* Re: [PATCH 11/17] net,rcu: convert call_rcu(sctp_local_addr_free) to kfree_rcu()
From: David Miller @ 2011-03-15 21:03 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: mingo-X9Un+BFzKDI, paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
axboe-tSWWG44O7X1aa/9Udqfwiw,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
vladislav.yasevich-VXdhtT5mjnY, sri-r/Jw6+rmf7HQT0dZR+AlfA,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
eparis-H+wXaHxf7aLQT0dZR+AlfA, menage-hpIqsD4AKlfQT0dZR+AlfA,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, pekkas-UjJjq++bwZ7HOG6cAo2yLw,
jmorris-gx6/JNMH7DfYtjvyW6yDsg, yoshfuji-VfPWfsRibaP+Ru+s062T9g,
kaber-dcUjhNyLwpNeoWH0uzbU5w, johannes-cdvu00un1VgdHxzADdlk8Q,
linville-2XuSBdqkA4R54TAoqtyWWQ, hadi-fAAogVwAN2Kw5LPnMra/2Q,
jpirko-H+wXaHxf7aLQT0dZR+AlfA,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w, hagen-GvnIQ6b/HdU,
randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA, jkosina-AlSwsSmVLrQ,
joe-6d6DIl74uiNBDgjK7y7TUQ,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, gregkh-l3A5Bk7waGM,
xemul-GEFAQzZX7r8dnm+yROfE0A, linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-nfs-u79uwXL29TY76Z2rM5mHXA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, netdev-u79uwXL29TY76Z2rM5mHXA,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <4D7F39CE.80403-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 18:05:02 +0800
>
>
> The rcu callback sctp_local_addr_free() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(sctp_local_addr_free).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 08/17] net,rcu: convert call_rcu(listeners_free_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:03 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, xemul-GEFAQzZX7r8dnm+yROfE0A,
pekkas-UjJjq++bwZ7HOG6cAo2yLw,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, mingo-X9Un+BFzKDI,
paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
sri-r/Jw6+rmf7HQT0dZR+AlfA, vladislav.yasevich-VXdhtT5mjnY,
hagen-GvnIQ6b/HdU, linville-2XuSBdqkA4R54TAoqtyWWQ,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
menage-hpIqsD4AKlfQT0dZR+AlfA, axboe-tSWWG44O7X1aa/9Udqfwiw,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, jpirko-H+wXaHxf7aLQT0dZR+AlfA,
yoshfuji-VfPWfsRibaP+Ru+s062T9g, jkosina-AlSwsSmVLrQ,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
gregkh-l3A5Bk7waGM, linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
eparis-H+wXaHxf7aLQT0dZR+AlfA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, netdev-u79uwXL29TY76Z2rM5mHXA,
joe-6d6DIl74uiNBDgjK7y7TUQ, johannes-cdvu00un1VgdHxzADdlk8Q
In-Reply-To: <4D7F3906.3090107-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 18:01:42 +0800
>
>
> The rcu callback listeners_free_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(listeners_free_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
^ permalink raw reply
* Re: [PATCH 06/17] net,rcu: convert call_rcu(in6_dev_finish_destroy_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:03 UTC (permalink / raw)
To: laijs
Cc: mingo, paulmck, axboe, Trond.Myklebust, vladislav.yasevich, sri,
viro, eparis, menage, kuznet, pekkas, jmorris, yoshfuji, kaber,
johannes, linville, hadi, jpirko, eric.dumazet, hagen,
randy.dunlap, jkosina, joe, u.kleine-koenig, ebiederm, gregkh,
xemul, linux-kernel, linux-nfs, linux-sctp, netdev, containers,
linux-decnet-user, linux-wireless, linux-security-module
In-Reply-To: <4D7F3872.6090305@cn.fujitsu.com>
From: Lai Jiangshan <laijs@cn.fujitsu.com>
Date: Tue, 15 Mar 2011 17:59:14 +0800
>
>
> The rcu callback in6_dev_finish_destroy_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(in6_dev_finish_destroy_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply
* Re: [PATCH 05/17] net,rcu: convert call_rcu(tcf_police_free_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:02 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, xemul-GEFAQzZX7r8dnm+yROfE0A,
pekkas-UjJjq++bwZ7HOG6cAo2yLw,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, mingo-X9Un+BFzKDI,
paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
sri-r/Jw6+rmf7HQT0dZR+AlfA, vladislav.yasevich-VXdhtT5mjnY,
hagen-GvnIQ6b/HdU, linville-2XuSBdqkA4R54TAoqtyWWQ,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
menage-hpIqsD4AKlfQT0dZR+AlfA, axboe-tSWWG44O7X1aa/9Udqfwiw,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, jpirko-H+wXaHxf7aLQT0dZR+AlfA,
yoshfuji-VfPWfsRibaP+Ru+s062T9g, jkosina-AlSwsSmVLrQ,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
gregkh-l3A5Bk7waGM, linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
eparis-H+wXaHxf7aLQT0dZR+AlfA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, netdev-u79uwXL29TY76Z2rM5mHXA,
joe-6d6DIl74uiNBDgjK7y7TUQ, johannes-cdvu00un1VgdHxzADdlk8Q
In-Reply-To: <4D7F3828.4040403-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 17:58:00 +0800
> [PATCH 05/17] net,rcu: convert call_rcu(tcf_police_free_rcu) to kfree_rcu()
>
> The rcu callback tcf_police_free_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(tcf_police_free_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
^ permalink raw reply
* Re: [PATCH 07/17] net,rcu: convert call_rcu(inet6_ifa_finish_destroy_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:03 UTC (permalink / raw)
To: laijs
Cc: mingo, paulmck, axboe, Trond.Myklebust, vladislav.yasevich, sri,
viro, eparis, menage, kuznet, pekkas, jmorris, yoshfuji, kaber,
johannes, linville, hadi, jpirko, eric.dumazet, hagen,
randy.dunlap, jkosina, joe, u.kleine-koenig, ebiederm, gregkh,
xemul, linux-kernel, linux-nfs, linux-sctp, netdev, containers,
linux-decnet-user, linux-wireless, linux-security-module
In-Reply-To: <4D7F38AE.7060708@cn.fujitsu.com>
From: Lai Jiangshan <laijs@cn.fujitsu.com>
Date: Tue, 15 Mar 2011 18:00:14 +0800
>
>
> The rcu callback inet6_ifa_finish_destroy_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(inet6_ifa_finish_destroy_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply
* Re: [PATCH 04/17] net,rcu: convert call_rcu(tcf_common_free_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:02 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, xemul-GEFAQzZX7r8dnm+yROfE0A,
pekkas-UjJjq++bwZ7HOG6cAo2yLw,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, mingo-X9Un+BFzKDI,
paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
sri-r/Jw6+rmf7HQT0dZR+AlfA, vladislav.yasevich-VXdhtT5mjnY,
hagen-GvnIQ6b/HdU, linville-2XuSBdqkA4R54TAoqtyWWQ,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
menage-hpIqsD4AKlfQT0dZR+AlfA, axboe-tSWWG44O7X1aa/9Udqfwiw,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, jpirko-H+wXaHxf7aLQT0dZR+AlfA,
yoshfuji-VfPWfsRibaP+Ru+s062T9g, jkosina-AlSwsSmVLrQ,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
gregkh-l3A5Bk7waGM, linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
eparis-H+wXaHxf7aLQT0dZR+AlfA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, netdev-u79uwXL29TY76Z2rM5mHXA,
joe-6d6DIl74uiNBDgjK7y7TUQ, johannes-cdvu00un1VgdHxzADdlk8Q
In-Reply-To: <4D7F37F0.1050801-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 17:57:04 +0800
>
>
> The rcu callback tcf_common_free_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(tcf_common_free_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
^ permalink raw reply
* Re: pull request: wireless-next-2.6 2011-03-15
From: David Miller @ 2011-03-15 20:57 UTC (permalink / raw)
To: linville; +Cc: linux-wireless, netdev
In-Reply-To: <20110315193122.GD2542@tuxdriver.com>
From: "John W. Linville" <linville@tuxdriver.com>
Date: Tue, 15 Mar 2011 15:31:22 -0400
> One last non-fix pull for 2.6.39 -- hooray!
>
> Not a lot here, since we just had a pull towards the end of last week.
> There are a handfule of ath9k bits, a couple of wl1251 patches,
> a couple of mac80211 bits, etc. Nothing too troublesome. :-)
>
> Please let me know if there are problems!
Pulled, thanks a lot John.
^ permalink raw reply
* Re: [PATCH 03/17] cgroup, rcu: convert call_rcu(__free_css_id_cb) to kfree_rcu()
From: Paul Menage @ 2011-03-15 20:04 UTC (permalink / raw)
To: Lai Jiangshan
Cc: Randy Dunlap, linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond Myklebust, linux-sctp-u79uwXL29TY76Z2rM5mHXA,
Pavel Emelyanov, Pekka Savola (ipv6), Eric Dumazet,
Uwe Kleine-König, Alexey Kuznetsov, Ingo Molnar,
Paul E. McKenney, Sridhar Samudrala, Vlad Yasevich,
Hagen Paul Pfeifer, John W. Linville, Al Viro, Jens Axboe,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, Jiri Pirko
In-Reply-To: <4D7F37BA.5000308-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2011/3/15 Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>:
>
>
> The rcu callback __free_css_id_cb() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(__free_css_id_cb).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: Paul Menage <menage-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
> ---
> kernel/cgroup.c | 10 +---------
> 1 files changed, 1 insertions(+), 9 deletions(-)
>
> diff --git a/kernel/cgroup.c b/kernel/cgroup.c
> index 5c83c91..b7d3f6d 100644
> --- a/kernel/cgroup.c
> +++ b/kernel/cgroup.c
> @@ -4612,14 +4612,6 @@ bool css_is_ancestor(struct cgroup_subsys_state *child,
> return ret;
> }
>
> -static void __free_css_id_cb(struct rcu_head *head)
> -{
> - struct css_id *id;
> -
> - id = container_of(head, struct css_id, rcu_head);
> - kfree(id);
> -}
> -
> void free_css_id(struct cgroup_subsys *ss, struct cgroup_subsys_state *css)
> {
> struct css_id *id = css->id;
> @@ -4634,7 +4626,7 @@ void free_css_id(struct cgroup_subsys *ss, struct cgroup_subsys_state *css)
> spin_lock(&ss->id_lock);
> idr_remove(&ss->idr, id->id);
> spin_unlock(&ss->id_lock);
> - call_rcu(&id->rcu_head, __free_css_id_cb);
> + kfree_rcu(id, rcu_head);
> }
> EXPORT_SYMBOL_GPL(free_css_id);
>
> --
> 1.7.4
>
^ permalink raw reply
* Re: [PATCH 02/17] cgroup, rcu: convert call_rcu(free_cgroup_rcu) to kfree_rcu()
From: Paul Menage @ 2011-03-15 20:04 UTC (permalink / raw)
To: Lai Jiangshan
Cc: Randy Dunlap, linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond Myklebust, linux-sctp-u79uwXL29TY76Z2rM5mHXA,
Pavel Emelyanov, Pekka Savola (ipv6), Eric Dumazet,
Uwe Kleine-König, Alexey Kuznetsov, Ingo Molnar,
Paul E. McKenney, Sridhar Samudrala, Vlad Yasevich,
Hagen Paul Pfeifer, John W. Linville, Al Viro, Jens Axboe,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, Jiri Pirko
In-Reply-To: <4D7F3784.6090307-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2011/3/15 Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>:
>
> The rcu callback free_cgroup_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(free_cgroup_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: Paul Menage <menage-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
> ---
> kernel/cgroup.c | 9 +--------
> 1 files changed, 1 insertions(+), 8 deletions(-)
>
> diff --git a/kernel/cgroup.c b/kernel/cgroup.c
> index ad485d4..5c83c91 100644
> --- a/kernel/cgroup.c
> +++ b/kernel/cgroup.c
> @@ -806,13 +806,6 @@ static int cgroup_call_pre_destroy(struct cgroup *cgrp)
> return ret;
> }
>
> -static void free_cgroup_rcu(struct rcu_head *obj)
> -{
> - struct cgroup *cgrp = container_of(obj, struct cgroup, rcu_head);
> -
> - kfree(cgrp);
> -}
> -
> static void cgroup_diput(struct dentry *dentry, struct inode *inode)
> {
> /* is dentry a directory ? if so, kfree() associated cgroup */
> @@ -850,7 +843,7 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
> */
> BUG_ON(!list_empty(&cgrp->pidlists));
>
> - call_rcu(&cgrp->rcu_head, free_cgroup_rcu);
> + kfree_rcu(cgrp, rcu_head);
> }
> iput(inode);
> }
> --
> 1.7.4
>
^ permalink raw reply
* Re: [PATCH 01/17] cgroup, rcu: convert call_rcu(free_css_set_rcu) to kfree_rcu()
From: Paul Menage @ 2011-03-15 20:03 UTC (permalink / raw)
To: Lai Jiangshan
Cc: Randy Dunlap, linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond Myklebust, linux-sctp-u79uwXL29TY76Z2rM5mHXA,
Pavel Emelyanov, Pekka Savola (ipv6), Eric Dumazet,
Uwe Kleine-König, Alexey Kuznetsov, Ingo Molnar,
Paul E. McKenney, Sridhar Samudrala, Vlad Yasevich,
Hagen Paul Pfeifer, John W. Linville, Al Viro, Jens Axboe,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, Jiri Pirko
In-Reply-To: <4D7F372A.6050407-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2011/3/15 Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>:
>
> The rcu callback free_css_set_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(free_css_set_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: Paul Menage <menage-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
Looks fine, assuming the main kfree_rcu() changes go through.
Paul
^ permalink raw reply
* [PATCH] Fix overflow of name in struct net_device, replaced sprintf with snprintf.
From: Sasikanth V @ 2011-03-15 20:00 UTC (permalink / raw)
To: davem; +Cc: netdev, Sasikanth V
Signed-off-by: Sasikanth V <sasikanth.v19@gmail.com>
---
net/core/dev.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6561021..a74efa9 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -539,7 +539,7 @@ unsigned long netdev_boot_base(const char *prefix, int unit)
char name[IFNAMSIZ];
int i;
- sprintf(name, "%s%d", prefix, unit);
+ snprintf(name, IFNAMSIZ, "%s%d", prefix, unit);
/*
* If device already registered then return base of 1
--
1.7.3.4
^ permalink raw reply related
* Re: [PATCH 00/37] netfilter: netfilter update
From: David Miller @ 2011-03-15 19:58 UTC (permalink / raw)
To: kaber; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: kaber@trash.net
Date: Tue, 15 Mar 2011 20:43:40 +0100
>
> Please pull from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6.git master
Pulled, thanks Patrick.
^ permalink raw reply
* Re: ECN + pfifo_fast borked? (Was Re: [Bloat] shaper team forming up)
From: Eric Dumazet @ 2011-03-15 19:56 UTC (permalink / raw)
To: Jonathan Morton; +Cc: Dave Täht, David Miller, netdev
In-Reply-To: <7CFAAB08-8A30-4569-8825-64121D43EA77@gmail.com>
Le mardi 15 mars 2011 à 20:37 +0200, Jonathan Morton a écrit :
> On 15 Mar, 2011, at 8:28 pm, Eric Dumazet wrote:
>
> >>> band 0 : high priority packets (like now)
> >>> band 1 : (old band 1, ECN capable flows)
> >>> band 2 : (old band 1, no ECN flows)
> >>> band 3 : low priority packets (old band 2)
> >>
> >> This seems good to me. It would provide a concrete (if minor) enticement to turn ECN on.
> >
> > Here is a patch to implement that, on top of net-next-2.6 git tree
>
> Does this take both ECN bits into account? The ECT(0), ECT(1) and ECE codepoints all need to be recognised equally.
This is done in a different layer, as already explained.
Current linux code ignores low order bit when doing TOS -> skb->priority
mapping.
^ permalink raw reply
* [PATCH 37/37] netfilter: xt_addrtype: ipv6 support
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Florian Westphal <fwestphal@astaro.com>
The kernel will refuse certain types that do not work in ipv6 mode.
We can then add these features incrementally without risk of userspace
breakage.
Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
include/linux/netfilter/xt_addrtype.h | 17 ++++++
net/netfilter/Kconfig | 1 +
net/netfilter/xt_addrtype.c | 98 ++++++++++++++++++++++++++++++++-
3 files changed, 114 insertions(+), 2 deletions(-)
diff --git a/include/linux/netfilter/xt_addrtype.h b/include/linux/netfilter/xt_addrtype.h
index b492fc8..b156baa 100644
--- a/include/linux/netfilter/xt_addrtype.h
+++ b/include/linux/netfilter/xt_addrtype.h
@@ -10,6 +10,23 @@ enum {
XT_ADDRTYPE_LIMIT_IFACE_OUT = 0x0008,
};
+
+/* rtn_type enum values from rtnetlink.h, but shifted */
+enum {
+ XT_ADDRTYPE_UNSPEC = 1 << 0,
+ XT_ADDRTYPE_UNICAST = 1 << 1, /* 1 << RTN_UNICAST */
+ XT_ADDRTYPE_LOCAL = 1 << 2, /* 1 << RTN_LOCAL, etc */
+ XT_ADDRTYPE_BROADCAST = 1 << 3,
+ XT_ADDRTYPE_ANYCAST = 1 << 4,
+ XT_ADDRTYPE_MULTICAST = 1 << 5,
+ XT_ADDRTYPE_BLACKHOLE = 1 << 6,
+ XT_ADDRTYPE_UNREACHABLE = 1 << 7,
+ XT_ADDRTYPE_PROHIBIT = 1 << 8,
+ XT_ADDRTYPE_THROW = 1 << 9,
+ XT_ADDRTYPE_NAT = 1 << 10,
+ XT_ADDRTYPE_XRESOLVE = 1 << 11,
+};
+
struct xt_addrtype_info_v1 {
__u16 source; /* source-type mask */
__u16 dest; /* dest-type mask */
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 32bff6d..c3f988a 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -652,6 +652,7 @@ comment "Xtables matches"
config NETFILTER_XT_MATCH_ADDRTYPE
tristate '"addrtype" address type match support'
depends on NETFILTER_ADVANCED
+ depends on (IPV6 || IPV6=n)
---help---
This option allows you to match what routing thinks of an address,
eg. UNICAST, LOCAL, BROADCAST, ...
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index e89c0b8..2220b85 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -16,6 +16,12 @@
#include <linux/ip.h>
#include <net/route.h>
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <net/ip6_fib.h>
+#endif
+
#include <linux/netfilter/xt_addrtype.h>
#include <linux/netfilter/x_tables.h>
@@ -23,6 +29,73 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_DESCRIPTION("Xtables: address type match");
MODULE_ALIAS("ipt_addrtype");
+MODULE_ALIAS("ip6t_addrtype");
+
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
+{
+ u32 ret;
+
+ if (!rt)
+ return XT_ADDRTYPE_UNREACHABLE;
+
+ if (rt->rt6i_flags & RTF_REJECT)
+ ret = XT_ADDRTYPE_UNREACHABLE;
+ else
+ ret = 0;
+
+ if (rt->rt6i_flags & RTF_LOCAL)
+ ret |= XT_ADDRTYPE_LOCAL;
+ if (rt->rt6i_flags & RTF_ANYCAST)
+ ret |= XT_ADDRTYPE_ANYCAST;
+ return ret;
+}
+
+static bool match_type6(struct net *net, const struct net_device *dev,
+ const struct in6_addr *addr, u16 mask)
+{
+ int addr_type = ipv6_addr_type(addr);
+
+ if ((mask & XT_ADDRTYPE_MULTICAST) &&
+ !(addr_type & IPV6_ADDR_MULTICAST))
+ return false;
+ if ((mask & XT_ADDRTYPE_UNICAST) && !(addr_type & IPV6_ADDR_UNICAST))
+ return false;
+ if ((mask & XT_ADDRTYPE_UNSPEC) && addr_type != IPV6_ADDR_ANY)
+ return false;
+
+ if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
+ XT_ADDRTYPE_UNREACHABLE) & mask) {
+ struct rt6_info *rt;
+ u32 type;
+ int ifindex = dev ? dev->ifindex : 0;
+
+ rt = rt6_lookup(net, addr, NULL, ifindex, !!dev);
+
+ type = xt_addrtype_rt6_to_type(rt);
+
+ dst_release(&rt->dst);
+ return !!(mask & type);
+ }
+ return true;
+}
+
+static bool
+addrtype_mt6(struct net *net, const struct net_device *dev,
+ const struct sk_buff *skb, const struct xt_addrtype_info_v1 *info)
+{
+ const struct ipv6hdr *iph = ipv6_hdr(skb);
+ bool ret = true;
+
+ if (info->source)
+ ret &= match_type6(net, dev, &iph->saddr, info->source) ^
+ (info->flags & XT_ADDRTYPE_INVERT_SOURCE);
+ if (ret && info->dest)
+ ret &= match_type6(net, dev, &iph->daddr, info->dest) ^
+ !!(info->flags & XT_ADDRTYPE_INVERT_DEST);
+ return ret;
+}
+#endif
static inline bool match_type(struct net *net, const struct net_device *dev,
__be32 addr, u_int16_t mask)
@@ -53,7 +126,7 @@ addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
{
struct net *net = dev_net(par->in ? par->in : par->out);
const struct xt_addrtype_info_v1 *info = par->matchinfo;
- const struct iphdr *iph = ip_hdr(skb);
+ const struct iphdr *iph;
const struct net_device *dev = NULL;
bool ret = true;
@@ -62,6 +135,11 @@ addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
else if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT)
dev = par->out;
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+ if (par->family == NFPROTO_IPV6)
+ return addrtype_mt6(net, dev, skb, info);
+#endif
+ iph = ip_hdr(skb);
if (info->source)
ret &= match_type(net, dev, iph->saddr, info->source) ^
(info->flags & XT_ADDRTYPE_INVERT_SOURCE);
@@ -98,6 +176,22 @@ static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
return -EINVAL;
}
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+ if (par->family == NFPROTO_IPV6) {
+ if ((info->source | info->dest) & XT_ADDRTYPE_BLACKHOLE) {
+ pr_err("ipv6 BLACKHOLE matching not supported\n");
+ return -EINVAL;
+ }
+ if ((info->source | info->dest) >= XT_ADDRTYPE_PROHIBIT) {
+ pr_err("ipv6 PROHIBT (THROW, NAT ..) matching not supported\n");
+ return -EINVAL;
+ }
+ if ((info->source | info->dest) & XT_ADDRTYPE_BROADCAST) {
+ pr_err("ipv6 does not support BROADCAST matching\n");
+ return -EINVAL;
+ }
+ }
+#endif
return 0;
}
@@ -111,7 +205,7 @@ static struct xt_match addrtype_mt_reg[] __read_mostly = {
},
{
.name = "addrtype",
- .family = NFPROTO_IPV4,
+ .family = NFPROTO_UNSPEC,
.revision = 1,
.match = addrtype_mt_v1,
.checkentry = addrtype_mt_checkentry_v1,
--
1.7.2.3
^ permalink raw reply related
* [PATCH 34/37] netfilter: ip_tables: fix infoleak to userspace
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Vasiliy Kulikov <segoon@openwall.com>
Structures ipt_replace, compat_ipt_replace, and xt_get_revision are
copied from userspace. Fields of these structs that are
zero-terminated strings are not checked. When they are used as argument
to a format string containing "%s" in request_module(), some sensitive
information is leaked to userspace via argument of spawned modprobe
process.
The first and the third bugs were introduced before the git epoch; the
second was introduced in 2722971c (v2.6.17-rc1). To trigger the bug
one should have CAP_NET_ADMIN.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/ipv4/netfilter/ip_tables.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index ef7d7b9..b09ed0d 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1262,6 +1262,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
/* overflow check */
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -1807,6 +1808,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -2036,6 +2038,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
ret = -EFAULT;
break;
}
+ rev.name[sizeof(rev.name)-1] = 0;
if (cmd == IPT_SO_GET_REVISION_TARGET)
target = 1;
--
1.7.2.3
^ permalink raw reply related
* [PATCH 31/37] netfilter: xt_connlimit: use hlist instead
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Changli Gao <xiaosuo@gmail.com>
The header of hlist is smaller than list.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/xt_connlimit.c | 28 ++++++++++++++--------------
1 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index ade2a80..da56d6e 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -33,14 +33,14 @@
/* we will save the tuples of all connections we care about */
struct xt_connlimit_conn {
- struct list_head list;
+ struct hlist_node node;
struct nf_conntrack_tuple tuple;
union nf_inet_addr addr;
};
struct xt_connlimit_data {
- struct list_head iphash[256];
- spinlock_t lock;
+ struct hlist_head iphash[256];
+ spinlock_t lock;
};
static u_int32_t connlimit_rnd __read_mostly;
@@ -102,9 +102,9 @@ static int count_them(struct net *net,
{
const struct nf_conntrack_tuple_hash *found;
struct xt_connlimit_conn *conn;
- struct xt_connlimit_conn *tmp;
+ struct hlist_node *pos, *n;
struct nf_conn *found_ct;
- struct list_head *hash;
+ struct hlist_head *hash;
bool addit = true;
int matches = 0;
@@ -116,7 +116,7 @@ static int count_them(struct net *net,
rcu_read_lock();
/* check the saved connections */
- list_for_each_entry_safe(conn, tmp, hash, list) {
+ hlist_for_each_entry_safe(conn, pos, n, hash, node) {
found = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE,
&conn->tuple);
found_ct = NULL;
@@ -136,7 +136,7 @@ static int count_them(struct net *net,
if (found == NULL) {
/* this one is gone */
- list_del(&conn->list);
+ hlist_del(&conn->node);
kfree(conn);
continue;
}
@@ -147,7 +147,7 @@ static int count_them(struct net *net,
* closed already -> ditch it
*/
nf_ct_put(found_ct);
- list_del(&conn->list);
+ hlist_del(&conn->node);
kfree(conn);
continue;
}
@@ -167,7 +167,7 @@ static int count_them(struct net *net,
return -ENOMEM;
conn->tuple = *tuple;
conn->addr = *addr;
- list_add(&conn->list, hash);
+ hlist_add_head(&conn->node, hash);
++matches;
}
@@ -246,7 +246,7 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
spin_lock_init(&info->data->lock);
for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i)
- INIT_LIST_HEAD(&info->data->iphash[i]);
+ INIT_HLIST_HEAD(&info->data->iphash[i]);
return 0;
}
@@ -255,15 +255,15 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
{
const struct xt_connlimit_info *info = par->matchinfo;
struct xt_connlimit_conn *conn;
- struct xt_connlimit_conn *tmp;
- struct list_head *hash = info->data->iphash;
+ struct hlist_node *pos, *n;
+ struct hlist_head *hash = info->data->iphash;
unsigned int i;
nf_ct_l3proto_module_put(par->family);
for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
- list_for_each_entry_safe(conn, tmp, &hash[i], list) {
- list_del(&conn->list);
+ hlist_for_each_entry_safe(conn, pos, n, &hash[i], node) {
+ hlist_del(&conn->node);
kfree(conn);
}
}
--
1.7.2.3
^ permalink raw reply related
* [PATCH 28/37] IPVS: Conditionally include sysctl members of struct netns_ipvs
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
There is now no need to include sysctl members of struct netns_ipvs
unless CONFIG_SYSCTL is defined.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
include/net/ip_vs.h | 21 +++++++++++++--------
1 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 299aeb5..272f593 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -839,6 +839,17 @@ struct netns_ipvs {
struct ip_vs_stats tot_stats; /* Statistics & est. */
int num_services; /* no of virtual services */
+
+ rwlock_t rs_lock; /* real services table */
+ /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
+ struct lock_class_key ctl_key; /* ctl_mutex debuging */
+ /* Trash for destinations */
+ struct list_head dest_trash;
+ /* Service counters */
+ atomic_t ftpsvc_counter;
+ atomic_t nullsvc_counter;
+
+#ifdef CONFIG_SYSCTL
/* 1/rate drop and drop-entry variables */
struct delayed_work defense_work; /* Work handler */
int drop_rate;
@@ -848,18 +859,12 @@ struct netns_ipvs {
spinlock_t dropentry_lock; /* drop entry handling */
spinlock_t droppacket_lock; /* drop packet handling */
spinlock_t securetcp_lock; /* state and timeout tables */
- rwlock_t rs_lock; /* real services table */
- /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
- struct lock_class_key ctl_key; /* ctl_mutex debuging */
- /* Trash for destinations */
- struct list_head dest_trash;
- /* Service counters */
- atomic_t ftpsvc_counter;
- atomic_t nullsvc_counter;
/* sys-ctl struct */
struct ctl_table_header *sysctl_hdr;
struct ctl_table *sysctl_tbl;
+#endif
+
/* sysctl variables */
int sysctl_amemthresh;
int sysctl_am_droprate;
--
1.7.2.3
^ permalink raw reply related
* [PATCH 26/37] IPVS: Conditionally define and use ip_vs_lblc{r}_table
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
ip_vs_lblc_table and ip_vs_lblcr_table, and code that uses them
are unnecessary when CONFIG_SYSCTL is undefined.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/ip_vs_lblc.c | 15 ++++++++++-----
net/netfilter/ipvs/ip_vs_lblcr.c | 14 ++++++++++----
2 files changed, 20 insertions(+), 9 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 51a27f5..f276df9 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -114,7 +114,7 @@ struct ip_vs_lblc_table {
/*
* IPVS LBLC sysctl table
*/
-
+#ifdef CONFIG_SYSCTL
static ctl_table vs_vars_table[] = {
{
.procname = "lblc_expiration",
@@ -125,6 +125,7 @@ static ctl_table vs_vars_table[] = {
},
{ }
};
+#endif
static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
{
@@ -548,6 +549,7 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler =
/*
* per netns init.
*/
+#ifdef CONFIG_SYSCTL
static int __net_init __ip_vs_lblc_init(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
@@ -563,7 +565,6 @@ static int __net_init __ip_vs_lblc_init(struct net *net)
ipvs->sysctl_lblc_expiration = DEFAULT_EXPIRATION;
ipvs->lblc_ctl_table[0].data = &ipvs->sysctl_lblc_expiration;
-#ifdef CONFIG_SYSCTL
ipvs->lblc_ctl_header =
register_net_sysctl_table(net, net_vs_ctl_path,
ipvs->lblc_ctl_table);
@@ -572,7 +573,6 @@ static int __net_init __ip_vs_lblc_init(struct net *net)
kfree(ipvs->lblc_ctl_table);
return -ENOMEM;
}
-#endif
return 0;
}
@@ -581,14 +581,19 @@ static void __net_exit __ip_vs_lblc_exit(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
-#ifdef CONFIG_SYSCTL
unregister_net_sysctl_table(ipvs->lblc_ctl_header);
-#endif
if (!net_eq(net, &init_net))
kfree(ipvs->lblc_ctl_table);
}
+#else
+
+static int __net_init __ip_vs_lblc_init(struct net *net) { return 0; }
+static void __net_exit __ip_vs_lblc_exit(struct net *net) { }
+
+#endif
+
static struct pernet_operations ip_vs_lblc_ops = {
.init = __ip_vs_lblc_init,
.exit = __ip_vs_lblc_exit,
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 7fb9190..cb1c991 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -285,6 +285,7 @@ struct ip_vs_lblcr_table {
};
+#ifdef CONFIG_SYSCTL
/*
* IPVS LBLCR sysctl table
*/
@@ -299,6 +300,7 @@ static ctl_table vs_vars_table[] = {
},
{ }
};
+#endif
static inline void ip_vs_lblcr_free(struct ip_vs_lblcr_entry *en)
{
@@ -743,6 +745,7 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler =
/*
* per netns init.
*/
+#ifdef CONFIG_SYSCTL
static int __net_init __ip_vs_lblcr_init(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
@@ -758,7 +761,6 @@ static int __net_init __ip_vs_lblcr_init(struct net *net)
ipvs->sysctl_lblcr_expiration = DEFAULT_EXPIRATION;
ipvs->lblcr_ctl_table[0].data = &ipvs->sysctl_lblcr_expiration;
-#ifdef CONFIG_SYSCTL
ipvs->lblcr_ctl_header =
register_net_sysctl_table(net, net_vs_ctl_path,
ipvs->lblcr_ctl_table);
@@ -767,7 +769,6 @@ static int __net_init __ip_vs_lblcr_init(struct net *net)
kfree(ipvs->lblcr_ctl_table);
return -ENOMEM;
}
-#endif
return 0;
}
@@ -776,14 +777,19 @@ static void __net_exit __ip_vs_lblcr_exit(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
-#ifdef CONFIG_SYSCTL
unregister_net_sysctl_table(ipvs->lblcr_ctl_header);
-#endif
if (!net_eq(net, &init_net))
kfree(ipvs->lblcr_ctl_table);
}
+#else
+
+static int __net_init __ip_vs_lblcr_init(struct net *net) { return 0; }
+static void __net_exit __ip_vs_lblcr_exit(struct net *net) { }
+
+#endif
+
static struct pernet_operations ip_vs_lblcr_ops = {
.init = __ip_vs_lblcr_init,
.exit = __ip_vs_lblcr_exit,
--
1.7.2.3
^ permalink raw reply related
* [PATCH 29/37] netfilter: xt_connlimit: fix daddr connlimit in SNAT scenario
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Changli Gao <xiaosuo@gmail.com>
We use the reply tuples when limiting the connections by the destination
addresses, however, in SNAT scenario, the final reply tuples won't be
ready until SNAT is done in POSTROUING or INPUT chain, and the following
nf_conntrack_find_get() in count_tem() will get nothing, so connlimit
can't work as expected.
In this patch, the original tuples are always used, and an additional
member addr is appended to save the address in either end.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/xt_connlimit.c | 20 +++++++++-----------
1 files changed, 9 insertions(+), 11 deletions(-)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index e029c48..1f4b9f9 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -33,8 +33,9 @@
/* we will save the tuples of all connections we care about */
struct xt_connlimit_conn {
- struct list_head list;
- struct nf_conntrack_tuple tuple;
+ struct list_head list;
+ struct nf_conntrack_tuple tuple;
+ union nf_inet_addr addr;
};
struct xt_connlimit_data {
@@ -151,7 +152,7 @@ static int count_them(struct net *net,
continue;
}
- if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
+ if (same_source_net(addr, mask, &conn->addr, family))
/* same source network -> be counted! */
++matches;
nf_ct_put(found_ct);
@@ -165,6 +166,7 @@ static int count_them(struct net *net,
if (conn == NULL)
return -ENOMEM;
conn->tuple = *tuple;
+ conn->addr = *addr;
list_add(&conn->list, hash);
++matches;
}
@@ -185,15 +187,11 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
int connections;
ct = nf_ct_get(skb, &ctinfo);
- if (ct != NULL) {
- if (info->flags & XT_CONNLIMIT_DADDR)
- tuple_ptr = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
- else
- tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
- } else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
- par->family, &tuple)) {
+ if (ct != NULL)
+ tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
+ par->family, &tuple))
goto hotdrop;
- }
if (par->family == NFPROTO_IPV6) {
const struct ipv6hdr *iph = ipv6_hdr(skb);
--
1.7.2.3
^ permalink raw reply related
* [PATCH 23/37] IPVS: ip_vs_todrop() becomes a noop when CONFIG_SYSCTL is undefined
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
include/net/ip_vs.h | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 687ef18..77ebece 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1253,6 +1253,7 @@ extern int ip_vs_icmp_xmit_v6
int offset);
#endif
+#ifdef CONFIG_SYSCTL
/*
* This is a simple mechanism to ignore packets when
* we are loaded. Just set ip_vs_drop_rate to 'n' and
@@ -1268,6 +1269,9 @@ static inline int ip_vs_todrop(struct netns_ipvs *ipvs)
ipvs->drop_counter = ipvs->drop_rate;
return 1;
}
+#else
+static inline int ip_vs_todrop(struct netns_ipvs *ipvs) { return 0; }
+#endif
/*
* ip_vs_fwd_tag returns the forwarding tag of the connection
--
1.7.2.3
^ permalink raw reply related
* [PATCH 24/37] IPVS: Conditional ip_vs_conntrack_enabled()
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
ip_vs_conntrack_enabled() becomes a noop when CONFIG_SYSCTL is undefined.
In preparation for not including sysctl_conntrack in
struct netns_ipvs when CONFIG_SYCTL is not defined.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
include/net/ip_vs.h | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 77ebece..299aeb5 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1359,7 +1359,11 @@ static inline void ip_vs_notrack(struct sk_buff *skb)
*/
static inline int ip_vs_conntrack_enabled(struct netns_ipvs *ipvs)
{
+#ifdef CONFIG_SYSCTL
return ipvs->sysctl_conntrack;
+#else
+ return 0;
+#endif
}
extern void ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp,
--
1.7.2.3
^ permalink raw reply related
* [PATCH 25/37] IPVS: Minimise ip_vs_leave when CONFIG_SYSCTL is undefined
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
Much of ip_vs_leave() is unnecessary if CONFIG_SYSCTL is undefined.
I tried an approach of breaking the now #ifdef'ed portions out
into a separate function. However this appeared to grow the
compiled code on x86_64 by about 200 bytes in the case where
CONFIG_SYSCTL is defined. So I have gone with the simpler though
less elegant #ifdef'ed solution for now.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/ip_vs_core.c | 9 +++++++--
1 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index d418bc6..07accf6 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -499,11 +499,13 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
struct ip_vs_proto_data *pd)
{
- struct net *net;
- struct netns_ipvs *ipvs;
__be16 _ports[2], *pptr;
struct ip_vs_iphdr iph;
+#ifdef CONFIG_SYSCTL
+ struct net *net;
+ struct netns_ipvs *ipvs;
int unicast;
+#endif
ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
@@ -512,6 +514,8 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
ip_vs_service_put(svc);
return NF_DROP;
}
+
+#ifdef CONFIG_SYSCTL
net = skb_net(skb);
#ifdef CONFIG_IP_VS_IPV6
@@ -563,6 +567,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
ip_vs_conn_put(cp);
return ret;
}
+#endif
/*
* When the virtual ftp service is presented, packets destined
--
1.7.2.3
^ permalink raw reply related
* [PATCH 19/37] IPVS: Add sysctl_sync_ver()
From: kaber @ 2011-03-15 19:43 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
In preparation for not including sysctl_sync_ver in
struct netns_ipvs when CONFIG_SYCTL is not defined.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
include/net/ip_vs.h | 11 +++++++++++
net/netfilter/ipvs/ip_vs_sync.c | 4 ++--
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 253736d..687ef18 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -911,6 +911,7 @@ struct netns_ipvs {
#define DEFAULT_SYNC_THRESHOLD 3
#define DEFAULT_SYNC_PERIOD 50
+#define DEFAULT_SYNC_VER 1
#ifdef CONFIG_SYSCTL
@@ -924,6 +925,11 @@ static inline int sysctl_sync_period(struct netns_ipvs *ipvs)
return ipvs->sysctl_sync_threshold[1];
}
+static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
+{
+ return ipvs->sysctl_sync_ver;
+}
+
#else
static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs)
@@ -936,6 +942,11 @@ static inline int sysctl_sync_period(struct netns_ipvs *ipvs)
return DEFAULT_SYNC_PERIOD;
}
+static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
+{
+ return DEFAULT_SYNC_VER;
+}
+
#endif
/*
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index e84987f..3e7961e 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -394,7 +394,7 @@ void ip_vs_sync_switch_mode(struct net *net, int mode)
if (!(ipvs->sync_state & IP_VS_STATE_MASTER))
return;
- if (mode == ipvs->sysctl_sync_ver || !ipvs->sync_buff)
+ if (mode == sysctl_sync_ver(ipvs) || !ipvs->sync_buff)
return;
spin_lock_bh(&ipvs->sync_buff_lock);
@@ -521,7 +521,7 @@ void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp)
unsigned int len, pe_name_len, pad;
/* Handle old version of the protocol */
- if (ipvs->sysctl_sync_ver == 0) {
+ if (sysctl_sync_ver(ipvs) == 0) {
ip_vs_sync_conn_v0(net, cp);
return;
}
--
1.7.2.3
^ permalink raw reply related
* [PATCH 21/37] IPVS: Add expire_quiescent_template()
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
In preparation for not including sysctl_expire_quiescent_template in
struct netns_ipvs when CONFIG_SYCTL is not defined.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/ip_vs_conn.c | 13 +++++++++++--
1 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 9c2a517..f289306 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -680,6 +680,16 @@ static inline void ip_vs_unbind_dest(struct ip_vs_conn *cp)
atomic_dec(&dest->refcnt);
}
+static int expire_quiescent_template(struct netns_ipvs *ipvs,
+ struct ip_vs_dest *dest)
+{
+#ifdef CONFIG_SYSCTL
+ return ipvs->sysctl_expire_quiescent_template &&
+ (atomic_read(&dest->weight) == 0);
+#else
+ return 0;
+#endif
+}
/*
* Checking if the destination of a connection template is available.
@@ -696,8 +706,7 @@ int ip_vs_check_template(struct ip_vs_conn *ct)
*/
if ((dest == NULL) ||
!(dest->flags & IP_VS_DEST_F_AVAILABLE) ||
- (ipvs->sysctl_expire_quiescent_template &&
- (atomic_read(&dest->weight) == 0))) {
+ expire_quiescent_template(ipvs, dest)) {
IP_VS_DBG_BUF(9, "check_template: dest not available for "
"protocol %s s:%s:%d v:%s:%d "
"-> d:%s:%d\n",
--
1.7.2.3
^ permalink raw reply related
* [PATCH 20/37] IPVS: Add sysctl_expire_nodest_conn()
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
In preparation for not including sysctl_expire_nodest_conn in
struct netns_ipvs when CONFIG_SYCTL is not defined.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/ip_vs_core.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 6a0053d..d418bc6 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -613,10 +613,16 @@ static int sysctl_nat_icmp_send(struct net *net)
return ipvs->sysctl_nat_icmp_send;
}
+static int sysctl_expire_nodest_conn(struct netns_ipvs *ipvs)
+{
+ return ipvs->sysctl_expire_nodest_conn;
+}
+
#else
static int sysctl_snat_reroute(struct sk_buff *skb) { return 0; }
static int sysctl_nat_icmp_send(struct net *net) { return 0; }
+static int sysctl_expire_nodest_conn(struct netns_ipvs *ipvs) { return 0; }
#endif
@@ -1583,7 +1589,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
/* the destination server is not available */
- if (ipvs->sysctl_expire_nodest_conn) {
+ if (sysctl_expire_nodest_conn(ipvs)) {
/* try to expire the connection immediately */
ip_vs_conn_expire_now(cp);
}
--
1.7.2.3
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox