* Re: Will RFC1146 (tcp alternative checksum options) be implemented in Linux tcp stack ?
From: Matti Aarnio @ 2007-10-16 10:28 UTC (permalink / raw)
To: Yanping Du; +Cc: netdev
In-Reply-To: <887901.30138.qm@web55205.mail.re4.yahoo.com>
On Mon, Oct 15, 2007 at 06:15:11PM -0700, Yanping Du wrote:
> Hi,
>
> We found the standard 16-bit tcp checksum is not
> strong enough in some cases. Is there any roadmap on
> implementing RFC1146 (tcp alternative checksum
> options) in Linux tcp stack ? If yes, how soon will
> that be in ?
If you want to pay to somebody to implement it, possibly soon.
Otherwise it is up to whims of capable kernel coders, who
usually have their hands quite full.
The tcp alternate checksum option does have severe performance
hinderance issue. It may be implemented by intermingling it
into standard tcp_checksum_and_copy routine, but in cases
where the hardware can do tcp checksum offloading, it definitely
does not improve the performance.
Your alternate approach could be to use a IPSEC VPN tunnel,
which will detect an attempt to alter data ( = transmission
error ) even when the original TCP does not detect anything.
Yet third way could be to do it in application: ssh datastream
as one example - or tunnel via SSH port forward.
Need for alternate checksums does appear to indicate that you
are using bad quality transmission system -- those are not
usually very high speed things, and then hacks like IPSEC or
SSH tunnels are excellent choices.
Nevertheless, adding checksum complexity/size on each packet
does not guarantee error detection, it merely lowers the
probability of error detection failure. There _will_ happen
an error which wasn't detected, but will it be once a minute
or once a year, or once per billion years..
Bad quality ( = error introducing ) transmission system will
also make speedy data transmission that much more difficult,
thus my presumption that it isn't very fast link...
Anyway, we have seen data corruption on disk, over the network
etc. Having application level MD5 checksumming of the datastream
every N kilobytes has its own attractions. Including embedding
those checksums in the stored datastreams.
> Please kindly copy reply to my email address as I've
> not subscribed the netdev@ mailing list at present.
>
> http://www.faqs.org/rfcs/rfc1146.html
>
> Thanks!
> -Yanping
/Matti Aarnio
^ permalink raw reply
* Re: [PATCH 5/10] [NET]: Avoid unnecessary cloning for ingress filtering
From: jamal @ 2007-10-16 10:28 UTC (permalink / raw)
To: Alexey Kuznetsov; +Cc: Herbert Xu, Patrick McHardy, David Miller, netdev
In-Reply-To: <20071015145527.GA11689@ms2.inr.ac.ru>
On Mon, 2007-15-10 at 18:55 +0400, Alexey Kuznetsov wrote:
> Hello!
Didnt mean to wake you up Alexey ;->
> I see not so many places inside net/sched/act* where skb_clone is used.
> Exactly one in act_mirred.c, to be more exact. Did I miss something?
No you are right, thats the only spot at the moment.
What i meant however was the design-intent/enviromental-rules for all
actions that branch is to clone, and when you do that you reset those
fields i described. I am looking at the new clone and i can see
Herbert's point - it does look less pleasant to stare at with that
#ifdef; i will send a patch to pull it out and also write a small doc to
describe the environmental rules.
cheers,
jamal
^ permalink raw reply
* Re: [PATCH 0/2] Interface groups
From: Laszlo Attila Toth @ 2007-10-16 9:47 UTC (permalink / raw)
To: Philip Craig; +Cc: netdev, netfilter-devel
In-Reply-To: <47147B49.706@snapgear.com>
Philip Craig írta:
> Laszlo Attila Toth wrote:
>> Hello,
>>
>> Different network interfaces can be grouped using the same group ID. With this
>> patch fewer netfilter rules are necessary but it may also be used by routing.
>
> This allows an interface to belong to only one group. I expect there are
> situations where you want more. eg you might want a group of all pptp
> connections, and another group of pptp connections for a subset of users.
With masked values it should work with only one group.
--
Attila
^ permalink raw reply
* Re: [PATCH 2/2] Interface group match - netfilter part
From: Laszlo Attila Toth @ 2007-10-16 9:46 UTC (permalink / raw)
To: Patrick McHardy; +Cc: netdev, netfilter-devel
In-Reply-To: <47147692.8070709@trash.net>
Patrick McHardy írta:
> Laszlo Attila Toth wrote:
>> +static int match(const struct sk_buff *skb,
>> + const struct net_device *in,
>> + const struct net_device *out,
>> + const struct xt_match *match,
>> + const void *matchinfo,
>> + int offset,
>> + unsigned int protoff,
>> + int *hotdrop)
>> +{
>> + const struct xt_ifgroup_info *info = matchinfo;
>> +
>> + return ((in->ifgroup & info->mask) == info->group) ^ info->invert;
>
> The input interface is only valid in PREROUTING, INPUT and FORWARD.
> Why don't you support output-interface matching?
>
It has no specific reason. I'll make it with the other changes you
wrote. I'll send the iptables patch at the same time.
--
Attila
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [IPROUTE2 PATCH] Interface group as new ip link option
From: Laszlo Attila Toth @ 2007-10-16 9:33 UTC (permalink / raw)
To: Patrick McHardy; +Cc: netdev, netfilter-devel
In-Reply-To: <47147892.4090801@trash.net>
Patrick McHardy írta:
> Laszlo Attila Toth wrote:
>> diff --git a/man/man8/ip.8 b/man/man8/ip.8
>> index c74440a..8e6a9a3 100644
>> --- a/man/man8/ip.8
>> +++ b/man/man8/ip.8
>> @@ -511,6 +511,11 @@ already configured.
>> @@ -1835,3 +1840,6 @@ was written by Alexey N. Kuznetsov and added in
>> Linux 2.2.
>>
>> .SH AUTHOR
>> Original Manpage by Michail Litvak <mci@owl.openwall.com>
>> +.br
>> +Modified for ZorpOS by Tamas Pal <folti@balabit.hu>
>
>
> Did you really intend to include this?
>
I forgot to cut it off because in ZorpOS (v3.1, which is Sarge-based)
the manual page contains this part.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: Resend: [IPROUTE2 PATCH] Interface group as new ip link option
From: Patrick McHardy @ 2007-10-16 9:11 UTC (permalink / raw)
To: Laszlo Attila Toth; +Cc: netdev, netfilter-devel
In-Reply-To: <1192525384222-git-send-email-panther@balabit.hu>
Laszlo Attila Toth wrote:
> +static int set_group(const char *dev, int ifgroup)
> +{
> + struct {
> + struct nlmsghdr n;
> + struct ifinfomsg ifi;
> + char buf[256];
> + } req;
> + struct rtnl_handle rth;
> +
> + memset(&req, 0, sizeof(req));
> + req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifi));
> + req.n.nlmsg_flags = NLM_F_REQUEST;
> + req.n.nlmsg_type = RTM_SETLINK;
> +
> + req.ifi.ifi_index = -1;
> +
> + addattr_l(&req.n, sizeof(req), IFLA_IFNAME, dev, strlen(dev)+1);
> + addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &ifgroup, sizeof(ifgroup));
> + if (rtnl_open(&rth, 0) < 0)
> + exit(1);
> + if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
> + return -1;
> + rtnl_close(&rth);
> + return 0;
> +}
> +
> static int get_address(const char *dev, int *htype)
> {
> struct ifreq ifr;
> @@ -545,6 +582,7 @@ static int do_set(int argc, char **argv)
> __u32 mask = 0;
> __u32 flags = 0;
> int qlen = -1;
> + __u32 group = 0;
> int mtu = -1;
> char *newaddr = NULL;
> char *newbrd = NULL;
> @@ -577,6 +615,13 @@ static int do_set(int argc, char **argv)
> duparg("txqueuelen", *argv);
> if (get_integer(&qlen, *argv, 0))
> invarg("Invalid \"txqueuelen\" value\n", *argv);
> + } else if (matches(*argv, "group") == 0) {
> + NEXT_ARG();
> + if (group != 0)
> + duparg("group", *argv);
> +
> + if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
> + invarg("\"group\" value is invalid\n", *argv);
> } else if (strcmp(*argv, "mtu") == 0) {
> NEXT_ARG();
> if (mtu != -1)
> @@ -696,6 +741,10 @@ static int do_set(int argc, char **argv)
> return -1;
> }
> }
> + if (group) {
> + if (set_group(dev, group) < 0)
> + return -1;
> + }
This part looks useless, for new kernels iproute always uses netlink
to configure things and old kernels don't support this feature. So
there's no need to support it in the ioctl-based configuration path.
^ permalink raw reply
* Resend: [IPROUTE2 PATCH] Interface group as new ip link option
From: Laszlo Attila Toth @ 2007-10-16 9:03 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
In-Reply-To: <ifgroup.20071015.1192520046.panther@balabit.hu>
Interfaces can be grouped and each group has an unique positive integer ID.
It can be set via ip link.
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
---
include/linux/if_link.h | 2 +
include/rt_names.h | 2 +
ip/ipaddress.c | 4 +++
ip/iplink.c | 49 +++++++++++++++++++++++++++++++++++++
lib/rt_names.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++
man/man8/ip.8 | 8 ++++++
6 files changed, 127 insertions(+), 0 deletions(-)
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 23b3a8e..2dfb0b7 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -78,6 +78,8 @@ enum
IFLA_LINKMODE,
IFLA_LINKINFO,
#define IFLA_LINKINFO IFLA_LINKINFO
+ IFLA_IFGROUP,
+#define IFLA_IFGROUP IFLA_IFGROUP
__IFLA_MAX
};
diff --git a/include/rt_names.h b/include/rt_names.h
index 07a10e0..72c5247 100644
--- a/include/rt_names.h
+++ b/include/rt_names.h
@@ -8,11 +8,13 @@ char* rtnl_rtscope_n2a(int id, char *buf, int len);
char* rtnl_rttable_n2a(__u32 id, char *buf, int len);
char* rtnl_rtrealm_n2a(int id, char *buf, int len);
char* rtnl_dsfield_n2a(int id, char *buf, int len);
+char* rtnl_ifgroup_n2a(int id, char *buf, int len);
int rtnl_rtprot_a2n(__u32 *id, char *arg);
int rtnl_rtscope_a2n(__u32 *id, char *arg);
int rtnl_rttable_a2n(__u32 *id, char *arg);
int rtnl_rtrealm_a2n(__u32 *id, char *arg);
int rtnl_dsfield_a2n(__u32 *id, char *arg);
+int rtnl_ifgroup_a2n(__u32 *id, char *arg);
const char *inet_proto_n2a(int proto, char *buf, int len);
int inet_proto_a2n(char *buf);
diff --git a/ip/ipaddress.c b/ip/ipaddress.c
index 518d8cd..405e85c 100644
--- a/ip/ipaddress.c
+++ b/ip/ipaddress.c
@@ -227,6 +227,10 @@ int print_linkinfo(const struct sockaddr_nl *who,
fprintf(fp, "mtu %u ", *(int*)RTA_DATA(tb[IFLA_MTU]));
if (tb[IFLA_QDISC])
fprintf(fp, "qdisc %s ", (char*)RTA_DATA(tb[IFLA_QDISC]));
+ if (tb[IFLA_IFGROUP]) {
+ SPRINT_BUF(b1);
+ fprintf(fp, "group %s ", rtnl_ifgroup_n2a(*(int*)RTA_DATA(tb[IFLA_IFGROUP]), b1, sizeof(b1)));
+ }
#ifdef IFLA_MASTER
if (tb[IFLA_MASTER]) {
SPRINT_BUF(b1);
diff --git a/ip/iplink.c b/ip/iplink.c
index 8e0ed2a..87901e7 100644
--- a/ip/iplink.c
+++ b/ip/iplink.c
@@ -27,6 +27,7 @@
#include <string.h>
#include <sys/ioctl.h>
#include <linux/sockios.h>
+#include <linux/rtnetlink.h>
#include "rt_names.h"
#include "utils.h"
@@ -46,6 +47,7 @@ void iplink_usage(void)
fprintf(stderr, " promisc { on | off } |\n");
fprintf(stderr, " trailers { on | off } |\n");
fprintf(stderr, " txqueuelen PACKETS |\n");
+ fprintf(stderr, " group GROUP |\n");
fprintf(stderr, " name NEWNAME |\n");
fprintf(stderr, " address LLADDR | broadcast LLADDR |\n");
fprintf(stderr, " mtu MTU }\n");
@@ -145,6 +147,7 @@ static int iplink_have_newlink(void)
static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
{
int qlen = -1;
+ __u32 group = 0;
int mtu = -1;
int len;
char abuf[32];
@@ -197,6 +200,14 @@ static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
if (get_integer(&qlen, *argv, 0))
invarg("Invalid \"txqueuelen\" value\n", *argv);
addattr_l(&req.n, sizeof(req), IFLA_TXQLEN, &qlen, 4);
+ } else if (matches(*argv, "group") == 0) {
+ NEXT_ARG();
+ if (group != 0)
+ duparg("group", *argv);
+
+ if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
+ invarg("\"group\" value is invalid\n", *argv);
+ addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &group, sizeof(group));
} else if (strcmp(*argv, "mtu") == 0) {
NEXT_ARG();
if (mtu != -1)
@@ -462,6 +473,32 @@ static int set_mtu(const char *dev, int mtu)
return 0;
}
+static int set_group(const char *dev, int ifgroup)
+{
+ struct {
+ struct nlmsghdr n;
+ struct ifinfomsg ifi;
+ char buf[256];
+ } req;
+ struct rtnl_handle rth;
+
+ memset(&req, 0, sizeof(req));
+ req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifi));
+ req.n.nlmsg_flags = NLM_F_REQUEST;
+ req.n.nlmsg_type = RTM_SETLINK;
+
+ req.ifi.ifi_index = -1;
+
+ addattr_l(&req.n, sizeof(req), IFLA_IFNAME, dev, strlen(dev)+1);
+ addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &ifgroup, sizeof(ifgroup));
+ if (rtnl_open(&rth, 0) < 0)
+ exit(1);
+ if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
+ return -1;
+ rtnl_close(&rth);
+ return 0;
+}
+
static int get_address(const char *dev, int *htype)
{
struct ifreq ifr;
@@ -545,6 +582,7 @@ static int do_set(int argc, char **argv)
__u32 mask = 0;
__u32 flags = 0;
int qlen = -1;
+ __u32 group = 0;
int mtu = -1;
char *newaddr = NULL;
char *newbrd = NULL;
@@ -577,6 +615,13 @@ static int do_set(int argc, char **argv)
duparg("txqueuelen", *argv);
if (get_integer(&qlen, *argv, 0))
invarg("Invalid \"txqueuelen\" value\n", *argv);
+ } else if (matches(*argv, "group") == 0) {
+ NEXT_ARG();
+ if (group != 0)
+ duparg("group", *argv);
+
+ if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
+ invarg("\"group\" value is invalid\n", *argv);
} else if (strcmp(*argv, "mtu") == 0) {
NEXT_ARG();
if (mtu != -1)
@@ -696,6 +741,10 @@ static int do_set(int argc, char **argv)
return -1;
}
}
+ if (group) {
+ if (set_group(dev, group) < 0)
+ return -1;
+ }
if (mask)
return do_chflags(dev, flags, mask);
return 0;
diff --git a/lib/rt_names.c b/lib/rt_names.c
index 8d019a0..a067e74 100644
--- a/lib/rt_names.c
+++ b/lib/rt_names.c
@@ -446,3 +446,65 @@ int rtnl_dsfield_a2n(__u32 *id, char *arg)
return 0;
}
+static char * rtnl_rtifgroup_tab[256] = {
+ "0",
+};
+
+static int rtnl_rtifgroup_init;
+
+static void rtnl_rtifgroup_initialize(void)
+{
+ rtnl_rtifgroup_init = 1;
+ rtnl_tab_initialize("/etc/iproute2/rt_ifgroup",
+ rtnl_rtifgroup_tab, 256);
+}
+
+char * rtnl_ifgroup_n2a(int id, char *buf, int len)
+{
+ if (id<0 || id>=256) {
+ snprintf(buf, len, "%d", id);
+ return buf;
+ }
+ if (!rtnl_rtifgroup_tab[id]) {
+ if (!rtnl_rtifgroup_init)
+ rtnl_rtifgroup_initialize();
+ }
+ if (rtnl_rtifgroup_tab[id])
+ return rtnl_rtifgroup_tab[id];
+ snprintf(buf, len, "0x%02x", id);
+ return buf;
+}
+
+
+int rtnl_ifgroup_a2n(__u32 *id, char *arg)
+{
+ static char *cache = NULL;
+ static unsigned long res;
+ char *end;
+ int i;
+
+ if (cache && strcmp(cache, arg) == 0) {
+ *id = res;
+ return 0;
+ }
+
+ if (!rtnl_rtifgroup_init)
+ rtnl_rtifgroup_initialize();
+
+ for (i=0; i<256; i++) {
+ if (rtnl_rtifgroup_tab[i] &&
+ strcmp(rtnl_rtifgroup_tab[i], arg) == 0) {
+ cache = rtnl_rtifgroup_tab[i];
+ res = i;
+ *id = res;
+ return 0;
+ }
+ }
+
+ res = strtoul(arg, &end, 16);
+ if (!end || end == arg || *end || res > 255)
+ return -1;
+ *id = res;
+ return 0;
+}
+
diff --git a/man/man8/ip.8 b/man/man8/ip.8
index c74440a..8e6a9a3 100644
--- a/man/man8/ip.8
+++ b/man/man8/ip.8
@@ -511,6 +511,11 @@ already configured.
change the transmit queue length of the device.
.TP
+.BI group " GROUP"
+.TP
+change the interface group identifier of the device.
+
+.TP
.BI mtu " NUMBER"
change the
.I MTU
--
1.5.2.5
^ permalink raw reply related
* Resend: [IPROUTE2 PATCH] Interface group as new ip link option
From: Laszlo Attila Toth @ 2007-10-16 9:03 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
In-Reply-To: <ifgroup.20071015.1192520046.panther@balabit.hu>
Interfaces can be grouped and each group has an unique positive integer ID.
It can be set via ip link.
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
---
include/linux/if_link.h | 2 +
include/rt_names.h | 2 +
ip/ipaddress.c | 4 +++
ip/iplink.c | 49 +++++++++++++++++++++++++++++++++++++
lib/rt_names.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++
man/man8/ip.8 | 8 ++++++
6 files changed, 127 insertions(+), 0 deletions(-)
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 23b3a8e..2dfb0b7 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -78,6 +78,8 @@ enum
IFLA_LINKMODE,
IFLA_LINKINFO,
#define IFLA_LINKINFO IFLA_LINKINFO
+ IFLA_IFGROUP,
+#define IFLA_IFGROUP IFLA_IFGROUP
__IFLA_MAX
};
diff --git a/include/rt_names.h b/include/rt_names.h
index 07a10e0..72c5247 100644
--- a/include/rt_names.h
+++ b/include/rt_names.h
@@ -8,11 +8,13 @@ char* rtnl_rtscope_n2a(int id, char *buf, int len);
char* rtnl_rttable_n2a(__u32 id, char *buf, int len);
char* rtnl_rtrealm_n2a(int id, char *buf, int len);
char* rtnl_dsfield_n2a(int id, char *buf, int len);
+char* rtnl_ifgroup_n2a(int id, char *buf, int len);
int rtnl_rtprot_a2n(__u32 *id, char *arg);
int rtnl_rtscope_a2n(__u32 *id, char *arg);
int rtnl_rttable_a2n(__u32 *id, char *arg);
int rtnl_rtrealm_a2n(__u32 *id, char *arg);
int rtnl_dsfield_a2n(__u32 *id, char *arg);
+int rtnl_ifgroup_a2n(__u32 *id, char *arg);
const char *inet_proto_n2a(int proto, char *buf, int len);
int inet_proto_a2n(char *buf);
diff --git a/ip/ipaddress.c b/ip/ipaddress.c
index 518d8cd..405e85c 100644
--- a/ip/ipaddress.c
+++ b/ip/ipaddress.c
@@ -227,6 +227,10 @@ int print_linkinfo(const struct sockaddr_nl *who,
fprintf(fp, "mtu %u ", *(int*)RTA_DATA(tb[IFLA_MTU]));
if (tb[IFLA_QDISC])
fprintf(fp, "qdisc %s ", (char*)RTA_DATA(tb[IFLA_QDISC]));
+ if (tb[IFLA_IFGROUP]) {
+ SPRINT_BUF(b1);
+ fprintf(fp, "group %s ", rtnl_ifgroup_n2a(*(int*)RTA_DATA(tb[IFLA_IFGROUP]), b1, sizeof(b1)));
+ }
#ifdef IFLA_MASTER
if (tb[IFLA_MASTER]) {
SPRINT_BUF(b1);
diff --git a/ip/iplink.c b/ip/iplink.c
index 8e0ed2a..87901e7 100644
--- a/ip/iplink.c
+++ b/ip/iplink.c
@@ -27,6 +27,7 @@
#include <string.h>
#include <sys/ioctl.h>
#include <linux/sockios.h>
+#include <linux/rtnetlink.h>
#include "rt_names.h"
#include "utils.h"
@@ -46,6 +47,7 @@ void iplink_usage(void)
fprintf(stderr, " promisc { on | off } |\n");
fprintf(stderr, " trailers { on | off } |\n");
fprintf(stderr, " txqueuelen PACKETS |\n");
+ fprintf(stderr, " group GROUP |\n");
fprintf(stderr, " name NEWNAME |\n");
fprintf(stderr, " address LLADDR | broadcast LLADDR |\n");
fprintf(stderr, " mtu MTU }\n");
@@ -145,6 +147,7 @@ static int iplink_have_newlink(void)
static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
{
int qlen = -1;
+ __u32 group = 0;
int mtu = -1;
int len;
char abuf[32];
@@ -197,6 +200,14 @@ static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
if (get_integer(&qlen, *argv, 0))
invarg("Invalid \"txqueuelen\" value\n", *argv);
addattr_l(&req.n, sizeof(req), IFLA_TXQLEN, &qlen, 4);
+ } else if (matches(*argv, "group") == 0) {
+ NEXT_ARG();
+ if (group != 0)
+ duparg("group", *argv);
+
+ if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
+ invarg("\"group\" value is invalid\n", *argv);
+ addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &group, sizeof(group));
} else if (strcmp(*argv, "mtu") == 0) {
NEXT_ARG();
if (mtu != -1)
@@ -462,6 +473,32 @@ static int set_mtu(const char *dev, int mtu)
return 0;
}
+static int set_group(const char *dev, int ifgroup)
+{
+ struct {
+ struct nlmsghdr n;
+ struct ifinfomsg ifi;
+ char buf[256];
+ } req;
+ struct rtnl_handle rth;
+
+ memset(&req, 0, sizeof(req));
+ req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifi));
+ req.n.nlmsg_flags = NLM_F_REQUEST;
+ req.n.nlmsg_type = RTM_SETLINK;
+
+ req.ifi.ifi_index = -1;
+
+ addattr_l(&req.n, sizeof(req), IFLA_IFNAME, dev, strlen(dev)+1);
+ addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &ifgroup, sizeof(ifgroup));
+ if (rtnl_open(&rth, 0) < 0)
+ exit(1);
+ if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
+ return -1;
+ rtnl_close(&rth);
+ return 0;
+}
+
static int get_address(const char *dev, int *htype)
{
struct ifreq ifr;
@@ -545,6 +582,7 @@ static int do_set(int argc, char **argv)
__u32 mask = 0;
__u32 flags = 0;
int qlen = -1;
+ __u32 group = 0;
int mtu = -1;
char *newaddr = NULL;
char *newbrd = NULL;
@@ -577,6 +615,13 @@ static int do_set(int argc, char **argv)
duparg("txqueuelen", *argv);
if (get_integer(&qlen, *argv, 0))
invarg("Invalid \"txqueuelen\" value\n", *argv);
+ } else if (matches(*argv, "group") == 0) {
+ NEXT_ARG();
+ if (group != 0)
+ duparg("group", *argv);
+
+ if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
+ invarg("\"group\" value is invalid\n", *argv);
} else if (strcmp(*argv, "mtu") == 0) {
NEXT_ARG();
if (mtu != -1)
@@ -696,6 +741,10 @@ static int do_set(int argc, char **argv)
return -1;
}
}
+ if (group) {
+ if (set_group(dev, group) < 0)
+ return -1;
+ }
if (mask)
return do_chflags(dev, flags, mask);
return 0;
diff --git a/lib/rt_names.c b/lib/rt_names.c
index 8d019a0..a067e74 100644
--- a/lib/rt_names.c
+++ b/lib/rt_names.c
@@ -446,3 +446,65 @@ int rtnl_dsfield_a2n(__u32 *id, char *arg)
return 0;
}
+static char * rtnl_rtifgroup_tab[256] = {
+ "0",
+};
+
+static int rtnl_rtifgroup_init;
+
+static void rtnl_rtifgroup_initialize(void)
+{
+ rtnl_rtifgroup_init = 1;
+ rtnl_tab_initialize("/etc/iproute2/rt_ifgroup",
+ rtnl_rtifgroup_tab, 256);
+}
+
+char * rtnl_ifgroup_n2a(int id, char *buf, int len)
+{
+ if (id<0 || id>=256) {
+ snprintf(buf, len, "%d", id);
+ return buf;
+ }
+ if (!rtnl_rtifgroup_tab[id]) {
+ if (!rtnl_rtifgroup_init)
+ rtnl_rtifgroup_initialize();
+ }
+ if (rtnl_rtifgroup_tab[id])
+ return rtnl_rtifgroup_tab[id];
+ snprintf(buf, len, "0x%02x", id);
+ return buf;
+}
+
+
+int rtnl_ifgroup_a2n(__u32 *id, char *arg)
+{
+ static char *cache = NULL;
+ static unsigned long res;
+ char *end;
+ int i;
+
+ if (cache && strcmp(cache, arg) == 0) {
+ *id = res;
+ return 0;
+ }
+
+ if (!rtnl_rtifgroup_init)
+ rtnl_rtifgroup_initialize();
+
+ for (i=0; i<256; i++) {
+ if (rtnl_rtifgroup_tab[i] &&
+ strcmp(rtnl_rtifgroup_tab[i], arg) == 0) {
+ cache = rtnl_rtifgroup_tab[i];
+ res = i;
+ *id = res;
+ return 0;
+ }
+ }
+
+ res = strtoul(arg, &end, 16);
+ if (!end || end == arg || *end || res > 255)
+ return -1;
+ *id = res;
+ return 0;
+}
+
diff --git a/man/man8/ip.8 b/man/man8/ip.8
index c74440a..8e6a9a3 100644
--- a/man/man8/ip.8
+++ b/man/man8/ip.8
@@ -511,6 +511,11 @@ already configured.
change the transmit queue length of the device.
.TP
+.BI group " GROUP"
+.TP
+change the interface group identifier of the device.
+
+.TP
.BI mtu " NUMBER"
change the
.I MTU
--
1.5.2.5
^ permalink raw reply related
* Re: new NAPI interface broken
From: Benjamin Herrenschmidt @ 2007-10-16 9:01 UTC (permalink / raw)
To: David Miller; +Cc: ossthema, shemminger, netdev, themann, raisch, arjan
In-Reply-To: <20071016.013146.28785302.davem@davemloft.net>
On Tue, 2007-10-16 at 01:31 -0700, David Miller wrote:
> From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> Date: Tue, 16 Oct 2007 18:28:56 +1000
>
> > Allright, so that's an out of tree userland thingy... (which may well
> > work on ppc too I suppose). Definitely not installed by default by my
> > distro so IRQs from the network cards on all x86's using ubuntu gutsy at
> > least are spread to all CPUs :-)
>
> But the thing does treat network interfaces differently from
> other devices.
>
> Arjan ran over to my table at kernel summit when I presented this
> topic to the audience, to remind me of all of this and he should be
> included in on any discussions about this topic. :-)
>
> I've CC:'d him.
As far as I know, the x86 in-kernel thingy doesn't but yeah, the
userland one seems much more evolved and does things based on the
"class" of the device.
Christoph, have any of you tried it on powerpc ?
Cheers,
Ben.
^ permalink raw reply
* Re: [PATCH 0/2] Interface groups
From: Philip Craig @ 2007-10-16 8:50 UTC (permalink / raw)
To: Laszlo Attila Toth; +Cc: netdev, netfilter-devel
In-Reply-To: <1192521703479-git-send-email-panther@balabit.hu>
Laszlo Attila Toth wrote:
> Hello,
>
> Different network interfaces can be grouped using the same group ID. With this
> patch fewer netfilter rules are necessary but it may also be used by routing.
This allows an interface to belong to only one group. I expect there are
situations where you want more. eg you might want a group of all pptp
connections, and another group of pptp connections for a subset of users.
An alternative approach would be to extend ipset to have sets of ifindex,
although this would tie it closer to iptables, and it would be slower.
But it still gives the properties of reducing the number of iptables rules,
and allowing to change group membership without reinstalling rules.
Maybe Jozsef has designed nfset to be able to handle this already?
^ permalink raw reply
* Re: [PATCH] Update function names in /proc/net/tcp documentation
From: Jean Delvare @ 2007-10-16 8:46 UTC (permalink / raw)
To: Herbert Xu; +Cc: rick.jones2, netdev
In-Reply-To: <E1Ih0PI-0003TX-00@gondolin.me.apana.org.au>
Hi Herbert,
On Sun, 14 Oct 2007 18:09:12 +0800, Herbert Xu wrote:
> Jean Delvare <khali@linux-fr.org> wrote:
> >
> >> inet_diag is the preferred interface.
> >
> > How does it work? Is there some documentation available? I see
> > net/ipv4/inet_diag.c but I have no idea how to use it.
>
> Have a look at the iproute package. It contains the ss command
> which provides a command-line interface to it.
>
> Of course it's also a good example of how you can access it from
> C. The Debian pidentd package has also been patched to use this
> interface.
Thanks for the information. Now I'm worried that most people use
netstat and not ss, while it seems that netstat doesn't have tcp_diag
support. Would it make sense to add tcp_diag support to netstat? Or
should we simply invite system admins to switch from netstat to ss
(maybe by adding a netstat-like formatting option)?
Not that I am skilled enough in this area to do either myself anyway
(let alone the lack of time), but I'm curious what the correct approach
would be.
Thanks,
--
Jean Delvare
^ permalink raw reply
* Re: [IPROUTE2 PATCH] Interface group as new ip link option
From: Patrick McHardy @ 2007-10-16 8:38 UTC (permalink / raw)
To: Laszlo Attila Toth; +Cc: netdev, netfilter-devel
In-Reply-To: <1192521703205-git-send-email-panther@balabit.hu>
Laszlo Attila Toth wrote:
> diff --git a/man/man8/ip.8 b/man/man8/ip.8
> index c74440a..8e6a9a3 100644
> --- a/man/man8/ip.8
> +++ b/man/man8/ip.8
> @@ -511,6 +511,11 @@ already configured.
> @@ -1835,3 +1840,6 @@ was written by Alexey N. Kuznetsov and added in Linux 2.2.
>
> .SH AUTHOR
> Original Manpage by Michail Litvak <mci@owl.openwall.com>
> +.br
> +Modified for ZorpOS by Tamas Pal <folti@balabit.hu>
Did you really intend to include this?
^ permalink raw reply
* Re: [PATCH 1/2] Interface group: core (netlink) part
From: Patrick McHardy @ 2007-10-16 8:34 UTC (permalink / raw)
To: Laszlo Attila Toth; +Cc: netdev, netfilter-devel
In-Reply-To: <11925217031287-git-send-email-panther@balabit.hu>
Laszlo Attila Toth wrote:
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index 4756d58..18ff3c5 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -646,6 +646,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
> if (dev->master)
> NLA_PUT_U32(skb, IFLA_MASTER, dev->master->ifindex);
>
> + if (dev->ifgroup)
> + NLA_PUT_U32(skb, IFLA_IFGROUP, dev->ifgroup);
> +
You need to adjust if_nlmsg_size() to account for this.
> if (dev->qdisc_sleeping)
> NLA_PUT_STRING(skb, IFLA_QDISC, dev->qdisc_sleeping->ops->id);
>
> @@ -846,6 +849,11 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
> write_unlock_bh(&dev_base_lock);
> }
>
> + if (tb[IFLA_IFGROUP]) {
> + dev->ifgroup = nla_get_u32(tb[IFLA_IFGROUP ]);
> + rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
> + }
Notifcations should be atomic, not one for every single change. I know
thats not the case currently, but it seems we're missing a notifcation
for some of the attributes anyway (like tx_queue_len, operstate,
linkmode), please consolidate all these and send a single notifcation.
^ permalink raw reply
* Re: new NAPI interface broken
From: David Miller @ 2007-10-16 8:31 UTC (permalink / raw)
To: benh; +Cc: ossthema, shemminger, netdev, themann, raisch, arjan
In-Reply-To: <1192523336.7205.13.camel@pasglop>
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date: Tue, 16 Oct 2007 18:28:56 +1000
> Allright, so that's an out of tree userland thingy... (which may well
> work on ppc too I suppose). Definitely not installed by default by my
> distro so IRQs from the network cards on all x86's using ubuntu gutsy at
> least are spread to all CPUs :-)
But the thing does treat network interfaces differently from
other devices.
Arjan ran over to my table at kernel summit when I presented this
topic to the audience, to remind me of all of this and he should be
included in on any discussions about this topic. :-)
I've CC:'d him.
^ permalink raw reply
* Re: [PATCH 2/2] Interface group match - netfilter part
From: Patrick McHardy @ 2007-10-16 8:30 UTC (permalink / raw)
To: Laszlo Attila Toth; +Cc: netdev, netfilter-devel
In-Reply-To: <11925217031728-git-send-email-panther@balabit.hu>
Laszlo Attila Toth wrote:
> +static int match(const struct sk_buff *skb,
> + const struct net_device *in,
> + const struct net_device *out,
> + const struct xt_match *match,
> + const void *matchinfo,
> + int offset,
> + unsigned int protoff,
> + int *hotdrop)
> +{
> + const struct xt_ifgroup_info *info = matchinfo;
> +
> + return ((in->ifgroup & info->mask) == info->group) ^ info->invert;
The input interface is only valid in PREROUTING, INPUT and FORWARD.
Why don't you support output-interface matching?
> +}
> +
> +static struct xt_match ifgroup_match = {
> + .name = "ifgroup",
> + .match = match,
> + .matchsize = sizeof(struct xt_ifgroup_info),
> + .family = AF_INET,
> + .me = THIS_MODULE,
> +};
> +
> +static struct xt_match ifgroup6_match = {
> + .name = "ifgroup",
> + .match = match,
> + .matchsize = sizeof(struct xt_ifgroup_info),
> + .family = AF_INET6,
> + .me = THIS_MODULE,
> +};
__read_mostly
> +
> +static int __init xt_ifgroup_init(void)
> +{
> + int ret;
> +
> + ret = xt_register_match(&ifgroup_match);
xt_register_matches please.
^ permalink raw reply
* Re: new NAPI interface broken
From: Benjamin Herrenschmidt @ 2007-10-16 8:28 UTC (permalink / raw)
To: David Miller; +Cc: ossthema, shemminger, netdev, themann, raisch
In-Reply-To: <20071016.004410.85411180.davem@davemloft.net>
On Tue, 2007-10-16 at 00:44 -0700, David Miller wrote:
> From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> Date: Tue, 16 Oct 2007 17:29:47 +1000
>
> > Do you have any pointer to how that is done on x86 or sparc64 ?
>
> Sparc64 does it statically in the kernel.
>
> For x86, see http://irqbalance.org/
Allright, so that's an out of tree userland thingy... (which may well
work on ppc too I suppose). Definitely not installed by default by my
distro so IRQs from the network cards on all x86's using ubuntu gutsy at
least are spread to all CPUs :-)
There's also a balance kernel thread in x86 with has a notion of irq
that isn't moveable but that flag isn't set by any driver.
Cheers,
Ben.
^ permalink raw reply
* [IPROUTE2 PATCH] Interface group as new ip link option
From: Laszlo Attila Toth @ 2007-10-16 8:01 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
In-Reply-To: <ifgroup.20071015.1192520046.panther@balabit.hu>
Interfaces can be grouped and each group has an unique positive integer ID.
It can be set via ip link.
Signed-off-by: Laszlo Attila Toth <panther@aldaris.(none)>
---
include/linux/if_link.h | 2 +
include/rt_names.h | 2 +
ip/ipaddress.c | 4 +++
ip/iplink.c | 49 +++++++++++++++++++++++++++++++++++++
lib/rt_names.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++
man/man8/ip.8 | 8 ++++++
6 files changed, 127 insertions(+), 0 deletions(-)
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 23b3a8e..2dfb0b7 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -78,6 +78,8 @@ enum
IFLA_LINKMODE,
IFLA_LINKINFO,
#define IFLA_LINKINFO IFLA_LINKINFO
+ IFLA_IFGROUP,
+#define IFLA_IFGROUP IFLA_IFGROUP
__IFLA_MAX
};
diff --git a/include/rt_names.h b/include/rt_names.h
index 07a10e0..72c5247 100644
--- a/include/rt_names.h
+++ b/include/rt_names.h
@@ -8,11 +8,13 @@ char* rtnl_rtscope_n2a(int id, char *buf, int len);
char* rtnl_rttable_n2a(__u32 id, char *buf, int len);
char* rtnl_rtrealm_n2a(int id, char *buf, int len);
char* rtnl_dsfield_n2a(int id, char *buf, int len);
+char* rtnl_ifgroup_n2a(int id, char *buf, int len);
int rtnl_rtprot_a2n(__u32 *id, char *arg);
int rtnl_rtscope_a2n(__u32 *id, char *arg);
int rtnl_rttable_a2n(__u32 *id, char *arg);
int rtnl_rtrealm_a2n(__u32 *id, char *arg);
int rtnl_dsfield_a2n(__u32 *id, char *arg);
+int rtnl_ifgroup_a2n(__u32 *id, char *arg);
const char *inet_proto_n2a(int proto, char *buf, int len);
int inet_proto_a2n(char *buf);
diff --git a/ip/ipaddress.c b/ip/ipaddress.c
index 518d8cd..405e85c 100644
--- a/ip/ipaddress.c
+++ b/ip/ipaddress.c
@@ -227,6 +227,10 @@ int print_linkinfo(const struct sockaddr_nl *who,
fprintf(fp, "mtu %u ", *(int*)RTA_DATA(tb[IFLA_MTU]));
if (tb[IFLA_QDISC])
fprintf(fp, "qdisc %s ", (char*)RTA_DATA(tb[IFLA_QDISC]));
+ if (tb[IFLA_IFGROUP]) {
+ SPRINT_BUF(b1);
+ fprintf(fp, "group %s ", rtnl_ifgroup_n2a(*(int*)RTA_DATA(tb[IFLA_IFGROUP]), b1, sizeof(b1)));
+ }
#ifdef IFLA_MASTER
if (tb[IFLA_MASTER]) {
SPRINT_BUF(b1);
diff --git a/ip/iplink.c b/ip/iplink.c
index 8e0ed2a..87901e7 100644
--- a/ip/iplink.c
+++ b/ip/iplink.c
@@ -27,6 +27,7 @@
#include <string.h>
#include <sys/ioctl.h>
#include <linux/sockios.h>
+#include <linux/rtnetlink.h>
#include "rt_names.h"
#include "utils.h"
@@ -46,6 +47,7 @@ void iplink_usage(void)
fprintf(stderr, " promisc { on | off } |\n");
fprintf(stderr, " trailers { on | off } |\n");
fprintf(stderr, " txqueuelen PACKETS |\n");
+ fprintf(stderr, " group GROUP |\n");
fprintf(stderr, " name NEWNAME |\n");
fprintf(stderr, " address LLADDR | broadcast LLADDR |\n");
fprintf(stderr, " mtu MTU }\n");
@@ -145,6 +147,7 @@ static int iplink_have_newlink(void)
static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
{
int qlen = -1;
+ __u32 group = 0;
int mtu = -1;
int len;
char abuf[32];
@@ -197,6 +200,14 @@ static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
if (get_integer(&qlen, *argv, 0))
invarg("Invalid \"txqueuelen\" value\n", *argv);
addattr_l(&req.n, sizeof(req), IFLA_TXQLEN, &qlen, 4);
+ } else if (matches(*argv, "group") == 0) {
+ NEXT_ARG();
+ if (group != 0)
+ duparg("group", *argv);
+
+ if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
+ invarg("\"group\" value is invalid\n", *argv);
+ addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &group, sizeof(group));
} else if (strcmp(*argv, "mtu") == 0) {
NEXT_ARG();
if (mtu != -1)
@@ -462,6 +473,32 @@ static int set_mtu(const char *dev, int mtu)
return 0;
}
+static int set_group(const char *dev, int ifgroup)
+{
+ struct {
+ struct nlmsghdr n;
+ struct ifinfomsg ifi;
+ char buf[256];
+ } req;
+ struct rtnl_handle rth;
+
+ memset(&req, 0, sizeof(req));
+ req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifi));
+ req.n.nlmsg_flags = NLM_F_REQUEST;
+ req.n.nlmsg_type = RTM_SETLINK;
+
+ req.ifi.ifi_index = -1;
+
+ addattr_l(&req.n, sizeof(req), IFLA_IFNAME, dev, strlen(dev)+1);
+ addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &ifgroup, sizeof(ifgroup));
+ if (rtnl_open(&rth, 0) < 0)
+ exit(1);
+ if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
+ return -1;
+ rtnl_close(&rth);
+ return 0;
+}
+
static int get_address(const char *dev, int *htype)
{
struct ifreq ifr;
@@ -545,6 +582,7 @@ static int do_set(int argc, char **argv)
__u32 mask = 0;
__u32 flags = 0;
int qlen = -1;
+ __u32 group = 0;
int mtu = -1;
char *newaddr = NULL;
char *newbrd = NULL;
@@ -577,6 +615,13 @@ static int do_set(int argc, char **argv)
duparg("txqueuelen", *argv);
if (get_integer(&qlen, *argv, 0))
invarg("Invalid \"txqueuelen\" value\n", *argv);
+ } else if (matches(*argv, "group") == 0) {
+ NEXT_ARG();
+ if (group != 0)
+ duparg("group", *argv);
+
+ if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
+ invarg("\"group\" value is invalid\n", *argv);
} else if (strcmp(*argv, "mtu") == 0) {
NEXT_ARG();
if (mtu != -1)
@@ -696,6 +741,10 @@ static int do_set(int argc, char **argv)
return -1;
}
}
+ if (group) {
+ if (set_group(dev, group) < 0)
+ return -1;
+ }
if (mask)
return do_chflags(dev, flags, mask);
return 0;
diff --git a/lib/rt_names.c b/lib/rt_names.c
index 8d019a0..a067e74 100644
--- a/lib/rt_names.c
+++ b/lib/rt_names.c
@@ -446,3 +446,65 @@ int rtnl_dsfield_a2n(__u32 *id, char *arg)
return 0;
}
+static char * rtnl_rtifgroup_tab[256] = {
+ "0",
+};
+
+static int rtnl_rtifgroup_init;
+
+static void rtnl_rtifgroup_initialize(void)
+{
+ rtnl_rtifgroup_init = 1;
+ rtnl_tab_initialize("/etc/iproute2/rt_ifgroup",
+ rtnl_rtifgroup_tab, 256);
+}
+
+char * rtnl_ifgroup_n2a(int id, char *buf, int len)
+{
+ if (id<0 || id>=256) {
+ snprintf(buf, len, "%d", id);
+ return buf;
+ }
+ if (!rtnl_rtifgroup_tab[id]) {
+ if (!rtnl_rtifgroup_init)
+ rtnl_rtifgroup_initialize();
+ }
+ if (rtnl_rtifgroup_tab[id])
+ return rtnl_rtifgroup_tab[id];
+ snprintf(buf, len, "0x%02x", id);
+ return buf;
+}
+
+
+int rtnl_ifgroup_a2n(__u32 *id, char *arg)
+{
+ static char *cache = NULL;
+ static unsigned long res;
+ char *end;
+ int i;
+
+ if (cache && strcmp(cache, arg) == 0) {
+ *id = res;
+ return 0;
+ }
+
+ if (!rtnl_rtifgroup_init)
+ rtnl_rtifgroup_initialize();
+
+ for (i=0; i<256; i++) {
+ if (rtnl_rtifgroup_tab[i] &&
+ strcmp(rtnl_rtifgroup_tab[i], arg) == 0) {
+ cache = rtnl_rtifgroup_tab[i];
+ res = i;
+ *id = res;
+ return 0;
+ }
+ }
+
+ res = strtoul(arg, &end, 16);
+ if (!end || end == arg || *end || res > 255)
+ return -1;
+ *id = res;
+ return 0;
+}
+
diff --git a/man/man8/ip.8 b/man/man8/ip.8
index c74440a..8e6a9a3 100644
--- a/man/man8/ip.8
+++ b/man/man8/ip.8
@@ -511,6 +511,11 @@ already configured.
change the transmit queue length of the device.
.TP
+.BI group " GROUP"
+.TP
+change the interface group identifier of the device.
+
+.TP
.BI mtu " NUMBER"
change the
.I MTU
@@ -1835,3 +1840,6 @@ was written by Alexey N. Kuznetsov and added in Linux 2.2.
.SH AUTHOR
Original Manpage by Michail Litvak <mci@owl.openwall.com>
+.br
+Modified for ZorpOS by Tamas Pal <folti@balabit.hu>
+
--
1.5.2.5
^ permalink raw reply related
* [PATCH 2/2] Interface group match - netfilter part
From: Laszlo Attila Toth @ 2007-10-16 8:01 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
In-Reply-To: <1824b3d462b1d85aaf33941cf082c4e018d5bff7.1192460167.git.panther@balabit.hu>
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
---
include/linux/netfilter/xt_ifgroup.h | 11 +++++
net/netfilter/Kconfig | 16 +++++++
net/netfilter/Makefile | 1 +
net/netfilter/xt_ifgroup.c | 78 ++++++++++++++++++++++++++++++++++
4 files changed, 106 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/xt_ifgroup.h b/include/linux/netfilter/xt_ifgroup.h
new file mode 100644
index 0000000..a992d4c
--- /dev/null
+++ b/include/linux/netfilter/xt_ifgroup.h
@@ -0,0 +1,11 @@
+#ifndef _XT_IFGROUP_H
+#define _XT_IFGROUP_H
+
+struct xt_ifgroup_info {
+ u_int32_t group;
+ u_int32_t mask;
+ u_int8_t invert;
+};
+
+#endif /*_XT_IFGROUP_H*/
+
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 3599770..0864e19 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -597,6 +597,22 @@ config NETFILTER_XT_MATCH_QUOTA
If you want to compile it as a module, say M here and read
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
+config NETFILTER_XT_MATCH_IFGROUP
+ tristate '"ifgroup" interface group match support'
+ depends on NETFILTER_XTABLES
+ help
+ Interface group matching allows you to match a packet by
+ its incoming interface "group", settable using ip link set
+ group
+
+ Typical usage is to assign dynamic interfaces to a group
+ when they come up using "ip link set group" and then match
+ incoming packets with a rule like this:
+
+ iptables -A INPUT -m ifgroup --if-group openvpn-rw1 -j LOG
+
+ To compile it as a module, choose M here. If unsure, say N.
+
config NETFILTER_XT_MATCH_REALM
tristate '"realm" match support'
depends on NETFILTER_XTABLES
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 0c054bf..da9ab07 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -77,3 +77,4 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o
obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
obj-$(CONFIG_NETFILTER_XT_MATCH_U32) += xt_u32.o
obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_IFGROUP) += xt_ifgroup.o
diff --git a/net/netfilter/xt_ifgroup.c b/net/netfilter/xt_ifgroup.c
new file mode 100644
index 0000000..766f668
--- /dev/null
+++ b/net/netfilter/xt_ifgroup.c
@@ -0,0 +1,78 @@
+/*
+ * An x_tables match module to match interface groups
+ *
+ * (C) 2006 Balazs Scheidler <bazsi@balabit.hu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/if_ether.h>
+#include <linux/if_packet.h>
+
+#include <linux/netfilter/xt_ifgroup.h>
+#include <linux/netfilter/x_tables.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Balazs Scheidler <bazsi@balabit.hu>");
+MODULE_DESCRIPTION("IP tables match to match on interface group");
+MODULE_ALIAS("ipt_ifgroup");
+MODULE_ALIAS("ip6t_ifgroup");
+
+static int match(const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const struct xt_match *match,
+ const void *matchinfo,
+ int offset,
+ unsigned int protoff,
+ int *hotdrop)
+{
+ const struct xt_ifgroup_info *info = matchinfo;
+
+ return ((in->ifgroup & info->mask) == info->group) ^ info->invert;
+}
+
+static struct xt_match ifgroup_match = {
+ .name = "ifgroup",
+ .match = match,
+ .matchsize = sizeof(struct xt_ifgroup_info),
+ .family = AF_INET,
+ .me = THIS_MODULE,
+};
+
+static struct xt_match ifgroup6_match = {
+ .name = "ifgroup",
+ .match = match,
+ .matchsize = sizeof(struct xt_ifgroup_info),
+ .family = AF_INET6,
+ .me = THIS_MODULE,
+};
+
+static int __init xt_ifgroup_init(void)
+{
+ int ret;
+
+ ret = xt_register_match(&ifgroup_match);
+ if (ret)
+ return ret;
+
+ ret = xt_register_match(&ifgroup6_match);
+ if (ret)
+ xt_unregister_match(&ifgroup_match);
+
+ return ret;
+}
+
+static void __exit xt_ifgroup_fini(void)
+{
+ xt_unregister_match(&ifgroup_match);
+ xt_unregister_match(&ifgroup6_match);
+}
+
+module_init(xt_ifgroup_init);
+module_exit(xt_ifgroup_fini);
+
--
1.5.2.5
^ permalink raw reply related
* [PATCH 0/2] Interface groups
From: Laszlo Attila Toth @ 2007-10-16 8:01 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
Hello,
Different network interfaces can be grouped using the same group ID. With this
patch fewer netfilter rules are necessary but it may also be used by routing.
The interface group (ifgroup) member of the net_device can be modified via
netlink (with iproute2) and it is used in the new 'ifgroup' netfilter match.
ip link set eth0 group 4
iptables -A INPUT -m ifgroup --if-group 4 -j ACCEPT
--
Laszlo Attila Toth
^ permalink raw reply
* [PATCH 1/2] Interface group: core (netlink) part
From: Laszlo Attila Toth @ 2007-10-16 8:01 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
In-Reply-To: <ifgroup.20071015.1192520046.panther@balabit.hu>
Interface groups let handle different interfaces with one (netfilter) rule.
Modified net device structure and netlink interface.
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
---
include/linux/if_link.h | 2 ++
include/linux/netdevice.h | 2 ++
net/core/rtnetlink.c | 8 ++++++++
3 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 422084d..d9f1726 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -78,6 +78,8 @@ enum
IFLA_LINKMODE,
IFLA_LINKINFO,
#define IFLA_LINKINFO IFLA_LINKINFO
+ IFLA_IFGROUP,
+#define IFLA_IFGROUP IFLA_IFGROUP
__IFLA_MAX
};
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index e679b27..4cfc697 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -365,6 +365,8 @@ struct net_device
/* Interface index. Unique device identifier */
int ifindex;
int iflink;
+ /* interface group this interface belongs to */
+ int ifgroup;
struct net_device_stats* (*get_stats)(struct net_device *dev);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 4756d58..18ff3c5 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -646,6 +646,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
if (dev->master)
NLA_PUT_U32(skb, IFLA_MASTER, dev->master->ifindex);
+ if (dev->ifgroup)
+ NLA_PUT_U32(skb, IFLA_IFGROUP, dev->ifgroup);
+
if (dev->qdisc_sleeping)
NLA_PUT_STRING(skb, IFLA_QDISC, dev->qdisc_sleeping->ops->id);
@@ -846,6 +849,11 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
write_unlock_bh(&dev_base_lock);
}
+ if (tb[IFLA_IFGROUP]) {
+ dev->ifgroup = nla_get_u32(tb[IFLA_IFGROUP ]);
+ rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
+ }
+
err = 0;
errout:
--
1.5.2.5
^ permalink raw reply related
* [IPROUTE2 PATCH] Interface group as new ip link option
From: Laszlo Attila Toth @ 2007-10-16 8:01 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
In-Reply-To: <ifgroup.20071015.1192520046.panther@balabit.hu>
Interfaces can be grouped and each group has an unique positive integer ID.
It can be set via ip link.
Signed-off-by: Laszlo Attila Toth <panther@aldaris.(none)>
---
include/linux/if_link.h | 2 +
include/rt_names.h | 2 +
ip/ipaddress.c | 4 +++
ip/iplink.c | 49 +++++++++++++++++++++++++++++++++++++
lib/rt_names.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++
man/man8/ip.8 | 8 ++++++
6 files changed, 127 insertions(+), 0 deletions(-)
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 23b3a8e..2dfb0b7 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -78,6 +78,8 @@ enum
IFLA_LINKMODE,
IFLA_LINKINFO,
#define IFLA_LINKINFO IFLA_LINKINFO
+ IFLA_IFGROUP,
+#define IFLA_IFGROUP IFLA_IFGROUP
__IFLA_MAX
};
diff --git a/include/rt_names.h b/include/rt_names.h
index 07a10e0..72c5247 100644
--- a/include/rt_names.h
+++ b/include/rt_names.h
@@ -8,11 +8,13 @@ char* rtnl_rtscope_n2a(int id, char *buf, int len);
char* rtnl_rttable_n2a(__u32 id, char *buf, int len);
char* rtnl_rtrealm_n2a(int id, char *buf, int len);
char* rtnl_dsfield_n2a(int id, char *buf, int len);
+char* rtnl_ifgroup_n2a(int id, char *buf, int len);
int rtnl_rtprot_a2n(__u32 *id, char *arg);
int rtnl_rtscope_a2n(__u32 *id, char *arg);
int rtnl_rttable_a2n(__u32 *id, char *arg);
int rtnl_rtrealm_a2n(__u32 *id, char *arg);
int rtnl_dsfield_a2n(__u32 *id, char *arg);
+int rtnl_ifgroup_a2n(__u32 *id, char *arg);
const char *inet_proto_n2a(int proto, char *buf, int len);
int inet_proto_a2n(char *buf);
diff --git a/ip/ipaddress.c b/ip/ipaddress.c
index 518d8cd..405e85c 100644
--- a/ip/ipaddress.c
+++ b/ip/ipaddress.c
@@ -227,6 +227,10 @@ int print_linkinfo(const struct sockaddr_nl *who,
fprintf(fp, "mtu %u ", *(int*)RTA_DATA(tb[IFLA_MTU]));
if (tb[IFLA_QDISC])
fprintf(fp, "qdisc %s ", (char*)RTA_DATA(tb[IFLA_QDISC]));
+ if (tb[IFLA_IFGROUP]) {
+ SPRINT_BUF(b1);
+ fprintf(fp, "group %s ", rtnl_ifgroup_n2a(*(int*)RTA_DATA(tb[IFLA_IFGROUP]), b1, sizeof(b1)));
+ }
#ifdef IFLA_MASTER
if (tb[IFLA_MASTER]) {
SPRINT_BUF(b1);
diff --git a/ip/iplink.c b/ip/iplink.c
index 8e0ed2a..87901e7 100644
--- a/ip/iplink.c
+++ b/ip/iplink.c
@@ -27,6 +27,7 @@
#include <string.h>
#include <sys/ioctl.h>
#include <linux/sockios.h>
+#include <linux/rtnetlink.h>
#include "rt_names.h"
#include "utils.h"
@@ -46,6 +47,7 @@ void iplink_usage(void)
fprintf(stderr, " promisc { on | off } |\n");
fprintf(stderr, " trailers { on | off } |\n");
fprintf(stderr, " txqueuelen PACKETS |\n");
+ fprintf(stderr, " group GROUP |\n");
fprintf(stderr, " name NEWNAME |\n");
fprintf(stderr, " address LLADDR | broadcast LLADDR |\n");
fprintf(stderr, " mtu MTU }\n");
@@ -145,6 +147,7 @@ static int iplink_have_newlink(void)
static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
{
int qlen = -1;
+ __u32 group = 0;
int mtu = -1;
int len;
char abuf[32];
@@ -197,6 +200,14 @@ static int iplink_modify(int cmd, unsigned int flags, int argc, char **argv)
if (get_integer(&qlen, *argv, 0))
invarg("Invalid \"txqueuelen\" value\n", *argv);
addattr_l(&req.n, sizeof(req), IFLA_TXQLEN, &qlen, 4);
+ } else if (matches(*argv, "group") == 0) {
+ NEXT_ARG();
+ if (group != 0)
+ duparg("group", *argv);
+
+ if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
+ invarg("\"group\" value is invalid\n", *argv);
+ addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &group, sizeof(group));
} else if (strcmp(*argv, "mtu") == 0) {
NEXT_ARG();
if (mtu != -1)
@@ -462,6 +473,32 @@ static int set_mtu(const char *dev, int mtu)
return 0;
}
+static int set_group(const char *dev, int ifgroup)
+{
+ struct {
+ struct nlmsghdr n;
+ struct ifinfomsg ifi;
+ char buf[256];
+ } req;
+ struct rtnl_handle rth;
+
+ memset(&req, 0, sizeof(req));
+ req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.ifi));
+ req.n.nlmsg_flags = NLM_F_REQUEST;
+ req.n.nlmsg_type = RTM_SETLINK;
+
+ req.ifi.ifi_index = -1;
+
+ addattr_l(&req.n, sizeof(req), IFLA_IFNAME, dev, strlen(dev)+1);
+ addattr_l(&req.n, sizeof(req), IFLA_IFGROUP, &ifgroup, sizeof(ifgroup));
+ if (rtnl_open(&rth, 0) < 0)
+ exit(1);
+ if (rtnl_talk(&rth, &req.n, 0, 0, NULL, NULL, NULL) < 0)
+ return -1;
+ rtnl_close(&rth);
+ return 0;
+}
+
static int get_address(const char *dev, int *htype)
{
struct ifreq ifr;
@@ -545,6 +582,7 @@ static int do_set(int argc, char **argv)
__u32 mask = 0;
__u32 flags = 0;
int qlen = -1;
+ __u32 group = 0;
int mtu = -1;
char *newaddr = NULL;
char *newbrd = NULL;
@@ -577,6 +615,13 @@ static int do_set(int argc, char **argv)
duparg("txqueuelen", *argv);
if (get_integer(&qlen, *argv, 0))
invarg("Invalid \"txqueuelen\" value\n", *argv);
+ } else if (matches(*argv, "group") == 0) {
+ NEXT_ARG();
+ if (group != 0)
+ duparg("group", *argv);
+
+ if (rtnl_ifgroup_a2n(&group, *argv) || group == 0)
+ invarg("\"group\" value is invalid\n", *argv);
} else if (strcmp(*argv, "mtu") == 0) {
NEXT_ARG();
if (mtu != -1)
@@ -696,6 +741,10 @@ static int do_set(int argc, char **argv)
return -1;
}
}
+ if (group) {
+ if (set_group(dev, group) < 0)
+ return -1;
+ }
if (mask)
return do_chflags(dev, flags, mask);
return 0;
diff --git a/lib/rt_names.c b/lib/rt_names.c
index 8d019a0..a067e74 100644
--- a/lib/rt_names.c
+++ b/lib/rt_names.c
@@ -446,3 +446,65 @@ int rtnl_dsfield_a2n(__u32 *id, char *arg)
return 0;
}
+static char * rtnl_rtifgroup_tab[256] = {
+ "0",
+};
+
+static int rtnl_rtifgroup_init;
+
+static void rtnl_rtifgroup_initialize(void)
+{
+ rtnl_rtifgroup_init = 1;
+ rtnl_tab_initialize("/etc/iproute2/rt_ifgroup",
+ rtnl_rtifgroup_tab, 256);
+}
+
+char * rtnl_ifgroup_n2a(int id, char *buf, int len)
+{
+ if (id<0 || id>=256) {
+ snprintf(buf, len, "%d", id);
+ return buf;
+ }
+ if (!rtnl_rtifgroup_tab[id]) {
+ if (!rtnl_rtifgroup_init)
+ rtnl_rtifgroup_initialize();
+ }
+ if (rtnl_rtifgroup_tab[id])
+ return rtnl_rtifgroup_tab[id];
+ snprintf(buf, len, "0x%02x", id);
+ return buf;
+}
+
+
+int rtnl_ifgroup_a2n(__u32 *id, char *arg)
+{
+ static char *cache = NULL;
+ static unsigned long res;
+ char *end;
+ int i;
+
+ if (cache && strcmp(cache, arg) == 0) {
+ *id = res;
+ return 0;
+ }
+
+ if (!rtnl_rtifgroup_init)
+ rtnl_rtifgroup_initialize();
+
+ for (i=0; i<256; i++) {
+ if (rtnl_rtifgroup_tab[i] &&
+ strcmp(rtnl_rtifgroup_tab[i], arg) == 0) {
+ cache = rtnl_rtifgroup_tab[i];
+ res = i;
+ *id = res;
+ return 0;
+ }
+ }
+
+ res = strtoul(arg, &end, 16);
+ if (!end || end == arg || *end || res > 255)
+ return -1;
+ *id = res;
+ return 0;
+}
+
diff --git a/man/man8/ip.8 b/man/man8/ip.8
index c74440a..8e6a9a3 100644
--- a/man/man8/ip.8
+++ b/man/man8/ip.8
@@ -511,6 +511,11 @@ already configured.
change the transmit queue length of the device.
.TP
+.BI group " GROUP"
+.TP
+change the interface group identifier of the device.
+
+.TP
.BI mtu " NUMBER"
change the
.I MTU
@@ -1835,3 +1840,6 @@ was written by Alexey N. Kuznetsov and added in Linux 2.2.
.SH AUTHOR
Original Manpage by Michail Litvak <mci@owl.openwall.com>
+.br
+Modified for ZorpOS by Tamas Pal <folti@balabit.hu>
+
--
1.5.2.5
^ permalink raw reply related
* [PATCH 2/2] Interface group match - netfilter part
From: Laszlo Attila Toth @ 2007-10-16 8:01 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
In-Reply-To: <1824b3d462b1d85aaf33941cf082c4e018d5bff7.1192460167.git.panther@balabit.hu>
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
---
include/linux/netfilter/xt_ifgroup.h | 11 +++++
net/netfilter/Kconfig | 16 +++++++
net/netfilter/Makefile | 1 +
net/netfilter/xt_ifgroup.c | 78 ++++++++++++++++++++++++++++++++++
4 files changed, 106 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/xt_ifgroup.h b/include/linux/netfilter/xt_ifgroup.h
new file mode 100644
index 0000000..a992d4c
--- /dev/null
+++ b/include/linux/netfilter/xt_ifgroup.h
@@ -0,0 +1,11 @@
+#ifndef _XT_IFGROUP_H
+#define _XT_IFGROUP_H
+
+struct xt_ifgroup_info {
+ u_int32_t group;
+ u_int32_t mask;
+ u_int8_t invert;
+};
+
+#endif /*_XT_IFGROUP_H*/
+
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 3599770..0864e19 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -597,6 +597,22 @@ config NETFILTER_XT_MATCH_QUOTA
If you want to compile it as a module, say M here and read
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
+config NETFILTER_XT_MATCH_IFGROUP
+ tristate '"ifgroup" interface group match support'
+ depends on NETFILTER_XTABLES
+ help
+ Interface group matching allows you to match a packet by
+ its incoming interface "group", settable using ip link set
+ group
+
+ Typical usage is to assign dynamic interfaces to a group
+ when they come up using "ip link set group" and then match
+ incoming packets with a rule like this:
+
+ iptables -A INPUT -m ifgroup --if-group openvpn-rw1 -j LOG
+
+ To compile it as a module, choose M here. If unsure, say N.
+
config NETFILTER_XT_MATCH_REALM
tristate '"realm" match support'
depends on NETFILTER_XTABLES
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 0c054bf..da9ab07 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -77,3 +77,4 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o
obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
obj-$(CONFIG_NETFILTER_XT_MATCH_U32) += xt_u32.o
obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_IFGROUP) += xt_ifgroup.o
diff --git a/net/netfilter/xt_ifgroup.c b/net/netfilter/xt_ifgroup.c
new file mode 100644
index 0000000..766f668
--- /dev/null
+++ b/net/netfilter/xt_ifgroup.c
@@ -0,0 +1,78 @@
+/*
+ * An x_tables match module to match interface groups
+ *
+ * (C) 2006 Balazs Scheidler <bazsi@balabit.hu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/if_ether.h>
+#include <linux/if_packet.h>
+
+#include <linux/netfilter/xt_ifgroup.h>
+#include <linux/netfilter/x_tables.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Balazs Scheidler <bazsi@balabit.hu>");
+MODULE_DESCRIPTION("IP tables match to match on interface group");
+MODULE_ALIAS("ipt_ifgroup");
+MODULE_ALIAS("ip6t_ifgroup");
+
+static int match(const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const struct xt_match *match,
+ const void *matchinfo,
+ int offset,
+ unsigned int protoff,
+ int *hotdrop)
+{
+ const struct xt_ifgroup_info *info = matchinfo;
+
+ return ((in->ifgroup & info->mask) == info->group) ^ info->invert;
+}
+
+static struct xt_match ifgroup_match = {
+ .name = "ifgroup",
+ .match = match,
+ .matchsize = sizeof(struct xt_ifgroup_info),
+ .family = AF_INET,
+ .me = THIS_MODULE,
+};
+
+static struct xt_match ifgroup6_match = {
+ .name = "ifgroup",
+ .match = match,
+ .matchsize = sizeof(struct xt_ifgroup_info),
+ .family = AF_INET6,
+ .me = THIS_MODULE,
+};
+
+static int __init xt_ifgroup_init(void)
+{
+ int ret;
+
+ ret = xt_register_match(&ifgroup_match);
+ if (ret)
+ return ret;
+
+ ret = xt_register_match(&ifgroup6_match);
+ if (ret)
+ xt_unregister_match(&ifgroup_match);
+
+ return ret;
+}
+
+static void __exit xt_ifgroup_fini(void)
+{
+ xt_unregister_match(&ifgroup_match);
+ xt_unregister_match(&ifgroup6_match);
+}
+
+module_init(xt_ifgroup_init);
+module_exit(xt_ifgroup_fini);
+
--
1.5.2.5
^ permalink raw reply related
* [PATCH 1/2] Interface group: core (netlink) part
From: Laszlo Attila Toth @ 2007-10-16 8:01 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
In-Reply-To: <ifgroup.20071015.1192520046.panther@balabit.hu>
Interface groups let handle different interfaces with one (netfilter) rule.
Modified net device structure and netlink interface.
Signed-off-by: Laszlo Attila Toth <panther@balabit.hu>
---
include/linux/if_link.h | 2 ++
include/linux/netdevice.h | 2 ++
net/core/rtnetlink.c | 8 ++++++++
3 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 422084d..d9f1726 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -78,6 +78,8 @@ enum
IFLA_LINKMODE,
IFLA_LINKINFO,
#define IFLA_LINKINFO IFLA_LINKINFO
+ IFLA_IFGROUP,
+#define IFLA_IFGROUP IFLA_IFGROUP
__IFLA_MAX
};
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index e679b27..4cfc697 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -365,6 +365,8 @@ struct net_device
/* Interface index. Unique device identifier */
int ifindex;
int iflink;
+ /* interface group this interface belongs to */
+ int ifgroup;
struct net_device_stats* (*get_stats)(struct net_device *dev);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 4756d58..18ff3c5 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -646,6 +646,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
if (dev->master)
NLA_PUT_U32(skb, IFLA_MASTER, dev->master->ifindex);
+ if (dev->ifgroup)
+ NLA_PUT_U32(skb, IFLA_IFGROUP, dev->ifgroup);
+
if (dev->qdisc_sleeping)
NLA_PUT_STRING(skb, IFLA_QDISC, dev->qdisc_sleeping->ops->id);
@@ -846,6 +849,11 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
write_unlock_bh(&dev_base_lock);
}
+ if (tb[IFLA_IFGROUP]) {
+ dev->ifgroup = nla_get_u32(tb[IFLA_IFGROUP ]);
+ rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
+ }
+
err = 0;
errout:
--
1.5.2.5
^ permalink raw reply related
* [PATCH 0/2] Interface groups
From: Laszlo Attila Toth @ 2007-10-16 8:01 UTC (permalink / raw)
To: netdev, netfilter-devel; +Cc: Laszlo Attila Toth
Hello,
Different network interfaces can be grouped using the same group ID. With this
patch fewer netfilter rules are necessary but it may also be used by routing.
The interface group (ifgroup) member of the net_device can be modified via
netlink (with iproute2) and it is used in the new 'ifgroup' netfilter match.
ip link set eth0 group 4
iptables -A INPUT -m ifgroup --if-group 4 -j ACCEPT
--
Laszlo Attila Toth
^ permalink raw reply
* Re: [PATCH linux-2.6] bonding: two small fixes for IPoIB support
From: Moni Shoua @ 2007-10-16 7:56 UTC (permalink / raw)
To: Jay Vosburgh, Jeff Garzik; +Cc: rdreier, netdev, general, Or Gerlitz, Moni Levy
In-Reply-To: <9245.1192491867@death>
Jay Vosburgh wrote:
> Two small fixes to IPoIB support for bonding:
>
> 1- copy header_ops from slave to bonding for IPoIB slaves
> 2- move release and destroy logic to UNREGISTER from GOING_DOWN
> notifier to avoid double release
>
> Set bonding to version 3.2.1.
>
> Signed-off-by: Moni Shoua <monis at voltaire.com>
> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
>
> ---
> drivers/net/bonding/bond_main.c | 11 +++++------
> drivers/net/bonding/bonding.h | 4 ++--
> 2 files changed, 7 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index db80f24..6f85cc3 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -1263,6 +1263,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
> struct bonding *bond = bond_dev->priv;
>
> bond_dev->neigh_setup = slave_dev->neigh_setup;
> + bond_dev->header_ops = slave_dev->header_ops;
>
> bond_dev->type = slave_dev->type;
> bond_dev->hard_header_len = slave_dev->hard_header_len;
> @@ -3351,7 +3352,10 @@ static int bond_slave_netdev_event(unsigned long event, struct net_device *slave
> switch (event) {
> case NETDEV_UNREGISTER:
> if (bond_dev) {
> - bond_release(bond_dev, slave_dev);
> + if (bond->setup_by_slave)
> + bond_release_and_destroy(bond_dev, slave_dev);
> + else
> + bond_release(bond_dev, slave_dev);
> }
> break;
> case NETDEV_CHANGE:
> @@ -3366,11 +3370,6 @@ static int bond_slave_netdev_event(unsigned long event, struct net_device *slave
> * ... Or is it this?
> */
> break;
> - case NETDEV_GOING_DOWN:
> - dprintk("slave %s is going down\n", slave_dev->name);
> - if (bond->setup_by_slave)
> - bond_release_and_destroy(bond_dev, slave_dev);
> - break;
> case NETDEV_CHANGEMTU:
> /*
> * TODO: Should slaves be allowed to
> diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
> index a8bbd56..b818060 100644
> --- a/drivers/net/bonding/bonding.h
> +++ b/drivers/net/bonding/bonding.h
> @@ -22,8 +22,8 @@
> #include "bond_3ad.h"
> #include "bond_alb.h"
>
> -#define DRV_VERSION "3.2.0"
> -#define DRV_RELDATE "September 13, 2007"
> +#define DRV_VERSION "3.2.1"
> +#define DRV_RELDATE "October 15, 2007"
> #define DRV_NAME "bonding"
> #define DRV_DESCRIPTION "Ethernet Channel Bonding Driver"
>
Jay,
Thanks for this work.
Jeff,
Thanks for applying.
I noticed that this patch isn't applied. It includes important fixes.
Can you please apply it also?
MoniS
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox