* Re: [PATCH v2] ethernet driver for the WIZnet W5300 chip
From: Ben Hutchings @ 2012-03-22 16:57 UTC (permalink / raw)
To: Mike Sinkovsky; +Cc: netdev
In-Reply-To: <4F69734B.7040105@permonline.ru>
On Wed, 2012-03-21 at 12:20 +0600, Mike Sinkovsky wrote:
> 21.03.2012 0:08, Ben Hutchings написал:
> > +static void w5300_get_drvinfo(struct net_device *ndev,
> > + struct ethtool_drvinfo *info)
> > +{
> > + strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
> > + strlcpy(info->version, DRV_VERSION, sizeof(info->version));
> > + strlcpy(info->fw_version, "N/A", sizeof(info->fw_version));
> > [...]
> >
> > Nitpick: if you don't have firmware, don't set fw_version at all.
> >
> > Ben.
>
> Then ethtool prints empty string as firmware version, I think "N/A" is
> more intuitive.
Well, we can replace it with "N/A" in ethtool if that's what people want
to see. But it should not be necessary for every driver that can't
report a firmware version to write this special string.
> Can will remove, if it is preferred way.
It is, and the various other drivers that used this string have recently
been changed.
> But I have a question to networking guru's:
>
> This chip have FRAME_SIZE limited to 1514, including eth header.
> So, for 802.1Q vlan packets mtu must be set to 1496.
>
> For now we handle this from userspace, but I think this is wrong in general
> - handling hardware bugs and limitations is kernels job.
>
> Can driver somehow limit mtu for slave vlan devices to 1496, but still
> use 1500
> for plain ethernet?
> ->ndo_change_mtu is called for master device only, not for it's slaves.
I don't think it's possible to do this at the moment. You can only set
NETIF_F_VLAN_CHALLENGED, which unfortunately disables VLAN sub-devices
entirely.
> (and sorry for my russian english, just in case)
Not to worry - your writing is quite clear.
Ben.
--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* long-lived tcp connection question
From: Josh Hunt @ 2012-03-22 16:56 UTC (permalink / raw)
To: netdev
Given things like web sockets with presumably long-lived persistent
tcp connections and a sparse amount of data, I was wondering if there
are currently any mechanisms in the kernel or out of tree projects
which work on reducing the overhead these connections require?
Possibly storing their state after a certain period of inactivity and
then reviving them when work needs to be done? I'm thinking something
along the lines of the state info stored for time-wait sockets and
then the ability to resurrect it on an incoming packet. Keeping
resources around for such connections seems inefficient although
possibly unavoidable.
Thanks
Josh
^ permalink raw reply
* Re: [patch] RDS: use gfp flags from caller in conn_alloc()
From: Venkat Venkatsubra @ 2012-03-22 15:19 UTC (permalink / raw)
To: Dan Carpenter; +Cc: David S. Miller, rds-devel, netdev, kernel-janitors
In-Reply-To: <20120322064409.GE7369@elgon.mountain>
On 3/22/2012 1:44 AM, Dan Carpenter wrote:
> We should be using the gfp flags the caller specified here, instead of
> GFP_KERNEL. I think this might be a bugfix, depending on the value of
> "sock->sk->sk_allocation" when we call rds_conn_create_outgoing() in
> rds_sendmsg(). Otherwise, it's just a cleanup.
>
> Signed-off-by: Dan Carpenter<dan.carpenter@oracle.com>
Acked-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
^ permalink raw reply
* Re: [PATCH 2/2] usbnet: don't clear urb->dev in tx_complete
From: Greg Kroah-Hartman @ 2012-03-22 14:36 UTC (permalink / raw)
To: Ming Lei
Cc: David S. Miller, netdev, linux-usb, stable, Alan Stern,
Oliver Neukum
In-Reply-To: <1332422558-6633-1-git-send-email-tom.leiming@gmail.com>
On Thu, Mar 22, 2012 at 09:22:38PM +0800, Ming Lei wrote:
> URB unlinking is always racing with its completion and tx_complete
> may be called before or during running usb_unlink_urb, so tx_complete
> must not clear urb->dev since it will be used in unlink path,
> otherwise invalid memory accesses or usb device leak may be caused
> inside usb_unlink_urb.
>
> Cc: stable@kernel.org
> Cc: Alan Stern <stern@rowland.harvard.edu>
> Cc: Oliver Neukum <oliver@neukum.org>
> Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply
* Re: [PATCH 1/2] usbnet: increase URB reference count before usb_unlink_urb
From: Greg Kroah-Hartman @ 2012-03-22 14:35 UTC (permalink / raw)
To: Ming Lei
Cc: David S. Miller, netdev, linux-usb, stable,
Sebastian Andrzej Siewior, Alan Stern, Oliver Neukum
In-Reply-To: <1332422538-6597-1-git-send-email-tom.leiming@gmail.com>
On Thu, Mar 22, 2012 at 09:22:18PM +0800, Ming Lei wrote:
> Commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d(net/usbnet: avoid
> recursive locking in usbnet_stop()) fixes the recursive locking
> problem by releasing the skb queue lock, but it makes usb_unlink_urb
> racing with defer_bh, and the URB to being unlinked may be freed before
> or during calling usb_unlink_urb, so use-after-free problem may be
> triggerd inside usb_unlink_urb.
>
> The patch fixes the use-after-free problem by increasing URB
> reference count with skb queue lock held before calling
> usb_unlink_urb, so the URB won't be freed until return from
> usb_unlink_urb.
>
> Cc: stable@kernel.org
> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> Cc: Alan Stern <stern@rowland.harvard.edu>
> Cc: Oliver Neukum <oliver@neukum.org>
> Reported-by: Dave Jones <davej@redhat.com>
> Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply
* Re: [PATCH] net: add QCA alx Ethernet driver
From: Luis R. Rodriguez @ 2012-03-22 13:38 UTC (permalink / raw)
To: Francois Romieu
Cc: David Miller, xiong, netdev, linux-kernel, qca-linux-team,
nic-devel, kgiori, chris.snook, mathieu, bryanh, Jesper Andersen,
Julia Lawall
In-Reply-To: <20120322092727.GA21284@electric-eye.fr.zoreil.com>
On Thu, Mar 22, 2012 at 2:27 AM, Francois Romieu <romieu@fr.zoreil.com> wrote:
> Luis R. Rodriguez <rodrigue@qca.qualcomm.com> :
>> On Tue, Feb 28, 2012 at 7:32 PM, David Miller <davem@davemloft.net> wrote:
> [...]
>> > To be honest tg3, as one example, supports quite a large array of
>> > different pieces of hardware that use the same logical core.
>>
>> At certain point it becomes a pain in the ass to support older
>> chipsets, and simply easier to leave the older driver to rot.
>
> I would avoid saying such things while trying to sell a plan for a bright
> future of drivers maintained and supported by $BIGCORP. :o)
My statement was more from a resource dedication point of view, but
yes, I agree with your concern. I want to clarify that Atheros !=
Qualcomm. Atheros is now known as Qualcomm Atheros and what we do is
different than Qualcomm. Atheros proactively works upstream as a high
priority. Addressing legacy chipsets support is IMHO a definite
requirement when any $BIGCORP wants to work on addressing support
upstream in the Linux kernel (or any kernel).
> [...]
>> Would it be worthwhile to consider alx upstream only for the newer
>> chipsets (regardless of the litmus test, which I do agree with on
>> technical grounds) in consideration for helping pave the way on
>> killing proprietary drivers?
>
> What is the situation regarding the availability for public use of
> programming manuals and errata on older chipsets ?
Atheros has provided documentation for at least 802.11 chipsets for
older and even newer chipsets to interested active community
developers, to the extent we have also even released GPLv2 open
firmware through ar9170.fw [0] which resulted in fork of that firmware
carl9170.fw [1] and new shiny driver carl9170 [2].
The way we work with the community on providing documentation has been
on a case by case basis and documentation has also been evaluated as
such. Over the last year we have been formalizing this process a bit
further and trying to categorize documentation moving forward so that
it is easier for engineering groups for different types of
technologies to work with the community and enable the community as
best as possible. We now have a program called, the QCA Developer
Program, not documented anywhere but in practice already used widely
by QCA, which has for instance, already enabled quite a bit of DFS
code upstream for ath9k, and a few developers are enabled for other
things, one of which we hope is to enable development of open firmware
for ath9k_htc [3] to set the precedent of success for it even further.
So -- for Ethernet I see it not different, lets leave history behind
and focus on enabling developers as best as possible. If there is
documentation available internally we should revise it, categorize it
and see to it that we enable developers as best as possible, in
whatever way we can.
> I am fine with Qualcomm being completely uninterested in maintaining
> code for old chipsets and dedicating manpower or $$$ on it, be it now,
> tomorrow or after a new arrival of management execs. However it sends
> a bad message if code for new chipsets comes in while users have to
> maintain their pile of poo in the dark.
Agreed 100%
> The hardware stays for years. It's one of the engineering problems of
> the day.
Sure.
> Killing proprietary drivers is an interesting goal but it is
> far, far away.
This is why progress isn't made. Talk is cheap. Lets just get it done.
> Qualcomm should imvho meet davem's remarks with more short termed
> deliverables.
I don't disagree based on technical grounds, what I stated was more as
a review in consideration of goals of sharing code. I did review the
possibility of sticking to atl1c to help with the evolutionary changes
there instead and while I believe that is the right technical
approach, legally from a sharing point of view, the atl1c is
derivative works of the Intel e1000 driver and the e1000 driver has
changes even before git days of the kernel. Relicensing atl1c to ISC
license, which is another option, therefore extremely difficult, but
one option I did review.
Either way, I am happy we follow the general direction given, I just
wanted to make one last point on using alx based on sharing objectives
and as a good simple technical use case of trying to help kill
proprietary drivers for good. I'm fine with alx not being the pivotal
point for us but given Ethernet's simplicity it seems ideal to
consider given the objectives and I felt compelled to address that one
last point given the small set of other options we have.
[0] http://wireless.kernel.org/en/users/Drivers/ar9170.fw
[1] http://wireless.kernel.org/en/users/Drivers/carl9170.fw
[2] http://wireless.kernel.org/en/users/Drivers/carl9170
[3] http://wireless.kernel.org/en/developers/GSoC/2012/ath9k_htc_open_firmware
Luis
^ permalink raw reply
* [PATCH 2/2] usbnet: don't clear urb->dev in tx_complete
From: Ming Lei @ 2012-03-22 13:22 UTC (permalink / raw)
To: David S. Miller, Greg Kroah-Hartman
Cc: netdev, linux-usb, Ming Lei, stable, Alan Stern, Oliver Neukum
URB unlinking is always racing with its completion and tx_complete
may be called before or during running usb_unlink_urb, so tx_complete
must not clear urb->dev since it will be used in unlink path,
otherwise invalid memory accesses or usb device leak may be caused
inside usb_unlink_urb.
Cc: stable@kernel.org
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
---
drivers/net/usb/usbnet.c | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index febfdce..62f8b5c 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1037,7 +1037,6 @@ static void tx_complete (struct urb *urb)
}
usb_autopm_put_interface_async(dev->intf);
- urb->dev = NULL;
entry->state = tx_done;
defer_bh(dev, skb, &dev->txq);
}
--
1.7.9.1
^ permalink raw reply related
* [PATCH 1/2] usbnet: increase URB reference count before usb_unlink_urb
From: Ming Lei @ 2012-03-22 13:22 UTC (permalink / raw)
To: David S. Miller, Greg Kroah-Hartman
Cc: netdev-u79uwXL29TY76Z2rM5mHXA, linux-usb-u79uwXL29TY76Z2rM5mHXA,
Ming Lei, stable-DgEjT+Ai2ygdnm+yROfE0A,
Sebastian Andrzej Siewior, Alan Stern, Oliver Neukum
Commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d(net/usbnet: avoid
recursive locking in usbnet_stop()) fixes the recursive locking
problem by releasing the skb queue lock, but it makes usb_unlink_urb
racing with defer_bh, and the URB to being unlinked may be freed before
or during calling usb_unlink_urb, so use-after-free problem may be
triggerd inside usb_unlink_urb.
The patch fixes the use-after-free problem by increasing URB
reference count with skb queue lock held before calling
usb_unlink_urb, so the URB won't be freed until return from
usb_unlink_urb.
Cc: stable-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org
Cc: Sebastian Andrzej Siewior <bigeasy-hfZtesqFncYOwBW4kG4KsQ@public.gmane.org>
Cc: Alan Stern <stern-nwvwT67g6+6dFdvTe/nMLpVzexx5G7lz@public.gmane.org>
Cc: Oliver Neukum <oliver-GvhC2dPhHPQdnm+yROfE0A@public.gmane.org>
Reported-by: Dave Jones <davej-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Signed-off-by: Ming Lei <tom.leiming-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
drivers/net/usb/usbnet.c | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 4b8b52c..febfdce 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -589,6 +589,14 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
entry = (struct skb_data *) skb->cb;
urb = entry->urb;
+ /*
+ * Get reference count of the URB to avoid it to be
+ * freed during usb_unlink_urb, which may trigger
+ * use-after-free problem inside usb_unlink_urb since
+ * usb_unlink_urb is always racing with .complete
+ * handler(include defer_bh).
+ */
+ usb_get_urb(urb);
spin_unlock_irqrestore(&q->lock, flags);
// during some PM-driven resume scenarios,
// these (async) unlinks complete immediately
@@ -597,6 +605,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
else
count++;
+ usb_put_urb(urb);
spin_lock_irqsave(&q->lock, flags);
}
spin_unlock_irqrestore (&q->lock, flags);
--
1.7.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* Re: [PATCH] tg3: Dont dump registers if interface not ready.
From: Luis Henriques @ 2012-03-22 13:17 UTC (permalink / raw)
To: Joe Jin
Cc: Matt Carlson, Xiao Jiang, Michael Chan, Guru Anbalagane,
Gurudas Pai, netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Greg Marsden, Luis Henriques
In-Reply-To: <4E9BFAF2.3040703@oracle.com>
Joe Jin <joe.jin@oracle.com> writes:
Hi,
> Hi Matt,
>
> Sorry for late response, after apply your changes, driver did not dumped
> registers info as well, but still hit tg3_stop_block timed out as below:
>
...
>
> Any suggestion?
I was wondering if there any progress with this patch. Is this
stalled, or has it been dropped?
Cheers,
--
Luis
>
> Thanks,
> Joe
>
> On 10/05/11 10:14, Matt Carlson wrote:
>> On Wed, Sep 28, 2011 at 11:50:01PM -0700, Xiao Jiang wrote:
>>> Joe Jin wrote:
>>>> When bootup the server with BCM5704 Gigabit Ethernet get below warning:
>>>>
>>>> tg3 0000:03:01.0: eth0: DMA Status error. Resetting chip.
>>>> <Registers state of device>
>>>> tg3 0000:03:01.0: eth0: 0: Host status block [00000007:00000002:(0000:0000:0000):(0000:0000)]
>>>> tg3 0000:03:01.0: eth0: 0: NAPI info [00000001:00000002:(0000:0000:01ff):0000:(00c8:0000:0000:0000)]
>>>> tg3 0000:03:01.0: eth0: Link is up at 1000 Mbps, full duplex
>>>> tg3 0000:03:01.0: eth0: Flow control is on for TX and on for RX
>>>> tg3 0000:03:01.0: tg3_stop_block timed out, ofs=4800 enable_bit=2
>>>> tg3 0000:03:01.0: eth0: Link is down
>>>> tg3 0000:03:01.0: eth0: Link is up at 1000 Mbps, full duplex
>>>> tg3 0000:03:01.0: eth0: Flow control is on for TX and on for RX
>>>>
>>>> If device not ready, then would not dump registers info.
>>>>
>>>> Signed-off-by: Joe Jin <joe.jin@oracle.com>
>>>> Signed-off-by: Guru Anbalagane <guru.anbalagane@oracle.com>
>>>> Reported-by: Gurudas Pai <gurudas.pai@oracle.com>
>>>> Cc: Matt Carlson <mcarlson@broadcom.com>
>>>> Cc: Michael Chan <mchan@broadcom.com>
>>>> ---
>>>> drivers/net/tg3.c | 11 +++++++++--
>>>>
>>> Maybe this one should based on net-next tree too, the tg3.c
>>> is lived below ./drivers/net/ethernet/broadcom/ in that tree.
>>>
>>> Thanks,
>>> Xiao Jiang
>>>> 1 files changed, 9 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
>>>> index 4a1374d..d79d344 100644
>>>> --- a/drivers/net/tg3.c
>>>> +++ b/drivers/net/tg3.c
>>>> @@ -5475,10 +5475,15 @@ static void tg3_process_error(struct tg3 *tp)
>>>> {
>>>> u32 val;
>>>> bool real_error = false;
>>>> + bool dump = true;
>>>>
>>>> if (tg3_flag(tp, ERROR_PROCESSED))
>>>> return;
>>>>
>>>> + /* If interface not ready then dont dump error */
>>>> + if (!netif_carrier_ok(tp->dev))
>>>> + dump = false;
>>
>> Would you still experience the problem if you did the following instead
>> of the above link check?
>>
>> if (tg3_flag(tp, INIT_COMPLETE))
>> dump = false;
>>
>>>> /* Check Flow Attention register */
>>>> val = tr32(HOSTCC_FLOW_ATTN);
>>>> if (val & ~HOSTCC_FLOW_ATTN_MBUF_LWM) {
>>>> @@ -5492,14 +5497,16 @@ static void tg3_process_error(struct tg3 *tp)
>>>> }
>>>>
>>>> if (tr32(RDMAC_STATUS) || tr32(WDMAC_STATUS)) {
>>>> - netdev_err(tp->dev, "DMA Status error. Resetting chip.\n");
>>>> + if (dump)
>>>> + netdev_err(tp->dev, "DMA Status error. Resetting chip.\n");
>>>> real_error = true;
>>>> }
>>>>
>>>> if (!real_error)
>>>> return;
>>>>
>>>> - tg3_dump_state(tp);
>>>> + if (dump)
>>>> + tg3_dump_state(tp);
>>>>
>>>> tg3_flag_set(tp, ERROR_PROCESSED);
>>>> schedule_work(&tp->reset_task);
>>>>
>>>
>>>
>>
^ permalink raw reply
* [v11 PATCH 3/3] NETFILTER userspace part for target HMARK
From: Hans Schillstrom @ 2012-03-22 11:59 UTC (permalink / raw)
To: kaber, pablo, jengelh, netfilter-devel, netdev; +Cc: hans, Hans Schillstrom
In-Reply-To: <1332417593-26232-1-git-send-email-hans.schillstrom@ericsson.com>
The target allows you to create rules in the "raw" and "mangle" tables
which alter the netfilter mark (nfmark) field within a given range.
First a 32 bit hash value is generated then modulus by <limit> and
finally an offset is added before it's written to nfmark.
Prior to routing, the nfmark can influence the routing method (see
"Use netfilter MARK value as routing key") and can also be used by
other subsystems to change their behaviour.
The mark match can also be used to match nfmark produced by this module.
Ver 10
conntrack reduced to --hmark-ct switch
renaming of vars in xt_hmark_info
Adding helptext and updated man due to --hmark-ct switch
Ver 9
Formating changes.
Ver 8
Syntax changes more descriptive options
--hmark-method added.
Ver 6-7 -
Ver 5
smask and dmask changed to length
Ver 4
xtoptions used for parsing.
Ver 3
-
Ver 2
IPv4 NAT added
iptables ver 1.4.12.1 adaptions.
Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
---
extensions/libxt_HMARK.c | 469 ++++++++++++++++++++++++++++++++++++
extensions/libxt_HMARK.man | 84 +++++++
include/linux/netfilter/xt_HMARK.h | 62 +++++
3 files changed, 615 insertions(+), 0 deletions(-)
create mode 100644 extensions/libxt_HMARK.c
create mode 100644 extensions/libxt_HMARK.man
create mode 100644 include/linux/netfilter/xt_HMARK.h
diff --git a/extensions/libxt_HMARK.c b/extensions/libxt_HMARK.c
new file mode 100644
index 0000000..d657d85
--- /dev/null
+++ b/extensions/libxt_HMARK.c
@@ -0,0 +1,469 @@
+/*
+ * Shared library add-on to iptables to add HMARK target support.
+ *
+ * The kernel module calculates a hash value that can be modified by modulus
+ * and an offset. The hash value is based on a direction independent
+ * five tuple: src & dst addr src & dst ports and protocol.
+ * However src & dst port can be masked and are not used for fragmented
+ * packets, ESP and AH don't have ports so SPI will be used instead.
+ * For ICMP error messages the hash mark values will be calculated on
+ * the source packet i.e. the packet caused the error (If sufficient
+ * amount of data exists).
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "xtables.h"
+#include <linux/netfilter/xt_HMARK.h>
+
+
+#define DEF_HRAND 0xc175a3b8 /* Default "random" value to jhash */
+
+#define XT_F_HMARK_L4_OPTS (XT_F_HMARK_SPI_AND | XT_F_HMARK_SPI_OR\
+ | XT_F_HMARK_SPORT_AND | XT_F_HMARK_SPORT_OR\
+ | XT_F_HMARK_DPORT_AND | XT_F_HMARK_DPORT_OR\
+ | XT_F_HMARK_PROTO_AND)
+
+static void HMARK_help(void)
+{
+ printf(
+"HMARK target options, i.e. modify hash calculation by:\n"
+" --hmark-method <method> Overall L3/L4 and fragment behavior\n"
+" L3 Fragment safe, do not use ports or proto\n"
+" i.e. Fragments don't need special care.\n"
+" L3-4 (Default) Fragment unsafe, use ports and proto\n"
+" if defrag off in conntrack\n"
+" no hmark on any part of a fragment\n"
+" Limit/modify the calculated hash mark by:\n"
+" --hmark-mod value nfmark modulus value\n"
+" --hmark-offset value Last action add value to nfmark\n\n"
+" Fine tuning of what will be included in hash calculation\n"
+" --hmark-src-mask length Source address mask length\n"
+" --hmark-dst-mask length Dest address mask length\n"
+" --hmark-sport-mask value Mask src port with value\n"
+" --hmark-dport-mask value Mask dst port with value\n"
+" --hmark-spi-mask value For esp and ah AND spi with value\n"
+" --hmark-sport-set value OR src port with value\n"
+" --hmark-dport-set value OR dst port with value\n"
+" --hmark-spi-set value For esp and ah OR spi with value\n"
+" --hmark-proto-mask value Mask Protocol with value\n"
+" --hmark-rnd Initial Random value to hash cacl.\n"
+" For NAT in IPv4: src part from original/reply tuple will always be used\n"
+" i.e. orig src part will be used as src address/port.\n"
+" reply src part will be used as dst address/port\n"
+" Make sure to qualify the rule in a proper way when using NAT flag\n"
+" When --ct is used only tracked connections will match\n"
+" --hmark-ct Force conntrack orig and rely tuples as\n"
+" source and destination.\n\n"
+" In many cases hmark can be omitted i.e. --src-mask can be used\n");
+}
+
+#define hi struct xt_hmark_info
+
+static const struct xt_option_entry HMARK_opts[]= {
+ { .name = "hmark-method",
+ .type = XTTYPE_STRING,
+ .id = XT_HMARK_METHOD_L3
+ },
+ { .name = "hmark-src-mask",
+ .type = XTTYPE_PLENMASK,
+ .id = XT_HMARK_SADR_AND,
+ .flags = XTOPT_PUT, XTOPT_POINTER(hi, src_mask)
+ },
+ { .name = "hmark-dst-mask",
+ .type = XTTYPE_PLENMASK,
+ .id = XT_HMARK_DADR_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, dst_mask)
+ },
+ { .name = "hmark-sport-mask",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_SPORT_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, port_mask.p16.src)
+ },
+ { .name = "hmark-dport-mask",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_DPORT_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, port_mask.p16.dst)
+ },
+ { .name = "hmark-spi-mask",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_SPI_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, spi_mask)
+ },
+ { .name = "hmark-sport-set",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_SPORT_OR,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, port_set.p16.src)
+ },
+ { .name = "hmark-dport-set",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_DPORT_OR,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, port_set.p16.dst)
+ },
+ { .name = "hmark-spi-set",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_SPI_OR,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, spi_set)
+ },
+ { .name = "hmark-proto-mask",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_PROTO_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, proto_mask)
+ },
+ { .name = "hmark-rnd",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_RND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, hashrnd)
+ },
+ { .name = "hmark-mod",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_MODULUS,
+ .min = 1,
+ .flags = XTOPT_PUT | XTOPT_MAND,
+ XTOPT_POINTER(hi, hmodulus)
+ },
+ { .name = "hmark-offset",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_OFFSET,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, hoffset)
+ },
+ { .name = "hmark-ct",
+ .type = XTTYPE_NONE,
+ .id = XT_HMARK_CT
+ },
+
+ { .name = "method",
+ .type = XTTYPE_STRING,
+ .id = XT_HMARK_METHOD_L3
+ },
+ { .name = "src-mask",
+ .type = XTTYPE_PLENMASK,
+ .id = XT_HMARK_SADR_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, src_mask)
+ },
+ { .name = "dst-mask",
+ .type = XTTYPE_PLENMASK,
+ .id = XT_HMARK_DADR_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, dst_mask)
+ },
+ { .name = "sport-mask",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_SPORT_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, port_mask.p16.src)
+ },
+ { .name = "dport-mask", .type = XTTYPE_UINT16,
+ .id = XT_HMARK_DPORT_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, port_mask.p16.dst)
+ },
+ { .name = "spi-mask",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_SPI_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, spi_mask)
+ },
+ { .name = "sport-set",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_SPORT_OR,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, port_set.p16.src)
+ },
+ { .name = "dport-set",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_DPORT_OR,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, port_set.p16.dst)
+ },
+ { .name = "spi-set",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_SPI_OR,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, spi_set)
+ },
+ { .name = "proto-mask",
+ .type = XTTYPE_UINT16,
+ .id = XT_HMARK_PROTO_AND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, proto_mask)
+ },
+ { .name = "rnd",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_RND,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, hashrnd)
+ },
+ { .name = "mod",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_MODULUS,
+ .min = 1,
+ .flags = XTOPT_PUT,
+ XTOPT_MAND, XTOPT_POINTER(hi, hmodulus)
+ },
+ { .name = "offset",
+ .type = XTTYPE_UINT32,
+ .id = XT_HMARK_OFFSET,
+ .flags = XTOPT_PUT,
+ XTOPT_POINTER(hi, hoffset)
+ },
+ { .name = "ct",
+ .type = XTTYPE_NONE,
+ .id = XT_HMARK_CT
+ },
+ XTOPT_TABLEEND,
+};
+
+static void HMARK_parse(struct xt_option_call *cb)
+{
+ struct xt_hmark_info *info = cb->data;
+
+ if (!cb->xflags) {
+ memset(info, 0xff, sizeof(struct xt_hmark_info));
+ info->port_set.v32 = 0;
+ info->flags = 0;
+ info->spi_set = 0;
+ info->hoffset = 0;
+ info->hashrnd = DEF_HRAND;
+ }
+ xtables_option_parse(cb);
+
+ switch (cb->entry->id) {
+ case XT_HMARK_SPI_AND:
+ info->spi_mask = htonl(cb->val.u32);
+ break;
+ case XT_HMARK_SPI_OR:
+ info->spi_set = htonl(cb->val.u32);
+ break;
+ case XT_HMARK_SPORT_AND:
+ info->port_mask.p16.src = htons(cb->val.u16);
+ break;
+ case XT_HMARK_DPORT_AND:
+ info->port_mask.p16.dst = htons(cb->val.u16);
+ break;
+ case XT_HMARK_SPORT_OR:
+ info->port_set.p16.src = htons(cb->val.u16);
+ break;
+ case XT_HMARK_DPORT_OR:
+ info->port_set.p16.dst = htons(cb->val.u16);
+ break;
+ case XT_HMARK_MODULUS:
+ if (info->hmodulus == 0) {
+ xtables_error(PARAMETER_PROBLEM,
+ "xxx modulus 0 ? "
+ "thats a div by 0");
+ info->hmodulus = 0xffffffff;
+ }
+ break;
+ case XT_HMARK_METHOD_L3:
+ if (strcmp(cb->arg, "L3") == 0) {
+ info->proto_mask = 0;
+ cb->xflags &= ~XT_F_HMARK_METHOD_L3_4;
+ } else if (strcmp(cb->arg, "L3-4") == 0) {
+ cb->xflags &= ~XT_F_HMARK_METHOD_L3;
+ cb->xflags |= XT_F_HMARK_METHOD_L3_4;
+ }
+ }
+ info->flags = cb->xflags;
+}
+
+static void HMARK_check(struct xt_fcheck_call *cb)
+{
+ if (!(cb->xflags & XT_F_HMARK_MODULUS))
+ xtables_error(PARAMETER_PROBLEM, "HMARK: the --hmark-mod, "
+ "is not set, or zero wich is a div by zero");
+ /* Check for invalid options */
+ if (cb->xflags & XT_F_HMARK_METHOD_L3 &&
+ (cb->xflags & XT_F_HMARK_L4_OPTS))
+ xtables_error(PARAMETER_PROBLEM, "HMARK: --hmark-method L3, "
+ "can not be combined by an Layer 4 options: "
+ "port, spi or proto ");
+}
+/*
+ * Common print for IPv4 & IPv6
+ */
+static void HMARK_print(const struct xt_hmark_info *info)
+{
+ if (info->flags & XT_F_HMARK_METHOD_L3) {
+ printf("method L3 ");
+ } else {
+ if (info->flags & XT_F_HMARK_METHOD_L3_4)
+ printf("method L3-4 ");
+ if (info->flags & XT_F_HMARK_SPORT_AND)
+ printf("sport-mask 0x%x ", htons(info->port_mask.p16.src));
+ if (info->flags & XT_F_HMARK_DPORT_AND)
+ printf("dport-mask 0x%x ", htons(info->port_mask.p16.dst));
+ if (info->flags & XT_F_HMARK_SPI_AND)
+ printf("spi-mask 0x%x ", htonl(info->spi_mask));
+ if (info->flags & XT_F_HMARK_SPORT_OR)
+ printf("sport-set 0x%x ", htons(info->port_set.p16.src));
+ if (info->flags & XT_F_HMARK_DPORT_OR)
+ printf("dport-set 0x%x ", htons(info->port_set.p16.dst));
+ if (info->flags & XT_F_HMARK_SPI_OR)
+ printf("spi-set 0x%x ", htonl(info->spi_set));
+ if (info->flags & XT_F_HMARK_PROTO_AND)
+ printf("proto-mask 0x%x ", info->proto_mask);
+ }
+ if (info->flags & XT_F_HMARK_RND)
+ printf("rnd 0x%x ", info->hashrnd);
+
+}
+
+static void HMARK_ip6_print(const void *ip,
+ const struct xt_entry_target *target, int numeric)
+{
+ const struct xt_hmark_info *info =
+ (const struct xt_hmark_info *)target->data;
+
+ printf(" HMARK ");
+ if (info->flags & XT_F_HMARK_MODULUS)
+ printf("%% 0x%x ", info->hmodulus);
+ if (info->flags & XT_F_HMARK_OFFSET)
+ printf("+ 0x%x ", info->hoffset);
+ if (info->flags & XT_F_HMARK_CT)
+ printf("ct, ");
+ if (info->flags & XT_F_HMARK_SADR_AND)
+ printf("src-mask %s ",
+ xtables_ip6mask_to_numeric(&info->src_mask.in6) + 1);
+ if (info->flags & XT_F_HMARK_DADR_AND)
+ printf("dst-mask %s ",
+ xtables_ip6mask_to_numeric(&info->dst_mask.in6) + 1);
+ HMARK_print(info);
+}
+static void HMARK_ip4_print(const void *ip,
+ const struct xt_entry_target *target, int numeric)
+{
+ const struct xt_hmark_info *info =
+ (const struct xt_hmark_info *)target->data;
+
+ printf(" HMARK ");
+ if (info->flags & XT_F_HMARK_MODULUS)
+ printf("%% 0x%x ", info->hmodulus);
+ if (info->flags & XT_F_HMARK_OFFSET)
+ printf("+ 0x%x ", info->hoffset);
+ if (info->flags & XT_F_HMARK_CT)
+ printf("ct, ");
+ if (info->flags & XT_F_HMARK_SADR_AND)
+ printf("src-mask %s ",
+ xtables_ipmask_to_numeric(&info->src_mask.in) + 1);
+ if (info->flags & XT_F_HMARK_DADR_AND)
+ printf("dst-mask %s ",
+ xtables_ipmask_to_numeric(&info->dst_mask.in) + 1);
+ HMARK_print(info);
+}
+static void HMARK_save(const struct xt_hmark_info *info)
+{
+ if (info->flags & XT_F_HMARK_METHOD_L3) {
+ printf(" --hmark-method L3");
+ } else {
+ if (info->flags & XT_F_HMARK_METHOD_L3_4)
+ printf(" --hmark-method L3-4");
+ if (info->flags & XT_F_HMARK_SPORT_AND)
+ printf(" --hmark-sport-mask 0x%x",
+ htons(info->port_mask.p16.src));
+ if (info->flags & XT_F_HMARK_DPORT_AND)
+ printf(" --hmark-dport-mask 0x%x",
+ htons(info->port_mask.p16.dst));
+ if (info->flags & XT_F_HMARK_SPI_AND)
+ printf(" --hmark-spi-mask 0x%x",
+ htonl(info->spi_mask));
+ if (info->flags & XT_F_HMARK_SPORT_OR)
+ printf(" --hmark-sport-set 0x%x",
+ htons(info->port_set.p16.src));
+ if (info->flags & XT_F_HMARK_DPORT_OR)
+ printf(" --hmark-dport-set 0x%x",
+ htons(info->port_set.p16.dst));
+ if (info->flags & XT_F_HMARK_SPI_OR)
+ printf(" --hmark-spi-set 0x%x", htonl(info->spi_set));
+ if (info->flags & XT_F_HMARK_PROTO_AND)
+ printf(" --hmark-proto-mask 0x%x", info->proto_mask);
+ }
+ if (info->flags & XT_F_HMARK_RND)
+ printf(" --hmark-rnd 0x%x", info->hashrnd);
+ if (info->flags & XT_F_HMARK_MODULUS)
+ printf(" --hmark-mod 0x%x", info->hmodulus);
+ if (info->flags & XT_F_HMARK_OFFSET)
+ printf(" --hmark-offset 0x%x", info->hoffset);
+ if (info->flags & XT_F_HMARK_CT)
+ printf(" --hmark-ct");
+}
+
+static void HMARK_ip6_save(const void *ip, const struct xt_entry_target *target)
+{
+ const struct xt_hmark_info *info =
+ (const struct xt_hmark_info *)target->data;
+
+ if (info->flags & XT_F_HMARK_SADR_AND)
+ printf(" --hmark-src-mask %s",
+ xtables_ip6mask_to_numeric(&info->src_mask.in6) + 1);
+ if (info->flags & XT_F_HMARK_DADR_AND)
+ printf(" --hmark-dst-mask %s",
+ xtables_ip6mask_to_numeric(&info->dst_mask.in6) + 1);
+ HMARK_save(info);
+}
+
+static void HMARK_ip4_save(const void *ip, const struct xt_entry_target *target)
+{
+ const struct xt_hmark_info *info =
+ (const struct xt_hmark_info *)target->data;
+
+ if (info->flags & XT_F_HMARK_SADR_AND)
+ printf(" --hmark-src-mask %s",
+ xtables_ipmask_to_numeric(&info->src_mask.in) + 1);
+ if (info->flags & XT_F_HMARK_DADR_AND)
+ printf(" --hmark-dst-mask %s",
+ xtables_ipmask_to_numeric(&info->dst_mask.in) + 1);
+ HMARK_save(info);
+}
+
+static struct xtables_target mark_tg_reg[] = {
+ {
+ .family = NFPROTO_IPV4,
+ .name = "HMARK",
+ .version = XTABLES_VERSION,
+ .revision = 0,
+ .size = XT_ALIGN(sizeof(struct xt_hmark_info)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_hmark_info)),
+ .help = HMARK_help,
+ .print = HMARK_ip4_print,
+ .save = HMARK_ip4_save,
+ .x6_parse = HMARK_parse,
+ .x6_fcheck = HMARK_check,
+ .x6_options = HMARK_opts,
+ },
+ {
+ .family = NFPROTO_IPV6,
+ .name = "HMARK",
+ .version = XTABLES_VERSION,
+ .revision = 0,
+ .size = XT_ALIGN(sizeof(struct xt_hmark_info)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_hmark_info)),
+ .help = HMARK_help,
+ .print = HMARK_ip6_print,
+ .save = HMARK_ip6_save,
+ .x6_parse = HMARK_parse,
+ .x6_fcheck = HMARK_check,
+ .x6_options = HMARK_opts,
+ },
+};
+
+void _init(void)
+{
+ xtables_register_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg));
+}
+
diff --git a/extensions/libxt_HMARK.man b/extensions/libxt_HMARK.man
new file mode 100644
index 0000000..92bd1ed
--- /dev/null
+++ b/extensions/libxt_HMARK.man
@@ -0,0 +1,84 @@
+This module does the same as MARK, i.e. set an fwmark, but the mark is based on a hash value.
+The hash is based on src-addr, dst-addr, sport, dport and proto. The same mark will be produced independent of direction if no masks is set or the same masks is used for src and dest.
+The hash mark could be adjusted by modulus and finally an offset could be added, i.e the final mark will be within a range.
+ICMP error will use the the original message for hash calculation not the icmp it self.
+
+Note: IPv4 packets with nf_defrag_ipv4 loaded will be defragmented before they reach hmark,
+ IPv6 nf_defrag is not implemented this way, hence fragmented ipv6 packets will reach hmark.
+ Default behavior is to completely ignore any fragment if it reach hmark.
+ --hmark-method L3 is fragment safe since neither ports or L4 protocol field is used.
+ None of the parameters effect the packet it self only the calculated hash value.
+
+.PP
+Parameters:
+Short hand methods
+.TP
+\fB\-\-hmark\-method\fP \fIL3\fP
+Do not use L4 protocol field, ports or spi, only Layer 3 addresses, mask length
+of L3 addresses can still be used. Fragment or not does not matter in
+this case since only L3 address can be used in calc. of hash value.
+.TP
+\fB\-\-hmark\-method\fP \fIL3-4\fP (Default)
+Include L4 in calculation. of hash value i.e. all masks below are valid.
+Fragments will be ignored. (i.e no hash value produced)
+.PP
+For all masks default is all "1:s", to disable a field use mask 0
+.TP
+\fB\-\-hmark\-src\-mask\fP \fIlength\fP
+The length of the mask to AND the source address with (saddr & value).
+.TP
+\fB\-\-hmark\-dst\-mask\fP \fIlength\fP
+The length of the mask to AND the dest. address with (daddr & value).
+.TP
+\fB\-\-hmark\-sport\-mask\fP \fIvalue\fP
+A 16 bit value to AND the src port with (sport & value).
+.TP
+\fB\-\-hmark\-dport\-mask\fP \fIvalue\fP
+A 16 bit value to AND the dest port with (dport & value).
+.TP
+\fB\-\-hmark\-sport\-set\fP \fIvalue\fP
+A 16 bit value to OR the src port with (sport | value).
+.TP
+\fB\-\-hmark\-dport\-set\fP \fIvalue\fP
+A 16 bit value to OR the dest port with (dport | value).
+.TP
+\fB\-\-hmark\-spi\-mask\fP \fIvalue\fP
+Value to AND the spi field with (spi & value) valid for proto esp or ah.
+.TP
+\fB\-\-hmark\-spi\-set\fP \fIvalue\fP
+Value to OR the spi field with (spi | value) valid for proto esp or ah.
+.TP
+\fB\-\-hmark\-proto\-mask\fP \fIvalue\fP
+An 8 bit value to AND the L4 proto field with (proto & value).
+.TP
+\fB\-\-hmark\-ct\fP
+When flag is set, conntrack data should be used. Useful when NAT internal addressed should be used in calculation.
+Be careful when using DNAT since mangle table is handled before nat table. I.e it will not work as expected to put HMARK in table mangle and PREROUTING chain. The initial packet will have it's hash based on the original address, while the rest of the flow will use the NAT:ed address.
+.TP
+\fB\-\-hmark\-rnd\fP \fIvalue\fP
+A 32 bit initial value for hash calc, default is 0xc175a3b8.
+.PP
+Final processing of the mark in order of execution.
+.TP
+\fB\-\-hmark\-mod\fP \fIvalue (must be > 0)\fP
+The easiest way to describe this is: hash = hash mod <value>
+.TP
+\fB\-\-hmark\-offset\fP \fIvalue\fP
+The easiest way to describe this is: hash = hash + <value>
+.PP
+\fIExamples:\fP
+.PP
+Default rule handles all TCP, UDP, SCTP, ESP & AH
+.IP
+iptables \-t mangle \-A PREROUTING \-m state \-\-state NEW,ESTABLISHED,RELATED
+ \-j HMARK \-\-hmark-offs 10000 \-\-hmark-mod 10
+.PP
+Handle SCTP and hash dest port only and produce a nfmark between 100-119.
+.IP
+iptables \-t mangle \-A PREROUTING -p SCTP \-j HMARK \-\-src\-mask 0 \-\-dst\-mask 0
+ \-\-sp\-mask 0 \-\-offset 100 \-\-mod 20
+.PP
+Fragment safe Layer 3 only that keep a class C network flow together
+.IP
+iptables \-t mangle \-A PREROUTING \-j HMARK \-\-method L3 \-\-src\-mask 24 \-\-mod 20 \-\-offset 100
+
diff --git a/include/linux/netfilter/xt_HMARK.h b/include/linux/netfilter/xt_HMARK.h
new file mode 100644
index 0000000..cdf4a8f
--- /dev/null
+++ b/include/linux/netfilter/xt_HMARK.h
@@ -0,0 +1,62 @@
+#ifndef XT_HMARK_H_
+#define XT_HMARK_H_
+
+#include <linux/types.h>
+
+enum {
+ XT_HMARK_NONE,
+ XT_HMARK_SADR_AND,
+ XT_HMARK_DADR_AND,
+ XT_HMARK_SPI_AND,
+ XT_HMARK_SPI_OR,
+ XT_HMARK_SPORT_AND,
+ XT_HMARK_DPORT_AND,
+ XT_HMARK_SPORT_OR,
+ XT_HMARK_DPORT_OR,
+ XT_HMARK_PROTO_AND,
+ XT_HMARK_RND,
+ XT_HMARK_MODULUS,
+ XT_HMARK_OFFSET,
+ XT_HMARK_CT,
+ XT_HMARK_METHOD_L3,
+ XT_HMARK_METHOD_L3_4,
+ XT_F_HMARK_SADR_AND = 1 << XT_HMARK_SADR_AND,
+ XT_F_HMARK_DADR_AND = 1 << XT_HMARK_DADR_AND,
+ XT_F_HMARK_SPI_AND = 1 << XT_HMARK_SPI_AND,
+ XT_F_HMARK_SPI_OR = 1 << XT_HMARK_SPI_OR,
+ XT_F_HMARK_SPORT_AND = 1 << XT_HMARK_SPORT_AND,
+ XT_F_HMARK_DPORT_AND = 1 << XT_HMARK_DPORT_AND,
+ XT_F_HMARK_SPORT_OR = 1 << XT_HMARK_SPORT_OR,
+ XT_F_HMARK_DPORT_OR = 1 << XT_HMARK_DPORT_OR,
+ XT_F_HMARK_PROTO_AND = 1 << XT_HMARK_PROTO_AND,
+ XT_F_HMARK_RND = 1 << XT_HMARK_RND,
+ XT_F_HMARK_MODULUS = 1 << XT_HMARK_MODULUS,
+ XT_F_HMARK_OFFSET = 1 << XT_HMARK_OFFSET,
+ XT_F_HMARK_CT = 1 << XT_HMARK_CT,
+ XT_F_HMARK_METHOD_L3 = 1 << XT_HMARK_METHOD_L3,
+ XT_F_HMARK_METHOD_L3_4 = 1 << XT_HMARK_METHOD_L3_4,
+};
+
+union hmark_ports {
+ struct {
+ __u16 src;
+ __u16 dst;
+ } p16;
+ __u32 v32;
+};
+
+struct xt_hmark_info {
+ union nf_inet_addr src_mask; /* Source address mask */
+ union nf_inet_addr dst_mask; /* Dest address mask */
+ union hmark_ports port_mask;
+ union hmark_ports port_set;
+ __u32 spi_mask;
+ __u32 spi_set;
+ __u32 flags; /* Print out only */
+ __u16 proto_mask; /* L4 Proto mask */
+ __u32 hashrnd;
+ __u32 hmodulus; /* Modulus */
+ __u32 hoffset; /* Offset */
+};
+
+#endif /* XT_HMARK_H_ */
--
1.7.2.3
^ permalink raw reply related
* [v11 PATCH 2/3] NETFILTER module xt_hmark, new target for HASH based fwmark
From: Hans Schillstrom @ 2012-03-22 11:59 UTC (permalink / raw)
To: kaber, pablo, jengelh, netfilter-devel, netdev; +Cc: hans, Hans Schillstrom
In-Reply-To: <1332417593-26232-1-git-send-email-hans.schillstrom@ericsson.com>
The target allows you to create rules in the "raw" and "mangle" tables
which alter the netfilter mark (nfmark) field within a given range.
First a 32 bit hash value is generated then modulus by <limit> and
finally an offset is added before it's written to nfmark.
Prior to routing, the nfmark can influence the routing method (see
"Use netfilter MARK value as routing key") and can also be used by
other subsystems to change their behavior.
man page
HMARK
This module does the same as MARK, i.e. set an fwmark, but the mark
is based on a hash value. The hash is based on saddr, daddr, sport,
dport and proto. The same mark will be produced independent of direction
if no masks is set or the same masks is used for src and dest.
The hash mark could be adjusted by modulus and finally an offset could
be added, i.e the final mark will be within a range. ICMP error will use
the the original message for hash calculation not the icmp it self.
Note: IPv4 packets with nf_defrag_ipv4 loaded will be defragmented before they reach hmark,
IPv6 nf_defrag is not implemented this way, hence fragmented ipv6 packets will reach hmark.
Default behavior is to completely ignore any fragment if it reach hmark.
--hmark-method L3 is fragment safe since neither ports or L4 protocol field is used.
None of the parameters effect the packet it self only the calculated hash value.
Parameters: Short hand methods
--hmark-method L3
Do not use L4 protocol field, ports or spi, only Layer 3 addresses,
mask length of L3 addresses can still be used. Fragment or not
does not matter in this case since only L3 address can be used in
calc. of hash value.
--hmark-method L3-4 (Default)
Include L4 in calculation. of hash value i.e. all masks below are valid.
Fragments will be ignored. (i.e no hash value produced)
For all masks default is all "1:s", to disable a field use mask 0
--hmark-src-mask length
The length of the mask to AND the source address with (saddr & value).
--hmark-dst-mask length
The length of the mask to AND the dest. address with (daddr & value).
--hmark-sport-mask value
A 16 bit value to AND the src port with (sport & value).
--hmark-dport-mask value
A 16 bit value to AND the dest port with (dport & value).
--hmark-sport-set value
A 16 bit value to OR the src port with (sport | value).
--hmark-dport-set value
A 16 bit value to OR the dest port with (dport | value).
--hmark-spi-mask value
Value to AND the spi field with (spi & value) valid for proto esp or ah.
--hmark-spi-set value
Value to OR the spi field with (spi | value) valid for proto esp or ah.
--hmark-proto-mask value
An 8 bit value to AND the L4 proto field with (proto & value).
--hmark-ct
When flag is set, conntrack data should be used. Useful when NAT internal
addressed should be used in calculation. Be careful when using DNAT
since mangle table is handled before nat table. I.e it will not work as
expected to put HMARK in table mangle and PREROUTING chain. The initial
packet will have it's hash based on the original address,
while the rest of the flow will use the NAT:ed address.
--hmark-rnd value
A 32 bit initial value for hash calc, default is 0xc175a3b8.
Final processing of the mark in order of execution.
--hmark-mod value (must be > 0)
The easiest way to describe this is: hash = hash mod <value>
--hmark-offset value
The easiest way to describe this is: hash = hash + <value>
Examples:
Default rule handles all TCP, UDP, SCTP, ESP & AH
iptables -t mangle -A PREROUTING -m state --state NEW,ESTABLISHED,RELATED
-j HMARK --hmark-offset 10000 --hmark-mod 10
Handle SCTP and hash dest port only and produce a nfmark between 100-119.
iptables -t mangle -A PREROUTING -p SCTP -j HMARK --src-mask 0 --dst-mask 0
--sp-mask 0 --offset 100 --mod 20
Fragment safe Layer 3 only, that keep a class C network flow together
iptables -t mangle -A PREROUTING -j HMARK --method L3 --src-mask 24 --mod 20 --offset 100
Rev 11
Two comments changed
Rev 10
Even more simplified NAT handling just one switch --hmark-ct
some renaming and some minor changes.
Changes are based on Pablos review.
Rev 9
Simplified NAT selections, cleanup of comments, added checkentry()
change of #ifdef to #if IS_ENABLED and dependency.
Some minor formating.
Most changes are based on Pablos review.
Rev 8
method L3 / L3-4 added i.e. Fragment handling changed to
don't handle in "method L3-4"
Syntax change in user mode more NF compatible.
Most changes are based on Pablos review.
Rev 7
IPv6 descending into icmp error hdr didn't work as expected
with ipv6_find_hdr() Now it works as expected.
Rev 6
Compile options with or without conntrack fixed.
__ipv6_find_hdr() replaced by ipv6_find_hdr()
Rev 5
IPv6 rewritten uses __ipv6_find_hdr() (P. Mc Hardy)
Full mask and address used for IPv6 smask and dmask (J.Engelhart)
Changes due to comments by Pablo Neira Ayuso and Eric Dumazet
i.e uses of skb_header_pointer() and Null check of info->hmod
Man page changes
Rev 4
different targets for IPv4 and IPv6
Changes based on review by Pablo.
Rev 3
Support added to SCTP for IPv6
Rev 2
IPv6 header scan changed to follow RFC 2640
IPv4 icmp echo fragmented does now use proto as ipv6
IPv6 pskb_may_pull() check is done in every time in header loop.
IPv4 nat support added.
default added in IPv6 loop and null check of hp
Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
---
include/linux/netfilter/xt_HMARK.h | 62 +++++++
net/netfilter/Kconfig | 18 ++
net/netfilter/Makefile | 1 +
net/netfilter/xt_HMARK.c | 319 ++++++++++++++++++++++++++++++++++++
4 files changed, 400 insertions(+), 0 deletions(-)
create mode 100644 include/linux/netfilter/xt_HMARK.h
create mode 100644 net/netfilter/xt_HMARK.c
diff --git a/include/linux/netfilter/xt_HMARK.h b/include/linux/netfilter/xt_HMARK.h
new file mode 100644
index 0000000..cdf4a8f
--- /dev/null
+++ b/include/linux/netfilter/xt_HMARK.h
@@ -0,0 +1,62 @@
+#ifndef XT_HMARK_H_
+#define XT_HMARK_H_
+
+#include <linux/types.h>
+
+enum {
+ XT_HMARK_NONE,
+ XT_HMARK_SADR_AND,
+ XT_HMARK_DADR_AND,
+ XT_HMARK_SPI_AND,
+ XT_HMARK_SPI_OR,
+ XT_HMARK_SPORT_AND,
+ XT_HMARK_DPORT_AND,
+ XT_HMARK_SPORT_OR,
+ XT_HMARK_DPORT_OR,
+ XT_HMARK_PROTO_AND,
+ XT_HMARK_RND,
+ XT_HMARK_MODULUS,
+ XT_HMARK_OFFSET,
+ XT_HMARK_CT,
+ XT_HMARK_METHOD_L3,
+ XT_HMARK_METHOD_L3_4,
+ XT_F_HMARK_SADR_AND = 1 << XT_HMARK_SADR_AND,
+ XT_F_HMARK_DADR_AND = 1 << XT_HMARK_DADR_AND,
+ XT_F_HMARK_SPI_AND = 1 << XT_HMARK_SPI_AND,
+ XT_F_HMARK_SPI_OR = 1 << XT_HMARK_SPI_OR,
+ XT_F_HMARK_SPORT_AND = 1 << XT_HMARK_SPORT_AND,
+ XT_F_HMARK_DPORT_AND = 1 << XT_HMARK_DPORT_AND,
+ XT_F_HMARK_SPORT_OR = 1 << XT_HMARK_SPORT_OR,
+ XT_F_HMARK_DPORT_OR = 1 << XT_HMARK_DPORT_OR,
+ XT_F_HMARK_PROTO_AND = 1 << XT_HMARK_PROTO_AND,
+ XT_F_HMARK_RND = 1 << XT_HMARK_RND,
+ XT_F_HMARK_MODULUS = 1 << XT_HMARK_MODULUS,
+ XT_F_HMARK_OFFSET = 1 << XT_HMARK_OFFSET,
+ XT_F_HMARK_CT = 1 << XT_HMARK_CT,
+ XT_F_HMARK_METHOD_L3 = 1 << XT_HMARK_METHOD_L3,
+ XT_F_HMARK_METHOD_L3_4 = 1 << XT_HMARK_METHOD_L3_4,
+};
+
+union hmark_ports {
+ struct {
+ __u16 src;
+ __u16 dst;
+ } p16;
+ __u32 v32;
+};
+
+struct xt_hmark_info {
+ union nf_inet_addr src_mask; /* Source address mask */
+ union nf_inet_addr dst_mask; /* Dest address mask */
+ union hmark_ports port_mask;
+ union hmark_ports port_set;
+ __u32 spi_mask;
+ __u32 spi_set;
+ __u32 flags; /* Print out only */
+ __u16 proto_mask; /* L4 Proto mask */
+ __u32 hashrnd;
+ __u32 hmodulus; /* Modulus */
+ __u32 hoffset; /* Offset */
+};
+
+#endif /* XT_HMARK_H_ */
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index f8ac4ef..a775804 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -488,6 +488,24 @@ config NETFILTER_XT_TARGET_HL
since you can easily create immortal packets that loop
forever on the network.
+config NETFILTER_XT_TARGET_HMARK
+ tristate '"HMARK" target support'
+ depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
+ depends on NETFILTER_ADVANCED
+ ---help---
+ This option adds the "HMARK" target.
+
+ The target allows you to create rules in the "raw" and "mangle" tables
+ which alter the netfilter mark (nfmark) field within a given range.
+ First a 32 bit hash value is generated then modulus by <limit> and
+ finally an offset is added before it's written to nfmark.
+
+ Prior to routing, the nfmark can influence the routing method (see
+ "Use netfilter MARK value as routing key") and can also be used by
+ other subsystems to change their behavior.
+
+ The mark match can also be used to match nfmark produced by this module.
+
config NETFILTER_XT_TARGET_IDLETIMER
tristate "IDLETIMER target support"
depends on NETFILTER_ADVANCED
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 40f4c3d..2712ba0 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -57,6 +57,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o
obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o
obj-$(CONFIG_NETFILTER_XT_TARGET_HL) += xt_HL.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_HMARK) += xt_HMARK.o
obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o
obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c
new file mode 100644
index 0000000..d90549d
--- /dev/null
+++ b/net/netfilter/xt_HMARK.c
@@ -0,0 +1,319 @@
+/*
+ * xt_hmark - Netfilter module to set mark as hash value
+ *
+ * (C) 2012 Hans Schillstrom <hans.schillstrom@ericsson.com>
+ *
+ *Description:
+ * This module calculates a hash value that can be modified by modulus
+ * and an offset, i.e. it is possible to produce a skb->mark within a range
+ * The hash value is based on a direction independent five tuple:
+ * src & dst addr src & dst ports and protocol.
+ * There is two distinct modes for hash calculation:
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <net/ip.h>
+#include <linux/icmp.h>
+
+#include <linux/netfilter/xt_HMARK.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/netfilter/nf_conntrack.h>
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+#include <net/ipv6.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#endif
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Hans Schillstrom <hans.schillstrom@ericsson.com>");
+MODULE_DESCRIPTION("Xtables: Packet range mark operations by Hash value");
+MODULE_ALIAS("ipt_HMARK");
+MODULE_ALIAS("ip6t_HMARK");
+
+/*
+ * ICMP, get header offset if icmp error
+ */
+static int get_inner_hdr(struct sk_buff *skb, int iphsz, int *nhoff)
+{
+ const struct icmphdr *icmph;
+ struct icmphdr _ih;
+
+ /* Not enough header? */
+ icmph = skb_header_pointer(skb, *nhoff + iphsz, sizeof(_ih), &_ih);
+ if (icmph == NULL && icmph->type > NR_ICMP_TYPES)
+ return 0;
+
+ /* Error message? */
+ if (icmph->type != ICMP_DEST_UNREACH &&
+ icmph->type != ICMP_SOURCE_QUENCH &&
+ icmph->type != ICMP_TIME_EXCEEDED &&
+ icmph->type != ICMP_PARAMETERPROB &&
+ icmph->type != ICMP_REDIRECT)
+ return 0;
+
+ *nhoff += iphsz + sizeof(_ih);
+ return 1;
+}
+
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+/*
+ * Get ipv6 header offset if icmp error
+ */
+static int get_inner6_hdr(struct sk_buff *skb, int *offset)
+{
+ struct icmp6hdr *icmp6h, _ih6;
+
+ icmp6h = skb_header_pointer(skb, *offset, sizeof(_ih6), &_ih6);
+ if (icmp6h == NULL)
+ return 0;
+
+ if (icmp6h->icmp6_type && icmp6h->icmp6_type < 128) {
+ *offset += sizeof(struct icmp6hdr);
+ return 1;
+ }
+ return 0;
+}
+/*
+ * Calculate hash based fw-mark, on the five tuple if possible.
+ * special cases :
+ * - Fragments do not use ports not even on the first fragment,
+ * nf_defrag_ipv6.ko don't defrag for us like it do in ipv4.
+ * This might be changed in the future.
+ * - On ICMP errors the inner header will be used.
+ * - Tunnels no ports
+ * - ESP & AH uses SPI
+ * @returns XT_CONTINUE
+ */
+static unsigned int
+hmark_v6(struct sk_buff *skb, const struct xt_action_param *par)
+{
+ const struct xt_hmark_info *info = par->targinfo;
+ struct ipv6hdr *ip6, _ip6;
+ int poff, flag = IP6T_FH_F_AUTH; /* Ports offset, find_hdr flags */
+ union hmark_ports uports;
+ u32 addr_src, addr_dst, hash, nhoffs = 0;
+ u16 fragoff = 0;
+ u8 nexthdr;
+
+ ip6 = (struct ipv6hdr *) (skb->data + skb_network_offset(skb));
+ nexthdr = ipv6_find_hdr(skb, &nhoffs, -1, &fragoff, &flag);
+ if (nexthdr < 0)
+ return XT_CONTINUE;
+ /* No need to check for icmp errors on fragments */
+ if ((flag & IP6T_FH_F_FRAG) || (nexthdr != IPPROTO_ICMPV6))
+ goto noicmp;
+ /* if an icmp error, use the inner header */
+ if (get_inner6_hdr(skb, &nhoffs)) {
+ ip6 = skb_header_pointer(skb, nhoffs, sizeof(_ip6), &_ip6);
+ if (!ip6)
+ return XT_CONTINUE;
+ /* Treat AH as ESP, use SPI nothing else. */
+ flag = IP6T_FH_F_AUTH;
+ nexthdr = ipv6_find_hdr(skb, &nhoffs, -1, &fragoff, &flag);
+ if (nexthdr < 0)
+ return XT_CONTINUE;
+ }
+noicmp:
+ addr_src = (__force u32)
+ (ip6->saddr.s6_addr32[0] & info->src_mask.in6.s6_addr32[0]) ^
+ (ip6->saddr.s6_addr32[1] & info->src_mask.in6.s6_addr32[1]) ^
+ (ip6->saddr.s6_addr32[2] & info->src_mask.in6.s6_addr32[2]) ^
+ (ip6->saddr.s6_addr32[3] & info->src_mask.in6.s6_addr32[3]);
+ addr_dst = (__force u32)
+ (ip6->daddr.s6_addr32[0] & info->dst_mask.in6.s6_addr32[0]) ^
+ (ip6->daddr.s6_addr32[1] & info->dst_mask.in6.s6_addr32[1]) ^
+ (ip6->daddr.s6_addr32[2] & info->dst_mask.in6.s6_addr32[2]) ^
+ (ip6->daddr.s6_addr32[3] & info->dst_mask.in6.s6_addr32[3]);
+
+ uports.v32 = 0;
+ if ((info->flags & XT_F_HMARK_METHOD_L3) ||
+ (nexthdr == IPPROTO_ICMPV6))
+ goto no_ports;
+ /* Is next header valid for port or SPI calculation ? */
+ poff = proto_ports_offset(nexthdr);
+ if ((flag & IP6T_FH_F_FRAG) || poff < 0)
+ return XT_CONTINUE;
+
+ nhoffs += poff;
+ if (skb_copy_bits(skb, nhoffs, &uports, sizeof(uports)) < 0)
+ return XT_CONTINUE;
+
+ if ((nexthdr == IPPROTO_ESP) || (nexthdr == IPPROTO_AH))
+ uports.v32 = (uports.v32 & info->spi_mask) | info->spi_set;
+ else {
+ uports.v32 = (uports.v32 & info->port_mask.v32) |
+ info->port_set.v32;
+ /* get a consistent hash (same value in any flow dirs.) */
+ if (uports.p16.dst < uports.p16.src)
+ swap(uports.p16.dst, uports.p16.src);
+ }
+
+no_ports:
+ nexthdr &= info->proto_mask;
+ /* get a consistent hash (same value in any flow direction) */
+ if (addr_dst < addr_src)
+ swap(addr_src, addr_dst);
+
+ hash = jhash_3words(addr_src, addr_dst, uports.v32, info->hashrnd) ^ nexthdr;
+ skb->mark = (hash % info->hmodulus) + info->hoffset;
+ return XT_CONTINUE;
+}
+#endif
+/*
+ * Calculate hash based fw-mark, on the five tuple if possible.
+ * special cases :
+ * - Fragments do not use ports not even on the first fragment,
+ * unless nf_defrag_xx.ko is used.
+ * - On ICMP errors the inner header will be used.
+ * - Tunnels no ports
+ * - ESP & AH uses SPI
+ * @returns XT_CONTINUE
+ */
+static unsigned int
+hmark_v4(struct sk_buff *skb, const struct xt_action_param *par)
+{
+ const struct xt_hmark_info *info = par->targinfo;
+ struct iphdr *ip, _ip;
+ int nhoff, poff, frag = 0;
+ union hmark_ports uports;
+ u32 addr_src, addr_dst, hash;
+ u8 ip_proto;
+
+ nhoff = skb_network_offset(skb);
+ ip = (struct iphdr *) (skb->data + nhoff);
+ if (ip->protocol == IPPROTO_ICMP) {
+ /* if an icmp error, calc hash on inner header */
+ if (get_inner_hdr(skb, ip->ihl * 4, &nhoff)) {
+ ip = skb_header_pointer(skb, nhoff, sizeof(_ip), &_ip);
+ if (!ip)
+ return XT_CONTINUE;
+ }
+ }
+
+ ip_proto = ip->protocol;
+ if (ip->frag_off & htons(IP_MF | IP_OFFSET))
+ frag = 1;
+
+ addr_src = (__force u32) ip->saddr;
+ addr_dst = (__force u32) ip->daddr;
+ uports.v32 = 0;
+/* conntrack take care of ICMP relation */
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+ if (info->flags & XT_F_HMARK_CT) {
+ struct nf_conntrack_tuple *otuple;
+ struct nf_conntrack_tuple *rtuple;
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+
+ if (!ct || nf_ct_is_untracked(ct))
+ return XT_CONTINUE;
+
+ otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ rtuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+
+ addr_src = (__force u32)otuple->src.u3.in.s_addr;
+ uports.p16.src = otuple->src.u.udp.port;
+ addr_dst = (__force u32)rtuple->src.u3.in.s_addr;
+ uports.p16.dst = rtuple->src.u.udp.port;
+ }
+#endif
+ addr_src &= info->src_mask.ip;
+ addr_dst &= info->dst_mask.ip;
+
+ if ((info->flags & XT_F_HMARK_METHOD_L3) ||
+ (ip_proto == IPPROTO_ICMP)) {
+ uports.v32 = 0;
+ goto noports;
+ }
+ /* Check if ports can be used in hash calculation. */
+ poff = proto_ports_offset(ip_proto);
+ if (frag || poff < 0)
+ return XT_CONTINUE;
+
+ /* if --ct not given, get ports from skb */
+ if (!uports.v32) {
+ nhoff += (ip->ihl * 4) + poff;
+ if (skb_copy_bits(skb, nhoff, &uports, sizeof(uports)) < 0)
+ return XT_CONTINUE;
+ }
+
+ if (ip_proto == IPPROTO_ESP || ip_proto == IPPROTO_AH)
+ uports.v32 = (uports.v32 & info->spi_mask) | info->spi_set;
+ else {
+ uports.v32 = (uports.v32 & info->port_mask.v32) |
+ info->port_set.v32;
+ /* get a consistent hash (same value in any flow dirs.) */
+ if (uports.p16.dst < uports.p16.src)
+ swap(uports.p16.src, uports.p16.dst);
+ }
+
+noports:
+ /* get a consistent hash (same value in any flow direction) */
+ if (addr_dst < addr_src)
+ swap(addr_src, addr_dst);
+
+ hash = jhash_3words(addr_src, addr_dst, uports.v32, info->hashrnd);
+ hash = hash ^ (ip_proto & info->proto_mask);
+ skb->mark = (hash % info->hmodulus) + info->hoffset;
+ return XT_CONTINUE;
+}
+
+static int hmark_check(const struct xt_tgchk_param *par)
+{
+ const struct xt_hmark_info *info = par->targinfo;
+
+ if (!info->hmodulus) {
+ pr_info("HMARK: hmark-mod can't be zero\n");
+ return -EINVAL;
+ }
+ if (info->proto_mask && (info->flags & XT_F_HMARK_METHOD_L3)) {
+ pr_info("HMARK: When method L3 proto mask must be zero\n");
+ return -EINVAL;
+ }
+ return 0;
+}
+
+static struct xt_target hmark_tg_reg[] __read_mostly = {
+ {
+ .name = "HMARK",
+ .revision = 0,
+ .family = NFPROTO_IPV4,
+ .target = hmark_v4,
+ .targetsize = sizeof(struct xt_hmark_info),
+ .checkentry = hmark_check,
+ .me = THIS_MODULE,
+ },
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+ {
+ .name = "HMARK",
+ .revision = 0,
+ .family = NFPROTO_IPV6,
+ .target = hmark_v6,
+ .targetsize = sizeof(struct xt_hmark_info),
+ .checkentry = hmark_check,
+ .me = THIS_MODULE,
+ },
+#endif
+};
+
+static int __init hmark_mt_init(void)
+{
+ int ret;
+
+ ret = xt_register_targets(hmark_tg_reg, ARRAY_SIZE(hmark_tg_reg));
+ if (ret < 0)
+ return ret;
+ return 0;
+}
+
+static void __exit hmark_mt_exit(void)
+{
+ xt_unregister_targets(hmark_tg_reg, ARRAY_SIZE(hmark_tg_reg));
+}
+
+module_init(hmark_mt_init);
+module_exit(hmark_mt_exit);
--
1.7.2.3
^ permalink raw reply related
* [v11 PATCH 1/3] NETFILTER added flags to ipv6_find_hdr()
From: Hans Schillstrom @ 2012-03-22 11:59 UTC (permalink / raw)
To: kaber, pablo, jengelh, netfilter-devel, netdev; +Cc: hans, Hans Schillstrom
In-Reply-To: <1332417593-26232-1-git-send-email-hans.schillstrom@ericsson.com>
Two new flags to ipv6_find_hdr,
One that tells us that this is a fragment.
One that stops at AH if any i.e. treat it like a transport header.
i.e. make handling of ESP and AH the same.
Param offset can now point to an inner icmp ipv5 header.
Version 3:
offset param into ipv6_find_hdr set to zero.
Version 2:
wrapper removed and changes made at every call.
Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
---
include/linux/netfilter_ipv6/ip6_tables.h | 8 +++++-
net/ipv6/netfilter/ip6_tables.c | 35 ++++++++++++++++++++++++----
net/ipv6/netfilter/ip6t_ah.c | 4 +-
net/ipv6/netfilter/ip6t_frag.c | 4 +-
net/ipv6/netfilter/ip6t_hbh.c | 4 +-
net/ipv6/netfilter/ip6t_rt.c | 4 +-
net/netfilter/xt_TPROXY.c | 4 +-
net/netfilter/xt_socket.c | 4 +-
8 files changed, 49 insertions(+), 18 deletions(-)
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index f549adc..e1ad013 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -288,9 +288,15 @@ extern unsigned int ip6t_do_table(struct sk_buff *skb,
/* Check for an extension */
extern int ip6t_ext_hdr(u8 nexthdr);
+enum {
+ IP6T_FH_FRAG,
+ IP6T_FH_AUTH,
+ IP6T_FH_F_FRAG = 1 << IP6T_FH_FRAG,
+ IP6T_FH_F_AUTH = 1 << IP6T_FH_AUTH,
+};
/* find specified header and get offset to it */
extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
- int target, unsigned short *fragoff);
+ int target, unsigned short *fragoff, int *fragflg);
#ifdef CONFIG_COMPAT
#include <net/compat.h>
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 94874b0..9dab6a8 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -146,7 +146,7 @@ ip6_packet_match(const struct sk_buff *skb,
int protohdr;
unsigned short _frag_off;
- protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
+ protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
if (protohdr < 0) {
if (_frag_off == 0)
*hotdrop = true;
@@ -375,6 +375,7 @@ ip6t_do_table(struct sk_buff *skb,
const struct xt_entry_match *ematch;
IP_NF_ASSERT(e);
+ acpar.thoff = 0;
if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
&acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
no_match:
@@ -2290,6 +2291,8 @@ static void __exit ip6_tables_fini(void)
* find the offset to specified header or the protocol number of last header
* if target < 0. "last header" is transport protocol header, ESP, or
* "No next header".
+ * Note, *offset is used as input param. an if != 0
+ * it must be an offset to an inner ipv6 header ex. icmp error
*
* If target header is found, its offset is set in *offset and return protocol
* number. Otherwise, return -1.
@@ -2302,17 +2305,34 @@ static void __exit ip6_tables_fini(void)
* *offset is meaningless and fragment offset is stored in *fragoff if fragoff
* isn't NULL.
*
+ * if flags != NULL AND
+ * it's a fragment the frag flag "IP6T_FH_F_FRAG" will be set
+ * it's an AH header and IP6T_FH_F_AUTH is set and target < 0
+ * stop at AH (i.e. treat is as a transport header)
*/
int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
- int target, unsigned short *fragoff)
+ int target, unsigned short *fragoff, int *flags)
{
unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
u8 nexthdr = ipv6_hdr(skb)->nexthdr;
- unsigned int len = skb->len - start;
+ unsigned int len;
if (fragoff)
*fragoff = 0;
+ if (*offset) {
+ struct ipv6hdr _ip6, *ip6;
+
+ ip6 = skb_header_pointer(skb, *offset, sizeof(_ip6), &_ip6);
+ if (!ip6 || (ip6->version != 6)) {
+ printk(KERN_ERR "IPv6 header not found\n");
+ return -EBADMSG;
+ }
+ start = *offset + sizeof(struct ipv6hdr);
+ nexthdr = ip6->nexthdr;
+ }
+ len = skb->len - start;
+
while (nexthdr != target) {
struct ipv6_opt_hdr _hdr, *hp;
unsigned int hdrlen;
@@ -2329,6 +2349,9 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
if (nexthdr == NEXTHDR_FRAGMENT) {
unsigned short _frag_off;
__be16 *fp;
+
+ if (flags) /* Indicate that this is a fragment */
+ *flags |= IP6T_FH_F_FRAG;
fp = skb_header_pointer(skb,
start+offsetof(struct frag_hdr,
frag_off),
@@ -2349,9 +2372,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
return -ENOENT;
}
hdrlen = 8;
- } else if (nexthdr == NEXTHDR_AUTH)
+ } else if (nexthdr == NEXTHDR_AUTH) {
+ if (flags && (*flags & IP6T_FH_F_AUTH) && (target < 0))
+ break;
hdrlen = (hp->hdrlen + 2) << 2;
- else
+ } else
hdrlen = ipv6_optlen(hp);
nexthdr = hp->nexthdr;
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 89cccc5..04099ab 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -41,11 +41,11 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
struct ip_auth_hdr _ah;
const struct ip_auth_hdr *ah;
const struct ip6t_ah *ahinfo = par->matchinfo;
- unsigned int ptr;
+ unsigned int ptr = 0;
unsigned int hdrlen = 0;
int err;
- err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
+ err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL, NULL);
if (err < 0) {
if (err != -ENOENT)
par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index eda898f..3b5735e 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -40,10 +40,10 @@ frag_mt6(const struct sk_buff *skb, struct xt_action_param *par)
struct frag_hdr _frag;
const struct frag_hdr *fh;
const struct ip6t_frag *fraginfo = par->matchinfo;
- unsigned int ptr;
+ unsigned int ptr = 0;
int err;
- err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
+ err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL, NULL);
if (err < 0) {
if (err != -ENOENT)
par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 59df051..01df142 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -50,7 +50,7 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
const struct ipv6_opt_hdr *oh;
const struct ip6t_opts *optinfo = par->matchinfo;
unsigned int temp;
- unsigned int ptr;
+ unsigned int ptr = 0;
unsigned int hdrlen = 0;
bool ret = false;
u8 _opttype;
@@ -62,7 +62,7 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
err = ipv6_find_hdr(skb, &ptr,
(par->match == &hbh_mt6_reg[0]) ?
- NEXTHDR_HOP : NEXTHDR_DEST, NULL);
+ NEXTHDR_HOP : NEXTHDR_DEST, NULL, NULL);
if (err < 0) {
if (err != -ENOENT)
par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index d8488c5..2c99b94 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -42,14 +42,14 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
const struct ipv6_rt_hdr *rh;
const struct ip6t_rt *rtinfo = par->matchinfo;
unsigned int temp;
- unsigned int ptr;
+ unsigned int ptr = 0;
unsigned int hdrlen = 0;
bool ret = false;
struct in6_addr _addr;
const struct in6_addr *ap;
int err;
- err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
+ err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL, NULL);
if (err < 0) {
if (err != -ENOENT)
par->hotdrop = true;
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 35a959a..146033a 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -282,10 +282,10 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
struct sock *sk;
const struct in6_addr *laddr;
__be16 lport;
- int thoff;
+ int thoff = 0;
int tproto;
- tproto = ipv6_find_hdr(skb, &thoff, -1, NULL);
+ tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
if (tproto < 0) {
pr_debug("unable to find transport header in IPv6 packet, dropping\n");
return NF_DROP;
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 72bb07f..9ea482d 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -263,10 +263,10 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
struct sock *sk;
struct in6_addr *daddr, *saddr;
__be16 dport, sport;
- int thoff, tproto;
+ int thoff = 0, tproto;
const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
- tproto = ipv6_find_hdr(skb, &thoff, -1, NULL);
+ tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
if (tproto < 0) {
pr_debug("unable to find transport header in IPv6 packet, dropping\n");
return NF_DROP;
--
1.7.2.3
^ permalink raw reply related
* [v11 PATCH 0/3] NETFILTER new target module, HMARK
From: Hans Schillstrom @ 2012-03-22 11:59 UTC (permalink / raw)
To: kaber, pablo, jengelh, netfilter-devel, netdev; +Cc: hans, Hans Schillstrom
The target allows you to create rules in the "raw" and "mangle" tables
which alter the netfilter mark (nfmark) field within a given range.
First a 32 bit hash value is generated then modulus by <limit> and
finally an offset is added before it's written to nfmark.
Prior to routing, the nfmark can influence the routing method (see
"Use netfilter MARK value as routing key") and can also be used by
other subsystems to change their behavior.
The mark match can also be used to match nfmark produced by this module.
See the kernel module for more info.
REVISION
Version 11
Changed two comments
Version 10
Even more simplified NAT handling just one switch --hmark-ct
some renaming and some minor changes.
Renaming of vars in xt_hmark_info
Adding helptext and updated man due to --hmark-ct switch
Changes are based on Pablos review.
Version 9
Simpliefied nat handling in IPv4, some formating
checkentry() used in kernel.
Most changes are based on Pablos review.
Version 8
method L3 / L3-4 added i.e. Fragment handling changed to:
- don't handle in "method L3-4"
Syntax change in user mode to be more NF compatible.
Most changes are based on Pablos review.
Version 7
ahuum, IPv6 descending into icmp error hdr didn't work as expected
with ipv6_find_hdr() Now it works as expected.
Version 6
Removed ipv6_find_hdr() wrapper (Pablo)
NAT / Conntrack compilation switches.
Version 5
Use length of mask an smask and dmask and whole IPv6 addr (Jan E)
Modify ipv6_find_hdr() and use it while traversing the IPv6 header.
Manual changes.
More or less all comments implemented.
Version 4
Split of IPv6 and IPv4, use IP_CT_IS_REPLY, as Pablo suggested.
removed one pskb_may_pull()
xtoption parse used in the user space part.
Version 3
Handling of SCTP for IPv6 added.
Version 2
NAT Added for IPv4
IPv6 ICMP handling enhanced.
Usage example added
Version 1
Initial RFC
We (Ericsson) use hmark in-front of ipvs as a pre-loadbalancer and
handles up to 70 ipvs running in parallel in clusters.
However hmark is not restricted to run in front of IPVS it can also be used as
"poor mans" load balancer.
With this version is also NAT supported as an option, with very high flows
you might not want to use conntrack.
The idea is to generate a direction independent fw mark range to use as input to
the routing (i.e. ip rule add fwmark ...).
Pretty straight forward and simple.
Example:
App Server (Real Server)
+---------+
-->| Service |
Gateway A +---------+
/
+----------+ / +----+ +---------+
--- if -A---| selector |----> |ipvs| --->| Service |
+----------+ \ +----+ +---------+
\
+----+ +---------+
|ipvs| -->| Service |
+----+ +---------+
Gateway C
+----------+ / +----+
--- if-B ---| selector | ---> |ipvs|
+----------+ \ +----+ +---------+
| Service |
+---------+
/
+----------+ / +----+ ..
--- if-B ---| selector | ---> |ipvs| +---------+
+----------+ \ +----+ | Service |
\ +---------+
#
# Example with four ipvs loadbalancers
#
iptables -t mangle -I PREROUTING -d $IPADDR -j HMARK --hmark-mod 4 --hmark-offs 100
ip rule add fwmark 100 table 100
ip rule add fwmark 101 table 101
ip rule add fwmark 102 table 102
ip rule add fwmark 103 table 103
ip ro ad table 100 default via x.y.z.1 dev bond1
ip ro ad table 101 default via x.y.z.2 dev bond1
ip ro ad table 102 default via x.y.z.3 dev bond1
ip ro ad table 103 default via x.y.z.4 dev bond1
If conntrack doesn't handle the return path,
do the oposite with HMARK and send it back right to ipvs.
Another exmaple of usage could be if you have cluster originated connections
and want to spread the connections over a number of interfaces
(NAT will complpicate things for you in this case)
\ Blade 1
\ +----------+ +---------+
<-- | selector | <--- | Service |
/ +----------+ +---------+
/
+------+
-- | Gw-A | \ Blade 2
+------+ \ +----------+ +---------+
+------+ <-- | selector | <--- | Service |
-- | Gw-B | / +----------+ +---------+
+------+ /
+------+
-- | Gw-C | \
+------+ \ +----------+ +---------+
<-- | selector | <--- | Service |
/ +----------+ +---------+
/
\ Blande -n
\ +----------+ +---------+
<-- | selector | <--- | Service |
/ +----------+ +---------+
/
Regards
Hans Schillstrom <hans.schillstrom@ericsson.com>
^ permalink raw reply
* Re: linux-next: Tree for Mar 21 (netfilter: xt_LOG.c)
From: Pablo Neira Ayuso @ 2012-03-22 11:18 UTC (permalink / raw)
To: Randy Dunlap; +Cc: Stephen Rothwell, linux-next, LKML, netdev, netfilter-devel
In-Reply-To: <4F6A7824.50606@xenotime.net>
Hi Randy,
On Wed, Mar 21, 2012 at 05:53:56PM -0700, Randy Dunlap wrote:
> On 03/21/2012 12:39 AM, Stephen Rothwell wrote:
>
> > Hi all,
> >
> > Reminder: please do not add stuff destined for v3.5 to linux-next
> > included trees/branches until after v3.4-rc1 has been released.
> >
> > Changes since 20120320:
>
> on x86_64:
>
> xt_LOG.c:(.text+0x6962e): undefined reference to `ip6t_ext_hdr'
>
> Full randconfig file is attached.
I'll push this to mainstream asap.
https://lkml.org/lkml/2012/3/10/68
Sorry, I forgot to make it.
Thanks.
^ permalink raw reply
* Server Rental Service in Hong Kong
From: boris @ 2012-03-22 10:11 UTC (permalink / raw)
Dear All,
We have our own datacenter in Hong Kong & provide email/application/web rental service to clients.We are APNIC member & provide clean IP to clients.
Dell? PowerEdge? EnterpriseRack Mount Server
-Intel(R) Xeon(R) E3-1240 Processor (3.3GHz, 8M Cache, Turbo, 4C/8T, 80W)
-8GB RAM, 2x4GB, 1333MHz, DDR-3, Dual Ranked UDIMMs
-500GB, 3.5", 6Gbps SAS x 2
-Raid 1 Mirroring Protection
-Remote KVM (iDRAC6 Enterprise)
Dell(TM) PowerEdge(TM) R410 Rack Mount Server
-Intel(R) Quad Core E5606 Xeon(R) CPU, 2.13GHz, 4M Cache, 4.86 GT/s QPI
-4GB Memory (2x2GB), 1333MHz Dual Ranked RDIMMs Fully-Buffered
-500GB 7.2K RPM SATAII 3.5" Hard Drive x 2
-iDRAC6 Enterprise or Express (Remote KVM Management)
Every Dedicated Server Hosting Solution Also Includes:
Software Specification
- CentOS / Fedora / Debian / FreeBSD / Ubuntu / Redhat Linux
- Full root-level access
- Data Center Facilities
- Shared Local & International Bandwidth
- 2 IP Addresses Allocation
- Un-interruptible Power Supply (UPS) backed up by private diesel generator
- FM200¡§based fire suppression system
- 24x7 CRAC Air Conditioning and Humidity Control
- 24x7 Security Control
- 24x7 Remote Hand Service
Pls send us email for further information.Thanks,
Boris
boris@cloudluca.com
If you do not wish to further receive this event message, email "borislamsv2@gmail.com" to unsubscribe this message or remove your email from the list.
^ permalink raw reply
* Server Rental Service in Hong Kong
From: boris @ 2012-03-22 10:11 UTC (permalink / raw)
Dear All,
We have our own datacenter in Hong Kong & provide email/application/web rental service to clients.We are APNIC member & provide clean IP to clients.
Dell? PowerEdge? EnterpriseRack Mount Server
-Intel(R) Xeon(R) E3-1240 Processor (3.3GHz, 8M Cache, Turbo, 4C/8T, 80W)
-8GB RAM, 2x4GB, 1333MHz, DDR-3, Dual Ranked UDIMMs
-500GB, 3.5", 6Gbps SAS x 2
-Raid 1 Mirroring Protection
-Remote KVM (iDRAC6 Enterprise)
Dell(TM) PowerEdge(TM) R410 Rack Mount Server
-Intel(R) Quad Core E5606 Xeon(R) CPU, 2.13GHz, 4M Cache, 4.86 GT/s QPI
-4GB Memory (2x2GB), 1333MHz Dual Ranked RDIMMs Fully-Buffered
-500GB 7.2K RPM SATAII 3.5" Hard Drive x 2
-iDRAC6 Enterprise or Express (Remote KVM Management)
Every Dedicated Server Hosting Solution Also Includes:
Software Specification
- CentOS / Fedora / Debian / FreeBSD / Ubuntu / Redhat Linux
- Full root-level access
- Data Center Facilities
- Shared Local & International Bandwidth
- 2 IP Addresses Allocation
- Un-interruptible Power Supply (UPS) backed up by private diesel generator
- FM200¡§based fire suppression system
- 24x7 CRAC Air Conditioning and Humidity Control
- 24x7 Security Control
- 24x7 Remote Hand Service
Pls send us email for further information.Thanks,
Boris
boris@cloudluca.com
If you do not wish to further receive this event message, email "borislamsv2@gmail.com" to unsubscribe this message or remove your email from the list.
^ permalink raw reply
* YOUR COMPENSATION IS APPROVED, OPEN THE ATTACHMENT.
From: COMPENSATION @ 2012-03-22 10:14 UTC (permalink / raw)
[-- Attachment #1: Type: text/plain, Size: 1 bytes --]
[-- Attachment #2: COMPENSATION IS APPROVED.pdf --]
[-- Type: application/pdf, Size: 41118 bytes --]
^ permalink raw reply
* Re: use-after-free in usbnet
From: Oliver Neukum @ 2012-03-22 9:57 UTC (permalink / raw)
To: Ming Lei; +Cc: Alan Stern, netdev, linux-usb, Fedora Kernel Team, Dave Jones
In-Reply-To: <CACVXFVODFvtF1DRyWJmnYCByw7sr9QDv_+Taxo5maVaUauDNtg@mail.gmail.com>
Am Donnerstag, 22. März 2012, 10:30:36 schrieb Ming Lei:
> On Thu, Mar 22, 2012 at 5:08 PM, Oliver Neukum <oneukum@suse.de> wrote:
> >
> > this looks good, but could you add a comment explaining the reason for
> > taking a reference?
>
> OK, I will post a formal one if you have no objection on the below.
Good patch :-)
Regards
Oliver
^ permalink raw reply
* Re: vhost question
From: Stefan Hajnoczi @ 2012-03-22 9:52 UTC (permalink / raw)
To: Steve Glass; +Cc: netdev, kvm, virtualization
In-Reply-To: <4F6A84EF.9060105@gmail.com>
On Thu, Mar 22, 2012 at 1:48 AM, Steve Glass <stevie.glass@gmail.com> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Just some further information concerning my earlier question
> concerning vhost and virtio.
>
> I'm using virtio to implement an emulated mac80211 device in the
> guest. A simple network simulation will be used to control delivery of
> frames between guests and for this I am using the vhost approach.
>
> A simple first-cut attempt at the tx and rx kick handlers are given
> below. When the guest transmits frames the vhost's TX kick handler is
> executed and copies the buffers onto a queue for the intended
> recipient(s). When the vhost's RX kick handler is run it copies the
> buffer from the queue and notifies the client that the buffers have
> been used.
>
> The problem is that if there are no frames in the queue when the guest
> rx kick handler runs then it has to exit and I have to arrange that it
> runs again. That's done in the current prototype by having the guests
> poll using a timer - which is ugly and inefficient. Can I get the
> vhost tx kick handler to wake the appropriate vhost rx kick handler?
> How can I achieve this?
Can you queue a tx->rx kick on the vhost work queue with vhost_work_queue()?
Stefan
^ permalink raw reply
* [PATCH] xfrm: Access the replay notify functions via the registered callbacks
From: Steffen Klassert @ 2012-03-22 9:36 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, netdev
We call the wrong replay notify function when we use ESN replay
handling. This leads to the fact that we don't send notifications
if we use ESN. Fix this by calling the registered callbacks instead
of xfrm_replay_notify().
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_replay.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 39e02c5..2f6d11d 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -167,7 +167,7 @@ static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
}
if (xfrm_aevent_is_on(xs_net(x)))
- xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+ x->repl->notify(x, XFRM_REPLAY_UPDATE);
}
static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
@@ -279,7 +279,7 @@ static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
replay_esn->bmp[nr] |= (1U << bitnr);
if (xfrm_aevent_is_on(xs_net(x)))
- xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+ x->repl->notify(x, XFRM_REPLAY_UPDATE);
}
static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
@@ -473,7 +473,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
replay_esn->bmp[nr] |= (1U << bitnr);
if (xfrm_aevent_is_on(xs_net(x)))
- xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+ x->repl->notify(x, XFRM_REPLAY_UPDATE);
}
static struct xfrm_replay xfrm_replay_legacy = {
--
1.7.0.4
^ permalink raw reply related
* [PATCH] xfrm: Remove unused xfrm_state from xfrm_state_check_space
From: Steffen Klassert @ 2012-03-22 9:32 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, netdev
The xfrm_state argument is unused in this function, so remove it.
Also the name xfrm_state_check_space does not really match what this
function does. It actually checks if we have enough head and tailroom
on the skb. So we rename the function to xfrm_skb_check_space.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_output.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 47bacd8..95a338c 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -21,7 +21,7 @@
static int xfrm_output2(struct sk_buff *skb);
-static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
+static int xfrm_skb_check_space(struct sk_buff *skb)
{
struct dst_entry *dst = skb_dst(skb);
int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev)
@@ -48,7 +48,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
goto resume;
do {
- err = xfrm_state_check_space(x, skb);
+ err = xfrm_skb_check_space(skb);
if (err) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
goto error_nolock;
--
1.7.0.4
^ permalink raw reply related
* Re: [PATCH] net: add QCA alx Ethernet driver
From: Francois Romieu @ 2012-03-22 9:27 UTC (permalink / raw)
To: Luis R. Rodriguez
Cc: David Miller, xiong, netdev, linux-kernel, qca-linux-team,
nic-devel, kgiori, chris.snook, mathieu, bryanh, Jesper Andersen,
Julia Lawall
In-Reply-To: <CAB=NE6W-CYjEhbfYOv7XqXFGvdhZxRECqfAmgouaa5_j45gnOQ@mail.gmail.com>
Luis R. Rodriguez <rodrigue@qca.qualcomm.com> :
> On Tue, Feb 28, 2012 at 7:32 PM, David Miller <davem@davemloft.net> wrote:
[...]
> > To be honest tg3, as one example, supports quite a large array of
> > different pieces of hardware that use the same logical core.
>
> At certain point it becomes a pain in the ass to support older
> chipsets, and simply easier to leave the older driver to rot.
I would avoid saying such things while trying to sell a plan for a bright
future of drivers maintained and supported by $BIGCORP. :o)
[...]
> Would it be worthwhile to consider alx upstream only for the newer
> chipsets (regardless of the litmus test, which I do agree with on
> technical grounds) in consideration for helping pave the way on
> killing proprietary drivers?
What is the situation regarding the availability for public use of
programming manuals and errata on older chipsets ?
I am fine with Qualcomm being completely uninterested in maintaining
code for old chipsets and dedicating manpower or $$$ on it, be it now,
tomorrow or after a new arrival of management execs. However it sends
a bad message if code for new chipsets comes in while users have to
maintain their pile of poo in the dark.
The hardware stays for years. It's one of the engineering problems of
the day. Killing proprietary drivers is an interesting goal but it is
far, far away.
Qualcomm should imvho meet davem's remarks with more short termed
deliverables.
--
Ueimor
^ permalink raw reply
* Re: use-after-free in usbnet
From: Ming Lei @ 2012-03-22 9:30 UTC (permalink / raw)
To: Oliver Neukum
Cc: Alan Stern, netdev-u79uwXL29TY76Z2rM5mHXA,
linux-usb-u79uwXL29TY76Z2rM5mHXA, Fedora Kernel Team, Dave Jones
In-Reply-To: <201203221008.46882.oneukum-l3A5Bk7waGM@public.gmane.org>
On Thu, Mar 22, 2012 at 5:08 PM, Oliver Neukum <oneukum-l3A5Bk7waGM@public.gmane.org> wrote:
>
> this looks good, but could you add a comment explaining the reason for
> taking a reference?
OK, I will post a formal one if you have no objection on the below.
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 4b8b52c..febfdce 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -589,6 +589,14 @@ static int unlink_urbs (struct usbnet *dev,
struct sk_buff_head *q)
entry = (struct skb_data *) skb->cb;
urb = entry->urb;
+ /*
+ * Get a reference count of the URB to avoid it to be
+ * freed during usb_unlink_urb, which may trigger
+ * use-after-free problem inside usb_unlink_urb since
+ * usb_unlink_urb is always racing with .complete
+ * handler(include defer_bh).
+ */
+ usb_get_urb(urb);
spin_unlock_irqrestore(&q->lock, flags);
// during some PM-driven resume scenarios,
// these (async) unlinks complete immediately
@@ -597,6 +605,7 @@ static int unlink_urbs (struct usbnet *dev, struct
sk_buff_head *q)
netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
else
count++;
+ usb_put_urb(urb);
spin_lock_irqsave(&q->lock, flags);
}
spin_unlock_irqrestore (&q->lock, flags);
Thanks,
--
Ming Lei
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* Re: use-after-free in usbnet
From: Oliver Neukum @ 2012-03-22 9:08 UTC (permalink / raw)
To: Ming Lei
Cc: Alan Stern, netdev-u79uwXL29TY76Z2rM5mHXA,
linux-usb-u79uwXL29TY76Z2rM5mHXA, Fedora Kernel Team, Dave Jones
In-Reply-To: <CACVXFVOVjnWjqpKxbU98DAyUC_OSb8ZL-3WcyYuFXgPJn5UyuA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
Am Mittwoch, 21. März 2012, 17:22:59 schrieb Ming Lei:
> -
> + usb_get_urb(urb);
> spin_unlock_irqrestore(&q->lock, flags);
> // during some PM-driven resume scenarios,
> // these (async) unlinks complete immediately
> @@ -597,6 +597,7 @@ static int unlink_urbs (struct usbnet *dev, struct
> sk_buff_head *q)
> netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
> else
> count++;
> + usb_put_urb(urb);
Hi,
this looks good, but could you add a comment explaining the reason for
taking a reference?
Regards
Oliver
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PULL] vhost-net/virtio: fixes for 3.4
From: David Miller @ 2012-03-22 8:57 UTC (permalink / raw)
To: mst; +Cc: kvm, virtualization, netdev, linux-kernel, levinsasha928, nyh,
nyh
In-Reply-To: <20120322082718.GA11258@redhat.com>
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: Thu, 22 Mar 2012 10:27:19 +0200
> Dave, just checking - not sure I made it clear that this pull request
> is intended to go in through your tree.
> If you see any issues pls let me know so I can fix them.
I missed it, sorry.
For some reason patchwork didn't pick it up, because if it did
then it wouldn't have mattered that I lost it in my huge inbox.
Oh well :-/
But I've got it now, thanks. I'll work on it tomorrow.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox