* SIP proxying: siproxd vs. Netfilter SIP nat
From: Christoph Lameter @ 2009-11-30 17:13 UTC (permalink / raw)
To: Patrick McHardy; +Cc: Christian Hentschel, netdev
It seems that the current sip nat module in the kernel has only limited
functionality. According to
http://people.netfilter.org/chentschel/docs/sip-conntrack-nat.html
one has to point the firewall at the target host for the SIP proxying to
work. Therefore the kernel will only support a single inside phone
connecting via SIP to the outside. For a network that has a series of
phones inside the NAT zones this means that the firewall sip nat is not
useful.
siproxd http://siproxd.sourceforge.net/ seems to be able to handle
multiple outgoing SIP connections but one needs to specify an outbound
proxy for each inside SIP phone.
Isnt there a way to make the kernel module work in the same way siproxd
works and able to support multiple phones? Right now configuring SIP
connectivity is a messy thing that is not easily setup. Can we fix this?
^ permalink raw reply
* Re: dmfe/tulip device id overlap
From: Grant Grundler @ 2009-11-30 17:14 UTC (permalink / raw)
To: Brandon Philips; +Cc: David Miller, tobias, kyle, netdev, grundler
In-Reply-To: <20091130065512.GA2792@jenkins.domain_not_set.invalid>
On Sun, Nov 29, 2009 at 10:55 PM, Brandon Philips <brandon@ifup.org> wrote:
> Hello Dave-
>
> On 00:30 Sun 29 Nov 2009, David Miller wrote:
>> From: Grant Grundler <grundler@google.com>
>> Date: Wed, 25 Nov 2009 09:24:54 -0800
>>
>> > I'm ok with this patch except the mention of Ubuntu in the comment is
>> > superfluous. All the distro's will share this problem. I trust davem
>> > to rewrite the comment and plase add my:
>> > Signed-off-by: Grant Grundler <grundler@parisc-linux.org>
>>
>> Please remove the comment and the __sparc__ ifdef.
>
> The comment and the __sparc__ ifdef is the entire patch... so you NACK
> the whole patch?? ;)
>
>> If tulip doesn't work on some sparc systems we simply need to fix
>> it.
>
> Tulip works on sparc as described in the linux-sparc[1] thread. The
> problem as I understand it:
>
> tulip works for the 0x9100 and 0x9102 parts that were onboard a few
> sparc motherboards.
Has anyone posted "lspci -v" output for the "Netra X1 and Sunfire
V100" motherboards?
I'm asking because I'm hoping it's possible to disambiguate the add-on
cards from
LAN-on-Motherboard cases by looking at subsystem vendor and device IDs as well.
If we are lucky, those subsystem ID to use "Sun Microsystems" Vendor IDs:
http://www.pcidatabase.com/vendor_details.php?id=526
and this will be easy to resolve.
> But, those same device IDs are used by a set of Davicom PCI cards that
> only work with the dmfe driver.
>
> Thus, the patch only lets tulip handle 0x9100 and 0x9102 if __sparc__.
>
> Perhaps someone knows if there is a way to tell the PCI card from the
> sparc builtin machine?
Do any add-on DMFE devices have OpenBOOT firmware support?
(e.g. for the Mac?) My expectation is the SPARC motherboard
devices do but that needs to be confirmed.
To be clear, I have no interest in merging dmfe driver support into
tulip driver.
I'm open to review patches that do that (and test them). Right now, I'd
only like to resolve the immediate problem SPARC users are seeing
since that seems to be pretty straight forward.
hth,
grant
>
> Cheers,
>
> Brandon
>
> [1] http://marc.info/?l=linux-sparc&m=123698696912216&w=2
>
^ permalink raw reply
* Re: SIP proxying: siproxd vs. Netfilter SIP nat
From: Patrick McHardy @ 2009-11-30 17:21 UTC (permalink / raw)
To: Christoph Lameter; +Cc: Christian Hentschel, netdev
In-Reply-To: <alpine.DEB.2.00.0911301104520.16713@router.home>
Christoph Lameter wrote:
> It seems that the current sip nat module in the kernel has only limited
> functionality. According to
>
> http://people.netfilter.org/chentschel/docs/sip-conntrack-nat.html
>
> one has to point the firewall at the target host for the SIP proxying to
> work. Therefore the kernel will only support a single inside phone
> connecting via SIP to the outside. For a network that has a series of
> phones inside the NAT zones this means that the firewall sip nat is not
> useful.
That documentation is horribly outdated.
> siproxd http://siproxd.sourceforge.net/ seems to be able to handle
> multiple outgoing SIP connections but one needs to specify an outbound
> proxy for each inside SIP phone.
>
> Isnt there a way to make the kernel module work in the same way siproxd
> works and able to support multiple phones? Right now configuring SIP
> connectivity is a messy thing that is not easily setup. Can we fix this?
It should work fine with multiple phones, it even recognizes calls
between two internal phones and makes the media stream go between
them directly. Depending on how your registrar/proxy works, you might
have to set one or both of these module options:
sip_direct_signalling: when set to zero, allows incoming signalling
connections from other hosts than the registrar. Usually not needed.
sip_direct_media: when set to zero, allows incoming media streams
from other hosts than the registrar. This one is often required,
some providers use server farms for handling the media streams,
some set up media streams to go directly between the endpoints.
^ permalink raw reply
* Re: [PATCH v2] irq: Add node_affinity CPU masks for smarter irqbalance hints
From: Peter P Waskiewicz Jr @ 2009-11-30 17:24 UTC (permalink / raw)
To: Thomas Gleixner
Cc: David Miller, linux-kernel@vger.kernel.org,
arjan@linux.jf.intel.com, mingo@elte.hu, yong.zhang0@gmail.com,
netdev@vger.kernel.org
In-Reply-To: <alpine.LFD.2.00.0911242317280.24119@localhost.localdomain>
On Tue, 2009-11-24 at 14:23 -0800, Thomas Gleixner wrote:
> On Tue, 24 Nov 2009, Peter P Waskiewicz Jr wrote:
> > On Tue, 2009-11-24 at 13:56 -0800, Thomas Gleixner wrote:
> > > On Tue, 24 Nov 2009, David Miller wrote:
> > >
> > > > From: Thomas Gleixner <tglx@linutronix.de>
> > > > Date: Tue, 24 Nov 2009 12:07:35 +0100 (CET)
> > > >
> > > > > And what does the kernel do with this information and why are we not
> > > > > using the existing device/numa_node information ?
> > > >
> > > > It's a different problem space Thomas.
> > > >
> > > > If the device lives on NUMA node X, we still end up wanting to
> > > > allocate memory resources (RX ring buffers) on other NUMA nodes on a
> > > > per-queue basis.
> > > >
> > > > Otherwise a network card's forwarding performance is limited by the
> > > > memory bandwidth of a single NUMA node, and on a multiqueue cards we
> > > > therefore fare much better by allocating each device RX queue's memory
> > > > resources on a different NUMA node.
> > > >
> > > > It is this NUMA usage that PJ is trying to export somehow to userspace
> > > > so that irqbalanced and friends can choose the IRQ cpu masks more
> > > > intelligently.
> > >
> > > So you need a preferred irq mask information on a per IRQ basis and
> > > that mask is not restricted to the CPUs of a single NUMA node, right ?
> > >
> > Just to clarify, I need a preferred CPU mask on a per IRQ basis. And
> > yes, that mask may not be restricted to the CPUs of a single NUMA node.
> > But in the normal case, the mask will be restricted to CPUs of a single
> > node.
>
> Right, but the normal case does not help much if we need to consider
> the special case of multiple nodes affected which requires another
> cpumask in irq_desc. That's what I really want to avoid.
>
> I at least understand the exact problem you guys want to solve. Will
> think more about it.
>
Just a friendly ping Thomas. Any progress on your thinking about this
proposal?
Cheers,
-PJ
^ permalink raw reply
* Re: SIP proxying: siproxd vs. Netfilter SIP nat
From: Christoph Lameter @ 2009-11-30 17:27 UTC (permalink / raw)
To: Patrick McHardy; +Cc: Christian Hentschel, netdev
In-Reply-To: <4B13FF05.5060005@trash.net>
On Mon, 30 Nov 2009, Patrick McHardy wrote:
> > http://people.netfilter.org/chentschel/docs/sip-conntrack-nat.html
>
> That documentation is horribly outdated.
Where do I find more recent documentation?
> > Isnt there a way to make the kernel module work in the same way siproxd
> > works and able to support multiple phones? Right now configuring SIP
> > connectivity is a messy thing that is not easily setup. Can we fix this?
>
> It should work fine with multiple phones, it even recognizes calls
> between two internal phones and makes the media stream go between
> them directly. Depending on how your registrar/proxy works, you might
> have to set one or both of these module options:
Loaded both sip modules without specifying any parameters. Resulted in one
way audio problems which is what I also get without the modules.
> sip_direct_signalling: when set to zero, allows incoming signalling
> connections from other hosts than the registrar. Usually not needed.
>
> sip_direct_media: when set to zero, allows incoming media streams
> from other hosts than the registrar. This one is often required,
> some providers use server farms for handling the media streams,
> some set up media streams to go directly between the endpoints.
Ok will try setting that parameter to zero.
^ permalink raw reply
* Re: [PATCH net-next-2.6 PATCH] net: Move && and || to end of previous line
From: Stephen Hemminger @ 2009-11-30 17:28 UTC (permalink / raw)
To: joe; +Cc: David Miller, netdev
In-Reply-To: <20091129.165557.84377714.davem@davemloft.net>
On Sun, 29 Nov 2009 16:55:57 -0800 (PST)
David Miller <davem@davemloft.net> wrote:
> From: Joe Perches <joe@perches.com>
> Date: Sun, 29 Nov 2009 13:00:49 -0800
>
> > Not including net/atm/
> >
> > Compiled tested x86 allyesconfig only
> > Added a > 80 column line or two, which I ignored.
> > Existing checkpatch plaints willfully, cheerfully ignored.
> >
> > Signed-off-by: Joe Perches <joe@perches.com>
>
> Applied, thanks a lot Joe.
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
Rather than playing with the dangling operator format which seems to be a coding
style that only David cares about. Why not go through and fix the really ugly old
drivers that need it. For a good horror experience, go look at the floppy driver.
^ permalink raw reply
* Re: SIP proxying: siproxd vs. Netfilter SIP nat
From: Patrick McHardy @ 2009-11-30 17:30 UTC (permalink / raw)
To: Christoph Lameter; +Cc: Christian Hentschel, netdev
In-Reply-To: <alpine.DEB.2.00.0911301123110.17037@router.home>
Christoph Lameter wrote:
> On Mon, 30 Nov 2009, Patrick McHardy wrote:
>
>>> http://people.netfilter.org/chentschel/docs/sip-conntrack-nat.html
>> That documentation is horribly outdated.
>
> Where do I find more recent documentation?
Below :)
>>> Isnt there a way to make the kernel module work in the same way siproxd
>>> works and able to support multiple phones? Right now configuring SIP
>>> connectivity is a messy thing that is not easily setup. Can we fix this?
>> It should work fine with multiple phones, it even recognizes calls
>> between two internal phones and makes the media stream go between
>> them directly. Depending on how your registrar/proxy works, you might
>> have to set one or both of these module options:
>
> Loaded both sip modules without specifying any parameters. Resulted in one
> way audio problems which is what I also get without the modules.
>
>> sip_direct_signalling: when set to zero, allows incoming signalling
>> connections from other hosts than the registrar. Usually not needed.
>>
>> sip_direct_media: when set to zero, allows incoming media streams
>> from other hosts than the registrar. This one is often required,
>> some providers use server farms for handling the media streams,
>> some set up media streams to go directly between the endpoints.
>
> Ok will try setting that parameter to zero.
You of course also need to accept the packets marked RELATED by
the helper. If this is missing it might result in one-way audio.
^ permalink raw reply
* Re: SIP proxying: siproxd vs. Netfilter SIP nat
From: Christoph Lameter @ 2009-11-30 17:35 UTC (permalink / raw)
To: Patrick McHardy; +Cc: Christian Hentschel, netdev
In-Reply-To: <4B140129.2050907@trash.net>
On Mon, 30 Nov 2009, Patrick McHardy wrote:
> > Where do I find more recent documentation?
>
> Below :)
I found http://lwn.net/Articles/271597/ which mentions that those two
values may be set too strictly. Can they default to zero?
> You of course also need to accept the packets marked RELATED by
> the helper. If this is missing it might result in one-way audio.
Firewall is configured to accept all udp traffic. Will that do it?
The "helper" is the conntrack module?
^ permalink raw reply
* Re: [PATCH 3/5] slab.c: remove branch hint
From: Pekka Enberg @ 2009-11-30 17:44 UTC (permalink / raw)
To: Christoph Lameter
Cc: Tim Blechmann, Ingo Molnar, linux-kernel, Nick Piggin, davem,
netdev
In-Reply-To: <alpine.DEB.2.00.0911300926150.14098@router.home>
On Mon, Nov 30, 2009 at 6:09 PM, Christoph Lameter
<cl@linux-foundation.org> wrote:
> On Mon, 30 Nov 2009, Pekka Enberg wrote:
>
>> OK, so it's the generic alloc_skb() function that keeps hitting
>> kmem_cache_alloc_node() with "-1". Christoph, are you okay with removing the
>> unlikely() annotation from __cache_alloc_node()?
>
> Yes. Lets look for other cases in the allocators too.
> kmem_cache_alloc_node used to be mainly used for off node allocations but
> the network alloc_skb() case shows that this is changing now.
Tim, can you please re-send the patch to me so I can apply it?
^ permalink raw reply
* Re: SIP proxying: siproxd vs. Netfilter SIP nat
From: Patrick McHardy @ 2009-11-30 17:46 UTC (permalink / raw)
To: Christoph Lameter; +Cc: Christian Hentschel, netdev
In-Reply-To: <alpine.DEB.2.00.0911301133280.17037@router.home>
Christoph Lameter wrote:
> On Mon, 30 Nov 2009, Patrick McHardy wrote:
>
>>> Where do I find more recent documentation?
>> Below :)
>
> I found http://lwn.net/Articles/271597/ which mentions that those two
> values may be set too strictly. Can they default to zero?
No, this is deliberate since it diverges from the behaviour of other
helpers. Usually they only allow to create RELATED connections between
the two hosts communicating. If you set either of these module options
to zero, they will allow completely foreign addresses to establish
connections when those addresses appear in the SDP payload. You should
usually use additional filters to f.i. only allow source addresses of
your registrar:
iptables -A FORWARD -m state --state RELATED \
-m helper --helper "sip" \
-s registrar-network/X -j ACCEPT
>> You of course also need to accept the packets marked RELATED by
>> the helper. If this is missing it might result in one-way audio.
>
> Firewall is configured to accept all udp traffic. Will that do it?
That should be fine, but you can restrict it to just accept
-m state --state RELATED packets.
> The "helper" is the conntrack module?
Yes.
^ permalink raw reply
* Re: [PATCH 3/5] slab.c: remove branch hint
From: Christoph Lameter @ 2009-11-30 17:50 UTC (permalink / raw)
To: Pekka Enberg
Cc: Tim Blechmann, Ingo Molnar, linux-kernel, Nick Piggin, davem,
netdev
In-Reply-To: <84144f020911300944x89309c5r8e9079e1a62fb416@mail.gmail.com>
On Mon, 30 Nov 2009, Pekka Enberg wrote:
> Tim, can you please re-send the patch to me so I can apply it?
SLUB has no issue since NUMA decisions are deferred to the page allocator.
^ permalink raw reply
* net 01/05: fib_rules: rearrange struct fib_rule
From: Patrick McHardy @ 2009-11-30 17:55 UTC (permalink / raw)
To: netdev; +Cc: Patrick McHardy
In-Reply-To: <20091130175529.7555.10132.sendpatchset@x2.localnet>
commit 0d9a871c9888ef8f7a08531beaa69220edf4bea3
Author: Patrick McHardy <kaber@trash.net>
Date: Mon Nov 30 15:45:49 2009 +0100
net: fib_rules: rearrange struct fib_rule
The ifname member is only used to resolve interface names and is not needed
during rule lookups. The target and ctarget members however are used during
rule lookups and are currently located in a second cacheline.
Move ifname further to the end to make sure both target and ctarget are
located in the same cacheline as other members used during rule lookups.
The layout on 64 bit changes from:
struct fib_rule {
...
u32 table; /* 56 4 */
u8 action; /* 60 1 */
/* XXX 3 bytes hole, try to pack */
/* --- cacheline 1 boundary (64 bytes) --- */
u32 target; /* 64 4 */
/* XXX 4 bytes hole, try to pack */
struct fib_rule * ctarget; /* 72 8 */
struct rcu_head rcu; /* 80 16 */
struct net * fr_net; /* 96 8 */
};
to:
struct fib_rule {
...
u32 table; /* 40 4 */
u8 action; /* 44 1 */
/* XXX 3 bytes hole, try to pack */
u32 target; /* 48 4 */
/* XXX 4 bytes hole, try to pack */
struct fib_rule * ctarget; /* 56 8 */
/* --- cacheline 1 boundary (64 bytes) --- */
char ifname[16]; /* 64 16 */
struct rcu_head rcu; /* 80 16 */
struct net * fr_net; /* 96 8 */
};
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 2cd707b..22fb323 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -11,7 +11,6 @@ struct fib_rule {
struct list_head list;
atomic_t refcnt;
int ifindex;
- char ifname[IFNAMSIZ];
u32 mark;
u32 mark_mask;
u32 pref;
@@ -20,6 +19,7 @@ struct fib_rule {
u8 action;
u32 target;
struct fib_rule * ctarget;
+ char ifname[IFNAMSIZ];
struct rcu_head rcu;
struct net * fr_net;
};
^ permalink raw reply related
* net 02/05: fib_rules: rename ifindex/ifname/FRA_IFNAME to iifindex/iifname/FRA_IIFNAME
From: Patrick McHardy @ 2009-11-30 17:55 UTC (permalink / raw)
To: netdev; +Cc: Patrick McHardy
In-Reply-To: <20091130175529.7555.10132.sendpatchset@x2.localnet>
commit dc4427ae3647195508b4df883050a9f0ef111165
Author: Patrick McHardy <kaber@trash.net>
Date: Mon Nov 30 15:54:05 2009 +0100
net: fib_rules: rename ifindex/ifname/FRA_IFNAME to iifindex/iifname/FRA_IIFNAME
The next patch will add oif classification, rename interface related members
and attributes to reflect that they're used for iif classification.
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/include/linux/fib_rules.h b/include/linux/fib_rules.h
index c7e5b70..e3c91af 100644
--- a/include/linux/fib_rules.h
+++ b/include/linux/fib_rules.h
@@ -8,7 +8,8 @@
#define FIB_RULE_PERMANENT 0x00000001
#define FIB_RULE_INVERT 0x00000002
#define FIB_RULE_UNRESOLVED 0x00000004
-#define FIB_RULE_DEV_DETACHED 0x00000008
+#define FIB_RULE_IIF_DETACHED 0x00000008
+#define FIB_RULE_DEV_DETACHED FIB_RULE_DEV_DETACHED
/* try to find source address in routing lookups */
#define FIB_RULE_FIND_SADDR 0x00010000
@@ -31,7 +32,8 @@ enum {
FRA_UNSPEC,
FRA_DST, /* destination address */
FRA_SRC, /* source address */
- FRA_IFNAME, /* interface name */
+ FRA_IIFNAME, /* interface name */
+#define FRA_IFNAME FRA_IIFNAME
FRA_GOTO, /* target to jump to (FR_ACT_GOTO) */
FRA_UNUSED2,
FRA_PRIORITY, /* priority/preference */
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 22fb323..62bebcb 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -10,7 +10,7 @@
struct fib_rule {
struct list_head list;
atomic_t refcnt;
- int ifindex;
+ int iifindex;
u32 mark;
u32 mark_mask;
u32 pref;
@@ -19,7 +19,7 @@ struct fib_rule {
u8 action;
u32 target;
struct fib_rule * ctarget;
- char ifname[IFNAMSIZ];
+ char iifname[IFNAMSIZ];
struct rcu_head rcu;
struct net * fr_net;
};
@@ -67,7 +67,7 @@ struct fib_rules_ops {
};
#define FRA_GENERIC_POLICY \
- [FRA_IFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \
+ [FRA_IIFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \
[FRA_PRIORITY] = { .type = NLA_U32 }, \
[FRA_FWMARK] = { .type = NLA_U32 }, \
[FRA_FWMASK] = { .type = NLA_U32 }, \
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index bd30938..8e8028c 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -135,7 +135,7 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
{
int ret = 0;
- if (rule->ifindex && (rule->ifindex != fl->iif))
+ if (rule->iifindex && (rule->iifindex != fl->iif))
goto out;
if ((rule->mark ^ fl->mark) & rule->mark_mask)
@@ -248,14 +248,14 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
if (tb[FRA_PRIORITY])
rule->pref = nla_get_u32(tb[FRA_PRIORITY]);
- if (tb[FRA_IFNAME]) {
+ if (tb[FRA_IIFNAME]) {
struct net_device *dev;
- rule->ifindex = -1;
- nla_strlcpy(rule->ifname, tb[FRA_IFNAME], IFNAMSIZ);
- dev = __dev_get_by_name(net, rule->ifname);
+ rule->iifindex = -1;
+ nla_strlcpy(rule->iifname, tb[FRA_IIFNAME], IFNAMSIZ);
+ dev = __dev_get_by_name(net, rule->iifname);
if (dev)
- rule->ifindex = dev->ifindex;
+ rule->iifindex = dev->ifindex;
}
if (tb[FRA_FWMARK]) {
@@ -388,8 +388,8 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
(rule->pref != nla_get_u32(tb[FRA_PRIORITY])))
continue;
- if (tb[FRA_IFNAME] &&
- nla_strcmp(tb[FRA_IFNAME], rule->ifname))
+ if (tb[FRA_IIFNAME] &&
+ nla_strcmp(tb[FRA_IIFNAME], rule->iifname))
continue;
if (tb[FRA_FWMARK] &&
@@ -447,7 +447,7 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
struct fib_rule *rule)
{
size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr))
- + nla_total_size(IFNAMSIZ) /* FRA_IFNAME */
+ + nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */
+ nla_total_size(4) /* FRA_PRIORITY */
+ nla_total_size(4) /* FRA_TABLE */
+ nla_total_size(4) /* FRA_FWMARK */
@@ -481,11 +481,11 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
if (rule->action == FR_ACT_GOTO && rule->ctarget == NULL)
frh->flags |= FIB_RULE_UNRESOLVED;
- if (rule->ifname[0]) {
- NLA_PUT_STRING(skb, FRA_IFNAME, rule->ifname);
+ if (rule->iifname[0]) {
+ NLA_PUT_STRING(skb, FRA_IIFNAME, rule->iifname);
- if (rule->ifindex == -1)
- frh->flags |= FIB_RULE_DEV_DETACHED;
+ if (rule->iifindex == -1)
+ frh->flags |= FIB_RULE_IIF_DETACHED;
}
if (rule->pref)
@@ -600,9 +600,9 @@ static void attach_rules(struct list_head *rules, struct net_device *dev)
struct fib_rule *rule;
list_for_each_entry(rule, rules, list) {
- if (rule->ifindex == -1 &&
- strcmp(dev->name, rule->ifname) == 0)
- rule->ifindex = dev->ifindex;
+ if (rule->iifindex == -1 &&
+ strcmp(dev->name, rule->iifname) == 0)
+ rule->iifindex = dev->ifindex;
}
}
@@ -611,8 +611,8 @@ static void detach_rules(struct list_head *rules, struct net_device *dev)
struct fib_rule *rule;
list_for_each_entry(rule, rules, list)
- if (rule->ifindex == dev->ifindex)
- rule->ifindex = -1;
+ if (rule->iifindex == dev->ifindex)
+ rule->iifindex = -1;
}
^ permalink raw reply related
* net 04/05: fib_rules: allow to delete local rule
From: Patrick McHardy @ 2009-11-30 17:55 UTC (permalink / raw)
To: netdev; +Cc: Patrick McHardy
In-Reply-To: <20091130175529.7555.10132.sendpatchset@x2.localnet>
commit ca1ba96aaa05cc0a2a7f172990e7787354c8b7b9
Author: Patrick McHardy <kaber@trash.net>
Date: Mon Nov 30 16:05:51 2009 +0100
net: fib_rules: allow to delete local rule
Allow to delete the local rule and recreate it with a lower priority. This
can be used to force packets with a local destination out on the wire instead
of routing them to loopback. Additionally this patch allows to recreate rules
with a priority of 0.
Combined with the previous patch to allow oif classification, a socket can
be bound to the desired interface and packets routed to the wire like this:
# move local rule to lower priority
ip rule add pref 1000 lookup local
ip rule del pref 0
# route packets of sockets bound to eth0 to the wire independant
# of the destination address
ip rule add pref 100 oif eth0 lookup 100
ip route add default dev eth0 lookup 100
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index d1a70ad..ef0e7d9 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -287,7 +287,7 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
rule->flags = frh->flags;
rule->table = frh_get_table(frh, tb);
- if (!rule->pref && ops->default_pref)
+ if (!tb[FRA_PRIORITY] && ops->default_pref)
rule->pref = ops->default_pref(ops);
err = -EINVAL;
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 835262c..1239ed2 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -284,7 +284,7 @@ static int fib_default_rules_init(struct fib_rules_ops *ops)
{
int err;
- err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, FIB_RULE_PERMANENT);
+ err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, 0);
if (err < 0)
return err;
err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 00a7a5e..3b38f49 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -276,7 +276,7 @@ static int fib6_rules_net_init(struct net *net)
INIT_LIST_HEAD(&net->ipv6.fib6_rules_ops->rules_list);
err = fib_default_rule_add(net->ipv6.fib6_rules_ops, 0,
- RT6_TABLE_LOCAL, FIB_RULE_PERMANENT);
+ RT6_TABLE_LOCAL, 0);
if (err)
goto out_fib6_rules_ops;
^ permalink raw reply related
* ipv4 05/05: add sysctl to accept packets with local source addresses
From: Patrick McHardy @ 2009-11-30 17:55 UTC (permalink / raw)
To: netdev; +Cc: Patrick McHardy
In-Reply-To: <20091130175529.7555.10132.sendpatchset@x2.localnet>
commit 35924708110a98ac8407deaef95194ff9d0375d2
Author: Patrick McHardy <kaber@trash.net>
Date: Mon Nov 30 17:48:03 2009 +0100
ipv4: add sysctl to accept packets with local source addresses
Change fib_validate_source() to accept packets with a local source address when
the "accept_local" sysctl is set for the incoming inet device. Combined with the
previous patches, this allows to communicate between multiple local interfaces
over the wire.
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index a0e134d..b319d4f 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -723,6 +723,12 @@ accept_source_route - BOOLEAN
default TRUE (router)
FALSE (host)
+accept_local - BOOLEAN
+ Accept packets with local source addresses. In combination with
+ suitable routing, this can be used to direct packets between two
+ local interfaces over the wire and have them accepted properly.
+ default FALSE
+
rp_filter - INTEGER
0 - No source validation.
1 - Strict mode as defined in RFC3704 Strict Reverse Path
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index eecfa55..699e85c 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -83,6 +83,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
#define IN_DEV_RPFILTER(in_dev) IN_DEV_MAXCONF((in_dev), RP_FILTER)
#define IN_DEV_SOURCE_ROUTE(in_dev) IN_DEV_ANDCONF((in_dev), \
ACCEPT_SOURCE_ROUTE)
+#define IN_DEV_ACCEPT_LOCAL(in_dev) IN_DEV_ORCONF((in_dev), ACCEPT_LOCAL)
#define IN_DEV_BOOTP_RELAY(in_dev) IN_DEV_ANDCONF((in_dev), BOOTP_RELAY)
#define IN_DEV_LOG_MARTIANS(in_dev) IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 1e4743e..9f047d7 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -490,6 +490,7 @@ enum
NET_IPV4_CONF_PROMOTE_SECONDARIES=20,
NET_IPV4_CONF_ARP_ACCEPT=21,
NET_IPV4_CONF_ARP_NOTIFY=22,
+ NET_IPV4_CONF_ACCEPT_LOCAL=23,
__NET_IPV4_CONF_MAX
};
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
index b6e7aae..f1d676e 100644
--- a/kernel/sysctl_check.c
+++ b/kernel/sysctl_check.c
@@ -220,6 +220,7 @@ static const struct trans_ctl_table trans_net_ipv4_conf_vars_table[] = {
{ NET_IPV4_CONF_PROMOTE_SECONDARIES, "promote_secondaries" },
{ NET_IPV4_CONF_ARP_ACCEPT, "arp_accept" },
{ NET_IPV4_CONF_ARP_NOTIFY, "arp_notify" },
+ { NET_IPV4_CONF_ACCEPT_LOCAL, "accept_local" },
{}
};
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index c100709..e312661 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1468,6 +1468,7 @@ static struct devinet_sysctl_table {
DEVINET_SYSCTL_RW_ENTRY(SEND_REDIRECTS, "send_redirects"),
DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
"accept_source_route"),
+ DEVINET_SYSCTL_RW_ENTRY(ACCEPT_LOCAL, "accept_local"),
DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 6c1e56a..32ea949 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -241,16 +241,17 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
.iif = oif };
struct fib_result res;
- int no_addr, rpf;
+ int no_addr, rpf, accept_local;
int ret;
struct net *net;
- no_addr = rpf = 0;
+ no_addr = rpf = accept_local = 0;
rcu_read_lock();
in_dev = __in_dev_get_rcu(dev);
if (in_dev) {
no_addr = in_dev->ifa_list == NULL;
rpf = IN_DEV_RPFILTER(in_dev);
+ accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
}
rcu_read_unlock();
@@ -260,8 +261,10 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
net = dev_net(dev);
if (fib_lookup(net, &fl, &res))
goto last_resort;
- if (res.type != RTN_UNICAST)
- goto e_inval_res;
+ if (res.type != RTN_UNICAST) {
+ if (res.type != RTN_LOCAL || !accept_local)
+ goto e_inval_res;
+ }
*spec_dst = FIB_RES_PREFSRC(res);
fib_combine_itag(itag, &res);
#ifdef CONFIG_IP_ROUTE_MULTIPATH
^ permalink raw reply related
* RFC: net 00/05: routing based send-to-self implementation
From: Patrick McHardy @ 2009-11-30 17:55 UTC (permalink / raw)
To: netdev; +Cc: Patrick McHardy
These patches are yet another attempt at adding "send-to-self" functionality,
allowing to send packets between two local interfaces over the wire. Unlike
the approaches I've seen so far, this one is purely routing based.
Especially the oif classification should also be useful for different setups.
The patchset consists of three parts:
- the first three patches add oif classification to fib_rules. This can be
used create special routing tables for sockets bound to an interface.
- the fourth patch changes IPv4 and IPv6 to allow to delete the local rule
with priority 0. This allows to re-create it using a lower priority and
insert new rules below it to force packets with a local destination out
on the wire.
- the fifth patch adds a devinet sysctl to accept packets with local source
addresses in fib_validate_source(). This one unfortunately seems to be
necessary, I couldn't come up with a method based purely on adding more
routes to fool fib_validate_source() into accepting those packets.
Usage example:
# move local routing rule to lower priority
ip rule add pref 1000 lookup local
ip rule del pref 0
# only reply to ARP requests for addresses configured on the device
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
# configure device and force packets of bound sockets out on eth1
ip address add dev eth1 10.0.0.1/24
echo 1 > /proc/sys/net/ipv4/conf/eth1/accept_local
ip link set eth1 up
ip rule add pref 500 oif eth1 lookup 500
ip route add default dev eth1 table 500
# configure device and force packets of bound sockets out on eth2
ip address add dev eth2 10.0.0.2/24
echo 1 > /proc/sys/net/ipv4/conf/eth2/accept_local
ip link set eth2 up
ip rule add pref 501 oif eth2 lookup 501
ip route add default dev eth2 table 501
At this point both packets between sockets bound to eth1/eth2 will
go over the wire.
Comments welcome.
Documentation/networking/ip-sysctl.txt | 6 +++
include/linux/fib_rules.h | 8 +++-
include/linux/inetdevice.h | 1 +
include/linux/sysctl.h | 1 +
include/net/fib_rules.h | 9 +++-
kernel/sysctl_check.c | 1 +
net/core/fib_rules.c | 71 +++++++++++++++++++++++---------
net/ipv4/devinet.c | 1 +
net/ipv4/fib_frontend.c | 11 +++--
net/ipv4/fib_rules.c | 2 +-
net/ipv6/fib6_rules.c | 2 +-
11 files changed, 82 insertions(+), 31 deletions(-)
Patrick McHardy (5):
net: fib_rules: rearrange struct fib_rule
net: fib_rules: rename ifindex/ifname/FRA_IFNAME to iifindex/iifname/FRA_IIFNAME
net: fib_rules: add oif classification
net: fib_rules: allow to delete local rule
ipv4: add sysctl to accept packets with local source addresses
^ permalink raw reply
* net 03/05: fib_rules: add oif classification
From: Patrick McHardy @ 2009-11-30 17:55 UTC (permalink / raw)
To: netdev; +Cc: Patrick McHardy
In-Reply-To: <20091130175529.7555.10132.sendpatchset@x2.localnet>
commit b3fe9e6465a572e97dc1bb6222c1ec4224285817
Author: Patrick McHardy <kaber@trash.net>
Date: Mon Nov 30 16:00:51 2009 +0100
net: fib_rules: add oif classification
Support routing table lookup based on the flow's oif. This is useful to
classify packets originating from sockets bound to interfaces differently.
The route cache already includes the oif and needs no changes.
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/include/linux/fib_rules.h b/include/linux/fib_rules.h
index e3c91af..05c9bbe 100644
--- a/include/linux/fib_rules.h
+++ b/include/linux/fib_rules.h
@@ -10,6 +10,7 @@
#define FIB_RULE_UNRESOLVED 0x00000004
#define FIB_RULE_IIF_DETACHED 0x00000008
#define FIB_RULE_DEV_DETACHED FIB_RULE_DEV_DETACHED
+#define FIB_RULE_OIF_DETACHED 0x00000010
/* try to find source address in routing lookups */
#define FIB_RULE_FIND_SADDR 0x00010000
@@ -47,6 +48,7 @@ enum {
FRA_UNUSED8,
FRA_TABLE, /* Extended table id */
FRA_FWMASK, /* mask for netfilter mark */
+ FRA_OIFNAME,
__FRA_MAX
};
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 62bebcb..d4e875a 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -11,6 +11,7 @@ struct fib_rule {
struct list_head list;
atomic_t refcnt;
int iifindex;
+ int oifindex;
u32 mark;
u32 mark_mask;
u32 pref;
@@ -20,6 +21,7 @@ struct fib_rule {
u32 target;
struct fib_rule * ctarget;
char iifname[IFNAMSIZ];
+ char oifname[IFNAMSIZ];
struct rcu_head rcu;
struct net * fr_net;
};
@@ -68,6 +70,7 @@ struct fib_rules_ops {
#define FRA_GENERIC_POLICY \
[FRA_IIFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \
+ [FRA_OIFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \
[FRA_PRIORITY] = { .type = NLA_U32 }, \
[FRA_FWMARK] = { .type = NLA_U32 }, \
[FRA_FWMASK] = { .type = NLA_U32 }, \
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 8e8028c..d1a70ad 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -138,6 +138,9 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops,
if (rule->iifindex && (rule->iifindex != fl->iif))
goto out;
+ if (rule->oifindex && (rule->oifindex != fl->oif))
+ goto out;
+
if ((rule->mark ^ fl->mark) & rule->mark_mask)
goto out;
@@ -258,6 +261,16 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
rule->iifindex = dev->ifindex;
}
+ if (tb[FRA_OIFNAME]) {
+ struct net_device *dev;
+
+ rule->oifindex = -1;
+ nla_strlcpy(rule->oifname, tb[FRA_OIFNAME], IFNAMSIZ);
+ dev = __dev_get_by_name(net, rule->oifname);
+ if (dev)
+ rule->oifindex = dev->ifindex;
+ }
+
if (tb[FRA_FWMARK]) {
rule->mark = nla_get_u32(tb[FRA_FWMARK]);
if (rule->mark)
@@ -392,6 +405,10 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
nla_strcmp(tb[FRA_IIFNAME], rule->iifname))
continue;
+ if (tb[FRA_OIFNAME] &&
+ nla_strcmp(tb[FRA_OIFNAME], rule->oifname))
+ continue;
+
if (tb[FRA_FWMARK] &&
(rule->mark != nla_get_u32(tb[FRA_FWMARK])))
continue;
@@ -448,6 +465,7 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
{
size_t payload = NLMSG_ALIGN(sizeof(struct fib_rule_hdr))
+ nla_total_size(IFNAMSIZ) /* FRA_IIFNAME */
+ + nla_total_size(IFNAMSIZ) /* FRA_OIFNAME */
+ nla_total_size(4) /* FRA_PRIORITY */
+ nla_total_size(4) /* FRA_TABLE */
+ nla_total_size(4) /* FRA_FWMARK */
@@ -488,6 +506,13 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
frh->flags |= FIB_RULE_IIF_DETACHED;
}
+ if (rule->oifname[0]) {
+ NLA_PUT_STRING(skb, FRA_OIFNAME, rule->oifname);
+
+ if (rule->oifindex == -1)
+ frh->flags |= FIB_RULE_OIF_DETACHED;
+ }
+
if (rule->pref)
NLA_PUT_U32(skb, FRA_PRIORITY, rule->pref);
@@ -603,6 +628,9 @@ static void attach_rules(struct list_head *rules, struct net_device *dev)
if (rule->iifindex == -1 &&
strcmp(dev->name, rule->iifname) == 0)
rule->iifindex = dev->ifindex;
+ if (rule->oifindex == -1 &&
+ strcmp(dev->name, rule->oifname) == 0)
+ rule->oifindex = dev->ifindex;
}
}
@@ -610,9 +638,12 @@ static void detach_rules(struct list_head *rules, struct net_device *dev)
{
struct fib_rule *rule;
- list_for_each_entry(rule, rules, list)
+ list_for_each_entry(rule, rules, list) {
if (rule->iifindex == dev->ifindex)
rule->iifindex = -1;
+ if (rule->oifindex == dev->ifindex)
+ rule->oifindex = -1;
+ }
}
^ permalink raw reply related
* Re: SIP proxying: siproxd vs. Netfilter SIP nat
From: Christoph Lameter @ 2009-11-30 17:55 UTC (permalink / raw)
To: Patrick McHardy; +Cc: Christian Hentschel, netdev
In-Reply-To: <4B140508.1090802@trash.net>
On Mon, 30 Nov 2009, Patrick McHardy wrote:
> No, this is deliberate since it diverges from the behaviour of other
> helpers. Usually they only allow to create RELATED connections between
> the two hosts communicating. If you set either of these module options
> to zero, they will allow completely foreign addresses to establish
> connections when those addresses appear in the SDP payload. You should
> usually use additional filters to f.i. only allow source addresses of
> your registrar:
>
> iptables -A FORWARD -m state --state RELATED \
> -m helper --helper "sip" \
> -s registrar-network/X -j ACCEPT
Please put documentation with all these tricks somewhere where people
looking for SIP NAT can find it. I see multiple threads where people have
struggled with setting up SIP proxying and have failed.
^ permalink raw reply
* Re: warning: massive change to conditional coding style in net?
From: Joe Perches @ 2009-11-30 17:56 UTC (permalink / raw)
To: William Allen Simpson
Cc: Linux Kernel Developers, Linux Kernel Network Developers
In-Reply-To: <4B13A025.7000103@gmail.com>
On Mon, 2009-11-30 at 05:36 -0500, William Allen Simpson wrote:
> Over the past several days, David Miller (with help from Joe Perches)
> made sweeping changes to the format of conditional statements in the
> net tree -- the equivalent of mass patches that change spaces.
> This makes writing patches for multiple versions of the tree very
> difficult, and will make future pullups problematic.
If it makes getting tcp cookies accepted difficult,
a reversion is simple. That style isn't as important.
I think writing a single set of patches for multiple
versions of linux is not feasible. Feature changes
occur in kernel source daily.
> if (condition
> && condition
> && (condition
> || condition
> || condition)) {
The above is my personally preferred style.
> if (condition &&
> condition && (condition || condition ||
> condition)) {
Except for the odd spacing, this is the significant
majority of net/ style.
The leading style was < 10%. It's less now.
> Miller (with Perches) changed hundreds (thousands?) of these to
> trailing form. This results in a number of hilarious examples --
> lines with both leading and trailing, lines with only &&, etc.
Nearly all existing.
^ permalink raw reply
* Re: [Bugme-new] [Bug 14685] New: 2.6.30 -> 2.6.31: very high number of RX dropped in bnx2
From: Michael Chan @ 2009-11-30 17:44 UTC (permalink / raw)
To: Krzysztof Oledzki
Cc: 'Andrew Morton', netdev@vger.kernel.org,
bugzilla-daemon@bugzilla.kernel.org,
bugme-daemon@bugzilla.kernel.org
In-Reply-To: <alpine.LNX.1.10.0911301632550.21971@bizon.gios.gov.pl>
On Mon, 2009-11-30 at 07:33 -0800, Krzysztof Oledzki wrote:
> # ethtool -S eth0|egrep "(rx_bcast_packets|rx_mcast_packets|
> rx_fw_discards)"
> rx_mcast_packets: 2806
> rx_bcast_packets: 790016
> rx_fw_discards: 790016
This tells me that all the dropped packets are occurring in the iSCSI
ring.
We have recently enabled iSCSI in the kernel and you probably don't have
the userspace components to handle the iSCSI ring. All broadcast
packets are also received in the iSCSI ring and they are all dropped in
this case without the userspace components. Networking is not affected.
If you rmmod the bnx2i and cnic drivers, the drop counter should stop
counting.
We have newer firmware that will not include dropped iSCSI packets in
the networking counters. It should appear in the 2.6.33 kernel
time-frame.
Thanks.
^ permalink raw reply
* Re: [PATCH net-next-2.6 PATCH] net: Move && and || to end of previous line
From: Joe Perches @ 2009-11-30 17:57 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: David Miller, netdev
In-Reply-To: <20091130092837.4998f961@nehalam>
On Mon, 2009-11-30 at 09:28 -0800, Stephen Hemminger wrote:
> Rather than playing with the dangling operator format which seems to be a coding
> style that only David cares about. Why not go through and fix the really ugly old
> drivers that need it.
net/... had the lower percentage of leading uses
and a maintainer that cared to standardize.
drivers/... has many odd uses of coding styles and
no single maintainer that cares much about style.
> For a good horror experience, go look at the floppy driver.
I've no desire to be floppy maintainer. Do you?
$ ./scripts/get_maintainer --nogit -f driver/block/floppy.c
linux-kernel@vger.kernel.org
^ permalink raw reply
* iprule: add oif classification support
From: Patrick McHardy @ 2009-11-30 18:00 UTC (permalink / raw)
To: Linux Netdev List
[-- Attachment #1: Type: text/plain, Size: 110 bytes --]
This patch contains iproute support for iprule oif classification
for the send-to-self RFC I just sent out.
[-- Attachment #2: 01.diff --]
[-- Type: text/x-patch, Size: 3579 bytes --]
commit ba680d5d5cbd7497feee2d3045b06b9062d15a70
Author: Patrick McHardy <kaber@trash.net>
Date: Mon Nov 30 19:06:38 2009 +0100
iprule: add oif classification support
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/include/linux/fib_rules.h b/include/linux/fib_rules.h
index 87b606b..625f019 100644
--- a/include/linux/fib_rules.h
+++ b/include/linux/fib_rules.h
@@ -8,7 +8,9 @@
#define FIB_RULE_PERMANENT 0x00000001
#define FIB_RULE_INVERT 0x00000002
#define FIB_RULE_UNRESOLVED 0x00000004
-#define FIB_RULE_DEV_DETACHED 0x00000008
+#define FIB_RULE_IIF_DETACHED 0x00000008
+#define FIB_RULE_DEV_DETACHED FIB_RULE_DEV_DETACHED
+#define FIB_RULE_OIF_DETACHED 0x00000010
/* try to find source address in routing lookups */
#define FIB_RULE_FIND_SADDR 0x00010000
@@ -33,7 +35,8 @@ enum
FRA_UNSPEC,
FRA_DST, /* destination address */
FRA_SRC, /* source address */
- FRA_IFNAME, /* interface name */
+ FRA_IIFNAME, /* interface name */
+#define FRA_IFNAME FRA_IIFNAME
FRA_GOTO, /* target to jump to (FR_ACT_GOTO) */
FRA_UNUSED2,
FRA_PRIORITY, /* priority/preference */
@@ -47,6 +50,7 @@ enum
FRA_UNUSED8,
FRA_TABLE, /* Extended table id */
FRA_FWMASK, /* mask for netfilter mark */
+ FRA_OIFNAME,
__FRA_MAX
};
diff --git a/ip/iprule.c b/ip/iprule.c
index e1a943a..9d4c9ae 100644
--- a/ip/iprule.c
+++ b/ip/iprule.c
@@ -38,7 +38,7 @@ static void usage(void)
{
fprintf(stderr, "Usage: ip rule [ list | add | del | flush ] SELECTOR ACTION\n");
fprintf(stderr, "SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ]\n");
- fprintf(stderr, " [ dev STRING ] [ pref NUMBER ]\n");
+ fprintf(stderr, " [ iif STRING ] [ oif STRING ] [ pref NUMBER ]\n");
fprintf(stderr, "ACTION := [ table TABLE_ID ]\n");
fprintf(stderr, " [ prohibit | reject | unreachable ]\n");
fprintf(stderr, " [ realms [SRCREALM/]DSTREALM ]\n");
@@ -146,7 +146,13 @@ int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
if (tb[FRA_IFNAME]) {
fprintf(fp, "iif %s ", (char*)RTA_DATA(tb[FRA_IFNAME]));
- if (r->rtm_flags & FIB_RULE_DEV_DETACHED)
+ if (r->rtm_flags & FIB_RULE_IIF_DETACHED)
+ fprintf(fp, "[detached] ");
+ }
+
+ if (tb[FRA_OIFNAME]) {
+ fprintf(fp, "oif %s ", (char*)RTA_DATA(tb[FRA_OIFNAME]));
+ if (r->rtm_flags & FIB_RULE_OIF_DETACHED)
fprintf(fp, "[detached] ");
}
@@ -311,6 +317,9 @@ static int iprule_modify(int cmd, int argc, char **argv)
strcmp(*argv, "iif") == 0) {
NEXT_ARG();
addattr_l(&req.n, sizeof(req), FRA_IFNAME, *argv, strlen(*argv)+1);
+ } else if (strcmp(*argv, "oif") == 0) {
+ NEXT_ARG();
+ addattr_l(&req.n, sizeof(req), FRA_OIFNAME, *argv, strlen(*argv)+1);
} else if (strcmp(*argv, "nat") == 0 ||
matches(*argv, "map-to") == 0) {
NEXT_ARG();
diff --git a/man/man8/ip.8 b/man/man8/ip.8
index a8fccc4..fab337d 100644
--- a/man/man8/ip.8
+++ b/man/man8/ip.8
@@ -240,7 +240,9 @@ throw " | " unreachable " | " prohibit " | " blackhole " | " nat " ]"
.IR TOS " ] [ "
.B fwmark
.IR FWMARK[/MASK] " ] [ "
-.B dev
+.B iif
+.IR STRING " ] [ "
+.B oif
.IR STRING " ] [ "
.B pref
.IR NUMBER " ]"
@@ -1936,6 +1938,12 @@ that you may create separate routing tables for forwarded and local
packets and, hence, completely segregate them.
.TP
+.BI oif " NAME"
+select the outgoing device to match. The outgoing interface is only
+available for packets originating from local sockets that are bound to
+a device.
+
+.TP
.BI tos " TOS"
.TP
.BI dsfield " TOS"
^ permalink raw reply related
* Re: [PATCH] bnx2: avoid flushing statistics when doing a MTU change
From: Michael Chan @ 2009-11-30 18:09 UTC (permalink / raw)
To: Breno Leitao; +Cc: Eric Dumazet, netdev@vger.kernel.org
In-Reply-To: <4B13D130.8080108@linux.vnet.ibm.com>
On Mon, 2009-11-30 at 06:05 -0800, Breno Leitao wrote:
> Eric Dumazet wrote:
> > I see nothing in the driver/patch that will consolidate bp->dev->stats
> > before your memcpy(). DMA transfert doesnt touch bp->dev->stats.
> You're right, calling bnx2_get_stats() after the DMA should be enough,
> as the following patch
> ---
>
> [PATCH] bnx2: avoid flushing statistics when doing a MTU change
>
> Actually when bnx2 changes the interface's MTU size, it resets
> the chip and consequently flushes the interface statistics.
> This patch saves the statistics in a temporary space in order to
> maintain the statistics correct after the chip reset.
Thanks Breno. As I mentioned earlier, this does not save the ethtool -S
stats before reset. The user may be confused when netstat does not
match ethtool -S. I think we should save the statistics block so
everything will match up. If you don't beat me to it, I'll work on the
patch later today.
>
> Signed-off-by: Breno Leitao<leitao@linux.vnet.ibm.com>
> ---
> drivers/net/bnx2.c | 57 ++++++++++++++++++++++++++++++++++++++-------------
> drivers/net/bnx2.h | 1 +
> 2 files changed, 43 insertions(+), 15 deletions(-)
>
> diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
> index 7fa4048..07c0376 100644
> --- a/drivers/net/bnx2.c
> +++ b/drivers/net/bnx2.c
> @@ -6221,6 +6221,8 @@ bnx2_open(struct net_device *dev)
> else if (bp->flags & BNX2_FLAG_USING_MSIX)
> printk(KERN_INFO PFX "%s: using MSIX\n", dev->name);
>
> + memset(&bp->stats_extra, 0, sizeof(struct net_device_stats));
> +
> netif_tx_start_all_queues(dev);
>
> return 0;
> @@ -6469,46 +6471,58 @@ bnx2_get_stats(struct net_device *dev)
> net_stats->rx_packets =
> GET_NET_STATS(stats_blk->stat_IfHCInUcastPkts) +
> GET_NET_STATS(stats_blk->stat_IfHCInMulticastPkts) +
> - GET_NET_STATS(stats_blk->stat_IfHCInBroadcastPkts);
> + GET_NET_STATS(stats_blk->stat_IfHCInBroadcastPkts) +
> + bp->stats_extra.rx_packets;
>
> net_stats->tx_packets =
> GET_NET_STATS(stats_blk->stat_IfHCOutUcastPkts) +
> GET_NET_STATS(stats_blk->stat_IfHCOutMulticastPkts) +
> - GET_NET_STATS(stats_blk->stat_IfHCOutBroadcastPkts);
> + GET_NET_STATS(stats_blk->stat_IfHCOutBroadcastPkts) +
> + bp->stats_extra.tx_packets;
>
> net_stats->rx_bytes =
> - GET_NET_STATS(stats_blk->stat_IfHCInOctets);
> + GET_NET_STATS(stats_blk->stat_IfHCInOctets) +
> + bp->stats_extra.rx_bytes;
>
> net_stats->tx_bytes =
> - GET_NET_STATS(stats_blk->stat_IfHCOutOctets);
> + GET_NET_STATS(stats_blk->stat_IfHCOutOctets) +
> + bp->stats_extra.tx_bytes;
>
> net_stats->multicast =
> - GET_NET_STATS(stats_blk->stat_IfHCOutMulticastPkts);
> + GET_NET_STATS(stats_blk->stat_IfHCOutMulticastPkts) +
> + bp->stats_extra.multicast;
>
> net_stats->collisions =
> - (unsigned long) stats_blk->stat_EtherStatsCollisions;
> + (unsigned long) stats_blk->stat_EtherStatsCollisions +
> + bp->stats_extra.collisions;
>
> net_stats->rx_length_errors =
> (unsigned long) (stats_blk->stat_EtherStatsUndersizePkts +
> - stats_blk->stat_EtherStatsOverrsizePkts);
> + stats_blk->stat_EtherStatsOverrsizePkts) +
> + bp->stats_extra.rx_length_errors;
>
> net_stats->rx_over_errors =
> (unsigned long) (stats_blk->stat_IfInFTQDiscards +
> - stats_blk->stat_IfInMBUFDiscards);
> + stats_blk->stat_IfInMBUFDiscards) +
> + bp->stats_extra.rx_over_errors;
>
> net_stats->rx_frame_errors =
> - (unsigned long) stats_blk->stat_Dot3StatsAlignmentErrors;
> + (unsigned long) stats_blk->stat_Dot3StatsAlignmentErrors +
> + bp->stats_extra.rx_frame_errors;
>
> net_stats->rx_crc_errors =
> - (unsigned long) stats_blk->stat_Dot3StatsFCSErrors;
> + (unsigned long) stats_blk->stat_Dot3StatsFCSErrors +
> + bp->stats_extra.rx_crc_errors;
>
> net_stats->rx_errors = net_stats->rx_length_errors +
> net_stats->rx_over_errors + net_stats->rx_frame_errors +
> - net_stats->rx_crc_errors;
> + net_stats->rx_crc_errors +
> + bp->stats_extra.rx_errors;
>
> net_stats->tx_aborted_errors =
> (unsigned long) (stats_blk->stat_Dot3StatsExcessiveCollisions +
> - stats_blk->stat_Dot3StatsLateCollisions);
> + stats_blk->stat_Dot3StatsLateCollisions) +
> + bp->stats_extra.tx_aborted_errors;
>
> if ((CHIP_NUM(bp) == CHIP_NUM_5706) ||
> (CHIP_ID(bp) == CHIP_ID_5708_A0))
> @@ -6516,7 +6530,8 @@ bnx2_get_stats(struct net_device *dev)
> else {
> net_stats->tx_carrier_errors =
> (unsigned long)
> - stats_blk->stat_Dot3StatsCarrierSenseErrors;
> + stats_blk->stat_Dot3StatsCarrierSenseErrors +
> + bp->stats_extra.tx_carrier_errors;
> }
>
> net_stats->tx_errors =
> @@ -6524,11 +6539,13 @@ bnx2_get_stats(struct net_device *dev)
> stats_blk->stat_emac_tx_stat_dot3statsinternalmactransmiterrors
> +
> net_stats->tx_aborted_errors +
> - net_stats->tx_carrier_errors;
> + net_stats->tx_carrier_errors +
> + bp->stats_extra.tx_errors;
>
> net_stats->rx_missed_errors =
> (unsigned long) (stats_blk->stat_IfInFTQDiscards +
> - stats_blk->stat_IfInMBUFDiscards + stats_blk->stat_FwRxDrop);
> + stats_blk->stat_IfInMBUFDiscards + stats_blk->stat_FwRxDrop) +
> + bp->stats_extra.rx_missed_errors;
>
> return net_stats;
> }
> @@ -6989,6 +7006,16 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
> {
> if (netif_running(bp->dev)) {
> bnx2_netif_stop(bp);
> +
> + /* Save statistics that is going to be reseted */
> + REG_WR(bp, BNX2_HC_COMMAND, bp->hc_cmd |
> + BNX2_HC_COMMAND_STATS_NOW);
> + REG_RD(bp, BNX2_HC_COMMAND);
> + udelay(5);
> + bnx2_get_stats(bp->dev);
> + memcpy(&bp->stats_extra, &bp->dev->stats,
> + sizeof(struct net_device_stats));
> +
> bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
> bnx2_free_skbs(bp);
> bnx2_free_mem(bp);
> diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
> index a4d8340..1063d1a 100644
> --- a/drivers/net/bnx2.h
> +++ b/drivers/net/bnx2.h
> @@ -6912,6 +6912,7 @@ struct bnx2 {
>
> const struct firmware *mips_firmware;
> const struct firmware *rv2p_firmware;
> + struct net_device_stats stats_extra;
> };
>
> #define REG_RD(bp, offset) \
^ permalink raw reply
* Re: [PROPOSAL]: Support Alternate Network Device Naming Schemes
From: Bill Nottingham @ 2009-11-30 18:34 UTC (permalink / raw)
To: Discussion of Development and Customization of the Red Hat Linux Installer
Cc: netdev, shyam_iyer, matt_domsch, jordan_hargrave, charles_rose
In-Reply-To: <20091127094257.GA24624@mock.linuxdev.us.dell.com>
Narendra K (Narendra_K@dell.com) said:
> Installers as of now allow the discovered network interfaces to be configured. This solution proposes to provide an option for the users to either retain the default naming convention that the kernel now has, i.e ethN names or rename the network interfaces based on the chassis label, MAC addresses, Driver name and any other naming convention. Here is how the modified network configuration wizard would look during the os installation process -
>
>
> ---------- Network Configuration ------------------------
>
> Default [ ] | SMBIOS Names [x] | Driver Names [] | MAC Names []
> -----------------------------------------------------------------------
> eth0 | Addin_NIC_1 | ice0 |
> -----------------------------------------------------------------------
> eth1 | Embedded_NIC_1 | bce0 |
> -----------------------------------------------------------------------
> eth2 | Embedded_NIC_2 | bce1 |
> -----------------------------------------------------------------------
> eth3 | Embedded_NIC_3 | bce2 |
> -----------------------------------------------------------------------
> eth4 | Embedded_NIC_4 | bce3 |
> -----------------------------------------------------------------------
>
> ------------
> | Next |
> ------------
>
> [ ice0 - Intel Controller 0, bce0 - Broadcom Controller 0 ]
>
> 1. In addition to the default ethN names the user can check against the available naming conventions and the wizard would show the names the interfaces will be renamed to.
> 2. The moment the user hits the Next button all interfaces are renamed as per the Naming convention they have selected.
> 3. Any further network communication would be using the new names.
> 4. Ifconfig would show names like "Embedded_NIC_1" and not eth0 etc.
That's a horrible interface to show the user when a large portion of
them do not care at all. (Also, not sure why netdev@vger cares about the
implementation details of OS installers.)
Bill
^ permalink raw reply
* RE: [RFC PATCH 1/4] net: Add support to netdev ops for changing hardware queue MAC and VLAN filters
From: Williams, Mitch A @ 2009-11-30 18:36 UTC (permalink / raw)
To: Simon Horman
Cc: Ben Hutchings, Kirsher, Jeffrey T, davem@davemloft.net,
shemminger@vyatta.com, netdev@vger.kernel.org, gospo@redhat.com
In-Reply-To: <20091130060323.GA17989@verge.net.au>
>From: Simon Horman [mailto:horms@verge.net.au]
>Sent: Sunday, November 29, 2009 10:03 PM
>> The issue of which VF goes with which PF device can be deduced in
>> userspace via sysfs.
>
>Does this mean that the configuration of filtering for a VF needs
>to be done where the interface for the VF exists - e.g. in a KVM
>guest/Xen domU?
>
No, all of the configuration is done through the PF device. What I was saying was that, given a specific VF PCI device (which would be passed through to the VM), you can use sysfs to determine which PF owns it, and then run the ip command to tell the PF to configure the VF.
>In terms of dealing with interfaces and the way that tools such as ip work
>that makes a lot of sense. But I wonder if it actually makes more sense
>from an administrative point of view to have this configuration go through
>the PF - e.g. the KVM host/Xen domO.
>From a policy and security standpoint, you can't allow the VM to handle its own hardware configuration. The host/hypervisor/VM Manager/boss has to handle this or you lose many of the advantages of virtualization (i.e. isolation, security, stability, etc).
-Mitch
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox