* Re: [PATCH 00/13]: Netfilter IPsec support
From: Herbert Xu @ 2005-11-23 4:47 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev, netfilter-devel, kaber
In-Reply-To: <20051122.193631.76306901.davem@davemloft.net>
On Tue, Nov 22, 2005 at 07:36:31PM -0800, David S. Miller wrote:
>
> View the net-2.6.16 GIT tree as a sort of playpen, much like
> -mm, until we get close to the real 2.6.16 upstream development
> openning up.
>
> I rebase all the time, and I can pluck out and change patches
> at will.
Sure, I have no objections against merging the patch now and then add
clean-ups later.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply
* Re: [PATCH 00/13]: Netfilter IPsec support
From: David S. Miller @ 2005-11-23 3:36 UTC (permalink / raw)
To: herbert; +Cc: netdev, netfilter-devel, kaber
In-Reply-To: <E1EejY9-0004fW-00@gondolin.me.apana.org.au>
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Wed, 23 Nov 2005 12:35:53 +1100
> How about merging the patches that everybody has agreed on first?
>
> So far, I haven't see any objections to patches 1 and 2 so they
> can go in straight away. They don't even touch IPv6.
>
> Patches 3-6 could become redundant if you go with my suggestion.
>
> The rest of them I haven't read yet so can't comment :)
View the net-2.6.16 GIT tree as a sort of playpen, much like
-mm, until we get close to the real 2.6.16 upstream development
openning up.
I rebase all the time, and I can pluck out and change patches
at will.
^ permalink raw reply
* Re: [PATCH 00/13]: Netfilter IPsec support
From: David S. Miller @ 2005-11-23 3:35 UTC (permalink / raw)
To: kaber; +Cc: netdev, netfilter-devel
In-Reply-To: <4383C31A.40101@trash.net>
From: Patrick McHardy <kaber@trash.net>
Date: Wed, 23 Nov 2005 02:17:14 +0100
> I would appreciate that, but I want to have a look closer look
> at Herbert's patches first. Unfortunately its late and I have
> to get up early, so its going to take me a day.
Take your time :)
^ permalink raw reply
* Re: [PATCH 00/13]: Netfilter IPsec support
From: Herbert Xu @ 2005-11-23 1:35 UTC (permalink / raw)
To: Patrick McHardy; +Cc: netdev, netfilter-devel, davem
In-Reply-To: <4383C31A.40101@trash.net>
Patrick McHardy <kaber@trash.net> wrote:
>
> I would appreciate that, but I want to have a look closer look
> at Herbert's patches first. Unfortunately its late and I have
> to get up early, so its going to take me a day.
How about merging the patches that everybody has agreed on first?
So far, I haven't see any objections to patches 1 and 2 so they
can go in straight away. They don't even touch IPv6.
Patches 3-6 could become redundant if you go with my suggestion.
The rest of them I haven't read yet so can't comment :)
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply
* [2.6 patch] net/sunrpc/xdr.c: remove xdr_decode_string()
From: Adrian Bunk @ 2005-11-23 1:24 UTC (permalink / raw)
To: Lever, Charles
Cc: David Miller, neilb, trond.myklebust, linux-kernel, nfs, netdev
In-Reply-To: <044B81DE141D7443BCE91E8F44B3C1E288E4FC@exsvl02.hq.netapp.com>
On Thu, Oct 06, 2005 at 07:13:14AM -0700, Lever, Charles wrote:
> actually, can we hold off on this change? the RPC transport switch will
> eventually need most of those EXPORT_SYMBOLs.
Am I right to assume this will happen in the foreseeable future?
> the only harmless change i see below is removing xdr_decode_string().
Patch below.
cu
Adrian
<-- snip -->
This patch removes ths unused function xdr_decode_string().
Signed-off-by: Adrian Bunk <bunk@stusta.de>
---
include/linux/sunrpc/xdr.h | 1 -
net/sunrpc/sunrpc_syms.c | 1 -
net/sunrpc/xdr.c | 21 ---------------------
3 files changed, 23 deletions(-)
--- linux-2.6.15-rc1-mm2-full/include/linux/sunrpc/xdr.h.old 2005-11-23 02:03:01.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/include/linux/sunrpc/xdr.h 2005-11-23 02:03:08.000000000 +0100
@@ -91,7 +91,6 @@
u32 * xdr_encode_opaque_fixed(u32 *p, const void *ptr, unsigned int len);
u32 * xdr_encode_opaque(u32 *p, const void *ptr, unsigned int len);
u32 * xdr_encode_string(u32 *p, const char *s);
-u32 * xdr_decode_string(u32 *p, char **sp, int *lenp, int maxlen);
u32 * xdr_decode_string_inplace(u32 *p, char **sp, int *lenp, int maxlen);
u32 * xdr_encode_netobj(u32 *p, const struct xdr_netobj *);
u32 * xdr_decode_netobj(u32 *p, struct xdr_netobj *);
--- linux-2.6.15-rc1-mm2-full/net/sunrpc/xdr.c.old 2005-11-23 02:03:17.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/sunrpc/xdr.c 2005-11-23 02:03:27.000000000 +0100
@@ -93,27 +93,6 @@
}
u32 *
-xdr_decode_string(u32 *p, char **sp, int *lenp, int maxlen)
-{
- unsigned int len;
- char *string;
-
- if ((len = ntohl(*p++)) > maxlen)
- return NULL;
- if (lenp)
- *lenp = len;
- if ((len % 4) != 0) {
- string = (char *) p;
- } else {
- string = (char *) (p - 1);
- memmove(string, p, len);
- }
- string[len] = '\0';
- *sp = string;
- return p + XDR_QUADLEN(len);
-}
-
-u32 *
xdr_decode_string_inplace(u32 *p, char **sp, int *lenp, int maxlen)
{
unsigned int len;
--- linux-2.6.15-rc1-mm2-full/net/sunrpc/sunrpc_syms.c.old 2005-11-23 02:03:35.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/sunrpc/sunrpc_syms.c 2005-11-23 02:03:38.000000000 +0100
@@ -120,7 +120,6 @@
/* Generic XDR */
EXPORT_SYMBOL(xdr_encode_string);
-EXPORT_SYMBOL(xdr_decode_string);
EXPORT_SYMBOL(xdr_decode_string_inplace);
EXPORT_SYMBOL(xdr_decode_netobj);
EXPORT_SYMBOL(xdr_encode_netobj);
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
NFS maillist - NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
^ permalink raw reply
* [2.6 patch] net/ipv6/: make two functions static
From: Adrian Bunk @ 2005-11-23 1:23 UTC (permalink / raw)
To: netdev; +Cc: linux-kernel
This patch makes two needlessly global functions static.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
---
net/ipv6/ip6_output.c | 3 ++-
net/ipv6/ipv6_sockglue.c | 4 ++--
2 files changed, 4 insertions(+), 3 deletions(-)
--- linux-2.6.15-rc1-mm2-full/net/ipv6/ip6_output.c.old 2005-11-23 02:10:08.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/ipv6/ip6_output.c 2005-11-23 02:10:25.000000000 +0100
@@ -774,7 +774,8 @@
*dst = NULL;
return err;
}
-inline int ip6_ufo_append_data(struct sock *sk,
+
+static inline int ip6_ufo_append_data(struct sock *sk,
int getfrag(void *from, char *to, int offset, int len,
int odd, struct sk_buff *skb),
void *from, int length, int hh_len, int fragheaderlen,
--- linux-2.6.15-rc1-mm2-full/net/ipv6/ipv6_sockglue.c.old 2005-11-23 02:10:43.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/ipv6/ipv6_sockglue.c 2005-11-23 02:11:02.000000000 +0100
@@ -628,8 +628,8 @@
return -EINVAL;
}
-int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
- char __user *optval, int len)
+static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
+ char __user *optval, int len)
{
if (!hdr)
return 0;
^ permalink raw reply
* Re: [PATCH 00/13]: Netfilter IPsec support
From: Patrick McHardy @ 2005-11-23 1:20 UTC (permalink / raw)
To: yoshfuji; +Cc: netdev, netfilter-devel, davem, kaber
In-Reply-To: <20051123.073825.106706639.yoshfuji@linux-ipv6.org>
YOSHIFUJI Hideaki / ^[$B5HF#1QL@^[ wrote:
> I believe he can manage these patches in his tree,
> but anyway...
It is kind of annoying redoing 13 patches for every small change.
> Well, it is very important to fix the packet processing
> path issues (including the extension header issue)
> before we merge it to the mainline. Definitely.
> What I want to ensure is that they will not reach the mainline
> tree without resolving those issues.
How about we put the IPv4 patches in now and I continue working
on the IPv6 side? The main approach is not going to change,
and I think users would appreciate having them available in
2.6.15.
^ permalink raw reply
* Re: [PATCH 00/13]: Netfilter IPsec support
From: Patrick McHardy @ 2005-11-23 1:17 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev, netfilter-devel
In-Reply-To: <20051122.143438.84749134.davem@davemloft.net>
David S. Miller wrote:
> From: Patrick McHardy <kaber@trash.net>
> Date: Sun, 20 Nov 2005 17:31:28 +0100
>
>
>>This is the latest netfilter/IPsec patchset. Its purpose is to make
>>IPsec look as much as a normal tunnel device to netfilter as possible
>>and to enable NAT support.
>
>
> I think there are some of these patches that we can merge in
> right now into net-2.6.16...
>
> I want to do this so that Patrick doesn't have to repost
> 13 or so patches every time one of the parts still under
> discussion gets changed.
>
> Actually, it seems the only part under discussion is how to
> avoid extension header reparsing and routing re-lookups on
> the ipv6 side. That could be fixed by a follow-on patch and
> is not %100 necessary for initial integration in my opinion.
>
> Can I get agreement on that? Patrick sends me a dump of the
> current state of his patch set right now, we put that into
> net-2.6.16, and fix problems with followon patches.
>
> Ok?
I would appreciate that, but I want to have a look closer look
at Herbert's patches first. Unfortunately its late and I have
to get up early, so its going to take me a day.
^ permalink raw reply
* [2.6 patch] net/ipv4/netfilter/: small cleanups
From: Adrian Bunk @ 2005-11-23 0:41 UTC (permalink / raw)
To: coreteam; +Cc: netfilter-devel, netdev, linux-kernel
This patch contains the following cleanups:
- make needlessly global code static
- ip_conntrack_core.c: ip_conntrack_flush() -> ip_conntrack_flush(void)
Signed-off-by: Adrian Bunk <bunk@stusta.de>
---
net/ipv4/netfilter/ip_conntrack_core.c | 4 ++--
net/ipv4/netfilter/ip_nat_core.c | 2 +-
net/ipv4/netfilter/ipt_LOG.c | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
--- linux-2.6.15-rc1-mm2-full/net/ipv4/netfilter/ip_conntrack_core.c.old 2005-11-22 22:52:16.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/ipv4/netfilter/ip_conntrack_core.c 2005-11-22 23:00:36.000000000 +0100
@@ -1354,7 +1354,7 @@
get_order(sizeof(struct list_head) * size));
}
-void ip_conntrack_flush()
+void ip_conntrack_flush(void)
{
/* This makes sure all current packets have passed through
netfilter framework. Roll on, two-stage module
@@ -1408,7 +1408,7 @@
return hash;
}
-int set_hashsize(const char *val, struct kernel_param *kp)
+static int set_hashsize(const char *val, struct kernel_param *kp)
{
int i, bucket, hashsize, vmalloced;
int old_vmalloced, old_size;
--- linux-2.6.15-rc1-mm2-full/net/ipv4/netfilter/ipt_LOG.c.old 2005-11-22 22:57:59.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/ipv4/netfilter/ipt_LOG.c 2005-11-22 22:58:08.000000000 +0100
@@ -351,7 +351,7 @@
/* maxlen = 230+ 91 + 230 + 252 = 803 */
}
-struct nf_loginfo default_loginfo = {
+static struct nf_loginfo default_loginfo = {
.type = NF_LOG_TYPE_LOG,
.u = {
.log = {
--- linux-2.6.15-rc1-mm2-full/net/ipv4/netfilter/ip_nat_core.c.old 2005-11-22 22:58:31.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/ipv4/netfilter/ip_nat_core.c 2005-11-22 22:58:39.000000000 +0100
@@ -49,7 +49,7 @@
static struct list_head *bysource;
#define MAX_IP_NAT_PROTO 256
-struct ip_nat_protocol *ip_nat_protos[MAX_IP_NAT_PROTO];
+static struct ip_nat_protocol *ip_nat_protos[MAX_IP_NAT_PROTO];
static inline struct ip_nat_protocol *
__ip_nat_proto_find(u_int8_t protonum)
^ permalink raw reply
* [2.6 patch] net/ipv4/: make two functions static
From: Adrian Bunk @ 2005-11-23 0:38 UTC (permalink / raw)
To: netdev; +Cc: linux-kernel
This patch makes two needlessly global functions static.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
---
net/ipv4/ip_gre.c | 2 +-
net/ipv4/ip_output.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- linux-2.6.15-rc1-mm2-full/net/ipv4/ip_output.c.old 2005-11-22 22:51:16.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/ipv4/ip_output.c 2005-11-22 22:51:29.000000000 +0100
@@ -690,7 +690,7 @@
return csum;
}
-inline int ip_ufo_append_data(struct sock *sk,
+static inline int ip_ufo_append_data(struct sock *sk,
int getfrag(void *from, char *to, int offset, int len,
int odd, struct sk_buff *skb),
void *from, int length, int hh_len, int fragheaderlen,
--- linux-2.6.15-rc1-mm2-full/net/ipv4/ip_gre.c.old 2005-11-22 22:59:32.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/net/ipv4/ip_gre.c 2005-11-22 22:59:45.000000000 +0100
@@ -1217,7 +1217,7 @@
return 0;
}
-int __init ipgre_fb_tunnel_init(struct net_device *dev)
+static int __init ipgre_fb_tunnel_init(struct net_device *dev)
{
struct ip_tunnel *tunnel = (struct ip_tunnel*)dev->priv;
struct iphdr *iph = &tunnel->parms.iph;
^ permalink raw reply
* Re: [NETLINK]: Use tgid instead of pid for nlmsg_pid
From: Herbert Xu @ 2005-11-23 0:03 UTC (permalink / raw)
To: David S. Miller; +Cc: kuznet, cfriesen, netdev, linux-kernel
In-Reply-To: <20051122.144334.23915283.davem@davemloft.net>
On Tue, Nov 22, 2005 at 02:43:34PM -0800, David S. Miller wrote:
>
> Applied, of course.
Thanks Dave.
> It is possible we accidently reintroduced current->pid when
> we redid all of the netlink hashing. :-)
I just checked using git-whatchanged and that line goes back to
2002 :)
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply
* Re: e1000 82571 Packet Splitting
From: Jesse Brandeburg @ 2005-11-22 23:46 UTC (permalink / raw)
To: Jeff V. Merkey; +Cc: linux-kernel, Kernel Netdev Mailing List
In-Reply-To: <43838614.9080807@soleranetworks.com>
this should be on netdev.
On 11/22/05, Jeff V. Merkey <jmerkey@soleranetworks.com> wrote:
>
> I have noted that the e1000 driver is now supporting DMA splitting of
> the packet header and payload into separate pages. I also noticed
> that none of the config options enable it. Is anyone using this feature
> at present and has it even been tested on Linux?
The 6.2.15 driver off http://prdownloads.sf.net/e1000 will enable it
by default. We've gone through our release approval, which includes
quite a bit of testing.
If the patches posted recently don't include that support, I missed
something :-)
This is only on the 82571 and greater hardware that packet split is
supported, BTW.
^ permalink raw reply
* Re: [2.6 patch] do not select NET_CLS
From: Adrian Bunk @ 2005-11-22 23:12 UTC (permalink / raw)
To: David S. Miller; +Cc: kaber, evil, linux-kernel, netdev, zippel
In-Reply-To: <20051122.143713.101129339.davem@davemloft.net>
On Tue, Nov 22, 2005 at 02:37:13PM -0800, David S. Miller wrote:
>...
> Changing config options of any kind can result in the main kernel
> image needing to be rebuilt. One thing we can do to prevent human
> mistakes, is to make the "make modules" pass do a quick "is vmlinux
> uptodate?" check, and if not print out an error message explaining the
> situation and aborting the "make modules" attempt.
This won't work with CONFIG_IKCONFIG=y.
cu
Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed
^ permalink raw reply
* Re: [2.6 patch] do not select NET_CLS
From: David S. Miller @ 2005-11-22 23:00 UTC (permalink / raw)
To: sam; +Cc: kaber, bunk, evil, linux-kernel, netdev, zippel
In-Reply-To: <20051122224914.GA17575@mars.ravnborg.org>
From: Sam Ravnborg <sam@ravnborg.org>
Date: Tue, 22 Nov 2005 23:49:14 +0100
> On Tue, Nov 22, 2005 at 02:37:13PM -0800, David S. Miller wrote:
> >
> > One thing we can do to prevent human
> > mistakes, is to make the "make modules" pass do a quick "is vmlinux
> > uptodate?" check, and if not print out an error message explaining the
> > situation and aborting the "make modules" attempt.
>
> I do not quite follow you here.
If the user tries to do a "make modules" without first rebuilding
their kernel image, then the make will fail if the dependencies
are not satisfied for the main kernel image and it is thus not
up to date.
^ permalink raw reply
* Re: [2.6 patch] do not select NET_CLS
From: Sam Ravnborg @ 2005-11-22 22:49 UTC (permalink / raw)
To: David S. Miller; +Cc: kaber, bunk, evil, linux-kernel, netdev, zippel
In-Reply-To: <20051122.143713.101129339.davem@davemloft.net>
On Tue, Nov 22, 2005 at 02:37:13PM -0800, David S. Miller wrote:
>
> One thing we can do to prevent human
> mistakes, is to make the "make modules" pass do a quick "is vmlinux
> uptodate?" check, and if not print out an error message explaining the
> situation and aborting the "make modules" attempt.
I do not quite follow you here.
For a while I have considered implementing something that told why a
given file was compiled - like:
CC net/ipv4/ip_gre.o due to net/dsfield.h, net/xfrm.h
CC net/ipv4/raw.c due to include/config/ip/mroute.h
The latter is a config option that I do not see a possibility to change
back to a config option syntax (at least not without doing some effort).
My thinking was that 'make V=2' would give above printout.
But what you request is something that keep the dense printout without
building the kernel - right?
Any suggestion for an intuitive syntax to enable that?
'make -n V=2' will not do it.
Sam
^ permalink raw reply
* Re: [NETLINK]: Use tgid instead of pid for nlmsg_pid
From: David S. Miller @ 2005-11-22 22:43 UTC (permalink / raw)
To: herbert; +Cc: kuznet, cfriesen, netdev, linux-kernel
In-Reply-To: <E1EeJxb-0006xG-00@gondolin.me.apana.org.au>
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 22 Nov 2005 09:16:27 +1100
> Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> wrote:
> >
> > I agree, apparently netlink_autobind was missed when sed'ing pid->tgid.
> > Of course, it does not matter, but tgid is nicer choice from user's viewpoint.
>
> Great, here is the patch to do just that.
>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied, of course.
I can't for the life of me figure out how we missed this when
we fixed up all the current->pid references under net/.
Ulrich Drepper let us know that the problem existed, and
I was sure we eliminated all such cases.
It is possible we accidently reintroduced current->pid when
we redid all of the netlink hashing. :-)
^ permalink raw reply
* Re: [PATCH 00/13]: Netfilter IPsec support
From: YOSHIFUJI Hideaki / 吉藤英明 @ 2005-11-22 22:38 UTC (permalink / raw)
To: davem; +Cc: netdev, netfilter-devel, kaber
In-Reply-To: <20051122.143438.84749134.davem@davemloft.net>
In article <20051122.143438.84749134.davem@davemloft.net> (at Tue, 22 Nov 2005 14:34:38 -0800 (PST)), "David S. Miller" <davem@davemloft.net> says:
> I want to do this so that Patrick doesn't have to repost
> 13 or so patches every time one of the parts still under
> discussion gets changed.
>
> Actually, it seems the only part under discussion is how to
> avoid extension header reparsing and routing re-lookups on
> the ipv6 side. That could be fixed by a follow-on patch and
> is not %100 necessary for initial integration in my opinion.
>
> Can I get agreement on that? Patrick sends me a dump of the
> current state of his patch set right now, we put that into
> net-2.6.16, and fix problems with followon patches.
>
> Ok?
I believe he can manage these patches in his tree,
but anyway...
Well, it is very important to fix the packet processing
path issues (including the extension header issue)
before we merge it to the mainline. Definitely.
What I want to ensure is that they will not reach the mainline
tree without resolving those issues.
Thank you.
--yoshfuji
^ permalink raw reply
* Re: [2.6 patch] do not select NET_CLS
From: David S. Miller @ 2005-11-22 22:37 UTC (permalink / raw)
To: kaber; +Cc: bunk, evil, linux-kernel, netdev, zippel
In-Reply-To: <4381F2D2.5000605@trash.net>
From: Patrick McHardy <kaber@trash.net>
Date: Mon, 21 Nov 2005 17:16:18 +0100
> Adrian Bunk wrote:
> > This patch therefore changes NET_CLS back to the 2.6.14 status quo of
> > being an user-visible option.
>
> I disagree with this patch. NET_CLS enables the infrastructure support
> for classifiers. Users generally don't care about infrastructure but
> directly usable things, so I'd prefer to have it automatically selected.
> And there are lots of other cases where enabling a module causes changes
> in the kernel image. Some examples include some of the netfilter stuff,
> the IPsec transforms, NET_CLS_ROUTE4, the ieee80211 stuff, and a lot
> more.
I agree with Patrick.
Changing config options of any kind can result in the main kernel
image needing to be rebuilt. One thing we can do to prevent human
mistakes, is to make the "make modules" pass do a quick "is vmlinux
uptodate?" check, and if not print out an error message explaining the
situation and aborting the "make modules" attempt.
^ permalink raw reply
* Re: [PATCH 00/13]: Netfilter IPsec support
From: David S. Miller @ 2005-11-22 22:34 UTC (permalink / raw)
To: kaber; +Cc: netdev, netfilter-devel
In-Reply-To: <20051120163128.16666.38111.sendpatchset@localhost.localdomain>
From: Patrick McHardy <kaber@trash.net>
Date: Sun, 20 Nov 2005 17:31:28 +0100
> This is the latest netfilter/IPsec patchset. Its purpose is to make
> IPsec look as much as a normal tunnel device to netfilter as possible
> and to enable NAT support.
I think there are some of these patches that we can merge in
right now into net-2.6.16...
I want to do this so that Patrick doesn't have to repost
13 or so patches every time one of the parts still under
discussion gets changed.
Actually, it seems the only part under discussion is how to
avoid extension header reparsing and routing re-lookups on
the ipv6 side. That could be fixed by a follow-on patch and
is not %100 necessary for initial integration in my opinion.
Can I get agreement on that? Patrick sends me a dump of the
current state of his patch set right now, we put that into
net-2.6.16, and fix problems with followon patches.
Ok?
^ permalink raw reply
* Re: [PATCH] NETFILTER arp_tables: Fix NUMA optimization
From: David S. Miller @ 2005-11-22 22:28 UTC (permalink / raw)
To: laforge; +Cc: netdev, netfilter-devel, dada1
In-Reply-To: <20051119103131.GE20775@sunbeam.de.gnumonks.org>
From: Harald Welte <laforge@netfilter.org>
Date: Sat, 19 Nov 2005 11:31:31 +0100
> There's another one that I detected while merging those changes with
> x_tables (painful). Please merge:
>
> [NETFILTER] arp_tables: Fix bug introduced with NUMA aware allocation
>
> This fix shows how bad I am with copy & paste.
>
> Signed-off-by: Harald Welte <laforge@netfilter.org>
Added to net-2.6.16, thanks a lot.
^ permalink raw reply
* Re: e1000 82571 Packet Splitting
From: Jeff V. Merkey @ 2005-11-22 22:27 UTC (permalink / raw)
To: Jesse Brandeburg; +Cc: linux-kernel, Kernel Netdev Mailing List
In-Reply-To: <4807377b0511221546h7a16c0a9p793e441197b23118@mail.gmail.com>
Jesse Brandeburg wrote:
>this should be on netdev.
>
>On 11/22/05, Jeff V. Merkey <jmerkey@soleranetworks.com> wrote:
>
>
>>I have noted that the e1000 driver is now supporting DMA splitting of
>>the packet header and payload into separate pages. I also noticed
>>that none of the config options enable it. Is anyone using this feature
>>at present and has it even been tested on Linux?
>>
>>
>
>The 6.2.15 driver off http://prdownloads.sf.net/e1000 will enable it
>by default. We've gone through our release approval, which includes
>quite a bit of testing.
>If the patches posted recently don't include that support, I missed
>something :-)
>
>This is only on the 82571 and greater hardware that packet split is
>supported, BTW.
>
>
>
Got it. I am merging packet capture support into the e1000 for DSFS for
direct cache DMA support. I noticed the two distinct fill routines
for the ring buffer. I have enabled DSFS for both with this driver. I
will post patches late tonight or in the morning for the 82571 support
for DSFS. I will
also be posting the patches for 2.6.12, 2.6.10. 2.6.14, Suse 9 and 10.0,
Red Hat ES/AS 3 and 4, and Fedora Core 2/3/4 by end of week with the
packet splitting capabilities with packet capture on DSFS. This is a
very good optimization and should come in handy for reducing header copies
in the protocol stacks.
Jeff
^ permalink raw reply
* Re: [PATCH] ebtables: port ebt*[u]log.c to nf[netlink]_log
From: David S. Miller @ 2005-11-22 22:26 UTC (permalink / raw)
To: bdschuym-LPO8gxj9N8aZIoH1IeqzKA
Cc: laforge-TgoAw6mPHtdg9hUCZPvPmw, netdev-u79uwXL29TY76Z2rM5mHXA,
ebtables-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f
In-Reply-To: <1132078881.3464.5.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org>
From: Bart De Schuymer <bdschuym-LPO8gxj9N8aZIoH1IeqzKA@public.gmane.org>
Date: Tue, 15 Nov 2005 18:21:21 +0000
> [NETFILTER] ebtables: Support nf_log API from ebt_log and ebt_ulog
>
> This makes ebt_log and ebt_ulog use the new nf_log api. This enables
> the bridging packet filter to log packets e.g. via nfnetlink_log.
>
> Signed-off-by: Bart De Schuymer <bdschuym-LPO8gxj9N8aZIoH1IeqzKA@public.gmane.org>
> Signed-off-by: Harald Welte <laforge-Cap9r6Oaw4JrovVCs/uTlw@public.gmane.org>
I'm going to queue this up for 2.6.16, thanks.
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
^ permalink raw reply
* Re: Network lockup under load
From: Herbert Xu @ 2005-11-22 20:40 UTC (permalink / raw)
To: Joe Korty; +Cc: David S. Miller, linux-kernel, netdev
In-Reply-To: <20051122164502.GA12498@tsunami.ccur.com>
On Tue, Nov 22, 2005 at 04:45:02PM +0000, Joe Korty wrote:
>
> To trigger the lockup, I do a 'scp -rp' of the kernel
> tree from a machine with a defective kernel to any other
> machine. It triggers anywhere after the first file
> transfered, to perhaps 30 files transfered.
Please generate a stack backtrace of your processes using either
CTRL-SCROLLLOCK or SysRq.
Thanks,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply
* Re: [PATCH 02/10]: [NETFILTER]: Defer fragmentation in ip_output when connection tracking is used
From: Harald Welte @ 2005-11-22 14:19 UTC (permalink / raw)
To: Patrick McHardy
Cc: Kernel Netdev Mailing List, Netfilter Development Mailinglist,
Herbert Xu
In-Reply-To: <4382D419.6070705@trash.net>
[-- Attachment #1: Type: text/plain, Size: 763 bytes --]
On Tue, Nov 22, 2005 at 09:17:29AM +0100, Patrick McHardy wrote:
> >>I've CCed Harald for his opinion in case I missed something.
> >I don't think you've missed something. I agree that the features you
> >pointed out seem to be useful and/or important.
>
> I hope you meant to write "don't seem to be"? :)
yes. I shouldn't be answering emails while holding a tutorial, sorry.
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply
* Re: [PATCH 05/13]: [IPV4/6]: Netfilter IPsec output hooks
From: Herbert Xu @ 2005-11-22 12:13 UTC (permalink / raw)
To: Patrick McHardy; +Cc: netdev, netfilter-devel, davem
In-Reply-To: <20051122103139.GA4632@gondor.apana.org.au>
On Tue, Nov 22, 2005 at 09:31:39PM +1100, herbert wrote:
>
> Unfortunately it looks like gcc 3.3.5 at least is too dumb to optimise
> it away. I think we'll need a better strategy.
OK, the idea is still the same: Move the loop from dst_output into
xfrm4_output/xfrm6_output since they're the only ones who need to it.
In order to avoid the tail call issue, I've added the inline function
nf_hook which is nf_hook_slow plus the empty list check.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -168,6 +168,37 @@ void nf_log_packet(int pf,
const struct net_device *out,
struct nf_loginfo *li,
const char *fmt, ...);
+
+int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
+ struct net_device *indev, struct net_device *outdev,
+ int (*okfn)(struct sk_buff *), int thresh);
+
+/**
+ * nf_hook_thresh - call a netfilter hook
+ *
+ * Returns 1 if the hook has allowed the packet to pass. The function
+ * okfn must be invoked by the caller in this case. Any other return
+ * value indicates the packet has been consumed by the hook.
+ */
+static inline int nf_hook_thresh(int pf, unsigned int hook,
+ struct sk_buff **pskb,
+ struct net_device *indev,
+ struct net_device *outdev,
+ int (*okfn)(struct sk_buff *), int thresh)
+{
+#ifndef CONFIG_NETFILTER_DEBUG
+ if (list_empty(&nf_hooks[pf][hook]))
+ return 1;
+#endif
+ return nf_hook_slow(pf, hook, pskb, indev, outdev, okfn, thresh);
+}
+
+static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
+ struct net_device *indev, struct net_device *outdev,
+ int (*okfn)(struct sk_buff *))
+{
+ return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN);
+}
/* Activate hook; either okfn or kfree_skb called, unless a hook
returns NF_STOLEN (in which case, it's up to the hook to deal with
@@ -188,35 +219,17 @@ void nf_log_packet(int pf,
/* This is gross, but inline doesn't cut it for avoiding the function
call in fast path: gcc doesn't inline (needs value tracking?). --RR */
-#ifdef CONFIG_NETFILTER_DEBUG
-#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
-({int __ret; \
-if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
- __ret = (okfn)(skb); \
-__ret;})
-#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
-({int __ret; \
-if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1) \
- __ret = (okfn)(skb); \
-__ret;})
-#else
-#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
-({int __ret; \
-if (list_empty(&nf_hooks[pf][hook]) || \
- (__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
- __ret = (okfn)(skb); \
-__ret;})
+
+/* HX: It's slightly less gross now. */
+
#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
({int __ret; \
-if (list_empty(&nf_hooks[pf][hook]) || \
- (__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1) \
+if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1)\
__ret = (okfn)(skb); \
__ret;})
-#endif
-int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
- struct net_device *indev, struct net_device *outdev,
- int (*okfn)(struct sk_buff *), int thresh);
+#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
+ NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN)
/* Call setsockopt() */
int nf_setsockopt(struct sock *sk, int pf, int optval, char __user *opt,
diff --git a/include/net/dst.h b/include/net/dst.h
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -224,16 +224,7 @@ static inline void dst_set_expires(struc
/* Output packet to network from transport. */
static inline int dst_output(struct sk_buff *skb)
{
- int err;
-
- for (;;) {
- err = skb->dst->output(skb);
-
- if (likely(err == 0))
- return err;
- if (unlikely(err != NET_XMIT_BYPASS))
- return err;
- }
+ return skb->dst->output(skb);
}
/* Input packet from network to transport. */
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -8,8 +8,10 @@
* 2 of the License, or (at your option) any later version.
*/
+#include <linux/compiler.h>
#include <linux/skbuff.h>
#include <linux/spinlock.h>
+#include <linux/netfilter_ipv4.h>
#include <net/inet_ecn.h>
#include <net/ip.h>
#include <net/xfrm.h>
@@ -95,7 +97,7 @@ out:
return ret;
}
-int xfrm4_output(struct sk_buff *skb)
+static int xfrm4_output_one(struct sk_buff *skb)
{
struct dst_entry *dst = skb->dst;
struct xfrm_state *x = dst->xfrm;
@@ -138,7 +140,7 @@ int xfrm4_output(struct sk_buff *skb)
x = dst->xfrm;
} while (x && !x->props.mode);
- err = NET_XMIT_BYPASS;
+ err = 0;
out_exit:
return err;
@@ -148,3 +150,34 @@ error_nolock:
kfree_skb(skb);
goto out_exit;
}
+
+static int xfrm4_output_finish(struct sk_buff *skb)
+{
+ int err;
+
+ while (likely((err = xfrm4_output_one(skb)) == 0)) {
+ nf_reset(skb);
+
+ err = nf_hook(PF_INET, NF_IP_LOCAL_OUT, &skb, NULL,
+ skb->dst->dev, dst_output);
+ if (unlikely(err != 1))
+ break;
+
+ err = 0;
+ if (!skb->dst->xfrm)
+ break;
+
+ err = nf_hook(PF_INET, NF_IP_POST_ROUTING, &skb, NULL,
+ skb->dst->dev, xfrm4_output_finish);
+ if (unlikely(err != 1))
+ break;
+ }
+
+ return err;
+}
+
+int xfrm4_output(struct sk_buff *skb)
+{
+ return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
+ xfrm4_output_finish);
+}
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -9,9 +9,11 @@
* 2 of the License, or (at your option) any later version.
*/
+#include <linux/compiler.h>
#include <linux/skbuff.h>
#include <linux/spinlock.h>
#include <linux/icmpv6.h>
+#include <linux/netfilter_ipv6.h>
#include <net/dsfield.h>
#include <net/inet_ecn.h>
#include <net/ipv6.h>
@@ -92,7 +94,7 @@ static int xfrm6_tunnel_check_size(struc
return ret;
}
-int xfrm6_output(struct sk_buff *skb)
+static int xfrm6_output_one(struct sk_buff *skb)
{
struct dst_entry *dst = skb->dst;
struct xfrm_state *x = dst->xfrm;
@@ -137,7 +139,7 @@ int xfrm6_output(struct sk_buff *skb)
x = dst->xfrm;
} while (x && !x->props.mode);
- err = NET_XMIT_BYPASS;
+ err = 0;
out_exit:
return err;
@@ -147,3 +149,34 @@ error_nolock:
kfree_skb(skb);
goto out_exit;
}
+
+static int xfrm6_output_finish(struct sk_buff *skb)
+{
+ int err;
+
+ while (likely((err = xfrm6_output_one(skb)) == 0)) {
+ nf_reset(skb);
+
+ err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL,
+ skb->dst->dev, dst_output);
+ if (unlikely(err != 1))
+ break;
+
+ err = 0;
+ if (!skb->dst->xfrm)
+ break;
+
+ err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL,
+ skb->dst->dev, xfrm6_output_finish);
+ if (unlikely(err != 1))
+ break;
+ }
+
+ return err;
+}
+
+int xfrm6_output(struct sk_buff *skb)
+{
+ return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev,
+ xfrm6_output_finish);
+}
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox