ethertap */
#define MAX_LINKS 32
^ permalink raw reply
* Re: Netlink allocation for iSCSI and others
From: Patrick McHardy @ 2005-08-08 21:19 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev, James.Bottomley, itn780, linux-scsi, hch, akpm
In-Reply-To: <20050808.134731.74751192.davem@davemloft.net>
David S. Miller wrote:
> So we can increase MAX_LINKS to 256 and that's what I think I will do
> for 2.6.14 unless there is a very serious objection. The tables sized
> by MAX_LINKS in af_netlink.c are dynamically allocated, and the only
> linear iterations over MAX_LINKS are for the netlink socket procfs
> seq-file dumper, so it's not a performance issue either.
I think we should increase it when allocating new numbers to save the
unused memory for the larger nltable and additional pid hashes.
Userspace shouldn't care if we change it.
^ permalink raw reply
* Re: Netlink allocation for iSCSI and others
From: David S. Miller @ 2005-08-08 21:21 UTC (permalink / raw)
To: kaber; +Cc: netdev, James.Bottomley, itn780, linux-scsi, hch, akpm
In-Reply-To: <42F7CC69.3060808@trash.net>
From: Patrick McHardy <kaber@trash.net>
Date: Mon, 08 Aug 2005 23:19:37 +0200
> David S. Miller wrote:
> > So we can increase MAX_LINKS to 256 and that's what I think I will do
> > for 2.6.14 unless there is a very serious objection. The tables sized
> > by MAX_LINKS in af_netlink.c are dynamically allocated, and the only
> > linear iterations over MAX_LINKS are for the netlink socket procfs
> > seq-file dumper, so it's not a performance issue either.
>
> I think we should increase it when allocating new numbers to save the
> unused memory for the larger nltable and additional pid hashes.
> Userspace shouldn't care if we change it.
Agreed. So we have 17 netlink numbers to allocate at this
point, and that should be good for a while.
^ permalink raw reply
* Re: [PATCH] add bridging support to nfnetlink_{log,queue}
From: David S. Miller @ 2005-08-09 0:00 UTC (permalink / raw)
To: laforge; +Cc: bdschuym, netdev, netfilter-devel
In-Reply-To: <20050808132413.GA25303@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 15:24:13 +0200
> [NETFILTER] add correct bridging support to nfnetlink_{queue,log}
Applied.
^ permalink raw reply
* Re: [PATCH] nf_{log,queue}: more verbose error reporting
From: David S. Miller @ 2005-08-09 0:01 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel
In-Reply-To: <20050808170304.GJ25303@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 19:03:05 +0200
> [NETFILTER] more verbose return codes from nf_{log,queue}
Applied.
^ permalink raw reply
* Re: [PATCH] nf_log: check function arguments
From: David S. Miller @ 2005-08-09 0:02 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel
In-Reply-To: <20050808170431.GK25303@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 19:04:31 +0200
> [NETFILTER] check nf_log function call arguments
Applied.
^ permalink raw reply
* Re: [PATCH] ip_conntrack: fix handling of OOM
From: David S. Miller @ 2005-08-09 0:03 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel
In-Reply-To: <20050808200559.GW25303@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 22:05:59 +0200
> [NETFILTER] return ENOMEM when ip_conntrack_alloc() fails.
Applied.
^ permalink raw reply
* default directive in Kconfig(subject modified)
From: Ravinandan Arakali @ 2005-08-09 0:40 UTC (permalink / raw)
To: 'David S. Miller'
Cc: hch, raghavendra.koushik, jgarzik, netdev, leonid.grossman,
rapuru.sriram
Hi,
Can somebody throw light on the below subject ?
We have S2io configured as a module and 2buff mode is
one of the suboptions under S2io. But a directive such
as "default y" does not seem to enable 2buff mode.
Thanks,
Ravi
-----Original Message-----
From: Ravinandan Arakali [mailto:ravinandan.arakali@neterion.com]
Sent: Friday, July 29, 2005 9:38 AM
To: 'David S. Miller'
Cc: 'hch@infradead.org'; 'raghavendra.koushik@neterion.com';
'jgarzik@pobox.com'; 'netdev@oss.sgi.com';
'leonid.grossman@neterion.com'; 'rapuru.sriram@neterion.com'
Subject: RE: [PATCH 2.6.12.1 5/12] S2io: Performance improvements
David,
We are trying to use the "default" directive in Kconfig. We tried
using an unconditional directive(just to test it out) such as
"default y" and a conditional one such as "default y if
CONFIG_IA64_SGI_SN2".
But when we run "make menuconfig", it does not seem to pickup any of these
changes from Kconfig.
Any idea what we might be missing ?
Once this is fixed, we'll send out a patch to address comments from
previous 12 patches as well as couple of issues we found in the
meantime.
Thanks,
Ravi
-----Original Message-----
From: David S. Miller [mailto:davem@davemloft.net]
Sent: Tuesday, July 12, 2005 2:04 PM
To: ravinandan.arakali@neterion.com
Cc: hch@infradead.org; raghavendra.koushik@neterion.com;
jgarzik@pobox.com; netdev@oss.sgi.com; leonid.grossman@neterion.com;
rapuru.sriram@neterion.com
Subject: Re: [PATCH 2.6.12.1 5/12] S2io: Performance improvements
From: "Ravinandan Arakali" <ravinandan.arakali@neterion.com>
Subject: RE: [PATCH 2.6.12.1 5/12] S2io: Performance improvements
Date: Tue, 12 Jul 2005 14:00:52 -0700
> The two-buffer mode was added as a configurable option
> to Kconfig file several months ago. Hence the macro
> is CONFIG_2BUFF_MODE.
We're saying that you should choose CONFIG_2BUFF_MODE, when
CONFIG_IA64_SGI_SN2 is set, inside the Kconfig file using the
"default" Kconfig directive.
You should never change the setting of CONFIG_* macros in C source.
^ permalink raw reply
* Re: default directive in Kconfig(subject modified)
From: David S. Miller @ 2005-08-09 2:38 UTC (permalink / raw)
To: ravinandan.arakali
Cc: hch, raghavendra.koushik, jgarzik, netdev, leonid.grossman,
rapuru.sriram
In-Reply-To: <002801c59c7a$fb660ec0$4810100a@pc.s2io.com>
From: "Ravinandan Arakali" <ravinandan.arakali@neterion.com>
Date: Mon, 8 Aug 2005 17:40:45 -0700
> Can somebody throw light on the below subject ?
> We have S2io configured as a module and 2buff mode is
> one of the suboptions under S2io. But a directive such
> as "default y" does not seem to enable 2buff mode.
Independant of this issue, can you please acknowledge what
many people are trying to show you in that you MUST make
this a run-time selectable feature.
Yes, that means the driver will have to have two totally
seperate code paths. But that should not be inefficient
because you can just hook up different transmit and
interrupt handler methods depending upon the mode selected.
^ permalink raw reply
* Re: [PATCH] add bridging support to nfnetlink_{log,queue}
From: Bart De Schuymer @ 2005-08-09 6:54 UTC (permalink / raw)
To: Harald Welte
Cc: bdschuym@pandora.be, Linux Netdev List,
Netfilter Development Mailinglist
In-Reply-To: <20050808173610.GN25303@rama.de.gnumonks.org>
Op ma, 08-08-2005 te 19:36 +0200, schreef Harald Welte:
> > then the physindev should still be filled in if ebt_ulog is used. I'm
> > afraid this will result in more ugly ifdef's.
>
> well, If you can send me a patch for those ugly ifdef's after you get
> back from holidays, I'll apply it. Until then I think we can live
> without that missing bit.
Perhaps I'd better wait then until I have access to the latest changes.
Transparency never has been the greatest asset of the netfilter
development.
cheers,
Bart
^ permalink raw reply
* [2.6 patch] net/irda/: possible cleanups
From: Adrian Bunk @ 2005-08-09 15:49 UTC (permalink / raw)
To: Andrew Morton
Cc: irda-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA
This patch contains the following possible cleanups:
- make the following needlessly global function static:
- irnet/irnet_ppp.c: irnet_init
- remove the following unneeded EXPORT_SYMBOL's:
- irlmp.c: sysctl_discovery_timeout
- irlmp.c: irlmp_reasons
- irlmp.c: irlmp_dup
- irqueue.c: hashbin_find_next
Please review which of these changes do make sense and which conflict
with pending patches.
Signed-off-by: Adrian Bunk <bunk-HeJ8Db2Gnd6zQB+pC5nmwQ@public.gmane.org>
---
This patch was already sent on:
- 9 Jul 2005
- 30 May 2005
- 7 May 2005
net/irda/irlmp.c | 3 ---
net/irda/irnet/irnet.h | 3 ---
net/irda/irnet/irnet_ppp.c | 2 +-
net/irda/irqueue.c | 1 -
4 files changed, 1 insertion(+), 8 deletions(-)
--- linux-2.6.12-rc3-mm3-full/net/irda/irnet/irnet.h.old 2005-05-05 22:38:59.000000000 +0200
+++ linux-2.6.12-rc3-mm3-full/net/irda/irnet/irnet.h 2005-05-05 22:39:12.000000000 +0200
@@ -517,9 +517,6 @@
irda_irnet_init(void); /* Initialise IrDA part of IrNET */
extern void
irda_irnet_cleanup(void); /* Teardown IrDA part of IrNET */
-/* ---------------------------- MODULE ---------------------------- */
-extern int
- irnet_init(void); /* Initialise IrNET module */
/**************************** VARIABLES ****************************/
--- linux-2.6.12-rc3-mm3-full/net/irda/irnet/irnet_ppp.c.old 2005-05-05 22:39:21.000000000 +0200
+++ linux-2.6.12-rc3-mm3-full/net/irda/irnet/irnet_ppp.c 2005-05-05 22:39:29.000000000 +0200
@@ -1107,7 +1107,7 @@
/*
* Module main entry point
*/
-int __init
+static int __init
irnet_init(void)
{
int err;
--- linux-2.6.12-rc3-mm3-full/net/irda/irlmp.c.old 2005-05-05 22:46:47.000000000 +0200
+++ linux-2.6.12-rc3-mm3-full/net/irda/irlmp.c 2005-05-05 22:50:52.000000000 +0200
@@ -53,7 +53,6 @@
/* These can be altered by the sysctl interface */
int sysctl_discovery = 0;
int sysctl_discovery_timeout = 3; /* 3 seconds by default */
-EXPORT_SYMBOL(sysctl_discovery_timeout);
int sysctl_discovery_slots = 6; /* 6 slots by default */
int sysctl_lap_keepalive_time = LM_IDLE_TIMEOUT * 1000 / HZ;
char sysctl_devname[65];
@@ -67,7 +66,6 @@
"LM_INIT_DISCONNECT",
"ERROR, NOT USED",
};
-EXPORT_SYMBOL(irlmp_reasons);
/*
* Function irlmp_init (void)
@@ -675,7 +673,6 @@
return new;
}
-EXPORT_SYMBOL(irlmp_dup);
/*
* Function irlmp_disconnect_request (handle, userdata)
--- linux-2.6.12-rc3-mm3-full/net/irda/irqueue.c.old 2005-05-05 22:48:55.000000000 +0200
+++ linux-2.6.12-rc3-mm3-full/net/irda/irqueue.c 2005-05-05 22:49:03.000000000 +0200
@@ -822,7 +822,6 @@
return entry;
}
-EXPORT_SYMBOL(hashbin_find_next);
/*
* Function hashbin_get_first (hashbin)
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
^ permalink raw reply
* RE: default directive in Kconfig(subject modified)
From: Ravinandan Arakali @ 2005-08-09 21:26 UTC (permalink / raw)
To: 'David S. Miller'
Cc: hch, raghavendra.koushik, jgarzik, netdev, leonid.grossman,
rapuru.sriram
In-Reply-To: <20050808.193816.70216612.davem@davemloft.net>
Yes, I got the run-time feature message. It will require quite
a bit of code reshuffle and testing to make sure we don't
break existing code in any way.
Thanks,
Ravi
-----Original Message-----
From: David S. Miller [mailto:davem@davemloft.net]
Sent: Monday, August 08, 2005 7:38 PM
To: ravinandan.arakali@neterion.com
Cc: hch@infradead.org; raghavendra.koushik@neterion.com;
jgarzik@pobox.com; netdev@oss.sgi.com; leonid.grossman@neterion.com;
rapuru.sriram@neterion.com
Subject: Re: default directive in Kconfig(subject modified)
From: "Ravinandan Arakali" <ravinandan.arakali@neterion.com>
Date: Mon, 8 Aug 2005 17:40:45 -0700
> Can somebody throw light on the below subject ?
> We have S2io configured as a module and 2buff mode is
> one of the suboptions under S2io. But a directive such
> as "default y" does not seem to enable 2buff mode.
Independant of this issue, can you please acknowledge what
many people are trying to show you in that you MUST make
this a run-time selectable feature.
Yes, that means the driver will have to have two totally
seperate code paths. But that should not be inefficient
because you can just hook up different transmit and
interrupt handler methods depending upon the mode selected.
^ permalink raw reply
* FINAL WINNING NOTIFICATIO!!!
From: Mrs.Myriam Van Haris. @ 2005-08-10 11:28 UTC (permalink / raw)
To: netdev
[-- Attachment #1: Type: text/plain, Size: 2079 bytes --]
SUNSPLASH GLOBAL MEGA SWEEPTAKE LOTTERY.
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REF: KLI/331-ILDI0501/11
BATCH: SPDL/76/142/FDNL
RE: WINNING FINAL NOTIFICATION
Sir/Madam
We are pleased to inform you of the result of the
Lottery Winners,International programs held on the
5TH of Aug 2005. Your e-mail address attached to
ticket number 55-345-22 drew lucky numbers
2-6-4-4-6-8-2 which consequently won in the 1st
category, you have therefore been approved for a lump
sum pay out of US$1,500,000.00 (One Million Five Hundred Thousand United States Dollars).
CONGRATULATIONS!!!
Due to mix up of some numbers and names, we ask that
you keep your winning information very confidential
till your claims has been processed and your
prize/money Remitted to you. This is part of our
security protocol to avoid double claiming and
unwarranted abuse of this program by some
participants.All participants were selected through a
computer ballot system drawn from over 200,000,000
company and 300,000,000 individual email addresses and
names from all over the world.
This promotional program takes place annually. We hope
with part of your winning you will take part in our
next year USD1 million international lottery.
To file for your claim, please contact our/your
fiducial agent,
MR.CLEM.L.HUMMER of the,
ONWARD TRUST AGENCY.NL
TEL: 0031 648 330 899
Fax: 0031 847 459 883
Email: sunglomeglott@netscape.net
Note that all winning must be claimed not later than
27TH of sept, 2005.
After this date all unclaimed funds will be included
in the next stake.
Please note in order to avoid unnecessary delays and
complications please remember to quote your Ticket
number and Draw Lucky numbers in all correspondence.
Furthermore, should there be any change of address do
inform our agent as soon as possible.
Congratulations once more from our members of staff
and thank you for being part of our promotional
program.
Note: Anybody under the age of 18 is automatically
disqualified.
Sincerely yours,
Mrs.Myriam Van Haris.
Lottery Co-ordinator.
[-- Attachment #2: "AVG certification" --]
[-- Type: text/plain, Size: 143 bytes --]
Internal Virus Database is out-of-date.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.2/55 - Release Date: 21/07/2005
^ permalink raw reply
* FINAL WINNING NOTIFICATIO!!!
From: Mrs.Myriam Van Haris. @ 2005-08-10 13:01 UTC (permalink / raw)
To: netdev
[-- Attachment #1: Type: text/plain, Size: 2079 bytes --]
SUNSPLASH GLOBAL MEGA SWEEPTAKE LOTTERY.
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REF: KLI/331-ILDI0501/11
BATCH: SPDL/76/142/FDNL
RE: WINNING FINAL NOTIFICATION
Sir/Madam
We are pleased to inform you of the result of the
Lottery Winners,International programs held on the
5TH of Aug 2005. Your e-mail address attached to
ticket number 55-345-22 drew lucky numbers
2-6-4-4-6-8-2 which consequently won in the 1st
category, you have therefore been approved for a lump
sum pay out of US$1,500,000.00 (One Million Five Hundred Thousand United States Dollars).
CONGRATULATIONS!!!
Due to mix up of some numbers and names, we ask that
you keep your winning information very confidential
till your claims has been processed and your
prize/money Remitted to you. This is part of our
security protocol to avoid double claiming and
unwarranted abuse of this program by some
participants.All participants were selected through a
computer ballot system drawn from over 200,000,000
company and 300,000,000 individual email addresses and
names from all over the world.
This promotional program takes place annually. We hope
with part of your winning you will take part in our
next year USD1 million international lottery.
To file for your claim, please contact our/your
fiducial agent,
MR.CLEM.L.HUMMER of the,
ONWARD TRUST AGENCY.NL
TEL: 0031 648 330 899
Fax: 0031 847 459 883
Email: sunglomeglott@netscape.net
Note that all winning must be claimed not later than
27TH of sept, 2005.
After this date all unclaimed funds will be included
in the next stake.
Please note in order to avoid unnecessary delays and
complications please remember to quote your Ticket
number and Draw Lucky numbers in all correspondence.
Furthermore, should there be any change of address do
inform our agent as soon as possible.
Congratulations once more from our members of staff
and thank you for being part of our promotional
program.
Note: Anybody under the age of 18 is automatically
disqualified.
Sincerely yours,
Mrs.Myriam Van Haris.
Lottery Co-ordinator.
[-- Attachment #2: "AVG certification" --]
[-- Type: text/plain, Size: 143 bytes --]
Internal Virus Database is out-of-date.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.2/55 - Release Date: 21/07/2005
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox