* Re: Multicast Fails Over Multipoint GRE Tunnel
From: Doug Kehn @ 2011-03-15 21:33 UTC (permalink / raw)
To: Eric Dumazet, Timo Teräs; +Cc: netdev
In-Reply-To: <4D7F9592.5050408@iki.fi>
Hi Timo,
--- On Tue, 3/15/11, Timo Teräs <timo.teras@iki.fi> wrote:
> From: Timo Teräs <timo.teras@iki.fi>
> Subject: Re: Multicast Fails Over Multipoint GRE Tunnel
> To: "Eric Dumazet" <eric.dumazet@gmail.com>
> Cc: "Doug Kehn" <rdkehn@yahoo.com>, netdev@vger.kernel.org
> Date: Tuesday, March 15, 2011, 12:36 PM
> On 03/15/2011 05:34 PM, Eric Dumazet
> wrote:
> > Le lundi 14 mars 2011 à 16:34 -0700, Doug Kehn a
> écrit :
> >> I'm running kernel version 2.6.36 on ARM XSCALE
> (big-endian) and multicast over a multipoint GRE tunnel
> isn't working. For my architecture, this worked on
> 2.6.26.8. For x86, multicast over a multipoint GRE
> tunnel worked with kernel version 2.6.31 but failed with
> version 2.6.35. Multicast over a multipoint GRE tunnel
> fails because ipgre_header() fails the 'if (iph->daddr)'
> check and reutrns -t->hlen. ipgre_header() is being
> called, from neigh_connected_output(), with a non-null
> daddr; the contents of daddr is zero.
> >>
> >> Reverting the ip_gre.c patch posted in http://marc.info/?l=linux-netdev&m=126762491525281&w=2
> resolves the problem. (Reviewing the HEAD of
> net-next-2.6 it appears that ipgre_header() remains
> unchanged from 2.6.36.)
> >>
> >> The configuration used to discover/diagnose the
> problem:
> >>
> >> ip tunnel add tun1 mode gre key 11223344 ttl 64
> csum remote any
> >> ip link set dev tun1 up
> >> ip link set dev tun1 multicast on
> >> ip addr flush dev tun1
> >> ip addr add 10.40.92.114/24 broadcast 10.40.92.255
> dev tun1
> >>
> >> 12: tun1: <MULTICAST,NOARP,UP,10000> mtu
> 1468 qdisc noqueue
> >> link/gre 0.0.0.0 brd
> 0.0.0.0
> >> inet 10.40.92.114/24 brd
> 10.40.92.255 scope global tun1
> >>
> >> Then attempt:
> >> ping -I tun1 224.0.0.9
> >>
> >> Are additional configuration steps now required
> for multicast over multipoint GRE tunnel or is
> ipgre_header() in error?
> >
> > Hi Doug
> >
> > CC Timo Teras <timo.teras@iki.fi>
> >
> > I would do a partial revert of Timo patch, but this
> means initial
> > concern should be addressed ?
> >
> > (Timo mentioned :
> > If the NOARP packets are not
> dropped, ipgre_tunnel_xmit() will
> > take rt->rt_gateway (= NBMA IP)
> and use that for route
> > look up (and may lead to bogus xfrm
> acquires).)
> >
> >
> > Is the following works for you ?
>
> I have memory that _header() is called with daddr being
> valid pointer,
> but pointing to zero memory. So basically my situation
> would break with
> this.
>
> The above configuration would be fixable by setting
> broadcast to tun1
> interface explicitly. But I'm not sure if the above
> configuration is
> somehow different that it'd need to work.
>
> Basically how things work on send path is:
> 1. arp_constructor maps multicast address to NUD_NOARP
> 2. arp_mc_map in turn copies dev->broadcast to haddr
> (so you get the ip packet pointing to zero
> ip)
> - i assumed normally gre tunnels would have
> the
> broadcast address set
> 3. ipgre_tunnel_xmit checks for daddr==0 and uses the
> rt_gateway then, which would map to the
> multicast
> address
>
> So I assume that the above ping command not working would
> end up sending
> gre encapsulated packet where both the inner and outer IP
> address is the
> same multicast address?
>
> Looks like my patch also broke the default behaviour that
> if one has
> such GRE tunnel, and you send unicast packets, it would
> default the link
> destination to be same as the inner destination. Not sure
> if this would
> be useful.
>
> So basically my situation is undistinguishable from the
> above one. The
> only difference is that the above problems only with
> multicast, and I'm
> having with unicast.
>
> I think the fundamental problem is that arp_mc_map maps the
> multicast
> address to zeroes (due to device broadcast being zero).
>
> Could we instead maybe do something like:
>
> diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
> index 7927589..372448a 100644
> --- a/net/ipv4/arp.c
> +++ b/net/ipv4/arp.c
> @@ -215,6 +215,12 @@ int arp_mc_map(__be32 addr, u8 *haddr,
> struct
> net_device *dev, int dir)
> case ARPHRD_INFINIBAND:
>
> ip_ib_mc_map(addr, dev->broadcast, haddr);
>
> return 0;
> + case ARPHRD_IPGRE:
> +
> if (dev->broadcast)
> +
> memcpy(haddr,
> dev->broadcast, dev->addr_len);
> +
> else
> +
> memcpy(haddr, &addr,
> sizeof(addr));
> +
> return 0;
> default:
> if
> (dir) {
>
> memcpy(haddr, dev->broadcast,
> dev->addr_len);
>
I wasn't sure if the above patch was in addition too or in lieu of the partial revert of ipgre_header() suggested by Eric; both cases were attempted.
The multicast scenario described does not work if only the arp_mc_map() patch is applied.
The multicast scenario described does work if the partial revert of ipgre_header(), suggested by Eric, and the arp_mc_map patch are applied.
Regards,
...doug
^ permalink raw reply
* Re: [RFC v3 3/6] can: make struct proto const
From: Oliver Hartkopp @ 2011-03-15 21:28 UTC (permalink / raw)
To: Kurt Van Dijck, Eric Dumazet; +Cc: socketcan-core, netdev
In-Reply-To: <20110314171752.GL333@e-circ.dyndns.org>
On 14.03.2011 18:17, Kurt Van Dijck wrote:
> On Mon, Mar 14, 2011 at 05:42:23PM +0100, Eric Dumazet wrote:
>> Le lundi 14 mars 2011 à 16:02 +0100, Kurt Van Dijck a écrit :
>>
>>> I see your point.
>>> The reason I modified this was, as described, checkpatch.pl was complaining.
>>> Anyway, this sequence was protected by a spinlock 'proto_tab_lock'.
>>> I don't think it was a race.
>>>
>>> Did I miss something?
>>
>> As soon as proto_tab[proto] = cp; is done, another thread on another cpu
>> can read the pointer and follow it.
>>
>> Hmm, I missed can_create() also uses the spinlock protection, so you're
>> probably right.
>>
>> It seems a bit overkill :(
>> phonet uses RCU for example.
Hello Eric,
the RCU code in phonet is worth to consider. But loading and removing of
protocols is far away from being a hot path ... what would be the advantages
to move to RCU here?
> I'll keep that in mind.
> Switching CAN protos to RCU is far beyond to goal of this patch :-)
Anyway making the struct proto a const (and set the default defines in the CAN
protocols) is a nice cleanup. Let's wait for the feedback about the RCU from
Eric ... then this patch could be put into mainline independently from the
j1939 protocol.
Thanks,
Oliver
^ permalink raw reply
* Re: Multicast Fails Over Multipoint GRE Tunnel
From: Doug Kehn @ 2011-03-15 21:24 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev, Timo Teras
In-Reply-To: <1300203277.2927.9.camel@edumazet-laptop>
Hi Eric,
--- On Tue, 3/15/11, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> From: Eric Dumazet <eric.dumazet@gmail.com>
> Subject: Re: Multicast Fails Over Multipoint GRE Tunnel
> To: "Doug Kehn" <rdkehn@yahoo.com>
> Cc: netdev@vger.kernel.org, "Timo Teras" <timo.teras@iki.fi>
> Date: Tuesday, March 15, 2011, 11:34 AM
> Le lundi 14 mars 2011 à 16:34 -0700,
> Doug Kehn a écrit :
> > Hi All,
> >
> > I'm running kernel version 2.6.36 on ARM XSCALE
> (big-endian) and multicast over a multipoint GRE tunnel
> isn't working. For my architecture, this worked on
> 2.6.26.8. For x86, multicast over a multipoint GRE
> tunnel worked with kernel version 2.6.31 but failed with
> version 2.6.35. Multicast over a multipoint GRE tunnel
> fails because ipgre_header() fails the 'if (iph->daddr)'
> check and reutrns -t->hlen. ipgre_header() is being
> called, from neigh_connected_output(), with a non-null
> daddr; the contents of daddr is zero.
> >
> > Reverting the ip_gre.c patch posted in http://marc.info/?l=linux-netdev&m=126762491525281&w=2
> resolves the problem. (Reviewing the HEAD of
> net-next-2.6 it appears that ipgre_header() remains
> unchanged from 2.6.36.)
> >
> > The configuration used to discover/diagnose the
> problem:
> >
> > ip tunnel add tun1 mode gre key 11223344 ttl 64 csum
> remote any
> > ip link set dev tun1 up
> > ip link set dev tun1 multicast on
> > ip addr flush dev tun1
> > ip addr add 10.40.92.114/24 broadcast 10.40.92.255 dev
> tun1
> >
> > 12: tun1: <MULTICAST,NOARP,UP,10000> mtu 1468
> qdisc noqueue
> > link/gre 0.0.0.0 brd 0.0.0.0
> > inet 10.40.92.114/24 brd
> 10.40.92.255 scope global tun1
> >
> > Then attempt:
> > ping -I tun1 224.0.0.9
> >
> > Are additional configuration steps now required for
> multicast over multipoint GRE tunnel or is ipgre_header() in
> error?
>
> Hi Doug
>
> CC Timo Teras <timo.teras@iki.fi>
>
> I would do a partial revert of Timo patch, but this means
> initial
> concern should be addressed ?
>
> (Timo mentioned :
> If the NOARP packets are not dropped,
> ipgre_tunnel_xmit() will
> take rt->rt_gateway (= NBMA IP) and
> use that for route
> look up (and may lead to bogus xfrm
> acquires).)
>
>
> Is the following works for you ?
>
> diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
> index da5941f..47844fa2 100644
> --- a/net/ipv4/ip_gre.c
> +++ b/net/ipv4/ip_gre.c
> @@ -1170,8 +1170,10 @@ static int ipgre_header(struct
> sk_buff *skb, struct net_device *dev,
>
> if (saddr)
>
> memcpy(&iph->saddr, saddr, 4);
> - if (daddr)
> + if (daddr) {
>
> memcpy(&iph->daddr, daddr, 4);
> + return t->hlen;
> + }
> if (iph->daddr)
> return t->hlen;
>
Yes, the partial revert does work.
Regards,
...doug
^ permalink raw reply
* Re: [PATCH 17/17] net,act_police,rcu: remove rcu_barrier()
From: David Miller @ 2011-03-15 21:04 UTC (permalink / raw)
To: laijs
Cc: mingo, paulmck, axboe, Trond.Myklebust, vladislav.yasevich, sri,
viro, eparis, menage, kuznet, pekkas, jmorris, yoshfuji, kaber,
johannes, linville, hadi, jpirko, eric.dumazet, hagen,
randy.dunlap, jkosina, joe, u.kleine-koenig, ebiederm, gregkh,
xemul, linux-kernel, linux-nfs, linux-sctp, netdev, containers,
linux-decnet-user, linux-wireless, linux-security-module
In-Reply-To: <4D7F3B62.6000005@cn.fujitsu.com>
From: Lai Jiangshan <laijs@cn.fujitsu.com>
Date: Tue, 15 Mar 2011 18:11:46 +0800
>
>
> There is no callback of this module maybe queued
> since we use kfree_rcu(), we can safely remove the rcu_barrier().
>
> Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply
* Re: [PATCH 15/17] net,rcu: convert call_rcu(ha_rcu_free) to kfree_rcu()
From: David Miller @ 2011-03-15 21:04 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: mingo-X9Un+BFzKDI, paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
axboe-tSWWG44O7X1aa/9Udqfwiw,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
vladislav.yasevich-VXdhtT5mjnY, sri-r/Jw6+rmf7HQT0dZR+AlfA,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
eparis-H+wXaHxf7aLQT0dZR+AlfA, menage-hpIqsD4AKlfQT0dZR+AlfA,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, pekkas-UjJjq++bwZ7HOG6cAo2yLw,
jmorris-gx6/JNMH7DfYtjvyW6yDsg, yoshfuji-VfPWfsRibaP+Ru+s062T9g,
kaber-dcUjhNyLwpNeoWH0uzbU5w, johannes-cdvu00un1VgdHxzADdlk8Q,
linville-2XuSBdqkA4R54TAoqtyWWQ, hadi-fAAogVwAN2Kw5LPnMra/2Q,
jpirko-H+wXaHxf7aLQT0dZR+AlfA,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w, hagen-GvnIQ6b/HdU,
randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA, jkosina-AlSwsSmVLrQ,
joe-6d6DIl74uiNBDgjK7y7TUQ,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, gregkh-l3A5Bk7waGM,
xemul-GEFAQzZX7r8dnm+yROfE0A, linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-nfs-u79uwXL29TY76Z2rM5mHXA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, netdev-u79uwXL29TY76Z2rM5mHXA,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <4D7F3ABA.7020709-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 18:08:58 +0800
>
>
> The rcu callback ha_rcu_free() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(ha_rcu_free).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 16/17] net,rcu: convert call_rcu(dn_dev_free_ifa_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:04 UTC (permalink / raw)
To: laijs
Cc: mingo, paulmck, axboe, Trond.Myklebust, vladislav.yasevich, sri,
viro, eparis, menage, kuznet, pekkas, jmorris, yoshfuji, kaber,
johannes, linville, hadi, jpirko, eric.dumazet, hagen,
randy.dunlap, jkosina, joe, u.kleine-koenig, ebiederm, gregkh,
xemul, linux-kernel, linux-nfs, linux-sctp, netdev, containers,
linux-decnet-user, linux-wireless, linux-security-module
In-Reply-To: <4D7F3B04.9080504@cn.fujitsu.com>
From: Lai Jiangshan <laijs@cn.fujitsu.com>
Date: Tue, 15 Mar 2011 18:10:12 +0800
>
> The rcu callback dn_dev_free_ifa_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(dn_dev_free_ifa_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply
* Re: [PATCH 11/17] net,rcu: convert call_rcu(sctp_local_addr_free) to kfree_rcu()
From: David Miller @ 2011-03-15 21:03 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: mingo-X9Un+BFzKDI, paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
axboe-tSWWG44O7X1aa/9Udqfwiw,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
vladislav.yasevich-VXdhtT5mjnY, sri-r/Jw6+rmf7HQT0dZR+AlfA,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
eparis-H+wXaHxf7aLQT0dZR+AlfA, menage-hpIqsD4AKlfQT0dZR+AlfA,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, pekkas-UjJjq++bwZ7HOG6cAo2yLw,
jmorris-gx6/JNMH7DfYtjvyW6yDsg, yoshfuji-VfPWfsRibaP+Ru+s062T9g,
kaber-dcUjhNyLwpNeoWH0uzbU5w, johannes-cdvu00un1VgdHxzADdlk8Q,
linville-2XuSBdqkA4R54TAoqtyWWQ, hadi-fAAogVwAN2Kw5LPnMra/2Q,
jpirko-H+wXaHxf7aLQT0dZR+AlfA,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w, hagen-GvnIQ6b/HdU,
randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA, jkosina-AlSwsSmVLrQ,
joe-6d6DIl74uiNBDgjK7y7TUQ,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, gregkh-l3A5Bk7waGM,
xemul-GEFAQzZX7r8dnm+yROfE0A, linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-nfs-u79uwXL29TY76Z2rM5mHXA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, netdev-u79uwXL29TY76Z2rM5mHXA,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <4D7F39CE.80403-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 18:05:02 +0800
>
>
> The rcu callback sctp_local_addr_free() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(sctp_local_addr_free).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 08/17] net,rcu: convert call_rcu(listeners_free_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:03 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, xemul-GEFAQzZX7r8dnm+yROfE0A,
pekkas-UjJjq++bwZ7HOG6cAo2yLw,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, mingo-X9Un+BFzKDI,
paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
sri-r/Jw6+rmf7HQT0dZR+AlfA, vladislav.yasevich-VXdhtT5mjnY,
hagen-GvnIQ6b/HdU, linville-2XuSBdqkA4R54TAoqtyWWQ,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
menage-hpIqsD4AKlfQT0dZR+AlfA, axboe-tSWWG44O7X1aa/9Udqfwiw,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, jpirko-H+wXaHxf7aLQT0dZR+AlfA,
yoshfuji-VfPWfsRibaP+Ru+s062T9g, jkosina-AlSwsSmVLrQ,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
gregkh-l3A5Bk7waGM, linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
eparis-H+wXaHxf7aLQT0dZR+AlfA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, netdev-u79uwXL29TY76Z2rM5mHXA,
joe-6d6DIl74uiNBDgjK7y7TUQ, johannes-cdvu00un1VgdHxzADdlk8Q
In-Reply-To: <4D7F3906.3090107-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 18:01:42 +0800
>
>
> The rcu callback listeners_free_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(listeners_free_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
^ permalink raw reply
* Re: [PATCH 06/17] net,rcu: convert call_rcu(in6_dev_finish_destroy_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:03 UTC (permalink / raw)
To: laijs
Cc: mingo, paulmck, axboe, Trond.Myklebust, vladislav.yasevich, sri,
viro, eparis, menage, kuznet, pekkas, jmorris, yoshfuji, kaber,
johannes, linville, hadi, jpirko, eric.dumazet, hagen,
randy.dunlap, jkosina, joe, u.kleine-koenig, ebiederm, gregkh,
xemul, linux-kernel, linux-nfs, linux-sctp, netdev, containers,
linux-decnet-user, linux-wireless, linux-security-module
In-Reply-To: <4D7F3872.6090305@cn.fujitsu.com>
From: Lai Jiangshan <laijs@cn.fujitsu.com>
Date: Tue, 15 Mar 2011 17:59:14 +0800
>
>
> The rcu callback in6_dev_finish_destroy_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(in6_dev_finish_destroy_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply
* Re: [PATCH 05/17] net,rcu: convert call_rcu(tcf_police_free_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:02 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, xemul-GEFAQzZX7r8dnm+yROfE0A,
pekkas-UjJjq++bwZ7HOG6cAo2yLw,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, mingo-X9Un+BFzKDI,
paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
sri-r/Jw6+rmf7HQT0dZR+AlfA, vladislav.yasevich-VXdhtT5mjnY,
hagen-GvnIQ6b/HdU, linville-2XuSBdqkA4R54TAoqtyWWQ,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
menage-hpIqsD4AKlfQT0dZR+AlfA, axboe-tSWWG44O7X1aa/9Udqfwiw,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, jpirko-H+wXaHxf7aLQT0dZR+AlfA,
yoshfuji-VfPWfsRibaP+Ru+s062T9g, jkosina-AlSwsSmVLrQ,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
gregkh-l3A5Bk7waGM, linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
eparis-H+wXaHxf7aLQT0dZR+AlfA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, netdev-u79uwXL29TY76Z2rM5mHXA,
joe-6d6DIl74uiNBDgjK7y7TUQ, johannes-cdvu00un1VgdHxzADdlk8Q
In-Reply-To: <4D7F3828.4040403-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 17:58:00 +0800
> [PATCH 05/17] net,rcu: convert call_rcu(tcf_police_free_rcu) to kfree_rcu()
>
> The rcu callback tcf_police_free_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(tcf_police_free_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
^ permalink raw reply
* Re: [PATCH 07/17] net,rcu: convert call_rcu(inet6_ifa_finish_destroy_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:03 UTC (permalink / raw)
To: laijs
Cc: mingo, paulmck, axboe, Trond.Myklebust, vladislav.yasevich, sri,
viro, eparis, menage, kuznet, pekkas, jmorris, yoshfuji, kaber,
johannes, linville, hadi, jpirko, eric.dumazet, hagen,
randy.dunlap, jkosina, joe, u.kleine-koenig, ebiederm, gregkh,
xemul, linux-kernel, linux-nfs, linux-sctp, netdev, containers,
linux-decnet-user, linux-wireless, linux-security-module
In-Reply-To: <4D7F38AE.7060708@cn.fujitsu.com>
From: Lai Jiangshan <laijs@cn.fujitsu.com>
Date: Tue, 15 Mar 2011 18:00:14 +0800
>
>
> The rcu callback inet6_ifa_finish_destroy_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(inet6_ifa_finish_destroy_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply
* Re: [PATCH 04/17] net,rcu: convert call_rcu(tcf_common_free_rcu) to kfree_rcu()
From: David Miller @ 2011-03-15 21:02 UTC (permalink / raw)
To: laijs-BthXqXjhjHXQFUHtdCDX3A
Cc: randy.dunlap-QHcLZuEGTsvQT0dZR+AlfA,
linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA,
linux-sctp-u79uwXL29TY76Z2rM5mHXA, xemul-GEFAQzZX7r8dnm+yROfE0A,
pekkas-UjJjq++bwZ7HOG6cAo2yLw,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w,
u.kleine-koenig-bIcnvbaLZ9MEGnE8C9+IrQ,
kuznet-v/Mj1YrvjDBInbfyfbPRSQ, mingo-X9Un+BFzKDI,
paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8,
sri-r/Jw6+rmf7HQT0dZR+AlfA, vladislav.yasevich-VXdhtT5mjnY,
hagen-GvnIQ6b/HdU, linville-2XuSBdqkA4R54TAoqtyWWQ,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn,
menage-hpIqsD4AKlfQT0dZR+AlfA, axboe-tSWWG44O7X1aa/9Udqfwiw,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, jpirko-H+wXaHxf7aLQT0dZR+AlfA,
yoshfuji-VfPWfsRibaP+Ru+s062T9g, jkosina-AlSwsSmVLrQ,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
gregkh-l3A5Bk7waGM, linux-wireless-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
eparis-H+wXaHxf7aLQT0dZR+AlfA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, netdev-u79uwXL29TY76Z2rM5mHXA,
joe-6d6DIl74uiNBDgjK7y7TUQ, johannes-cdvu00un1VgdHxzADdlk8Q
In-Reply-To: <4D7F37F0.1050801-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
From: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Date: Tue, 15 Mar 2011 17:57:04 +0800
>
>
> The rcu callback tcf_common_free_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(tcf_common_free_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: David S. Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
^ permalink raw reply
* Re: pull request: wireless-next-2.6 2011-03-15
From: David Miller @ 2011-03-15 20:57 UTC (permalink / raw)
To: linville; +Cc: linux-wireless, netdev
In-Reply-To: <20110315193122.GD2542@tuxdriver.com>
From: "John W. Linville" <linville@tuxdriver.com>
Date: Tue, 15 Mar 2011 15:31:22 -0400
> One last non-fix pull for 2.6.39 -- hooray!
>
> Not a lot here, since we just had a pull towards the end of last week.
> There are a handfule of ath9k bits, a couple of wl1251 patches,
> a couple of mac80211 bits, etc. Nothing too troublesome. :-)
>
> Please let me know if there are problems!
Pulled, thanks a lot John.
^ permalink raw reply
* Re: [PATCH 03/17] cgroup, rcu: convert call_rcu(__free_css_id_cb) to kfree_rcu()
From: Paul Menage @ 2011-03-15 20:04 UTC (permalink / raw)
To: Lai Jiangshan
Cc: Randy Dunlap, linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond Myklebust, linux-sctp-u79uwXL29TY76Z2rM5mHXA,
Pavel Emelyanov, Pekka Savola (ipv6), Eric Dumazet,
Uwe Kleine-König, Alexey Kuznetsov, Ingo Molnar,
Paul E. McKenney, Sridhar Samudrala, Vlad Yasevich,
Hagen Paul Pfeifer, John W. Linville, Al Viro, Jens Axboe,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, Jiri Pirko
In-Reply-To: <4D7F37BA.5000308-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2011/3/15 Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>:
>
>
> The rcu callback __free_css_id_cb() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(__free_css_id_cb).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: Paul Menage <menage-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
> ---
> kernel/cgroup.c | 10 +---------
> 1 files changed, 1 insertions(+), 9 deletions(-)
>
> diff --git a/kernel/cgroup.c b/kernel/cgroup.c
> index 5c83c91..b7d3f6d 100644
> --- a/kernel/cgroup.c
> +++ b/kernel/cgroup.c
> @@ -4612,14 +4612,6 @@ bool css_is_ancestor(struct cgroup_subsys_state *child,
> return ret;
> }
>
> -static void __free_css_id_cb(struct rcu_head *head)
> -{
> - struct css_id *id;
> -
> - id = container_of(head, struct css_id, rcu_head);
> - kfree(id);
> -}
> -
> void free_css_id(struct cgroup_subsys *ss, struct cgroup_subsys_state *css)
> {
> struct css_id *id = css->id;
> @@ -4634,7 +4626,7 @@ void free_css_id(struct cgroup_subsys *ss, struct cgroup_subsys_state *css)
> spin_lock(&ss->id_lock);
> idr_remove(&ss->idr, id->id);
> spin_unlock(&ss->id_lock);
> - call_rcu(&id->rcu_head, __free_css_id_cb);
> + kfree_rcu(id, rcu_head);
> }
> EXPORT_SYMBOL_GPL(free_css_id);
>
> --
> 1.7.4
>
^ permalink raw reply
* Re: [PATCH 02/17] cgroup, rcu: convert call_rcu(free_cgroup_rcu) to kfree_rcu()
From: Paul Menage @ 2011-03-15 20:04 UTC (permalink / raw)
To: Lai Jiangshan
Cc: Randy Dunlap, linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond Myklebust, linux-sctp-u79uwXL29TY76Z2rM5mHXA,
Pavel Emelyanov, Pekka Savola (ipv6), Eric Dumazet,
Uwe Kleine-König, Alexey Kuznetsov, Ingo Molnar,
Paul E. McKenney, Sridhar Samudrala, Vlad Yasevich,
Hagen Paul Pfeifer, John W. Linville, Al Viro, Jens Axboe,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, Jiri Pirko
In-Reply-To: <4D7F3784.6090307-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2011/3/15 Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>:
>
> The rcu callback free_cgroup_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(free_cgroup_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: Paul Menage <menage-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
> ---
> kernel/cgroup.c | 9 +--------
> 1 files changed, 1 insertions(+), 8 deletions(-)
>
> diff --git a/kernel/cgroup.c b/kernel/cgroup.c
> index ad485d4..5c83c91 100644
> --- a/kernel/cgroup.c
> +++ b/kernel/cgroup.c
> @@ -806,13 +806,6 @@ static int cgroup_call_pre_destroy(struct cgroup *cgrp)
> return ret;
> }
>
> -static void free_cgroup_rcu(struct rcu_head *obj)
> -{
> - struct cgroup *cgrp = container_of(obj, struct cgroup, rcu_head);
> -
> - kfree(cgrp);
> -}
> -
> static void cgroup_diput(struct dentry *dentry, struct inode *inode)
> {
> /* is dentry a directory ? if so, kfree() associated cgroup */
> @@ -850,7 +843,7 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
> */
> BUG_ON(!list_empty(&cgrp->pidlists));
>
> - call_rcu(&cgrp->rcu_head, free_cgroup_rcu);
> + kfree_rcu(cgrp, rcu_head);
> }
> iput(inode);
> }
> --
> 1.7.4
>
^ permalink raw reply
* Re: [PATCH 01/17] cgroup, rcu: convert call_rcu(free_css_set_rcu) to kfree_rcu()
From: Paul Menage @ 2011-03-15 20:03 UTC (permalink / raw)
To: Lai Jiangshan
Cc: Randy Dunlap, linux-decnet-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
Trond Myklebust, linux-sctp-u79uwXL29TY76Z2rM5mHXA,
Pavel Emelyanov, Pekka Savola (ipv6), Eric Dumazet,
Uwe Kleine-König, Alexey Kuznetsov, Ingo Molnar,
Paul E. McKenney, Sridhar Samudrala, Vlad Yasevich,
Hagen Paul Pfeifer, John W. Linville, Al Viro, Jens Axboe,
linux-nfs-u79uwXL29TY76Z2rM5mHXA, Jiri Pirko
In-Reply-To: <4D7F372A.6050407-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2011/3/15 Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>:
>
> The rcu callback free_css_set_rcu() just calls a kfree(),
> so we use kfree_rcu() instead of the call_rcu(free_css_set_rcu).
>
> Signed-off-by: Lai Jiangshan <laijs-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Acked-by: Paul Menage <menage-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
Looks fine, assuming the main kfree_rcu() changes go through.
Paul
^ permalink raw reply
* [PATCH] Fix overflow of name in struct net_device, replaced sprintf with snprintf.
From: Sasikanth V @ 2011-03-15 20:00 UTC (permalink / raw)
To: davem; +Cc: netdev, Sasikanth V
Signed-off-by: Sasikanth V <sasikanth.v19@gmail.com>
---
net/core/dev.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6561021..a74efa9 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -539,7 +539,7 @@ unsigned long netdev_boot_base(const char *prefix, int unit)
char name[IFNAMSIZ];
int i;
- sprintf(name, "%s%d", prefix, unit);
+ snprintf(name, IFNAMSIZ, "%s%d", prefix, unit);
/*
* If device already registered then return base of 1
--
1.7.3.4
^ permalink raw reply related
* Re: [PATCH 00/37] netfilter: netfilter update
From: David Miller @ 2011-03-15 19:58 UTC (permalink / raw)
To: kaber; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: kaber@trash.net
Date: Tue, 15 Mar 2011 20:43:40 +0100
>
> Please pull from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6.git master
Pulled, thanks Patrick.
^ permalink raw reply
* Re: ECN + pfifo_fast borked? (Was Re: [Bloat] shaper team forming up)
From: Eric Dumazet @ 2011-03-15 19:56 UTC (permalink / raw)
To: Jonathan Morton; +Cc: Dave Täht, David Miller, netdev
In-Reply-To: <7CFAAB08-8A30-4569-8825-64121D43EA77@gmail.com>
Le mardi 15 mars 2011 à 20:37 +0200, Jonathan Morton a écrit :
> On 15 Mar, 2011, at 8:28 pm, Eric Dumazet wrote:
>
> >>> band 0 : high priority packets (like now)
> >>> band 1 : (old band 1, ECN capable flows)
> >>> band 2 : (old band 1, no ECN flows)
> >>> band 3 : low priority packets (old band 2)
> >>
> >> This seems good to me. It would provide a concrete (if minor) enticement to turn ECN on.
> >
> > Here is a patch to implement that, on top of net-next-2.6 git tree
>
> Does this take both ECN bits into account? The ECT(0), ECT(1) and ECE codepoints all need to be recognised equally.
This is done in a different layer, as already explained.
Current linux code ignores low order bit when doing TOS -> skb->priority
mapping.
^ permalink raw reply
* [PATCH 37/37] netfilter: xt_addrtype: ipv6 support
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Florian Westphal <fwestphal@astaro.com>
The kernel will refuse certain types that do not work in ipv6 mode.
We can then add these features incrementally without risk of userspace
breakage.
Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
include/linux/netfilter/xt_addrtype.h | 17 ++++++
net/netfilter/Kconfig | 1 +
net/netfilter/xt_addrtype.c | 98 ++++++++++++++++++++++++++++++++-
3 files changed, 114 insertions(+), 2 deletions(-)
diff --git a/include/linux/netfilter/xt_addrtype.h b/include/linux/netfilter/xt_addrtype.h
index b492fc8..b156baa 100644
--- a/include/linux/netfilter/xt_addrtype.h
+++ b/include/linux/netfilter/xt_addrtype.h
@@ -10,6 +10,23 @@ enum {
XT_ADDRTYPE_LIMIT_IFACE_OUT = 0x0008,
};
+
+/* rtn_type enum values from rtnetlink.h, but shifted */
+enum {
+ XT_ADDRTYPE_UNSPEC = 1 << 0,
+ XT_ADDRTYPE_UNICAST = 1 << 1, /* 1 << RTN_UNICAST */
+ XT_ADDRTYPE_LOCAL = 1 << 2, /* 1 << RTN_LOCAL, etc */
+ XT_ADDRTYPE_BROADCAST = 1 << 3,
+ XT_ADDRTYPE_ANYCAST = 1 << 4,
+ XT_ADDRTYPE_MULTICAST = 1 << 5,
+ XT_ADDRTYPE_BLACKHOLE = 1 << 6,
+ XT_ADDRTYPE_UNREACHABLE = 1 << 7,
+ XT_ADDRTYPE_PROHIBIT = 1 << 8,
+ XT_ADDRTYPE_THROW = 1 << 9,
+ XT_ADDRTYPE_NAT = 1 << 10,
+ XT_ADDRTYPE_XRESOLVE = 1 << 11,
+};
+
struct xt_addrtype_info_v1 {
__u16 source; /* source-type mask */
__u16 dest; /* dest-type mask */
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 32bff6d..c3f988a 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -652,6 +652,7 @@ comment "Xtables matches"
config NETFILTER_XT_MATCH_ADDRTYPE
tristate '"addrtype" address type match support'
depends on NETFILTER_ADVANCED
+ depends on (IPV6 || IPV6=n)
---help---
This option allows you to match what routing thinks of an address,
eg. UNICAST, LOCAL, BROADCAST, ...
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index e89c0b8..2220b85 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -16,6 +16,12 @@
#include <linux/ip.h>
#include <net/route.h>
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <net/ip6_fib.h>
+#endif
+
#include <linux/netfilter/xt_addrtype.h>
#include <linux/netfilter/x_tables.h>
@@ -23,6 +29,73 @@ MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_DESCRIPTION("Xtables: address type match");
MODULE_ALIAS("ipt_addrtype");
+MODULE_ALIAS("ip6t_addrtype");
+
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
+{
+ u32 ret;
+
+ if (!rt)
+ return XT_ADDRTYPE_UNREACHABLE;
+
+ if (rt->rt6i_flags & RTF_REJECT)
+ ret = XT_ADDRTYPE_UNREACHABLE;
+ else
+ ret = 0;
+
+ if (rt->rt6i_flags & RTF_LOCAL)
+ ret |= XT_ADDRTYPE_LOCAL;
+ if (rt->rt6i_flags & RTF_ANYCAST)
+ ret |= XT_ADDRTYPE_ANYCAST;
+ return ret;
+}
+
+static bool match_type6(struct net *net, const struct net_device *dev,
+ const struct in6_addr *addr, u16 mask)
+{
+ int addr_type = ipv6_addr_type(addr);
+
+ if ((mask & XT_ADDRTYPE_MULTICAST) &&
+ !(addr_type & IPV6_ADDR_MULTICAST))
+ return false;
+ if ((mask & XT_ADDRTYPE_UNICAST) && !(addr_type & IPV6_ADDR_UNICAST))
+ return false;
+ if ((mask & XT_ADDRTYPE_UNSPEC) && addr_type != IPV6_ADDR_ANY)
+ return false;
+
+ if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
+ XT_ADDRTYPE_UNREACHABLE) & mask) {
+ struct rt6_info *rt;
+ u32 type;
+ int ifindex = dev ? dev->ifindex : 0;
+
+ rt = rt6_lookup(net, addr, NULL, ifindex, !!dev);
+
+ type = xt_addrtype_rt6_to_type(rt);
+
+ dst_release(&rt->dst);
+ return !!(mask & type);
+ }
+ return true;
+}
+
+static bool
+addrtype_mt6(struct net *net, const struct net_device *dev,
+ const struct sk_buff *skb, const struct xt_addrtype_info_v1 *info)
+{
+ const struct ipv6hdr *iph = ipv6_hdr(skb);
+ bool ret = true;
+
+ if (info->source)
+ ret &= match_type6(net, dev, &iph->saddr, info->source) ^
+ (info->flags & XT_ADDRTYPE_INVERT_SOURCE);
+ if (ret && info->dest)
+ ret &= match_type6(net, dev, &iph->daddr, info->dest) ^
+ !!(info->flags & XT_ADDRTYPE_INVERT_DEST);
+ return ret;
+}
+#endif
static inline bool match_type(struct net *net, const struct net_device *dev,
__be32 addr, u_int16_t mask)
@@ -53,7 +126,7 @@ addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
{
struct net *net = dev_net(par->in ? par->in : par->out);
const struct xt_addrtype_info_v1 *info = par->matchinfo;
- const struct iphdr *iph = ip_hdr(skb);
+ const struct iphdr *iph;
const struct net_device *dev = NULL;
bool ret = true;
@@ -62,6 +135,11 @@ addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
else if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT)
dev = par->out;
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+ if (par->family == NFPROTO_IPV6)
+ return addrtype_mt6(net, dev, skb, info);
+#endif
+ iph = ip_hdr(skb);
if (info->source)
ret &= match_type(net, dev, iph->saddr, info->source) ^
(info->flags & XT_ADDRTYPE_INVERT_SOURCE);
@@ -98,6 +176,22 @@ static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
return -EINVAL;
}
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+ if (par->family == NFPROTO_IPV6) {
+ if ((info->source | info->dest) & XT_ADDRTYPE_BLACKHOLE) {
+ pr_err("ipv6 BLACKHOLE matching not supported\n");
+ return -EINVAL;
+ }
+ if ((info->source | info->dest) >= XT_ADDRTYPE_PROHIBIT) {
+ pr_err("ipv6 PROHIBT (THROW, NAT ..) matching not supported\n");
+ return -EINVAL;
+ }
+ if ((info->source | info->dest) & XT_ADDRTYPE_BROADCAST) {
+ pr_err("ipv6 does not support BROADCAST matching\n");
+ return -EINVAL;
+ }
+ }
+#endif
return 0;
}
@@ -111,7 +205,7 @@ static struct xt_match addrtype_mt_reg[] __read_mostly = {
},
{
.name = "addrtype",
- .family = NFPROTO_IPV4,
+ .family = NFPROTO_UNSPEC,
.revision = 1,
.match = addrtype_mt_v1,
.checkentry = addrtype_mt_checkentry_v1,
--
1.7.2.3
^ permalink raw reply related
* [PATCH 34/37] netfilter: ip_tables: fix infoleak to userspace
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Vasiliy Kulikov <segoon@openwall.com>
Structures ipt_replace, compat_ipt_replace, and xt_get_revision are
copied from userspace. Fields of these structs that are
zero-terminated strings are not checked. When they are used as argument
to a format string containing "%s" in request_module(), some sensitive
information is leaked to userspace via argument of spawned modprobe
process.
The first and the third bugs were introduced before the git epoch; the
second was introduced in 2722971c (v2.6.17-rc1). To trigger the bug
one should have CAP_NET_ADMIN.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/ipv4/netfilter/ip_tables.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index ef7d7b9..b09ed0d 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1262,6 +1262,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
/* overflow check */
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -1807,6 +1808,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -2036,6 +2038,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
ret = -EFAULT;
break;
}
+ rev.name[sizeof(rev.name)-1] = 0;
if (cmd == IPT_SO_GET_REVISION_TARGET)
target = 1;
--
1.7.2.3
^ permalink raw reply related
* [PATCH 31/37] netfilter: xt_connlimit: use hlist instead
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Changli Gao <xiaosuo@gmail.com>
The header of hlist is smaller than list.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/xt_connlimit.c | 28 ++++++++++++++--------------
1 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index ade2a80..da56d6e 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -33,14 +33,14 @@
/* we will save the tuples of all connections we care about */
struct xt_connlimit_conn {
- struct list_head list;
+ struct hlist_node node;
struct nf_conntrack_tuple tuple;
union nf_inet_addr addr;
};
struct xt_connlimit_data {
- struct list_head iphash[256];
- spinlock_t lock;
+ struct hlist_head iphash[256];
+ spinlock_t lock;
};
static u_int32_t connlimit_rnd __read_mostly;
@@ -102,9 +102,9 @@ static int count_them(struct net *net,
{
const struct nf_conntrack_tuple_hash *found;
struct xt_connlimit_conn *conn;
- struct xt_connlimit_conn *tmp;
+ struct hlist_node *pos, *n;
struct nf_conn *found_ct;
- struct list_head *hash;
+ struct hlist_head *hash;
bool addit = true;
int matches = 0;
@@ -116,7 +116,7 @@ static int count_them(struct net *net,
rcu_read_lock();
/* check the saved connections */
- list_for_each_entry_safe(conn, tmp, hash, list) {
+ hlist_for_each_entry_safe(conn, pos, n, hash, node) {
found = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE,
&conn->tuple);
found_ct = NULL;
@@ -136,7 +136,7 @@ static int count_them(struct net *net,
if (found == NULL) {
/* this one is gone */
- list_del(&conn->list);
+ hlist_del(&conn->node);
kfree(conn);
continue;
}
@@ -147,7 +147,7 @@ static int count_them(struct net *net,
* closed already -> ditch it
*/
nf_ct_put(found_ct);
- list_del(&conn->list);
+ hlist_del(&conn->node);
kfree(conn);
continue;
}
@@ -167,7 +167,7 @@ static int count_them(struct net *net,
return -ENOMEM;
conn->tuple = *tuple;
conn->addr = *addr;
- list_add(&conn->list, hash);
+ hlist_add_head(&conn->node, hash);
++matches;
}
@@ -246,7 +246,7 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
spin_lock_init(&info->data->lock);
for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i)
- INIT_LIST_HEAD(&info->data->iphash[i]);
+ INIT_HLIST_HEAD(&info->data->iphash[i]);
return 0;
}
@@ -255,15 +255,15 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
{
const struct xt_connlimit_info *info = par->matchinfo;
struct xt_connlimit_conn *conn;
- struct xt_connlimit_conn *tmp;
- struct list_head *hash = info->data->iphash;
+ struct hlist_node *pos, *n;
+ struct hlist_head *hash = info->data->iphash;
unsigned int i;
nf_ct_l3proto_module_put(par->family);
for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
- list_for_each_entry_safe(conn, tmp, &hash[i], list) {
- list_del(&conn->list);
+ hlist_for_each_entry_safe(conn, pos, n, &hash[i], node) {
+ hlist_del(&conn->node);
kfree(conn);
}
}
--
1.7.2.3
^ permalink raw reply related
* [PATCH 28/37] IPVS: Conditionally include sysctl members of struct netns_ipvs
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
There is now no need to include sysctl members of struct netns_ipvs
unless CONFIG_SYSCTL is defined.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
include/net/ip_vs.h | 21 +++++++++++++--------
1 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 299aeb5..272f593 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -839,6 +839,17 @@ struct netns_ipvs {
struct ip_vs_stats tot_stats; /* Statistics & est. */
int num_services; /* no of virtual services */
+
+ rwlock_t rs_lock; /* real services table */
+ /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
+ struct lock_class_key ctl_key; /* ctl_mutex debuging */
+ /* Trash for destinations */
+ struct list_head dest_trash;
+ /* Service counters */
+ atomic_t ftpsvc_counter;
+ atomic_t nullsvc_counter;
+
+#ifdef CONFIG_SYSCTL
/* 1/rate drop and drop-entry variables */
struct delayed_work defense_work; /* Work handler */
int drop_rate;
@@ -848,18 +859,12 @@ struct netns_ipvs {
spinlock_t dropentry_lock; /* drop entry handling */
spinlock_t droppacket_lock; /* drop packet handling */
spinlock_t securetcp_lock; /* state and timeout tables */
- rwlock_t rs_lock; /* real services table */
- /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
- struct lock_class_key ctl_key; /* ctl_mutex debuging */
- /* Trash for destinations */
- struct list_head dest_trash;
- /* Service counters */
- atomic_t ftpsvc_counter;
- atomic_t nullsvc_counter;
/* sys-ctl struct */
struct ctl_table_header *sysctl_hdr;
struct ctl_table *sysctl_tbl;
+#endif
+
/* sysctl variables */
int sysctl_amemthresh;
int sysctl_am_droprate;
--
1.7.2.3
^ permalink raw reply related
* [PATCH 26/37] IPVS: Conditionally define and use ip_vs_lblc{r}_table
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Simon Horman <horms@verge.net.au>
ip_vs_lblc_table and ip_vs_lblcr_table, and code that uses them
are unnecessary when CONFIG_SYSCTL is undefined.
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/ip_vs_lblc.c | 15 ++++++++++-----
net/netfilter/ipvs/ip_vs_lblcr.c | 14 ++++++++++----
2 files changed, 20 insertions(+), 9 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 51a27f5..f276df9 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -114,7 +114,7 @@ struct ip_vs_lblc_table {
/*
* IPVS LBLC sysctl table
*/
-
+#ifdef CONFIG_SYSCTL
static ctl_table vs_vars_table[] = {
{
.procname = "lblc_expiration",
@@ -125,6 +125,7 @@ static ctl_table vs_vars_table[] = {
},
{ }
};
+#endif
static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
{
@@ -548,6 +549,7 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler =
/*
* per netns init.
*/
+#ifdef CONFIG_SYSCTL
static int __net_init __ip_vs_lblc_init(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
@@ -563,7 +565,6 @@ static int __net_init __ip_vs_lblc_init(struct net *net)
ipvs->sysctl_lblc_expiration = DEFAULT_EXPIRATION;
ipvs->lblc_ctl_table[0].data = &ipvs->sysctl_lblc_expiration;
-#ifdef CONFIG_SYSCTL
ipvs->lblc_ctl_header =
register_net_sysctl_table(net, net_vs_ctl_path,
ipvs->lblc_ctl_table);
@@ -572,7 +573,6 @@ static int __net_init __ip_vs_lblc_init(struct net *net)
kfree(ipvs->lblc_ctl_table);
return -ENOMEM;
}
-#endif
return 0;
}
@@ -581,14 +581,19 @@ static void __net_exit __ip_vs_lblc_exit(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
-#ifdef CONFIG_SYSCTL
unregister_net_sysctl_table(ipvs->lblc_ctl_header);
-#endif
if (!net_eq(net, &init_net))
kfree(ipvs->lblc_ctl_table);
}
+#else
+
+static int __net_init __ip_vs_lblc_init(struct net *net) { return 0; }
+static void __net_exit __ip_vs_lblc_exit(struct net *net) { }
+
+#endif
+
static struct pernet_operations ip_vs_lblc_ops = {
.init = __ip_vs_lblc_init,
.exit = __ip_vs_lblc_exit,
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 7fb9190..cb1c991 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -285,6 +285,7 @@ struct ip_vs_lblcr_table {
};
+#ifdef CONFIG_SYSCTL
/*
* IPVS LBLCR sysctl table
*/
@@ -299,6 +300,7 @@ static ctl_table vs_vars_table[] = {
},
{ }
};
+#endif
static inline void ip_vs_lblcr_free(struct ip_vs_lblcr_entry *en)
{
@@ -743,6 +745,7 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler =
/*
* per netns init.
*/
+#ifdef CONFIG_SYSCTL
static int __net_init __ip_vs_lblcr_init(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
@@ -758,7 +761,6 @@ static int __net_init __ip_vs_lblcr_init(struct net *net)
ipvs->sysctl_lblcr_expiration = DEFAULT_EXPIRATION;
ipvs->lblcr_ctl_table[0].data = &ipvs->sysctl_lblcr_expiration;
-#ifdef CONFIG_SYSCTL
ipvs->lblcr_ctl_header =
register_net_sysctl_table(net, net_vs_ctl_path,
ipvs->lblcr_ctl_table);
@@ -767,7 +769,6 @@ static int __net_init __ip_vs_lblcr_init(struct net *net)
kfree(ipvs->lblcr_ctl_table);
return -ENOMEM;
}
-#endif
return 0;
}
@@ -776,14 +777,19 @@ static void __net_exit __ip_vs_lblcr_exit(struct net *net)
{
struct netns_ipvs *ipvs = net_ipvs(net);
-#ifdef CONFIG_SYSCTL
unregister_net_sysctl_table(ipvs->lblcr_ctl_header);
-#endif
if (!net_eq(net, &init_net))
kfree(ipvs->lblcr_ctl_table);
}
+#else
+
+static int __net_init __ip_vs_lblcr_init(struct net *net) { return 0; }
+static void __net_exit __ip_vs_lblcr_exit(struct net *net) { }
+
+#endif
+
static struct pernet_operations ip_vs_lblcr_ops = {
.init = __ip_vs_lblcr_init,
.exit = __ip_vs_lblcr_exit,
--
1.7.2.3
^ permalink raw reply related
* [PATCH 29/37] netfilter: xt_connlimit: fix daddr connlimit in SNAT scenario
From: kaber @ 2011-03-15 19:44 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
In-Reply-To: <1300218257-26953-1-git-send-email-kaber@trash.net>
From: Changli Gao <xiaosuo@gmail.com>
We use the reply tuples when limiting the connections by the destination
addresses, however, in SNAT scenario, the final reply tuples won't be
ready until SNAT is done in POSTROUING or INPUT chain, and the following
nf_conntrack_find_get() in count_tem() will get nothing, so connlimit
can't work as expected.
In this patch, the original tuples are always used, and an additional
member addr is appended to save the address in either end.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/xt_connlimit.c | 20 +++++++++-----------
1 files changed, 9 insertions(+), 11 deletions(-)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index e029c48..1f4b9f9 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -33,8 +33,9 @@
/* we will save the tuples of all connections we care about */
struct xt_connlimit_conn {
- struct list_head list;
- struct nf_conntrack_tuple tuple;
+ struct list_head list;
+ struct nf_conntrack_tuple tuple;
+ union nf_inet_addr addr;
};
struct xt_connlimit_data {
@@ -151,7 +152,7 @@ static int count_them(struct net *net,
continue;
}
- if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
+ if (same_source_net(addr, mask, &conn->addr, family))
/* same source network -> be counted! */
++matches;
nf_ct_put(found_ct);
@@ -165,6 +166,7 @@ static int count_them(struct net *net,
if (conn == NULL)
return -ENOMEM;
conn->tuple = *tuple;
+ conn->addr = *addr;
list_add(&conn->list, hash);
++matches;
}
@@ -185,15 +187,11 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
int connections;
ct = nf_ct_get(skb, &ctinfo);
- if (ct != NULL) {
- if (info->flags & XT_CONNLIMIT_DADDR)
- tuple_ptr = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
- else
- tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
- } else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
- par->family, &tuple)) {
+ if (ct != NULL)
+ tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
+ par->family, &tuple))
goto hotdrop;
- }
if (par->family == NFPROTO_IPV6) {
const struct ipv6hdr *iph = ipv6_hdr(skb);
--
1.7.2.3
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox