* [PATCH 1/2] make nf_log compile with PROC_FS == n
From: Harald Welte @ 2005-08-11 7:12 UTC (permalink / raw)
To: David Miller; +Cc: Linux Netdev List, Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 337 bytes --]
Hi Dave, please apply!
--
- Harald Welte <laforge@gnumonks.org> http://gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
[-- Attachment #1.2: 42-nflog_no_procfs.patch --]
[-- Type: text/plain, Size: 526 bytes --]
[NETFILTER] Fix compilation when no PROC_FS enabled
Signed-off-by: Harald Welte <laforge@netfilter.org>
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -166,12 +166,12 @@ int __init netfilter_log_init(void)
{
#ifdef CONFIG_PROC_FS
struct proc_dir_entry *pde;
+
pde = create_proc_entry("nf_log", S_IRUGO, proc_net_netfilter);
-#endif
if (!pde)
return -1;
pde->proc_fops = &nflog_file_ops;
-
+#endif
return 0;
}
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [PATCH 2.6.13-rc4 1/13] S2io: Code cleanup
From: Jeff Garzik @ 2005-08-11 4:11 UTC (permalink / raw)
To: raghavendra.koushik
Cc: netdev, ravinandan.arakali, leonid.grossman, rapuru.sriram
In-Reply-To: <20050803192433.BBFB498336@linux.site>
applied patches 1-13
^ permalink raw reply
* Re: [PATCH] emac: add support for platform-specific unsupported PHY features
From: Jeff Garzik @ 2005-08-11 4:03 UTC (permalink / raw)
To: Wade Farnsworth; +Cc: netdev, Matt Porter, Eugene Surovegin
In-Reply-To: <1123284725.27880.26.camel@rhino.az.mvista.com>
Wade Farnsworth wrote:
> Hello,
>
> This patch adds support to the ibm_emac driver for platform-specific
> unsupported PHY features.
>
> The patch attempts to determine the highest speed and duplex when
> autonegotiation is unsupported.
>
> -Wade Farnsworth
>
> Signed-off-by: Wade Farnsworth <wfarnsworth@mvista.com>
Can you update this patch RE Eugene's comments?
Jeff
^ permalink raw reply
* FINAL WINNING NOTIFICATIO!!!
From: Mrs.Myriam Van Haris. @ 2005-08-10 13:01 UTC (permalink / raw)
To: netdev
[-- Attachment #1: Type: text/plain, Size: 2079 bytes --]
SUNSPLASH GLOBAL MEGA SWEEPTAKE LOTTERY.
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REF: KLI/331-ILDI0501/11
BATCH: SPDL/76/142/FDNL
RE: WINNING FINAL NOTIFICATION
Sir/Madam
We are pleased to inform you of the result of the
Lottery Winners,International programs held on the
5TH of Aug 2005. Your e-mail address attached to
ticket number 55-345-22 drew lucky numbers
2-6-4-4-6-8-2 which consequently won in the 1st
category, you have therefore been approved for a lump
sum pay out of US$1,500,000.00 (One Million Five Hundred Thousand United States Dollars).
CONGRATULATIONS!!!
Due to mix up of some numbers and names, we ask that
you keep your winning information very confidential
till your claims has been processed and your
prize/money Remitted to you. This is part of our
security protocol to avoid double claiming and
unwarranted abuse of this program by some
participants.All participants were selected through a
computer ballot system drawn from over 200,000,000
company and 300,000,000 individual email addresses and
names from all over the world.
This promotional program takes place annually. We hope
with part of your winning you will take part in our
next year USD1 million international lottery.
To file for your claim, please contact our/your
fiducial agent,
MR.CLEM.L.HUMMER of the,
ONWARD TRUST AGENCY.NL
TEL: 0031 648 330 899
Fax: 0031 847 459 883
Email: sunglomeglott@netscape.net
Note that all winning must be claimed not later than
27TH of sept, 2005.
After this date all unclaimed funds will be included
in the next stake.
Please note in order to avoid unnecessary delays and
complications please remember to quote your Ticket
number and Draw Lucky numbers in all correspondence.
Furthermore, should there be any change of address do
inform our agent as soon as possible.
Congratulations once more from our members of staff
and thank you for being part of our promotional
program.
Note: Anybody under the age of 18 is automatically
disqualified.
Sincerely yours,
Mrs.Myriam Van Haris.
Lottery Co-ordinator.
[-- Attachment #2: "AVG certification" --]
[-- Type: text/plain, Size: 143 bytes --]
Internal Virus Database is out-of-date.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.2/55 - Release Date: 21/07/2005
^ permalink raw reply
* FINAL WINNING NOTIFICATIO!!!
From: Mrs.Myriam Van Haris. @ 2005-08-10 11:28 UTC (permalink / raw)
To: netdev
[-- Attachment #1: Type: text/plain, Size: 2079 bytes --]
SUNSPLASH GLOBAL MEGA SWEEPTAKE LOTTERY.
INTERNATIONAL PROMOTION/PRIZE AWARD DEPT.
REF: KLI/331-ILDI0501/11
BATCH: SPDL/76/142/FDNL
RE: WINNING FINAL NOTIFICATION
Sir/Madam
We are pleased to inform you of the result of the
Lottery Winners,International programs held on the
5TH of Aug 2005. Your e-mail address attached to
ticket number 55-345-22 drew lucky numbers
2-6-4-4-6-8-2 which consequently won in the 1st
category, you have therefore been approved for a lump
sum pay out of US$1,500,000.00 (One Million Five Hundred Thousand United States Dollars).
CONGRATULATIONS!!!
Due to mix up of some numbers and names, we ask that
you keep your winning information very confidential
till your claims has been processed and your
prize/money Remitted to you. This is part of our
security protocol to avoid double claiming and
unwarranted abuse of this program by some
participants.All participants were selected through a
computer ballot system drawn from over 200,000,000
company and 300,000,000 individual email addresses and
names from all over the world.
This promotional program takes place annually. We hope
with part of your winning you will take part in our
next year USD1 million international lottery.
To file for your claim, please contact our/your
fiducial agent,
MR.CLEM.L.HUMMER of the,
ONWARD TRUST AGENCY.NL
TEL: 0031 648 330 899
Fax: 0031 847 459 883
Email: sunglomeglott@netscape.net
Note that all winning must be claimed not later than
27TH of sept, 2005.
After this date all unclaimed funds will be included
in the next stake.
Please note in order to avoid unnecessary delays and
complications please remember to quote your Ticket
number and Draw Lucky numbers in all correspondence.
Furthermore, should there be any change of address do
inform our agent as soon as possible.
Congratulations once more from our members of staff
and thank you for being part of our promotional
program.
Note: Anybody under the age of 18 is automatically
disqualified.
Sincerely yours,
Mrs.Myriam Van Haris.
Lottery Co-ordinator.
[-- Attachment #2: "AVG certification" --]
[-- Type: text/plain, Size: 143 bytes --]
Internal Virus Database is out-of-date.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.2/55 - Release Date: 21/07/2005
^ permalink raw reply
* RE: default directive in Kconfig(subject modified)
From: Ravinandan Arakali @ 2005-08-09 21:26 UTC (permalink / raw)
To: 'David S. Miller'
Cc: hch, raghavendra.koushik, jgarzik, netdev, leonid.grossman,
rapuru.sriram
In-Reply-To: <20050808.193816.70216612.davem@davemloft.net>
Yes, I got the run-time feature message. It will require quite
a bit of code reshuffle and testing to make sure we don't
break existing code in any way.
Thanks,
Ravi
-----Original Message-----
From: David S. Miller [mailto:davem@davemloft.net]
Sent: Monday, August 08, 2005 7:38 PM
To: ravinandan.arakali@neterion.com
Cc: hch@infradead.org; raghavendra.koushik@neterion.com;
jgarzik@pobox.com; netdev@oss.sgi.com; leonid.grossman@neterion.com;
rapuru.sriram@neterion.com
Subject: Re: default directive in Kconfig(subject modified)
From: "Ravinandan Arakali" <ravinandan.arakali@neterion.com>
Date: Mon, 8 Aug 2005 17:40:45 -0700
> Can somebody throw light on the below subject ?
> We have S2io configured as a module and 2buff mode is
> one of the suboptions under S2io. But a directive such
> as "default y" does not seem to enable 2buff mode.
Independant of this issue, can you please acknowledge what
many people are trying to show you in that you MUST make
this a run-time selectable feature.
Yes, that means the driver will have to have two totally
seperate code paths. But that should not be inefficient
because you can just hook up different transmit and
interrupt handler methods depending upon the mode selected.
^ permalink raw reply
* [2.6 patch] net/irda/: possible cleanups
From: Adrian Bunk @ 2005-08-09 15:49 UTC (permalink / raw)
To: Andrew Morton
Cc: irda-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA
This patch contains the following possible cleanups:
- make the following needlessly global function static:
- irnet/irnet_ppp.c: irnet_init
- remove the following unneeded EXPORT_SYMBOL's:
- irlmp.c: sysctl_discovery_timeout
- irlmp.c: irlmp_reasons
- irlmp.c: irlmp_dup
- irqueue.c: hashbin_find_next
Please review which of these changes do make sense and which conflict
with pending patches.
Signed-off-by: Adrian Bunk <bunk-HeJ8Db2Gnd6zQB+pC5nmwQ@public.gmane.org>
---
This patch was already sent on:
- 9 Jul 2005
- 30 May 2005
- 7 May 2005
net/irda/irlmp.c | 3 ---
net/irda/irnet/irnet.h | 3 ---
net/irda/irnet/irnet_ppp.c | 2 +-
net/irda/irqueue.c | 1 -
4 files changed, 1 insertion(+), 8 deletions(-)
--- linux-2.6.12-rc3-mm3-full/net/irda/irnet/irnet.h.old 2005-05-05 22:38:59.000000000 +0200
+++ linux-2.6.12-rc3-mm3-full/net/irda/irnet/irnet.h 2005-05-05 22:39:12.000000000 +0200
@@ -517,9 +517,6 @@
irda_irnet_init(void); /* Initialise IrDA part of IrNET */
extern void
irda_irnet_cleanup(void); /* Teardown IrDA part of IrNET */
-/* ---------------------------- MODULE ---------------------------- */
-extern int
- irnet_init(void); /* Initialise IrNET module */
/**************************** VARIABLES ****************************/
--- linux-2.6.12-rc3-mm3-full/net/irda/irnet/irnet_ppp.c.old 2005-05-05 22:39:21.000000000 +0200
+++ linux-2.6.12-rc3-mm3-full/net/irda/irnet/irnet_ppp.c 2005-05-05 22:39:29.000000000 +0200
@@ -1107,7 +1107,7 @@
/*
* Module main entry point
*/
-int __init
+static int __init
irnet_init(void)
{
int err;
--- linux-2.6.12-rc3-mm3-full/net/irda/irlmp.c.old 2005-05-05 22:46:47.000000000 +0200
+++ linux-2.6.12-rc3-mm3-full/net/irda/irlmp.c 2005-05-05 22:50:52.000000000 +0200
@@ -53,7 +53,6 @@
/* These can be altered by the sysctl interface */
int sysctl_discovery = 0;
int sysctl_discovery_timeout = 3; /* 3 seconds by default */
-EXPORT_SYMBOL(sysctl_discovery_timeout);
int sysctl_discovery_slots = 6; /* 6 slots by default */
int sysctl_lap_keepalive_time = LM_IDLE_TIMEOUT * 1000 / HZ;
char sysctl_devname[65];
@@ -67,7 +66,6 @@
"LM_INIT_DISCONNECT",
"ERROR, NOT USED",
};
-EXPORT_SYMBOL(irlmp_reasons);
/*
* Function irlmp_init (void)
@@ -675,7 +673,6 @@
return new;
}
-EXPORT_SYMBOL(irlmp_dup);
/*
* Function irlmp_disconnect_request (handle, userdata)
--- linux-2.6.12-rc3-mm3-full/net/irda/irqueue.c.old 2005-05-05 22:48:55.000000000 +0200
+++ linux-2.6.12-rc3-mm3-full/net/irda/irqueue.c 2005-05-05 22:49:03.000000000 +0200
@@ -822,7 +822,6 @@
return entry;
}
-EXPORT_SYMBOL(hashbin_find_next);
/*
* Function hashbin_get_first (hashbin)
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
^ permalink raw reply
* Re: [PATCH] add bridging support to nfnetlink_{log,queue}
From: Bart De Schuymer @ 2005-08-09 6:54 UTC (permalink / raw)
To: Harald Welte
Cc: bdschuym@pandora.be, Linux Netdev List,
Netfilter Development Mailinglist
In-Reply-To: <20050808173610.GN25303@rama.de.gnumonks.org>
Op ma, 08-08-2005 te 19:36 +0200, schreef Harald Welte:
> > then the physindev should still be filled in if ebt_ulog is used. I'm
> > afraid this will result in more ugly ifdef's.
>
> well, If you can send me a patch for those ugly ifdef's after you get
> back from holidays, I'll apply it. Until then I think we can live
> without that missing bit.
Perhaps I'd better wait then until I have access to the latest changes.
Transparency never has been the greatest asset of the netfilter
development.
cheers,
Bart
^ permalink raw reply
* Re: default directive in Kconfig(subject modified)
From: David S. Miller @ 2005-08-09 2:38 UTC (permalink / raw)
To: ravinandan.arakali
Cc: hch, raghavendra.koushik, jgarzik, netdev, leonid.grossman,
rapuru.sriram
In-Reply-To: <002801c59c7a$fb660ec0$4810100a@pc.s2io.com>
From: "Ravinandan Arakali" <ravinandan.arakali@neterion.com>
Date: Mon, 8 Aug 2005 17:40:45 -0700
> Can somebody throw light on the below subject ?
> We have S2io configured as a module and 2buff mode is
> one of the suboptions under S2io. But a directive such
> as "default y" does not seem to enable 2buff mode.
Independant of this issue, can you please acknowledge what
many people are trying to show you in that you MUST make
this a run-time selectable feature.
Yes, that means the driver will have to have two totally
seperate code paths. But that should not be inefficient
because you can just hook up different transmit and
interrupt handler methods depending upon the mode selected.
^ permalink raw reply
* default directive in Kconfig(subject modified)
From: Ravinandan Arakali @ 2005-08-09 0:40 UTC (permalink / raw)
To: 'David S. Miller'
Cc: hch, raghavendra.koushik, jgarzik, netdev, leonid.grossman,
rapuru.sriram
Hi,
Can somebody throw light on the below subject ?
We have S2io configured as a module and 2buff mode is
one of the suboptions under S2io. But a directive such
as "default y" does not seem to enable 2buff mode.
Thanks,
Ravi
-----Original Message-----
From: Ravinandan Arakali [mailto:ravinandan.arakali@neterion.com]
Sent: Friday, July 29, 2005 9:38 AM
To: 'David S. Miller'
Cc: 'hch@infradead.org'; 'raghavendra.koushik@neterion.com';
'jgarzik@pobox.com'; 'netdev@oss.sgi.com';
'leonid.grossman@neterion.com'; 'rapuru.sriram@neterion.com'
Subject: RE: [PATCH 2.6.12.1 5/12] S2io: Performance improvements
David,
We are trying to use the "default" directive in Kconfig. We tried
using an unconditional directive(just to test it out) such as
"default y" and a conditional one such as "default y if
CONFIG_IA64_SGI_SN2".
But when we run "make menuconfig", it does not seem to pickup any of these
changes from Kconfig.
Any idea what we might be missing ?
Once this is fixed, we'll send out a patch to address comments from
previous 12 patches as well as couple of issues we found in the
meantime.
Thanks,
Ravi
-----Original Message-----
From: David S. Miller [mailto:davem@davemloft.net]
Sent: Tuesday, July 12, 2005 2:04 PM
To: ravinandan.arakali@neterion.com
Cc: hch@infradead.org; raghavendra.koushik@neterion.com;
jgarzik@pobox.com; netdev@oss.sgi.com; leonid.grossman@neterion.com;
rapuru.sriram@neterion.com
Subject: Re: [PATCH 2.6.12.1 5/12] S2io: Performance improvements
From: "Ravinandan Arakali" <ravinandan.arakali@neterion.com>
Subject: RE: [PATCH 2.6.12.1 5/12] S2io: Performance improvements
Date: Tue, 12 Jul 2005 14:00:52 -0700
> The two-buffer mode was added as a configurable option
> to Kconfig file several months ago. Hence the macro
> is CONFIG_2BUFF_MODE.
We're saying that you should choose CONFIG_2BUFF_MODE, when
CONFIG_IA64_SGI_SN2 is set, inside the Kconfig file using the
"default" Kconfig directive.
You should never change the setting of CONFIG_* macros in C source.
^ permalink raw reply
* Re: [PATCH] ip_conntrack: fix handling of OOM
From: David S. Miller @ 2005-08-09 0:03 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel
In-Reply-To: <20050808200559.GW25303@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 22:05:59 +0200
> [NETFILTER] return ENOMEM when ip_conntrack_alloc() fails.
Applied.
^ permalink raw reply
* Re: [PATCH] nf_log: check function arguments
From: David S. Miller @ 2005-08-09 0:02 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel
In-Reply-To: <20050808170431.GK25303@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 19:04:31 +0200
> [NETFILTER] check nf_log function call arguments
Applied.
^ permalink raw reply
* Re: [PATCH] nf_{log,queue}: more verbose error reporting
From: David S. Miller @ 2005-08-09 0:01 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel
In-Reply-To: <20050808170304.GJ25303@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 19:03:05 +0200
> [NETFILTER] more verbose return codes from nf_{log,queue}
Applied.
^ permalink raw reply
* Re: [PATCH] add bridging support to nfnetlink_{log,queue}
From: David S. Miller @ 2005-08-09 0:00 UTC (permalink / raw)
To: laforge; +Cc: bdschuym, netdev, netfilter-devel
In-Reply-To: <20050808132413.GA25303@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 15:24:13 +0200
> [NETFILTER] add correct bridging support to nfnetlink_{queue,log}
Applied.
^ permalink raw reply
* Re: Netlink allocation for iSCSI and others
From: David S. Miller @ 2005-08-08 21:21 UTC (permalink / raw)
To: kaber; +Cc: netdev, James.Bottomley, itn780, linux-scsi, hch, akpm
In-Reply-To: <42F7CC69.3060808@trash.net>
From: Patrick McHardy <kaber@trash.net>
Date: Mon, 08 Aug 2005 23:19:37 +0200
> David S. Miller wrote:
> > So we can increase MAX_LINKS to 256 and that's what I think I will do
> > for 2.6.14 unless there is a very serious objection. The tables sized
> > by MAX_LINKS in af_netlink.c are dynamically allocated, and the only
> > linear iterations over MAX_LINKS are for the netlink socket procfs
> > seq-file dumper, so it's not a performance issue either.
>
> I think we should increase it when allocating new numbers to save the
> unused memory for the larger nltable and additional pid hashes.
> Userspace shouldn't care if we change it.
Agreed. So we have 17 netlink numbers to allocate at this
point, and that should be good for a while.
^ permalink raw reply
* Re: Netlink allocation for iSCSI and others
From: Patrick McHardy @ 2005-08-08 21:19 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev, James.Bottomley, itn780, linux-scsi, hch, akpm
In-Reply-To: <20050808.134731.74751192.davem@davemloft.net>
David S. Miller wrote:
> So we can increase MAX_LINKS to 256 and that's what I think I will do
> for 2.6.14 unless there is a very serious objection. The tables sized
> by MAX_LINKS in af_netlink.c are dynamically allocated, and the only
> linear iterations over MAX_LINKS are for the netlink socket procfs
> seq-file dumper, so it's not a performance issue either.
I think we should increase it when allocating new numbers to save the
unused memory for the larger nltable and additional pid hashes.
Userspace shouldn't care if we change it.
^ permalink raw reply
* Netlink allocation for iSCSI and others
From: David S. Miller @ 2005-08-08 20:47 UTC (permalink / raw)
To: netdev; +Cc: James.Bottomley, itn780, linux-scsi, hch, kaber, akpm
Ok, here is what I'm going to do for 2.6.13 and in the longer
term.
First, we can give the current NETLINK_ARPD value to iSCSI
as it is unused since before I can even remember.
Second, ROUTE6 and TAPBASE we can kill from the header file
as both are unused as well.
In the longer term, Patrick is right in that there is no
connection between MAX_LINKS and NPROTO as I had claimed.
So we can increase MAX_LINKS to 256 and that's what I think I will do
for 2.6.14 unless there is a very serious objection. The tables sized
by MAX_LINKS in af_netlink.c are dynamically allocated, and the only
linear iterations over MAX_LINKS are for the netlink socket procfs
seq-file dumper, so it's not a performance issue either.
So, for 2.6.13 I'm going to push the following to Linus so that
everyone gets what they need for the time being.
[NETLINK]: Allocate and kill some netlink numbers.
NETLINK_ARPD is unused, allocate it to the Open-iSCSI folks.
NETLINK_ROUTE6 and NETLINK_TAPBASE are no longer used, delete
them.
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -12,15 +12,13 @@
#define NETLINK_NFLOG 5 /* netfilter/iptables ULOG */
#define NETLINK_XFRM 6 /* ipsec */
#define NETLINK_SELINUX 7 /* SELinux event notifications */
-#define NETLINK_ARPD 8
+#define NETLINK_ISCSI 8 /* Open-iSCSI */
#define NETLINK_AUDIT 9 /* auditing */
#define NETLINK_FIB_LOOKUP 10
-#define NETLINK_ROUTE6 11 /* af_inet6 route comm channel */
#define NETLINK_NETFILTER 12 /* netfilter subsystem */
#define NETLINK_IP6_FW 13
#define NETLINK_DNRTMSG 14 /* DECnet routing messages */
#define NETLINK_KOBJECT_UEVENT 15 /* Kernel messages to userspace */
-#define NETLINK_TAPBASE 16 /* 16 to 31 are ethertap */
#define MAX_LINKS 32
^ permalink raw reply
* [PATCH] ip_conntrack: fix handling of OOM
From: Harald Welte @ 2005-08-08 20:05 UTC (permalink / raw)
To: David Miller; +Cc: Linux Netdev List, Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 435 bytes --]
Hi Dave, please apply to net-2.6.14,
[ok, now back to vdev]
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 41-conntrack_alloc-errptr.patch --]
[-- Type: text/plain, Size: 1857 bytes --]
[NETFILTER] return ENOMEM when ip_conntrack_alloc() fails.
This patch fixes the bug which doesn't return ERR_PTR(-ENOMEM) if it failed
to allocate memory space from slab cache. This bug leads to erroneously
not dropped packets under stress, and wrong statistic counters ('invalid'
is incremented instead of 'drop'). It was introduced during the ctnetlink
merge in the net-2.6.14 tree, so no stable or mainline releases affected.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 5fd482be95fb5c0f60e1dc51bcd956ed535c33cb
tree 64c3930d4f4e701db945b27ebfe972d83ee1ed30
parent 041cf7f2c1158ae8e9b6d8173b77cbcc878cb54c
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 21:57:59 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 21:57:59 +0200
net/ipv4/netfilter/ip_conntrack_core.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -655,7 +655,7 @@ struct ip_conntrack *ip_conntrack_alloc(
conntrack = kmem_cache_alloc(ip_conntrack_cachep, GFP_ATOMIC);
if (!conntrack) {
DEBUGP("Can't allocate conntrack.\n");
- return NULL;
+ return ERR_PTR(-ENOMEM);
}
memset(conntrack, 0, sizeof(*conntrack));
@@ -696,8 +696,9 @@ init_conntrack(struct ip_conntrack_tuple
return NULL;
}
- if (!(conntrack = ip_conntrack_alloc(tuple, &repl_tuple)))
- return NULL;
+ conntrack = ip_conntrack_alloc(tuple, &repl_tuple);
+ if (conntrack == NULL || IS_ERR(conntrack))
+ return (struct ip_conntrack_tuple_hash *)conntrack;
if (!protocol->new(conntrack, skb)) {
ip_conntrack_free(conntrack);
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [PATCH] add bridging support to nfnetlink_{log,queue}
From: Bart De Schuymer @ 2005-08-08 17:43 UTC (permalink / raw)
To: Harald Welte
Cc: bdschuym@pandora.be, Linux Netdev List,
Netfilter Development Mailinglist
In-Reply-To: <20050808132413.GA25303@rama.de.gnumonks.org>
Op ma, 08-08-2005 te 15:24 +0200, schreef Harald Welte:
> > There is one case missing: the brouter case. If br0=eth0+eth1 and a
> > packet arrives at eth0 (not br0) in the IP code (not the bridge code),
> > then the indev must be eth0, not br0. How about something like this?
>
> Ok, I've implemented your suggested modifications now.
There's still one small issue: if CONFIG_BRIDGE_NETFILTER isn't set in
the kernel configuration but ebtables is enabled, then the physindev
should still be filled in if ebt_ulog is used. I'm afraid this will
result in more ugly ifdef's.
I don't mind making CONFIG_BRIDGE_NETFILTER mandatory for people wanting
to log the logical {in,out}put device, if you feel it would uglify the
code too much otherwise... The {in,out}dev sent to userspace will then
be different depending on whether CONFIG_BRIDGE_NETFILTER is set or not.
People can still disable bridge-nf at runtime with the right /proc
entry. This should then be stated somewhere very clearly.
cheers,
Bart
^ permalink raw reply
* Re: [PATCH] add bridging support to nfnetlink_{log,queue}
From: Harald Welte @ 2005-08-08 17:36 UTC (permalink / raw)
To: Bart De Schuymer
Cc: bdschuym@pandora.be, Linux Netdev List,
Netfilter Development Mailinglist
In-Reply-To: <1123523010.3384.19.camel@localhost.localdomain>
[-- Attachment #1: Type: text/plain, Size: 1677 bytes --]
On Mon, Aug 08, 2005 at 05:43:29PM +0000, Bart De Schuymer wrote:
> Op ma, 08-08-2005 te 15:24 +0200, schreef Harald Welte:
> > > There is one case missing: the brouter case. If br0=eth0+eth1 and a
> > > packet arrives at eth0 (not br0) in the IP code (not the bridge code),
> > > then the indev must be eth0, not br0. How about something like this?
> >
> > Ok, I've implemented your suggested modifications now.
>
> There's still one small issue: if CONFIG_BRIDGE_NETFILTER isn't set in
> the kernel configuration but ebtables is enabled,
Doesn't ebtables attach to netfilter hooks? Ah, BRIDGE_NETFILTER
actually only selects the {ip,ip6,arp}tables emulation, not netfilter
support in bridging.
> then the physindev should still be filled in if ebt_ulog is used. I'm
> afraid this will result in more ugly ifdef's.
well, If you can send me a patch for those ugly ifdef's after you get
back from holidays, I'll apply it. Until then I think we can live
without that missing bit.
> I don't mind making CONFIG_BRIDGE_NETFILTER mandatory for people wanting
> to log the logical {in,out}put device, if you feel it would uglify the
> code too much otherwise...
No, I don't think we should force people to use certain config options
if they're technically not required.
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* [PATCH] nf_log: check function arguments
From: Harald Welte @ 2005-08-08 17:04 UTC (permalink / raw)
To: David Miller; +Cc: Linux Netdev List, Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 522 bytes --]
Hi Dave!
Please apply to your net-2.6.14, thanks
Ok, this will be my last patch for some time, I promise. Guess you must
be bored by now...
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 40-nf_log-nproto-check.patch --]
[-- Type: text/plain, Size: 1903 bytes --]
[NETFILTER] check nf_log function call arguments
Check whether pf is too large in order to prevent array overflow.
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 041cf7f2c1158ae8e9b6d8173b77cbcc878cb54c
tree dd3f91ef47ed9867f4baaaa240161f9ee2210d3c
parent 2f20e47c7aaf09749b1bb0684fbd30a1921d2de2
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 19:02:07 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 19:02:07 +0200
include/linux/netfilter.h | 2 +-
net/netfilter/nf_log.c | 10 +++++++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -157,7 +157,7 @@ struct nf_logger {
/* Function to register/unregister log function. */
int nf_log_register(int pf, struct nf_logger *logger);
-void nf_log_unregister_pf(int pf);
+int nf_log_unregister_pf(int pf);
void nf_log_unregister_logger(struct nf_logger *logger);
/* Calls the registered backend logging function */
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -23,6 +23,9 @@ int nf_log_register(int pf, struct nf_lo
{
int ret = -EBUSY;
+ if (pf >= NPROTO)
+ return -EINVAL;
+
/* Any setup of logging members must be done before
* substituting pointer. */
spin_lock(&nf_log_lock);
@@ -37,14 +40,19 @@ int nf_log_register(int pf, struct nf_lo
}
EXPORT_SYMBOL(nf_log_register);
-void nf_log_unregister_pf(int pf)
+int nf_log_unregister_pf(int pf)
{
+ if (pf >= NPROTO)
+ return -EINVAL;
+
spin_lock(&nf_log_lock);
nf_logging[pf] = NULL;
spin_unlock(&nf_log_lock);
/* Give time to concurrent readers. */
synchronize_net();
+
+ return 0;
}
EXPORT_SYMBOL(nf_log_unregister_pf);
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* [PATCH] nf_{log,queue}: more verbose error reporting
From: Harald Welte @ 2005-08-08 17:03 UTC (permalink / raw)
To: David Miller; +Cc: Linux Netdev List, Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 426 bytes --]
Hi Dave!
Please apply to your net-2.6.14, thanks
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 39-nf_log_register-EBUSY.patch --]
[-- Type: text/plain, Size: 2286 bytes --]
[NETFILTER] more verbose return codes from nf_{log,queue}
This adds EEXIST to distinguish between the following return values:
0: nobody was registered, registration successful
EEXIST: the exact same handler was already registered, no registration
required
EBUSY: somebody else is registered, registration unsuccessful.
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 2f20e47c7aaf09749b1bb0684fbd30a1921d2de2
tree d8bf732f6a40d56f1a1e8b54a421473e2d40df98
parent 5f748d529c9bf1f0f52453d02a5e3aa9eca351e3
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 18:55:39 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 18:55:39 +0200
net/netfilter/nf_log.c | 6 +++++-
net/netfilter/nf_queue.c | 6 +++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -17,6 +17,8 @@
static struct nf_logger *nf_logging[NPROTO]; /* = NULL */
static DEFINE_SPINLOCK(nf_log_lock);
+/* return EBUSY if somebody else is registered, EEXIST if the same logger
+ * is registred, 0 on success. */
int nf_log_register(int pf, struct nf_logger *logger)
{
int ret = -EBUSY;
@@ -27,7 +29,9 @@ int nf_log_register(int pf, struct nf_lo
if (!nf_logging[pf]) {
rcu_assign_pointer(nf_logging[pf], logger);
ret = 0;
- }
+ } else if (nf_logging[pf] == logger)
+ ret = -EEXIST;
+
spin_unlock(&nf_log_lock);
return ret;
}
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -19,6 +19,8 @@ static struct nf_queue_rerouter *queue_r
static DEFINE_RWLOCK(queue_handler_lock);
+/* return EBUSY when somebody else is registered, return EEXIST if the
+ * same handler is registered, return 0 in case of success. */
int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
{
int ret;
@@ -27,7 +29,9 @@ int nf_register_queue_handler(int pf, st
return -EINVAL;
write_lock_bh(&queue_handler_lock);
- if (queue_handler[pf])
+ if (queue_handler[pf] == qh)
+ ret = -EEXIST;
+ else if (queue_handler[pf])
ret = -EBUSY;
else {
queue_handler[pf] = qh;
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [PATCH] move conntrack helper buffers out of BSS
From: David S. Miller @ 2005-08-08 13:45 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel
In-Reply-To: <20050807223934.GA4066@rama.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Mon, 8 Aug 2005 00:39:34 +0200
> [NETFILTER] move conntrack helper buffers from BSS to kmalloc()ed memory
Patch applied, thanks :-)
^ permalink raw reply
* [PATCH] add bridging support to nfnetlink_{log,queue}
From: Harald Welte @ 2005-08-08 13:24 UTC (permalink / raw)
To: David Miller
Cc: bdschuym@pandora.be, Linux Netdev List,
Netfilter Development Mailinglist
In-Reply-To: <W911141491296841123491979@kostunerix.telenet-ops.be>
[-- Attachment #1.1: Type: text/plain, Size: 704 bytes --]
> There is one case missing: the brouter case. If br0=eth0+eth1 and a
> packet arrives at eth0 (not br0) in the IP code (not the bridge code),
> then the indev must be eth0, not br0. How about something like this?
Ok, I've implemented your suggested modifications now.
Dave: Please apply to your net-2.6.14 tree. Thanks!
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 38-nfnetlink_queue_log-bridge.patch --]
[-- Type: text/plain, Size: 8495 bytes --]
[NETFILTER] add correct bridging support to nfnetlink_{queue,log}
This patch adds support for passing the real 'physical' device ifindex down
to userspace via nfnetlink_log and nfnetlink_queue.
This feature basically obsoletes net/bridge/netfilter/ebt_ulog.c, and it
is likely ebt_ulog.c will die with one of the next couple of patches.
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 5f748d529c9bf1f0f52453d02a5e3aa9eca351e3
tree f337de87d43b721ba0653e759c7d54d5daa27c52
parent e9d42778324d0432fe18b1a26d915d342a067351
author Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 15:20:14 +0200
committer Harald Welte <laforge@netfilter.org> Mo, 08 Aug 2005 15:20:14 +0200
include/linux/netfilter/nfnetlink_log.h | 2 +
include/linux/netfilter/nfnetlink_queue.h | 2 +
net/netfilter/nfnetlink_log.c | 58 +++++++++++++++++++++++++++++
net/netfilter/nfnetlink_queue.c | 58 +++++++++++++++++++++++++++++
4 files changed, 120 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/nfnetlink_log.h b/include/linux/netfilter/nfnetlink_log.h
--- a/include/linux/netfilter/nfnetlink_log.h
+++ b/include/linux/netfilter/nfnetlink_log.h
@@ -40,6 +40,8 @@ enum nfulnl_attr_type {
NFULA_TIMESTAMP, /* nfulnl_msg_packet_timestamp */
NFULA_IFINDEX_INDEV, /* u_int32_t ifindex */
NFULA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
+ NFULA_IFINDEX_PHYSINDEV, /* u_int32_t ifindex */
+ NFULA_IFINDEX_PHYSOUTDEV, /* u_int32_t ifindex */
NFULA_HWADDR, /* nfulnl_msg_packet_hw */
NFULA_PAYLOAD, /* opaque data payload */
NFULA_PREFIX, /* string prefix */
diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -36,6 +36,8 @@ enum nfqnl_attr_type {
NFQA_TIMESTAMP, /* nfqnl_msg_packet_timestamp */
NFQA_IFINDEX_INDEV, /* u_int32_t ifindex */
NFQA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
+ NFQA_IFINDEX_PHYSINDEV, /* u_int32_t ifindex */
+ NFQA_IFINDEX_PHYSOUTDEV, /* u_int32_t ifindex */
NFQA_HWADDR, /* nfqnl_msg_packet_hw */
NFQA_PAYLOAD, /* opaque data payload */
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -33,6 +33,10 @@
#include <asm/atomic.h>
+#ifdef CONFIG_BRIDGE_NETFILTER
+#include "../bridge/br_private.h"
+#endif
+
#define NFULNL_NLBUFSIZ_DEFAULT 4096
#define NFULNL_TIMEOUT_DEFAULT 100 /* every second */
#define NFULNL_QTHRESH_DEFAULT 100 /* 100 packets */
@@ -412,14 +416,64 @@ __build_packet_message(struct nfulnl_ins
if (indev) {
tmp_uint = htonl(indev->ifindex);
+#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV, sizeof(tmp_uint),
&tmp_uint);
+#else
+ if (pf == PF_BRIDGE) {
+ /* Case 1: outdev is physical input device, we need to
+ * look for bridge group (when called from
+ * netfilter_bridge) */
+ NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ /* this is the bridge group "brX" */
+ tmp_uint = htonl(indev->br_port->br->dev->ifindex);
+ NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ } else {
+ /* Case 2: indev is bridge group, we need to look for
+ * physical device (when called from ipv4) */
+ NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ if (skb->nf_bridge && skb->nf_bridge->physindev) {
+ tmp_uint =
+ htonl(skb->nf_bridge->physindev->ifindex);
+ NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ }
+ }
+#endif
}
if (outdev) {
tmp_uint = htonl(outdev->ifindex);
+#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV, sizeof(tmp_uint),
&tmp_uint);
+#else
+ if (pf == PF_BRIDGE) {
+ /* Case 1: outdev is physical output device, we need to
+ * look for bridge group (when called from
+ * netfilter_bridge) */
+ NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ /* this is the bridge group "brX" */
+ tmp_uint = htonl(outdev->br_port->br->dev->ifindex);
+ NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ } else {
+ /* Case 2: indev is a bridge group, we need to look
+ * for physical device (when called from ipv4) */
+ NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ if (skb->nf_bridge) {
+ tmp_uint =
+ htonl(skb->nf_bridge->physoutdev->ifindex);
+ NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ }
+ }
+#endif
}
if (skb->nfmark) {
@@ -536,6 +590,10 @@ nfulnl_log_packet(unsigned int pf,
+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_hdr))
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+ NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+#ifdef CONFIG_BRIDGE_NETFILTER
+ + NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+ + NFA_SPACE(sizeof(u_int32_t)) /* ifindex */
+#endif
+ NFA_SPACE(sizeof(u_int32_t)) /* mark */
+ NFA_SPACE(sizeof(u_int32_t)) /* uid */
+ NFA_SPACE(NFULNL_PREFIXLEN) /* prefix */
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -30,6 +30,10 @@
#include <asm/atomic.h>
+#ifdef CONFIG_BRIDGE_NETFILTER
+#include "../bridge/br_private.h"
+#endif
+
#define NFQNL_QMAX_DEFAULT 1024
#if 0
@@ -361,6 +365,10 @@ nfqnl_build_packet_message(struct nfqnl_
size = NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hdr))
+ NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+ NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+#ifdef CONFIG_BRIDGE_NETFILTER
+ + NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+ + NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+#endif
+ NLMSG_SPACE(sizeof(u_int32_t)) /* mark */
+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hw))
+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_timestamp));
@@ -412,12 +420,62 @@ nfqnl_build_packet_message(struct nfqnl_
if (entry->info->indev) {
tmp_uint = htonl(entry->info->indev->ifindex);
+#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);
+#else
+ if (entry->info->pf == PF_BRIDGE) {
+ /* Case 1: indev is physical input device, we need to
+ * look for bridge group (when called from
+ * netfilter_bridge) */
+ NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ /* this is the bridge group "brX" */
+ tmp_uint = htonl(entry->info->indev->br_port->br->dev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ } else {
+ /* Case 2: indev is bridge group, we need to look for
+ * physical device (when called from ipv4) */
+ NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ if (entry->skb->nf_bridge
+ && entry->skb->nf_bridge->physindev) {
+ tmp_uint = htonl(entry->skb->nf_bridge->physindev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ }
+ }
+#endif
}
if (entry->info->outdev) {
tmp_uint = htonl(entry->info->outdev->ifindex);
+#ifndef CONFIG_BRIDGE_NETFILTER
NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);
+#else
+ if (entry->info->pf == PF_BRIDGE) {
+ /* Case 1: outdev is physical output device, we need to
+ * look for bridge group (when called from
+ * netfilter_bridge) */
+ NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ /* this is the bridge group "brX" */
+ tmp_uint = htonl(entry->info->outdev->br_port->br->dev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ } else {
+ /* Case 2: outdev is bridge group, we need to look for
+ * physical output device (when called from ipv4) */
+ NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
+ &tmp_uint);
+ if (entry->skb->nf_bridge
+ && entry->skb->nf_bridge->physoutdev) {
+ tmp_uint = htonl(entry->skb->nf_bridge->physoutdev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV,
+ sizeof(tmp_uint), &tmp_uint);
+ }
+ }
+#endif
}
if (entry->skb->nfmark) {
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [RFC PATCH] convert ebt_ulog to nfnetlink_log
From: bdschuym@pandora.be @ 2005-08-08 9:06 UTC (permalink / raw)
To: Harald Welte; +Cc: Linux Netdev List, Netfilter Development Mailinglist
(using webmail)
>----- Oorspronkelijk bericht -----
>Van: Harald Welte [mailto:laforge@netfilter.org]
>Ok, so this is actually the opposite problem of the ipt_physdev.c
>problem. Here we have the physical device, but not the bridge group.
>
>This means we have to handle two separate cases:
>
>1) when nf_log_packet() gets called from the bridging code
> indev == eth0
> outdev == eth1
> -> we need to resolve br0 from dev->br_port member
>
>2) when nf_log_packet() gets called from the ipv4 code:
> indev == br0
> outdev == br0
> -> we need to resolve ethX from skb->nf_bridge member
>
>If I'm now correct, what about the following [reverse] patch (also
>attached the whole resulting file for your reference, since you don't
>have access to the tree).
There is one case missing: the brouter case. If br0=eth0+eth1 and a packet arrives at eth0 (not br0) in the IP code (not the bridge code), then the indev must be eth0, not br0.
How about something like this?
if (pf == PF_BRIDGE) { /* Called from ebtables */
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
sizeof(tmp_uint), &tmp_uint);
tmp_uint = htonl(indev->br_port->br->dev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
sizeof(tmp_uint), &tmp_uint);
} else {
NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
sizeof(tmp_uint), &tmp_uint);
if (skb->nf_bridge && skb->nf_bridge->physindev)
/* Called inside bridge code, but not from ebtables. */
tmp_uint = htonl(skb->nf_bridge->physindev->ifindex);
NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
sizeof(tmp_uint), &tmp_uint);
}
cheers,
Bart
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox