* RE: [PATCH 04/37] atl1c: remove VPD register
From: Huang, Xiong @ 2012-04-17 8:36 UTC (permalink / raw)
To: Ben Hutchings
Cc: David Miller, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, qca-linux-team, nic-devel
In-Reply-To: <1334413369.7150.422.camel@deadeye>
Ok, I will update it. thanks a lot
-Xiong
________________________________________
发件人: Ben Hutchings [bhutchings@solarflare.com]
发送时间: 2012年4月14日 22:22
收件人: Huang, Xiong
Cc: David Miller; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; qca-linux-team; nic-devel
主题: RE: [PATCH 04/37] atl1c: remove VPD register
On Sat, 2012-04-14 at 09:12 +0000, Huang, Xiong wrote:
>
> > -----Original Message-----
> > From: David Miller [mailto:davem@davemloft.net]
> > Sent: Saturday, April 14, 2012 8:46
> > To: Huang, Xiong
> > Cc: netdev@vger.kernel.org; linux-kernel@vger.kernel.org; qca-linux-team; nic-
> > devel
> > Subject: Re: [PATCH 04/37] atl1c: remove VPD register
> >
> > From: xiong <xiong@qca.qualcomm.com>
> > Date: Fri, 13 Apr 2012 08:14:29 +0800
> >
> > > VPD register is only used for L1(devid=PCI_DEVICE_ID_ATTANSIC_L1) to
> > > access external NV-memory.
> > > l1c & later chip doesn't use it any more.
> > >
> > > Signed-off-by: xiong <xiong@qca.qualcomm.com>
> > > Tested-by: Liu David <dwliu@qca.qualcomm.com>
> >
> > You just broke ethtool register dumps with this change.
> >
> > Now, all the initial registers are reported offset by one entry, yet the last two are
> > still reported in their original spots.
> >
> > This layout is exposed to userspace, and interpreted by tools, and you cannot
> > change it.
> >
> > If this register always reports some value, you should just keep it there in the
> > dumps.
> >
> The VPD register doesn't report anything :(, just a dummy register now.
> we don't have any special tools in userspace to explain the dumped registers.
> Actually the purpose of dumping these registers via ethtool is just for debug.
[...]
Of course, the whole purpose of the operation is for debugging. But you
should bump the dump version number (currently 0) every time you change
the offsets of registers in the dump.
Ben.
--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: [PATCH 0/9] atl1: add napi to Atheros L1 NIC
From: Tony Zelenoff @ 2012-04-17 8:42 UTC (permalink / raw)
To: Chris Snook
Cc: David Miller, netdev@vger.kernel.org, jcliburn@gmail.com,
Konstantin Khorenko
In-Reply-To: <CAMXMK6v11Hd3BttPMWkb+dLppTiUFbYpPbHgCUz7butVxjYL8g@mail.gmail.com>
4/17/12 12:51 AM, Chris Snook написал:
> On Mon, Apr 16, 2012 at 12:22 AM, Tony Zelenoff<antonz@parallels.com> wrote:
>> Also, i'm interested in what to do with Chris Nook address in contacts list.
>> Reason - mailer respond that this address is not valid anymore. Should i
>> remove him from contacts or leave?
>>
>> Mailer response:
>>
>> csnook@redhat.com
>> SMTP error from remote mail server after RCPT TO:<csnook@redhat.com>:
>> host mx1.redhat.com [209.132.183.28]: 550 5.2.1<csnook@redhat.com>...
>> Mailbox disabled for this recipient
>
> MAINTAINERS is your friend :)
Oh, nice) May be change email address in contacts list?
^ permalink raw reply
* Re: [PATCH 00/12] add namespace support for netfilter protos
From: Pablo Neira Ayuso @ 2012-04-17 8:52 UTC (permalink / raw)
To: Gao feng; +Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <1334631383-12326-1-git-send-email-gaofeng@cn.fujitsu.com>
Hi Gao,
On Tue, Apr 17, 2012 at 10:56:11AM +0800, Gao feng wrote:
> Currently the sysctl of netfilter proto is not isolated, so when
> changing proto's sysctl in container will cause the host's sysctl
> be changed too. it's not expected.
>
> This patch set adds the namespace support for netfilter protos.
>
> impletement four pernet_operations to register sysctl,and disable
> register sysctl when protos are registered.
This indeed needs to be fixed, but this patchset has several
deficiencies. I'll spot them in follow-up emails.
> nf_conntrack_net_proto_ipv4_ops is used to register tcp4(compat),
> udp4(compat),icmp(compat),ipv4(compat).
> nf_conntrack_net_proto_ipv6_ops is used to register tcp6,udp6 and
> icmpv6.
> nf_conntrack_net_proto_sctp_ops is used to register sctp4(compat)
> and sctp6.
> nf_conntrack_net_proto_udplite_ops is used to register udplite4
> and udplite6
>
> these operations will be registered when module be loaded.
>
> And this will break the cttimeout, because timeout_nlattr_to_obj
> function use the orig timeout(such as tcp_timeouts) to set timeouts.
>
> I will fix this in my next patch.
No way.
You cannot leave the repository in broken / inconsistent state because
you are not making things good.
Please, hang on until this patchset is fixed to send more patches.
^ permalink raw reply
* Re: [PATCH 01/12] netfilter: add struct netns_ct_proto to support netfilter namespace
From: Pablo Neira Ayuso @ 2012-04-17 8:54 UTC (permalink / raw)
To: Gao feng; +Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <1334631383-12326-2-git-send-email-gaofeng@cn.fujitsu.com>
On Tue, Apr 17, 2012 at 10:56:12AM +0800, Gao feng wrote:
> the struct netns_ct_proto is used to store ctl_table_header and sysctl vars.
> because udp_conntrack and udplite_conntrack are used by netns_ct_proto,
> so move the udp_conntrack and udplite_conntrack to the header file,
>
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> ---
> include/linux/netfilter/nf_conntrack_udp.h | 10 ++++++
> include/linux/netfilter/nf_conntrack_udplite.h | 10 ++++++
> include/net/netns/conntrack.h | 37 ++++++++++++++++++++++++
> 3 files changed, 57 insertions(+), 0 deletions(-)
> create mode 100644 include/linux/netfilter/nf_conntrack_udp.h
> create mode 100644 include/linux/netfilter/nf_conntrack_udplite.h
>
> diff --git a/include/linux/netfilter/nf_conntrack_udp.h b/include/linux/netfilter/nf_conntrack_udp.h
> new file mode 100644
> index 0000000..02869fc
> --- /dev/null
> +++ b/include/linux/netfilter/nf_conntrack_udp.h
> @@ -0,0 +1,10 @@
> +#ifndef _NF_CONNTRACK_UDP_H
> +#define _NF_CONNTRACK_UDP_H
> +
> +enum udp_conntrack {
> + UDP_CT_UNREPLIED,
> + UDP_CT_REPLIED,
> + UDP_CT_MAX
> +};
This will be exported to user-space. We don't need this.
> +
> +#endif /* _NF_CONNTRACK_UDP_H */
> diff --git a/include/linux/netfilter/nf_conntrack_udplite.h b/include/linux/netfilter/nf_conntrack_udplite.h
> new file mode 100644
> index 0000000..62b90a2
> --- /dev/null
> +++ b/include/linux/netfilter/nf_conntrack_udplite.h
> @@ -0,0 +1,10 @@
> +#ifndef _NF_CONNTRACK_UDPLITE_H
> +#define _NF_CONNTRACK_UDPLITE_H
> +
> +enum udplite_conntrack {
> + UDPLITE_CT_UNREPLIED,
> + UDPLITE_CT_REPLIED,
> + UDPLITE_CT_MAX
> +};
> +
> +#endif /* _NF_CONNTRACK_UDPLITE_H */
> diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
> index 7a911ec..5845665 100644
> --- a/include/net/netns/conntrack.h
> +++ b/include/net/netns/conntrack.h
> @@ -4,10 +4,46 @@
> #include <linux/list.h>
> #include <linux/list_nulls.h>
> #include <linux/atomic.h>
> +#include <linux/netfilter/nf_conntrack_tcp.h>
> +#include <linux/netfilter/nf_conntrack_udp.h>
> +#include <linux/netfilter/nf_conntrack_udplite.h>
> +#include <linux/netfilter/nf_conntrack_sctp.h>
>
> struct ctl_table_header;
> struct nf_conntrack_ecache;
>
> +struct netns_ct_proto {
> + unsigned int sysctl_generic_timeout;
> + unsigned int sysctl_tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
> + unsigned int sysctl_tcp_loose;
> + unsigned int sysctl_tcp_be_liberal;
> + unsigned int sysctl_tcp_max_retrans;
> + unsigned int sysctl_udp_timeouts[UDP_CT_MAX];
> + unsigned int sysctl_udplite_timeouts[UDPLITE_CT_MAX];
> + unsigned int sysctl_sctp_timeouts[SCTP_CONNTRACK_MAX];
> + unsigned int sysctl_icmp_timeout;
> + unsigned int sysctl_icmpv6_timeout;
> +#ifdef CONFIG_SYSCTL
> + struct ctl_table_header *generic_sysctl_header;
> + struct ctl_table_header *tcp_sysctl_header;
> + struct ctl_table_header *udp_sysctl_header;
> + struct ctl_table_header *udplite_sysctl_header;
> + struct ctl_table_header *sctp_sysctl_header;
> + struct ctl_table_header *icmp_sysctl_header;
> + struct ctl_table_header *icmpv6_sysctl_header;
> + unsigned int tcp_table_users;
> + unsigned int udp_table_users;
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> + struct ctl_table_header *generic_compat_header;
> + struct ctl_table_header *tcp_compat_header;
> + struct ctl_table_header *udp_compat_header;
> + struct ctl_table_header *sctp_compat_header;
> + struct ctl_table_header *icmp_compat_header;
> + struct ctl_table_header *ipv4_compat_header;
> +#endif
> +#endif
> +};
No.
You cannot just send a patch that adds a structure like this and use
it in follow-up patches.
You have to make patches that leave the repository in consistent state.
Instead, you have to populate the structure little by little in your
patches.
> +
> struct netns_ct {
> atomic_t count;
> unsigned int expect_count;
> @@ -26,6 +62,7 @@ struct netns_ct {
> int sysctl_tstamp;
> int sysctl_checksum;
> unsigned int sysctl_log_invalid; /* Log invalid packets */
> + struct netns_ct_proto proto;
> #ifdef CONFIG_SYSCTL
> struct ctl_table_header *sysctl_header;
> struct ctl_table_header *acct_sysctl_header;
> --
> 1.7.7.6
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 02/12] netfilter: don't register sysctl when register proto
From: Pablo Neira Ayuso @ 2012-04-17 8:56 UTC (permalink / raw)
To: Gao feng; +Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <1334631383-12326-3-git-send-email-gaofeng@cn.fujitsu.com>
On Tue, Apr 17, 2012 at 10:56:13AM +0800, Gao feng wrote:
> delete nf_ct_l[3,4]proto_register_sysctl when register l[3,4]proto.
> and add nf_ct_register_net_sysctl,nf_ct_unregister_net_sysctl to
> register the sysctl for net namespace.
>
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> ---
> net/netfilter/nf_conntrack_proto.c | 109 +++++-------------------------------
> 1 files changed, 15 insertions(+), 94 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
> index be3da2c..207cdd8 100644
> --- a/net/netfilter/nf_conntrack_proto.c
> +++ b/net/netfilter/nf_conntrack_proto.c
> @@ -35,12 +35,15 @@ EXPORT_SYMBOL_GPL(nf_ct_l3protos);
> static DEFINE_MUTEX(nf_ct_proto_mutex);
>
> #ifdef CONFIG_SYSCTL
> -static int
> -nf_ct_register_sysctl(struct ctl_table_header **header, struct ctl_path *path,
> - struct ctl_table *table, unsigned int *users)
> +int
> +nf_ct_register_net_sysctl(struct net *net,
> + struct ctl_table_header **header,
> + struct ctl_path *path,
> + struct ctl_table *table,
> + unsigned int *users)
Please, don't rename this function. Just add the *net parameter
instead.
> {
> if (*header == NULL) {
> - *header = register_sysctl_paths(path, table);
> + *header = register_net_sysctl_table(net, path, table);
> if (*header == NULL)
> return -ENOMEM;
> }
> @@ -48,17 +51,21 @@ nf_ct_register_sysctl(struct ctl_table_header **header, struct ctl_path *path,
> (*users)++;
> return 0;
> }
> +EXPORT_SYMBOL_GPL(nf_ct_register_net_sysctl);
>
> -static void
> -nf_ct_unregister_sysctl(struct ctl_table_header **header,
> - struct ctl_table *table, unsigned int *users)
> +void
> +nf_ct_unregister_net_sysctl(struct ctl_table_header **header,
> + struct ctl_table *table,
> + unsigned int *users)
> {
> if (users != NULL && --*users > 0)
> return;
>
> unregister_sysctl_table(*header);
> + kfree(table);
> *header = NULL;
> }
> +EXPORT_SYMBOL_GPL(nf_ct_unregister_net_sysctl);
> #endif
>
> struct nf_conntrack_l4proto *
> @@ -161,29 +168,6 @@ static int kill_l4proto(struct nf_conn *i, void *data)
> nf_ct_l3num(i) == l4proto->l3proto;
> }
>
> -static int nf_ct_l3proto_register_sysctl(struct nf_conntrack_l3proto *l3proto)
> -{
> - int err = 0;
> -
> -#ifdef CONFIG_SYSCTL
> - if (l3proto->ctl_table != NULL) {
> - err = nf_ct_register_sysctl(&l3proto->ctl_table_header,
> - l3proto->ctl_table_path,
> - l3proto->ctl_table, NULL);
> - }
> -#endif
> - return err;
> -}
> -
> -static void nf_ct_l3proto_unregister_sysctl(struct nf_conntrack_l3proto *l3proto)
> -{
> -#ifdef CONFIG_SYSCTL
> - if (l3proto->ctl_table_header != NULL)
> - nf_ct_unregister_sysctl(&l3proto->ctl_table_header,
> - l3proto->ctl_table, NULL);
> -#endif
> -}
> -
> int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
> {
> int ret = 0;
> @@ -203,10 +187,6 @@ int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
> goto out_unlock;
> }
>
> - ret = nf_ct_l3proto_register_sysctl(proto);
> - if (ret < 0)
> - goto out_unlock;
> -
> if (proto->nlattr_tuple_size)
> proto->nla_size = 3 * proto->nlattr_tuple_size();
>
> @@ -230,7 +210,6 @@ void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
> ) != proto);
> rcu_assign_pointer(nf_ct_l3protos[proto->l3proto],
> &nf_conntrack_l3proto_generic);
> - nf_ct_l3proto_unregister_sysctl(proto);
> mutex_unlock(&nf_ct_proto_mutex);
>
> synchronize_rcu();
> @@ -243,52 +222,6 @@ void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
> }
> EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
>
> -static int nf_ct_l4proto_register_sysctl(struct nf_conntrack_l4proto *l4proto)
> -{
> - int err = 0;
> -
> -#ifdef CONFIG_SYSCTL
> - if (l4proto->ctl_table != NULL) {
> - err = nf_ct_register_sysctl(l4proto->ctl_table_header,
> - nf_net_netfilter_sysctl_path,
> - l4proto->ctl_table,
> - l4proto->ctl_table_users);
> - if (err < 0)
> - goto out;
> - }
> -#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> - if (l4proto->ctl_compat_table != NULL) {
> - err = nf_ct_register_sysctl(&l4proto->ctl_compat_table_header,
> - nf_net_ipv4_netfilter_sysctl_path,
> - l4proto->ctl_compat_table, NULL);
> - if (err == 0)
> - goto out;
> - nf_ct_unregister_sysctl(l4proto->ctl_table_header,
> - l4proto->ctl_table,
> - l4proto->ctl_table_users);
> - }
> -#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
> -out:
> -#endif /* CONFIG_SYSCTL */
> - return err;
> -}
> -
> -static void nf_ct_l4proto_unregister_sysctl(struct nf_conntrack_l4proto *l4proto)
> -{
> -#ifdef CONFIG_SYSCTL
> - if (l4proto->ctl_table_header != NULL &&
> - *l4proto->ctl_table_header != NULL)
> - nf_ct_unregister_sysctl(l4proto->ctl_table_header,
> - l4proto->ctl_table,
> - l4proto->ctl_table_users);
> -#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> - if (l4proto->ctl_compat_table_header != NULL)
> - nf_ct_unregister_sysctl(&l4proto->ctl_compat_table_header,
> - l4proto->ctl_compat_table, NULL);
> -#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
> -#endif /* CONFIG_SYSCTL */
> -}
> -
Where did this function go?
> /* FIXME: Allow NULL functions and sub in pointers to generic for
> them. --RR */
> int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *l4proto)
> @@ -333,10 +266,6 @@ int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *l4proto)
> goto out_unlock;
> }
>
> - ret = nf_ct_l4proto_register_sysctl(l4proto);
> - if (ret < 0)
> - goto out_unlock;
> -
> l4proto->nla_size = 0;
> if (l4proto->nlattr_size)
> l4proto->nla_size += l4proto->nlattr_size();
> @@ -365,7 +294,6 @@ void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
> ) != l4proto);
> rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
> &nf_conntrack_l4proto_generic);
> - nf_ct_l4proto_unregister_sysctl(l4proto);
> mutex_unlock(&nf_ct_proto_mutex);
>
> synchronize_rcu();
> @@ -380,12 +308,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_unregister);
>
> int nf_conntrack_proto_init(void)
> {
> - unsigned int i;
> - int err;
> -
> - err = nf_ct_l4proto_register_sysctl(&nf_conntrack_l4proto_generic);
> - if (err < 0)
> - return err;
> + unsigned int i;
>
> for (i = 0; i < AF_MAX; i++)
> rcu_assign_pointer(nf_ct_l3protos[i],
> @@ -397,8 +320,6 @@ void nf_conntrack_proto_fini(void)
> {
> unsigned int i;
>
> - nf_ct_l4proto_unregister_sysctl(&nf_conntrack_l4proto_generic);
> -
> /* free l3proto protocol tables */
> for (i = 0; i < PF_MAX; i++)
> kfree(nf_ct_protos[i]);
> --
> 1.7.7.6
>
^ permalink raw reply
* Re: [PATCH 03/12] netfilter: generic proto sysctl support for net namespace
From: Pablo Neira Ayuso @ 2012-04-17 8:58 UTC (permalink / raw)
To: Gao feng; +Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <1334631383-12326-4-git-send-email-gaofeng@cn.fujitsu.com>
On Tue, Apr 17, 2012 at 10:56:14AM +0800, Gao feng wrote:
> register the generic proto's sysctl in pernet_operations.init.
> and use net->ct.proto.sysctl_generic_timeout replaces nf_ct_generic_timeout.
>
> in the after patch,the timeout_nlattr_to_obj will be modified too.
>
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> ---
> net/netfilter/nf_conntrack_core.c | 6 ++
> net/netfilter/nf_conntrack_proto_generic.c | 93 +++++++++++++++++++++++++---
> 2 files changed, 91 insertions(+), 8 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
> index 729f157..bf11dd6 100644
> --- a/net/netfilter/nf_conntrack_core.c
> +++ b/net/netfilter/nf_conntrack_core.c
> @@ -1358,6 +1358,7 @@ static void nf_conntrack_cleanup_net(struct net *net)
> nf_conntrack_tstamp_fini(net);
> nf_conntrack_acct_fini(net);
> nf_conntrack_expect_fini(net);
> + nf_conntrack_proto_generic_net_fini(net);
> kmem_cache_destroy(net->ct.nf_conntrack_cachep);
> kfree(net->ct.slabname);
> free_percpu(net->ct.stat);
> @@ -1573,6 +1574,9 @@ static int nf_conntrack_init_net(struct net *net)
> printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
> goto err_hash;
> }
> + ret = nf_conntrack_proto_generic_net_init(net);
> + if (ret < 0)
> + goto err_generic;
> ret = nf_conntrack_expect_init(net);
> if (ret < 0)
> goto err_expect;
> @@ -1600,6 +1604,8 @@ err_tstamp:
> err_acct:
> nf_conntrack_expect_fini(net);
> err_expect:
> + nf_conntrack_proto_generic_net_fini(net);
> +err_generic:
> nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
> err_hash:
> kmem_cache_destroy(net->ct.nf_conntrack_cachep);
> diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
> index 835e24c..0d4545b 100644
> --- a/net/netfilter/nf_conntrack_proto_generic.c
> +++ b/net/netfilter/nf_conntrack_proto_generic.c
> @@ -42,7 +42,7 @@ static int generic_print_tuple(struct seq_file *s,
>
> static unsigned int *generic_get_timeouts(struct net *net)
> {
> - return &nf_ct_generic_timeout;
> + return &(net->ct.proto.sysctl_generic_timeout);
> }
>
> /* Returns verdict for packet, or -1 for invalid. */
> @@ -105,11 +105,10 @@ generic_timeout_nla_policy[CTA_TIMEOUT_GENERIC_MAX+1] = {
> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
>
> #ifdef CONFIG_SYSCTL
> -static struct ctl_table_header *generic_sysctl_header;
> static struct ctl_table generic_sysctl_table[] = {
> {
> .procname = "nf_conntrack_generic_timeout",
> - .data = &nf_ct_generic_timeout,
> + .data = &init_net.ct.proto.sysctl_generic_timeout,
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> @@ -120,7 +119,7 @@ static struct ctl_table generic_sysctl_table[] = {
> static struct ctl_table generic_compat_sysctl_table[] = {
> {
> .procname = "ip_conntrack_generic_timeout",
> - .data = &nf_ct_generic_timeout,
> + .data = &init_net.ct.proto.sysctl_generic_timeout,
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> @@ -150,11 +149,89 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_generic __read_mostly =
> .nla_policy = generic_timeout_nla_policy,
> },
> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
> +};
> +
> +int nf_conntrack_proto_generic_net_init(struct net *net)
Please, check int nf_conntrack_ecache_init(struct net *net) for
instance on how we're doing the per-net registration of netfilter
modules.
Basically, we register the module only once for the init_net case.
Then, we register one sysctl per-net.
> +{
> + struct ctl_table *table;
> + int ret = 0;
> #ifdef CONFIG_SYSCTL
> - .ctl_table_header = &generic_sysctl_header,
> - .ctl_table = generic_sysctl_table,
> #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> - .ctl_compat_table = generic_compat_sysctl_table,
> + struct ctl_table *compat_table;
> #endif
> #endif
> -};
> + net->ct.proto.sysctl_generic_timeout = nf_ct_generic_timeout;
> +#ifdef CONFIG_SYSCTL
> + table = kmemdup(generic_sysctl_table,
> + sizeof(generic_sysctl_table),
> + GFP_KERNEL);
> + if (!table)
> + return -ENOMEM;
> +
> + table[0].data = &net->ct.proto.sysctl_generic_timeout;
> +
> + ret = nf_ct_register_net_sysctl(net,
> + &net->ct.proto.generic_sysctl_header,
> + nf_net_netfilter_sysctl_path,
> + table,
> + NULL);
> + if (ret < 0) {
> + printk(KERN_ERR
> + "nf_conntrack_proto_generic:"
> + " can't register to sysctl.\n");
> + kfree(table);
> + return ret;
> + }
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> + compat_table = kmemdup(generic_compat_sysctl_table,
> + sizeof(generic_compat_sysctl_table),
> + GFP_KERNEL);
> + if (!compat_table) {
> + ret = -ENOMEM;
> + goto out_compat;
> + }
> + compat_table[0].data = &net->ct.proto.sysctl_generic_timeout;
> + ret = nf_ct_register_net_sysctl(net,
> + &net->ct.proto.generic_compat_header,
> + nf_net_ipv4_netfilter_sysctl_path,
> + compat_table,
> + NULL);
> + if (ret < 0) {
> + printk(KERN_ERR
> + "nf_conntrack_proto_generic:"
> + " can't register to compat sysctl.\n");
> + goto out_compat_register;
> + }
> +#endif
> + return 0;
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> +out_compat_register:
> + kfree(compat_table);
> +out_compat:
> + nf_ct_unregister_net_sysctl(&net->ct.proto.generic_sysctl_header,
> + table,
> + NULL);
> +#endif
> +#endif
> + return ret;
> +}
> +
> +void nf_conntrack_proto_generic_net_fini(struct net *net)
> +{
> +#ifdef CONFIG_SYSCTL
> + struct ctl_table *table;
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> + struct ctl_table *compat_table;
> +#endif
> + table = net->ct.proto.generic_sysctl_header->ctl_table_arg;
> + nf_ct_unregister_net_sysctl(&net->ct.proto.generic_sysctl_header,
> + table,
> + NULL);
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> + compat_table = net->ct.proto.generic_compat_header->ctl_table_arg;
> + nf_ct_unregister_net_sysctl(&net->ct.proto.generic_compat_header,
> + compat_table,
> + NULL);
> +#endif
> +#endif
> +}
> --
> 1.7.7.6
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 12/12] netfilter: export necessary function for generic proto
From: Pablo Neira Ayuso @ 2012-04-17 9:01 UTC (permalink / raw)
To: Gao feng; +Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <1334631383-12326-13-git-send-email-gaofeng@cn.fujitsu.com>
On Tue, Apr 17, 2012 at 10:56:23AM +0800, Gao feng wrote:
> export two functions nf_conntrack_proto_generic_net_init and
> nf_conntrack_proto_generic_net_fini.
>
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> ---
> include/net/netfilter/nf_conntrack_core.h | 3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
> index aced085..3c3fabe 100644
> --- a/include/net/netfilter/nf_conntrack_core.h
> +++ b/include/net/netfilter/nf_conntrack_core.h
> @@ -31,6 +31,9 @@ extern void nf_conntrack_cleanup(struct net *net);
> extern int nf_conntrack_proto_init(void);
> extern void nf_conntrack_proto_fini(void);
>
> +extern int nf_conntrack_proto_generic_net_init(struct net *net);
> +extern void nf_conntrack_proto_generic_net_fini(struct net *net);
This does not require a separated patch only for this.
Please, review the logic that you've follow to split changes.
Thank you.
^ permalink raw reply
* [BUG] ixgbe: something wrong with queue selection ?
From: Eric Dumazet @ 2012-04-17 9:06 UTC (permalink / raw)
To: Kirsher, Jeffrey T, Greg Rose, John Fastabend, Jesse Brandeburg; +Cc: netdev
Hi guys
I have bad feelings with ixgbe and its multiqueue selection.
On a quad core machine (Q6600), I get lots of reorderings on a single
TCP stream.
Apparently packets happily spread on all available queues, instead of a
single one.
This defeats GRO at receiver and TCP performance is really bad.
# ethtool -S eth5|egrep "x_queue_[0123]_packets" ; taskset 1 netperf -H
192.168.99.1 ; ethtool -S eth5|egrep "x_queue_[0123]_packets"
tx_queue_0_packets: 24
tx_queue_1_packets: 26
tx_queue_2_packets: 32
tx_queue_3_packets: 16
rx_queue_0_packets: 11
rx_queue_1_packets: 47
rx_queue_2_packets: 27
rx_queue_3_packets: 22
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to
192.168.99.1 (192.168.99.1) port 0 AF_INET
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
87380 16384 16384 10.00 3866.43
tx_queue_0_packets: 1653201
tx_queue_1_packets: 608000
tx_queue_2_packets: 541382
tx_queue_3_packets: 536543
rx_queue_0_packets: 434703
rx_queue_1_packets: 137444
rx_queue_2_packets: 131023
rx_queue_3_packets: 128407
# ip ro get 192.168.99.1
192.168.99.1 dev eth5 src 192.168.99.2
cache ipid 0x438b rtt 4ms rttvar 4ms cwnd 57 reordering 127
# lspci -v -s 02:00.0
02:00.0 Ethernet controller: Intel Corporation 82599EB 10-Gigabit
SFI/SFP+ Network Connection (rev 01)
Subsystem: Intel Corporation Ethernet Server Adapter X520-2
Flags: bus master, fast devsel, latency 0, IRQ 16
Memory at f1100000 (64-bit, prefetchable) [size=512K]
I/O ports at b000 [size=32]
Memory at f1200000 (64-bit, prefetchable) [size=16K]
Capabilities: [40] Power Management version 3
Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+
Capabilities: [70] MSI-X: Enable+ Count=64 Masked-
Capabilities: [a0] Express Endpoint, MSI 00
Capabilities: [100] Advanced Error Reporting
Capabilities: [140] Device Serial Number 00-1b-21-ff-ff-4a-fe-54
Capabilities: [150] Alternative Routing-ID Interpretation (ARI)
Capabilities: [160] Single Root I/O Virtualization (SR-IOV)
Kernel driver in use: ixgbe
Kernel modules: ixgbe
^ permalink raw reply
* Re: [BUG] ixgbe: something wrong with queue selection ?
From: Jeff Kirsher @ 2012-04-17 9:16 UTC (permalink / raw)
To: Eric Dumazet, Skidmore, Donald C, Duyck, Alexander H
Cc: Greg Rose, John Fastabend, Jesse Brandeburg, netdev
In-Reply-To: <1334653608.6226.11.camel@edumazet-laptop>
[-- Attachment #1: Type: text/plain, Size: 2553 bytes --]
On Tue, 2012-04-17 at 11:06 +0200, Eric Dumazet wrote:
> Hi guys
>
> I have bad feelings with ixgbe and its multiqueue selection.
>
> On a quad core machine (Q6600), I get lots of reorderings on a single
> TCP stream.
>
>
> Apparently packets happily spread on all available queues, instead of a
> single one.
>
> This defeats GRO at receiver and TCP performance is really bad.
>
> # ethtool -S eth5|egrep "x_queue_[0123]_packets" ; taskset 1 netperf -H
> 192.168.99.1 ; ethtool -S eth5|egrep "x_queue_[0123]_packets"
> tx_queue_0_packets: 24
> tx_queue_1_packets: 26
> tx_queue_2_packets: 32
> tx_queue_3_packets: 16
> rx_queue_0_packets: 11
> rx_queue_1_packets: 47
> rx_queue_2_packets: 27
> rx_queue_3_packets: 22
> MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to
> 192.168.99.1 (192.168.99.1) port 0 AF_INET
> Recv Send Send
> Socket Socket Message Elapsed
> Size Size Size Time Throughput
> bytes bytes bytes secs. 10^6bits/sec
>
> 87380 16384 16384 10.00 3866.43
> tx_queue_0_packets: 1653201
> tx_queue_1_packets: 608000
> tx_queue_2_packets: 541382
> tx_queue_3_packets: 536543
> rx_queue_0_packets: 434703
> rx_queue_1_packets: 137444
> rx_queue_2_packets: 131023
> rx_queue_3_packets: 128407
>
> # ip ro get 192.168.99.1
> 192.168.99.1 dev eth5 src 192.168.99.2
> cache ipid 0x438b rtt 4ms rttvar 4ms cwnd 57 reordering 127
>
> # lspci -v -s 02:00.0
> 02:00.0 Ethernet controller: Intel Corporation 82599EB 10-Gigabit
> SFI/SFP+ Network Connection (rev 01)
> Subsystem: Intel Corporation Ethernet Server Adapter X520-2
> Flags: bus master, fast devsel, latency 0, IRQ 16
> Memory at f1100000 (64-bit, prefetchable) [size=512K]
> I/O ports at b000 [size=32]
> Memory at f1200000 (64-bit, prefetchable) [size=16K]
> Capabilities: [40] Power Management version 3
> Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+
> Capabilities: [70] MSI-X: Enable+ Count=64 Masked-
> Capabilities: [a0] Express Endpoint, MSI 00
> Capabilities: [100] Advanced Error Reporting
> Capabilities: [140] Device Serial Number 00-1b-21-ff-ff-4a-fe-54
> Capabilities: [150] Alternative Routing-ID Interpretation (ARI)
> Capabilities: [160] Single Root I/O Virtualization (SR-IOV)
> Kernel driver in use: ixgbe
> Kernel modules: ixgbe
>
>
Adding Don Skidmore and Alex Duyck...
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply
* [PATCH] tcp: fix tcp_grow_window() for large incoming frames
From: Eric Dumazet @ 2012-04-17 9:28 UTC (permalink / raw)
To: David Miller; +Cc: Neal Cardwell, Tom Herbert, netdev
From: Eric Dumazet <edumazet@google.com>
tcp_grow_window() has to grow rcv_ssthresh up to window_clamp, allowing
sender to increase its window.
tcp_grow_window() still assumes a tcp frame is under MSS, but its no
longer true with LRO/GRO.
This patch fixes one of the performance issue we noticed with GRO on.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Tom Herbert <therbert@google.com>
---
Sorry for the delay, this was discussed a long time ago.
net/ipv4/tcp_input.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 9944c1d..3ff36406 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -335,6 +335,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
incr = __tcp_grow_window(sk, skb);
if (incr) {
+ incr = max_t(int, incr, 2 * skb->len);
tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
tp->window_clamp);
inet_csk(sk)->icsk_ack.quick |= 1;
^ permalink raw reply related
* [PATCH] stmmac: fix kernel crash when device probed for SPEAr with DT
From: Viresh Kumar @ 2012-04-17 9:24 UTC (permalink / raw)
To: peppe.cavallaro; +Cc: spear-devel, viresh.linux, netdev, davem, Viresh Kumar
plat->dma_cfg is never allocated memory and is tried to be filled when we boot
it for SPEAr SoCs with DT. And so get a kernel crash.
Fix it by allocating memory for dma_cfg.
Signed-off-by: Viresh Kumar <viresh.kumar@st.com>
---
.../net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 12bd221..f124f60 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -110,6 +110,14 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
goto out_unmap;
}
+ plat_dat->dma_cfg = devm_kzalloc(&pdev->dev,
+ sizeof(*plat_dat->dma_cfg), GFP_KERNEL);
+ if (!plat_dat->dma_cfg) {
+ pr_err("%s: ERROR: no memory for dma_cfg", __func__);
+ ret = -ENOMEM;
+ goto out_unmap;
+ }
+
ret = stmmac_probe_config_dt(pdev, plat_dat, &mac);
if (ret) {
pr_err("%s: main dt probe failed", __func__);
--
1.7.9
^ permalink raw reply related
* Server Rental Service in Hong Kong
From: boris @ 2012-04-17 9:45 UTC (permalink / raw)
Dear All,
We have our own datacenter in Hong Kong & provide email/application/web rental service to clients.We are APNIC member & provide clean IP to clients.
Dell? PowerEdge? EnterpriseRack Mount Server
-Intel(R) Xeon(R) E3-1240 Processor (3.3GHz, 8M Cache, Turbo, 4C/8T, 80W)
-8GB RAM, 2x4GB, 1333MHz, DDR-3, Dual Ranked UDIMMs
-500GB, 3.5", 6Gbps SAS x 2
-Raid 1 Mirroring Protection
-Remote KVM (iDRAC6 Enterprise)
Dell(TM) PowerEdge(TM) R410 Rack Mount Server
-Intel(R) Quad Core E5606 Xeon(R) CPU, 2.13GHz, 4M Cache, 4.86 GT/s QPI
-4GB Memory (2x2GB), 1333MHz Dual Ranked RDIMMs Fully-Buffered
-500GB 7.2K RPM SATAII 3.5" Hard Drive x 2
-iDRAC6 Enterprise or Express (Remote KVM Management)
Every Dedicated Server Hosting Solution Also Includes:
Software Specification
- CentOS / Fedora / Debian / FreeBSD / Ubuntu / Redhat Linux
- Full root-level access
- Data Center Facilities
- Shared Local & International Bandwidth
- 2 IP Addresses Allocation
- Un-interruptible Power Supply (UPS) backed up by private diesel generator
- FM200¡§based fire suppression system
- 24x7 CRAC Air Conditioning and Humidity Control
- 24x7 Security Control
- 24x7 Remote Hand Service
Pls send us email for further information.Thanks,
Boris
boris@dedicatedserver.com.hk
If you do not wish to further receive this event message, email "borislamsv2@gmail.com" to unsubscribe this message or remove your email from the list.
^ permalink raw reply
* Re: [PATCH 00/12] add namespace support for netfilter protos
From: Gao feng @ 2012-04-17 10:12 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <20120417085209.GA2100@1984>
Hi pablo
于 2012年04月17日 16:52, Pablo Neira Ayuso 写道:
> Hi Gao,
>
> On Tue, Apr 17, 2012 at 10:56:11AM +0800, Gao feng wrote:
>> Currently the sysctl of netfilter proto is not isolated, so when
>> changing proto's sysctl in container will cause the host's sysctl
>> be changed too. it's not expected.
>>
>> This patch set adds the namespace support for netfilter protos.
>>
>> impletement four pernet_operations to register sysctl,and disable
>> register sysctl when protos are registered.
>
> This indeed needs to be fixed, but this patchset has several
> deficiencies. I'll spot them in follow-up emails.
>
>> nf_conntrack_net_proto_ipv4_ops is used to register tcp4(compat),
>> udp4(compat),icmp(compat),ipv4(compat).
>> nf_conntrack_net_proto_ipv6_ops is used to register tcp6,udp6 and
>> icmpv6.
>> nf_conntrack_net_proto_sctp_ops is used to register sctp4(compat)
>> and sctp6.
>> nf_conntrack_net_proto_udplite_ops is used to register udplite4
>> and udplite6
>>
>> these operations will be registered when module be loaded.
>>
>> And this will break the cttimeout, because timeout_nlattr_to_obj
>> function use the orig timeout(such as tcp_timeouts) to set timeouts.
>>
>> I will fix this in my next patch.
>
> No way.
OK... I will fix all and resend the patch ;)
>
> You cannot leave the repository in broken / inconsistent state because
> you are not making things good.
>
> Please, hang on until this patchset is fixed to send more patches.
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 6/6] vhost_net: don't poll on -EFAULT
From: Michael S. Tsirkin @ 2012-04-17 10:18 UTC (permalink / raw)
To: Jason Wang; +Cc: netdev, xma, davem, linux-kernel, ebiederm
In-Reply-To: <4F8D0E03.7030105@redhat.com>
On Tue, Apr 17, 2012 at 02:30:27PM +0800, Jason Wang wrote:
> On 04/17/2012 02:07 PM, Michael S. Tsirkin wrote:
> >On Tue, Apr 17, 2012 at 01:54:55PM +0800, Jason Wang wrote:
> >>On 04/17/2012 12:57 PM, Michael S. Tsirkin wrote:
> >>>On Tue, Apr 17, 2012 at 11:27:01AM +0800, Jason Wang wrote:
> >>>>On 04/16/2012 09:39 PM, Michael S. Tsirkin wrote:
> >>>>>On Mon, Apr 16, 2012 at 04:28:10PM +0800, Jason Wang wrote:
> >>>>>>> On 04/16/2012 03:16 PM, Michael S. Tsirkin wrote:
> >>>>>>>> >On Mon, Apr 16, 2012 at 02:08:33PM +0800, Jason Wang wrote:
> >>>>>>>>> >>Currently, we restart tx polling unconditionally when sendmsg()
> >>>>>>>>> >>fails. This would cause unnecessary wakeups of vhost wokers as it's
> >>>>>>>>> >>only needed when the socket send buffer were exceeded.
> >>>>>>>> >Why is this a problem?
> >>>>>>> > This issue is when guest driver is able to hit the
> >>>>>>-EFAULT, vhost
> >>>>>>> discard the the descriptor and restart the polling. This would wake
> >>>>>>> vhost thread and repeat the loop again which waste cpu.
> >>>>>Does same thing happen if we get an error from copy from user?
> >>>>>
> >>>>Right, so do you think it makes sense that we only restart polling
> >>>>on -EAGAIN or -ENOBUFS?
> >>>Sounds OK. BTW how do you test this?
> >>>
> >>Not very hard, w/o this patch, we can see almost 100% cpu
> >>utilization for vhost thread if guest hit EFAULT or EINVAL. With
> >>this patch, the cpu utilization should be very low I think.
> >Yes but do you have a test that makes guest hit EFAULT or EINVAL?
>
> Looks like we can do this by supplying an invalid hdr_len in vnet
> header as tap does the check for this.
Ah so you patched qemu to do this? Cool. Can you post the patch for testing pls?
> >--
> >To unsubscribe from this list: send the line "unsubscribe netdev" in
> >the body of a message to majordomo@vger.kernel.org
> >More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 5/6] vhost_net: fix use after free of vq->ubufs
From: Michael S. Tsirkin @ 2012-04-17 10:22 UTC (permalink / raw)
To: Jason Wang; +Cc: netdev, xma, davem, linux-kernel, ebiederm
In-Reply-To: <4F8CE14E.5080508@redhat.com>
On Tue, Apr 17, 2012 at 11:19:42AM +0800, Jason Wang wrote:
> On 04/16/2012 09:28 PM, Michael S. Tsirkin wrote:
> >On Mon, Apr 16, 2012 at 02:08:25PM +0800, Jason Wang wrote:
> >>When zerocopy socket is used, ubufs pointer were used in handle_tx()
> >>without any validation. This would cause NULL pointer deference after
> >>it has been freed in vhost_net_set_backend(). Fix this by check the
> >>pointer before using it.
> >>
> >>Signed-off-by: Jason Wang<jasowang@redhat.com>
> >
> >OK so it's NULL dereference and not user after free :)
> >Also could you clarify how does this happen pls?
> >Don't we always initialize ubufs when vhost_sock_zcopy is set?
>
> The problem happens when we want to disable backend. At this time
> ubufs were assigned to NULL and it may be dereferenced by
> handle_tx():
Heh, I see. How about
- zcopy = vhost_sock_zcopy(sock);
+ zcopy = vq->ubufs;
--
MST
^ permalink raw reply
* Re: [PATCH] bnx2x: tx-switching module parameter
From: Eilon Greenstein @ 2012-04-17 10:22 UTC (permalink / raw)
To: John Fastabend; +Cc: davem, Stephen Hemminger, Ariel Elior, netdev
In-Reply-To: <4F8BA9FE.4010905@intel.com>
On Sun, 2012-04-15 at 22:11 -0700, John Fastabend wrote:
> On 2/16/2012 11:57 AM, Eilon Greenstein wrote:
> >>>> "Ariel Elior" <ariele@broadcom.com> wrote:
> >>>>
> >>>>> In 57712 and 578xx the tx-switching module parameter allows the user to control
> >>>>> whether outgoing traffic can be loopbacked into the device in case there is a
> >>>>> relevant client for the data using the same device for rx.
>
> [...]
>
> >>> But netdev is a great place to ask - are there other vendors out there
> >>> that requires this control over internal switching? If so, we can define
> >>> a new ethtool command. The alternative of using the ethtool private
> >>> flags seems just as inconvenient from administrators point of view and
> >>> also seem less appropriate since this configuration is more likely to be
> >>> the same for all PFs on the same machine.
> >>>
>
> [...]
>
> > OK, thanks John. Dave - please do not apply this patch. We need to look
> > at the alternatives suggested by John.
> >
> > Thanks,
> > Eilon
> >
>
> Eilon, any progress with this? We need this to support VEPA modes in
> macvlan running over SR-IOV devices or other embedded switches. The
> problem being if the stacked device expects the packet to be sent
> to the reflexive relay on the switch in the SR-IOV case the embedded
> switch may not actually do this.
John, honestly, this is not at the top of the priority list for us right
now. If you would like to proceed, please do so - we will have to adopt
to what you suggest when we get back to this issue.
Thanks,
Eilon
^ permalink raw reply
* Re: [PATCH 03/12] netfilter: generic proto sysctl support for net namespace
From: Gao feng @ 2012-04-17 10:22 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <20120417085813.GD2100@1984>
于 2012年04月17日 16:58, Pablo Neira Ayuso 写道:
> On Tue, Apr 17, 2012 at 10:56:14AM +0800, Gao feng wrote:
>> register the generic proto's sysctl in pernet_operations.init.
>> and use net->ct.proto.sysctl_generic_timeout replaces nf_ct_generic_timeout.
>>
>> in the after patch,the timeout_nlattr_to_obj will be modified too.
>>
>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
>> ---
>> net/netfilter/nf_conntrack_core.c | 6 ++
>> net/netfilter/nf_conntrack_proto_generic.c | 93 +++++++++++++++++++++++++---
>> 2 files changed, 91 insertions(+), 8 deletions(-)
>>
>> diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
>> index 729f157..bf11dd6 100644
>> --- a/net/netfilter/nf_conntrack_core.c
>> +++ b/net/netfilter/nf_conntrack_core.c
>> @@ -1358,6 +1358,7 @@ static void nf_conntrack_cleanup_net(struct net *net)
>> nf_conntrack_tstamp_fini(net);
>> nf_conntrack_acct_fini(net);
>> nf_conntrack_expect_fini(net);
>> + nf_conntrack_proto_generic_net_fini(net);
>> kmem_cache_destroy(net->ct.nf_conntrack_cachep);
>> kfree(net->ct.slabname);
>> free_percpu(net->ct.stat);
>> @@ -1573,6 +1574,9 @@ static int nf_conntrack_init_net(struct net *net)
>> printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
>> goto err_hash;
>> }
>> + ret = nf_conntrack_proto_generic_net_init(net);
>> + if (ret < 0)
>> + goto err_generic;
>> ret = nf_conntrack_expect_init(net);
>> if (ret < 0)
>> goto err_expect;
>> @@ -1600,6 +1604,8 @@ err_tstamp:
>> err_acct:
>> nf_conntrack_expect_fini(net);
>> err_expect:
>> + nf_conntrack_proto_generic_net_fini(net);
>> +err_generic:
>> nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
>> err_hash:
>> kmem_cache_destroy(net->ct.nf_conntrack_cachep);
>> diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
>> index 835e24c..0d4545b 100644
>> --- a/net/netfilter/nf_conntrack_proto_generic.c
>> +++ b/net/netfilter/nf_conntrack_proto_generic.c
>> @@ -42,7 +42,7 @@ static int generic_print_tuple(struct seq_file *s,
>>
>> static unsigned int *generic_get_timeouts(struct net *net)
>> {
>> - return &nf_ct_generic_timeout;
>> + return &(net->ct.proto.sysctl_generic_timeout);
>> }
>>
>> /* Returns verdict for packet, or -1 for invalid. */
>> @@ -105,11 +105,10 @@ generic_timeout_nla_policy[CTA_TIMEOUT_GENERIC_MAX+1] = {
>> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
>>
>> #ifdef CONFIG_SYSCTL
>> -static struct ctl_table_header *generic_sysctl_header;
>> static struct ctl_table generic_sysctl_table[] = {
>> {
>> .procname = "nf_conntrack_generic_timeout",
>> - .data = &nf_ct_generic_timeout,
>> + .data = &init_net.ct.proto.sysctl_generic_timeout,
>> .maxlen = sizeof(unsigned int),
>> .mode = 0644,
>> .proc_handler = proc_dointvec_jiffies,
>> @@ -120,7 +119,7 @@ static struct ctl_table generic_sysctl_table[] = {
>> static struct ctl_table generic_compat_sysctl_table[] = {
>> {
>> .procname = "ip_conntrack_generic_timeout",
>> - .data = &nf_ct_generic_timeout,
>> + .data = &init_net.ct.proto.sysctl_generic_timeout,
>> .maxlen = sizeof(unsigned int),
>> .mode = 0644,
>> .proc_handler = proc_dointvec_jiffies,
>> @@ -150,11 +149,89 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_generic __read_mostly =
>> .nla_policy = generic_timeout_nla_policy,
>> },
>> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
>> +};
>> +
>> +int nf_conntrack_proto_generic_net_init(struct net *net)
>
> Please, check int nf_conntrack_ecache_init(struct net *net) for
> instance on how we're doing the per-net registration of netfilter
> modules.
nf_conntrack_l4proto_generic is registered when loading nf_conntrack module.
so we should register sysctl in nf_conntrack_init_net.
I don't know what's wrong here...
>
> Basically, we register the module only once for the init_net case.
> Then, we register one sysctl per-net.
>
>> +{
>> + struct ctl_table *table;
>> + int ret = 0;
>> #ifdef CONFIG_SYSCTL
>> - .ctl_table_header = &generic_sysctl_header,
>> - .ctl_table = generic_sysctl_table,
>> #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
>> - .ctl_compat_table = generic_compat_sysctl_table,
>> + struct ctl_table *compat_table;
>> #endif
>> #endif
>> -};
>> + net->ct.proto.sysctl_generic_timeout = nf_ct_generic_timeout;
>> +#ifdef CONFIG_SYSCTL
>> + table = kmemdup(generic_sysctl_table,
>> + sizeof(generic_sysctl_table),
>> + GFP_KERNEL);
>> + if (!table)
>> + return -ENOMEM;
>> +
>> + table[0].data = &net->ct.proto.sysctl_generic_timeout;
>> +
>> + ret = nf_ct_register_net_sysctl(net,
>> + &net->ct.proto.generic_sysctl_header,
>> + nf_net_netfilter_sysctl_path,
>> + table,
>> + NULL);
>> + if (ret < 0) {
>> + printk(KERN_ERR
>> + "nf_conntrack_proto_generic:"
>> + " can't register to sysctl.\n");
>> + kfree(table);
>> + return ret;
>> + }
>> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
>> + compat_table = kmemdup(generic_compat_sysctl_table,
>> + sizeof(generic_compat_sysctl_table),
>> + GFP_KERNEL);
>> + if (!compat_table) {
>> + ret = -ENOMEM;
>> + goto out_compat;
>> + }
>> + compat_table[0].data = &net->ct.proto.sysctl_generic_timeout;
>> + ret = nf_ct_register_net_sysctl(net,
>> + &net->ct.proto.generic_compat_header,
>> + nf_net_ipv4_netfilter_sysctl_path,
>> + compat_table,
>> + NULL);
>> + if (ret < 0) {
>> + printk(KERN_ERR
>> + "nf_conntrack_proto_generic:"
>> + " can't register to compat sysctl.\n");
>> + goto out_compat_register;
>> + }
>> +#endif
>> + return 0;
>> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
>> +out_compat_register:
>> + kfree(compat_table);
>> +out_compat:
>> + nf_ct_unregister_net_sysctl(&net->ct.proto.generic_sysctl_header,
>> + table,
>> + NULL);
>> +#endif
>> +#endif
>> + return ret;
>> +}
>> +
>> +void nf_conntrack_proto_generic_net_fini(struct net *net)
>> +{
>> +#ifdef CONFIG_SYSCTL
>> + struct ctl_table *table;
>> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
>> + struct ctl_table *compat_table;
>> +#endif
>> + table = net->ct.proto.generic_sysctl_header->ctl_table_arg;
>> + nf_ct_unregister_net_sysctl(&net->ct.proto.generic_sysctl_header,
>> + table,
>> + NULL);
>> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
>> + compat_table = net->ct.proto.generic_compat_header->ctl_table_arg;
>> + nf_ct_unregister_net_sysctl(&net->ct.proto.generic_compat_header,
>> + compat_table,
>> + NULL);
>> +#endif
>> +#endif
>> +}
>> --
>> 1.7.7.6
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe netdev" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 02/12] netfilter: don't register sysctl when register proto
From: Gao feng @ 2012-04-17 10:25 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <20120417085617.GC2100@1984>
于 2012年04月17日 16:56, Pablo Neira Ayuso 写道:
> On Tue, Apr 17, 2012 at 10:56:13AM +0800, Gao feng wrote:
>> delete nf_ct_l[3,4]proto_register_sysctl when register l[3,4]proto.
>> and add nf_ct_register_net_sysctl,nf_ct_unregister_net_sysctl to
>> register the sysctl for net namespace.
>>
>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
>> ---
>> net/netfilter/nf_conntrack_proto.c | 109 +++++-------------------------------
>> 1 files changed, 15 insertions(+), 94 deletions(-)
>>
>> diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
>> index be3da2c..207cdd8 100644
>> --- a/net/netfilter/nf_conntrack_proto.c
>> +++ b/net/netfilter/nf_conntrack_proto.c
>> @@ -35,12 +35,15 @@ EXPORT_SYMBOL_GPL(nf_ct_l3protos);
>> static DEFINE_MUTEX(nf_ct_proto_mutex);
>>
>> #ifdef CONFIG_SYSCTL
>> -static int
>> -nf_ct_register_sysctl(struct ctl_table_header **header, struct ctl_path *path,
>> - struct ctl_table *table, unsigned int *users)
>> +int
>> +nf_ct_register_net_sysctl(struct net *net,
>> + struct ctl_table_header **header,
>> + struct ctl_path *path,
>> + struct ctl_table *table,
>> + unsigned int *users)
>
> Please, don't rename this function. Just add the *net parameter
> instead.
>
OK,i will modify it.
>> {
>> if (*header == NULL) {
>> - *header = register_sysctl_paths(path, table);
>> + *header = register_net_sysctl_table(net, path, table);
>> if (*header == NULL)
>> return -ENOMEM;
>> }
>> @@ -48,17 +51,21 @@ nf_ct_register_sysctl(struct ctl_table_header **header, struct ctl_path *path,
>> (*users)++;
>> return 0;
>> }
>> +EXPORT_SYMBOL_GPL(nf_ct_register_net_sysctl);
>>
>> -static void
>> -nf_ct_unregister_sysctl(struct ctl_table_header **header,
>> - struct ctl_table *table, unsigned int *users)
>> +void
>> +nf_ct_unregister_net_sysctl(struct ctl_table_header **header,
>> + struct ctl_table *table,
>> + unsigned int *users)
>> {
>> if (users != NULL && --*users > 0)
>> return;
>>
>> unregister_sysctl_table(*header);
>> + kfree(table);
>> *header = NULL;
>> }
>> +EXPORT_SYMBOL_GPL(nf_ct_unregister_net_sysctl);
>> #endif
>>
>> struct nf_conntrack_l4proto *
>> @@ -161,29 +168,6 @@ static int kill_l4proto(struct nf_conn *i, void *data)
>> nf_ct_l3num(i) == l4proto->l3proto;
>> }
>>
>> -static int nf_ct_l3proto_register_sysctl(struct nf_conntrack_l3proto *l3proto)
>> -{
>> - int err = 0;
>> -
>> -#ifdef CONFIG_SYSCTL
>> - if (l3proto->ctl_table != NULL) {
>> - err = nf_ct_register_sysctl(&l3proto->ctl_table_header,
>> - l3proto->ctl_table_path,
>> - l3proto->ctl_table, NULL);
>> - }
>> -#endif
>> - return err;
>> -}
>> -
>> -static void nf_ct_l3proto_unregister_sysctl(struct nf_conntrack_l3proto *l3proto)
>> -{
>> -#ifdef CONFIG_SYSCTL
>> - if (l3proto->ctl_table_header != NULL)
>> - nf_ct_unregister_sysctl(&l3proto->ctl_table_header,
>> - l3proto->ctl_table, NULL);
>> -#endif
>> -}
>> -
>> int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
>> {
>> int ret = 0;
>> @@ -203,10 +187,6 @@ int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
>> goto out_unlock;
>> }
>>
>> - ret = nf_ct_l3proto_register_sysctl(proto);
>> - if (ret < 0)
>> - goto out_unlock;
>> -
>> if (proto->nlattr_tuple_size)
>> proto->nla_size = 3 * proto->nlattr_tuple_size();
>>
>> @@ -230,7 +210,6 @@ void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
>> ) != proto);
>> rcu_assign_pointer(nf_ct_l3protos[proto->l3proto],
>> &nf_conntrack_l3proto_generic);
>> - nf_ct_l3proto_unregister_sysctl(proto);
>> mutex_unlock(&nf_ct_proto_mutex);
>>
>> synchronize_rcu();
>> @@ -243,52 +222,6 @@ void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
>> }
>> EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
>>
>> -static int nf_ct_l4proto_register_sysctl(struct nf_conntrack_l4proto *l4proto)
>> -{
>> - int err = 0;
>> -
>> -#ifdef CONFIG_SYSCTL
>> - if (l4proto->ctl_table != NULL) {
>> - err = nf_ct_register_sysctl(l4proto->ctl_table_header,
>> - nf_net_netfilter_sysctl_path,
>> - l4proto->ctl_table,
>> - l4proto->ctl_table_users);
>> - if (err < 0)
>> - goto out;
>> - }
>> -#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
>> - if (l4proto->ctl_compat_table != NULL) {
>> - err = nf_ct_register_sysctl(&l4proto->ctl_compat_table_header,
>> - nf_net_ipv4_netfilter_sysctl_path,
>> - l4proto->ctl_compat_table, NULL);
>> - if (err == 0)
>> - goto out;
>> - nf_ct_unregister_sysctl(l4proto->ctl_table_header,
>> - l4proto->ctl_table,
>> - l4proto->ctl_table_users);
>> - }
>> -#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
>> -out:
>> -#endif /* CONFIG_SYSCTL */
>> - return err;
>> -}
>> -
>> -static void nf_ct_l4proto_unregister_sysctl(struct nf_conntrack_l4proto *l4proto)
>> -{
>> -#ifdef CONFIG_SYSCTL
>> - if (l4proto->ctl_table_header != NULL &&
>> - *l4proto->ctl_table_header != NULL)
>> - nf_ct_unregister_sysctl(l4proto->ctl_table_header,
>> - l4proto->ctl_table,
>> - l4proto->ctl_table_users);
>> -#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
>> - if (l4proto->ctl_compat_table_header != NULL)
>> - nf_ct_unregister_sysctl(&l4proto->ctl_compat_table_header,
>> - l4proto->ctl_compat_table, NULL);
>> -#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
>> -#endif /* CONFIG_SYSCTL */
>> -}
>> -
>
> Where did this function go?
nf_ct_l4proto_unregister_sysctl just register sysctl,and we move this logic
to the pernet_operations.init, so this function has no use.
>
>> /* FIXME: Allow NULL functions and sub in pointers to generic for
>> them. --RR */
>> int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *l4proto)
>> @@ -333,10 +266,6 @@ int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *l4proto)
>> goto out_unlock;
>> }
>>
>> - ret = nf_ct_l4proto_register_sysctl(l4proto);
>> - if (ret < 0)
>> - goto out_unlock;
>> -
>> l4proto->nla_size = 0;
>> if (l4proto->nlattr_size)
>> l4proto->nla_size += l4proto->nlattr_size();
>> @@ -365,7 +294,6 @@ void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
>> ) != l4proto);
>> rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
>> &nf_conntrack_l4proto_generic);
>> - nf_ct_l4proto_unregister_sysctl(l4proto);
>> mutex_unlock(&nf_ct_proto_mutex);
>>
>> synchronize_rcu();
>> @@ -380,12 +308,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_unregister);
>>
>> int nf_conntrack_proto_init(void)
>> {
>> - unsigned int i;
>> - int err;
>> -
>> - err = nf_ct_l4proto_register_sysctl(&nf_conntrack_l4proto_generic);
>> - if (err < 0)
>> - return err;
>> + unsigned int i;
>>
>> for (i = 0; i < AF_MAX; i++)
>> rcu_assign_pointer(nf_ct_l3protos[i],
>> @@ -397,8 +320,6 @@ void nf_conntrack_proto_fini(void)
>> {
>> unsigned int i;
>>
>> - nf_ct_l4proto_unregister_sysctl(&nf_conntrack_l4proto_generic);
>> -
>> /* free l3proto protocol tables */
>> for (i = 0; i < PF_MAX; i++)
>> kfree(nf_ct_protos[i]);
>> --
>> 1.7.7.6
>>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 10/12] netfilter: sctp proto sysctl support for net namespace
From: Gao feng @ 2012-04-17 10:30 UTC (permalink / raw)
To: Gao feng; +Cc: pablo, netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <1334631383-12326-11-git-send-email-gaofeng@cn.fujitsu.com>
于 2012年04月17日 10:56, Gao feng 写道:
> register pernet_operations nf_conntrack_net_proto_sctp_ops
> when loading nf_conntrack_proto_sctp module,and unregister
> it when removing.
>
> It makes no senes to register subsys for sctp and sctp6,because
> the nf_conntrack_l4proto_sctp4 and nf_conntrack_l4proto_sctp6 are
> register or unregister together.
>
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
I think it's better to impletement this as dccp,
dccp stores the timeouts and ctl_table in net_generic.
This will don't cause waste when sctp module is not loaded.
> ---
> net/netfilter/nf_conntrack_proto_sctp.c | 205 ++++++++++++++++++++++++++-----
> 1 files changed, 175 insertions(+), 30 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> index 72b5088..866d151 100644
> --- a/net/netfilter/nf_conntrack_proto_sctp.c
> +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> @@ -281,7 +281,7 @@ static int sctp_new_state(enum ip_conntrack_dir dir,
>
> static unsigned int *sctp_get_timeouts(struct net *net)
> {
> - return sctp_timeouts;
> + return net->ct.proto.sysctl_sctp_timeouts;
> }
>
> /* Returns verdict for packet, or -NF_ACCEPT for invalid. */
> @@ -599,56 +599,60 @@ sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
> };
> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
>
> -
> #ifdef CONFIG_SYSCTL
> -static unsigned int sctp_sysctl_table_users;
> -static struct ctl_table_header *sctp_sysctl_header;
> static struct ctl_table sctp_sysctl_table[] = {
> {
> .procname = "nf_conntrack_sctp_timeout_closed",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_CLOSED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_cookie_wait",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_cookie_echoed",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_established",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_shutdown_sent",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_shutdown_recd",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> @@ -660,49 +664,56 @@ static struct ctl_table sctp_sysctl_table[] = {
> static struct ctl_table sctp_compat_sysctl_table[] = {
> {
> .procname = "ip_conntrack_sctp_timeout_closed",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_CLOSED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_cookie_wait",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_cookie_echoed",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_established",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_shutdown_sent",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_shutdown_recd",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> },
> {
> .procname = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
> - .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
> + .data = &init_net.ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
> .maxlen = sizeof(unsigned int),
> .mode = 0644,
> .proc_handler = proc_dointvec_jiffies,
> @@ -742,14 +753,6 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
> .nla_policy = sctp_timeout_nla_policy,
> },
> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
> -#ifdef CONFIG_SYSCTL
> - .ctl_table_users = &sctp_sysctl_table_users,
> - .ctl_table_header = &sctp_sysctl_header,
> - .ctl_table = sctp_sysctl_table,
> -#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> - .ctl_compat_table = sctp_compat_sysctl_table,
> -#endif
> -#endif
> };
>
> static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
> @@ -782,11 +785,146 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
> },
> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
> #endif
> +};
> +
> +static int nf_conntrack_proto_sctp_net_init(struct net *net)
> +{
> + struct ctl_table *table;
> + int i, ret = 0;
> + for (i = 0; i < SCTP_CONNTRACK_MAX; i++)
> + net->ct.proto.sysctl_sctp_timeouts[i] = sctp_timeouts[i];
> +
> #ifdef CONFIG_SYSCTL
> - .ctl_table_users = &sctp_sysctl_table_users,
> - .ctl_table_header = &sctp_sysctl_header,
> - .ctl_table = sctp_sysctl_table,
> + table = kmemdup(sctp_sysctl_table,
> + sizeof(sctp_sysctl_table),
> + GFP_KERNEL);
> + if (!table)
> + return -ENOMEM;
> + table[0].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_CLOSED];
> + table[1].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT];
> + table[2].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED];
> + table[3].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED];
> + table[4].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT];
> + table[5].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD];
> + table[6].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT];
> +
> + ret = nf_ct_register_net_sysctl(net,
> + &net->ct.proto.sctp_sysctl_header,
> + nf_net_netfilter_sysctl_path,
> + table,
> + NULL);
> + if (ret < 0) {
> + printk(KERN_ERR
> + "nf_conntrack_proto_sctp:"
> + " can't register to sysctl.\n");
> + goto out_register;
> + }
> + return 0;
> +out_register:
> + kfree(table);
> #endif
> + return ret;
> +}
> +
> +static void nf_conntrack_proto_sctp_net_fini(struct net *net)
> +{
> +#ifdef CONFIG_SYSCTL
> + struct ctl_table *table;
> + table = net->ct.proto.sctp_sysctl_header->ctl_table_arg;
> +
> + nf_ct_unregister_net_sysctl(&net->ct.proto.sctp_sysctl_header,
> + table,
> + NULL);
> +#endif
> +}
> +
> +static int nf_conntrack_proto_sctp_compat_init(struct net *net)
> +{
> + int ret = 0;
> +#ifdef CONFIG_SYSCTL
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> + struct ctl_table *compat_table;
> + compat_table = kmemdup(sctp_compat_sysctl_table,
> + sizeof(sctp_compat_sysctl_table),
> + GFP_KERNEL);
> + if (!compat_table)
> + return -ENOMEM;
> +
> + compat_table[0].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_CLOSED];
> + compat_table[1].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT];
> + compat_table[2].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED];
> + compat_table[3].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED];
> + compat_table[4].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT];
> + compat_table[5].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD];
> + compat_table[6].data = &net->ct.proto.
> + sysctl_sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT];
> +
> + ret = nf_ct_register_net_sysctl(net,
> + &net->ct.proto.sctp_compat_header,
> + nf_net_ipv4_netfilter_sysctl_path,
> + compat_table,
> + NULL);
> + if (ret < 0) {
> + printk(KERN_ERR
> + "nf_conntrack_proto_sctp:"
> + " can't register to compat sysctl.\n");
> + goto out_register;
> + }
> + return 0;
> +out_register:
> + kfree(compat_table);
> +#endif
> +#endif
> + return ret;
> +}
> +
> +static void nf_conntrack_proto_sctp_compat_fini(struct net *net)
> +{
> +#ifdef CONFIG_SYSCTL
> +#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
> + struct ctl_table *compat_table;
> + compat_table = net->ct.proto.sctp_compat_header->ctl_table_arg;
> + nf_ct_unregister_net_sysctl(&net->ct.proto.sctp_compat_header,
> + compat_table,
> + NULL);
> +#endif
> +#endif
> +}
> +
> +static int nf_conntrack_net_proto_sctp_init(struct net *net)
> +{
> + int ret;
> + ret = nf_conntrack_proto_sctp_net_init(net);
> + if (ret < 0)
> + return ret;
> + ret = nf_conntrack_proto_sctp_compat_init(net);
> + if (ret < 0)
> + nf_conntrack_proto_sctp_net_fini(net);
> + return ret;
> +}
> +
> +static void nf_conntrack_net_proto_sctp_fini(struct net *net)
> +{
> + nf_conntrack_proto_sctp_compat_fini(net);
> + nf_conntrack_proto_sctp_net_fini(net);
> +}
> +
> +static struct pernet_operations nf_conntrack_net_proto_sctp_ops = {
> + .init = nf_conntrack_net_proto_sctp_init,
> + .exit = nf_conntrack_net_proto_sctp_fini,
> };
>
> static int __init nf_conntrack_proto_sctp_init(void)
> @@ -803,9 +941,15 @@ static int __init nf_conntrack_proto_sctp_init(void)
> pr_err("nf_conntrack_l4proto_sctp6: protocol register failed\n");
> goto cleanup_sctp4;
> }
> -
> + ret = register_pernet_subsys(&nf_conntrack_net_proto_sctp_ops);
> + if (ret) {
> + pr_err("nf_conntrack: sctp pernet subsys register failed\n");
> + goto cleanup_sctp6;
> + }
> return ret;
>
> + cleanup_sctp6:
> + nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
> cleanup_sctp4:
> nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
> out:
> @@ -814,6 +958,7 @@ static int __init nf_conntrack_proto_sctp_init(void)
>
> static void __exit nf_conntrack_proto_sctp_fini(void)
> {
> + unregister_pernet_subsys(&nf_conntrack_net_proto_sctp_ops);
> nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
> nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
> }
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Server Rental Service in Hong Kong
From: boris @ 2012-04-17 9:45 UTC (permalink / raw)
Dear All,
We have our own datacenter in Hong Kong & provide email/application/web rental service to clients.We are APNIC member & provide clean IP to clients.
Dell? PowerEdge? EnterpriseRack Mount Server
-Intel(R) Xeon(R) E3-1240 Processor (3.3GHz, 8M Cache, Turbo, 4C/8T, 80W)
-8GB RAM, 2x4GB, 1333MHz, DDR-3, Dual Ranked UDIMMs
-500GB, 3.5", 6Gbps SAS x 2
-Raid 1 Mirroring Protection
-Remote KVM (iDRAC6 Enterprise)
Dell(TM) PowerEdge(TM) R410 Rack Mount Server
-Intel(R) Quad Core E5606 Xeon(R) CPU, 2.13GHz, 4M Cache, 4.86 GT/s QPI
-4GB Memory (2x2GB), 1333MHz Dual Ranked RDIMMs Fully-Buffered
-500GB 7.2K RPM SATAII 3.5" Hard Drive x 2
-iDRAC6 Enterprise or Express (Remote KVM Management)
Every Dedicated Server Hosting Solution Also Includes:
Software Specification
- CentOS / Fedora / Debian / FreeBSD / Ubuntu / Redhat Linux
- Full root-level access
- Data Center Facilities
- Shared Local & International Bandwidth
- 2 IP Addresses Allocation
- Un-interruptible Power Supply (UPS) backed up by private diesel generator
- FM200¡§based fire suppression system
- 24x7 CRAC Air Conditioning and Humidity Control
- 24x7 Security Control
- 24x7 Remote Hand Service
Pls send us email for further information.Thanks,
Boris
boris@dedicatedserver.com.hk
If you do not wish to further receive this event message, email "borislamsv2@gmail.com" to unsubscribe this message or remove your email from the list.
^ permalink raw reply
* Re: [PATCH 00/12] add namespace support for netfilter protos
From: Jan Engelhardt @ 2012-04-17 10:34 UTC (permalink / raw)
To: Gao feng; +Cc: pablo, netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <1334631383-12326-1-git-send-email-gaofeng@cn.fujitsu.com>
On Tuesday 2012-04-17 04:56, Gao feng wrote:
>Currently the sysctl of netfilter proto is not isolated, so when
>changing proto's sysctl in container will cause the host's sysctl
>be changed too. it's not expected.
I wonder if it made sense to do the configuration of NFCT via
netlink as well, and deprecate the sysctl interface.
^ permalink raw reply
* [patch] Fix handling of overlength pathname in AF_UNIX sun_path
From: Michael Kerrisk @ 2012-04-17 10:44 UTC (permalink / raw)
To: netdev
Cc: Tetsuo Handa, linux-api-u79uwXL29TY76Z2rM5mHXA,
yoshfuji-VfPWfsRibaP+Ru+s062T9g, David Miller, Jan Engelhardt,
Willy Tarreau, Alan Cox
Tetsuo Handa sent me a patch to document the kernel's odd
behavior when asked to create a UNIX domain socket address where the
pathname completely fills the sun_path field without including a null
terminator [1].
One of the consequences of the current kernel behavior is that
when a socket address is returned to userspace (via getsockname(),
getpeername(), accept(), recvfrom()), applications can't reliably
do things such as:
printf("%s\n", addr.sun_path);
Instead one must either write:
printf("%.*s\n", sizeof(addr.sun_path), addr.sun_path);
or, when retrieving a socket address structure, employ a buffer whose
size is:
sizeof(struct sockaddr_un) + 1
(This ensures that there is enough space to hold the null terminator
for the case where a socket was bound to a sun_path with non-NUL characters
in all 108 bytes. But it entails some casting.)
Tetsuo initially considered there might be a kernel bug here,
but an attempt to change the kernel behavior met resistance [2].
The patch at the end of this message is a slightly different
fix for the same problem. There are a few reasons why I think
it (or some variation) should be considered:
1. Changing the kernel behavior prevents userspace having
to go through the sort of contortions described above
in order to handle the 108-non-NUL-bytes-in-sun_path case.
2. POSIX says that sun_path is a pathname. By (POSIX) definition,
a pathname is null terminated.
3. Considering these two sets:
(a) [applications that rely on the assumption that there
is a null terminator inside sizeof(sun_path) bytes]
(b) [applications that would break if the kernel behavior changed]
I suspect that set (a) is rather larger than set (b)--or, more
likely still, applications ensure they go for the lowest common
denominator limit of 92 (HP-UX) or 104 (historical BSD limit)
bytes, and so avoid this issue completely.
The accompanying patch changes unix_mkname() to ensure that a terminating
null byte is always located within the first 108 bytes of sun_path.
It does change the ABI for the former case where a pathname ran to 108
bytes without a null terminator: for that case, the call now fails with
the error -EINVAL. What are people's thoughts on applying this?
[1] http://thread.gmane.org/gmane.linux.network/174473/focus=1861
[2] http://thread.gmane.org/gmane.linux.kernel/291038
Signed-off-by: Michael Kerrisk <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
--- net/unix/af_unix.c.orig 2012-04-17 09:50:07.383459311 +1200
+++ net/unix/af_unix.c 2012-04-17 19:49:56.077852639 +1200
@@ -207,14 +207,16 @@ static int unix_mkname(struct sockaddr_u
if (!sunaddr || sunaddr->sun_family != AF_UNIX)
return -EINVAL;
if (sunaddr->sun_path[0]) {
- /*
- * This may look like an off by one error but it is a bit more
- * subtle. 108 is the longest valid AF_UNIX path for a binding.
- * sun_path[108] doesn't as such exist. However in kernel space
- * we are guaranteed that it is a valid memory location in our
- * kernel address buffer.
- */
- ((char *)sunaddr)[len] = 0;
+ if (len == sizeof(*sunaddr)) {
+ /*
+ * If 'sun_path' is completely filled, the user
+ * must include a terminator
+ */
+ if (!memchr(sunaddr->sun_path, '\0',
+ sizeof(sunaddr->sun_path)))
+ return -EINVAL;
+ } else
+ ((char *)sunaddr)[len] = 0;
len = strlen(sunaddr->sun_path)+1+sizeof(short);
return len;
}
^ permalink raw reply
* Re: [PATCH 6/6] vhost_net: don't poll on -EFAULT
From: Jason Wang @ 2012-04-17 10:46 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: netdev, xma, davem, linux-kernel, ebiederm
In-Reply-To: <20120417101820.GB20905@redhat.com>
On 04/17/2012 06:18 PM, Michael S. Tsirkin wrote:
> On Tue, Apr 17, 2012 at 02:30:27PM +0800, Jason Wang wrote:
>> > On 04/17/2012 02:07 PM, Michael S. Tsirkin wrote:
>>> > >On Tue, Apr 17, 2012 at 01:54:55PM +0800, Jason Wang wrote:
>>>> > >>On 04/17/2012 12:57 PM, Michael S. Tsirkin wrote:
>>>>> > >>>On Tue, Apr 17, 2012 at 11:27:01AM +0800, Jason Wang wrote:
>>>>>> > >>>>On 04/16/2012 09:39 PM, Michael S. Tsirkin wrote:
>>>>>>> > >>>>>On Mon, Apr 16, 2012 at 04:28:10PM +0800, Jason Wang wrote:
>>>>>>>>> > >>>>>>> On 04/16/2012 03:16 PM, Michael S. Tsirkin wrote:
>>>>>>>>>> > >>>>>>>> >On Mon, Apr 16, 2012 at 02:08:33PM +0800, Jason Wang wrote:
>>>>>>>>>>> > >>>>>>>>> >>Currently, we restart tx polling unconditionally when sendmsg()
>>>>>>>>>>> > >>>>>>>>> >>fails. This would cause unnecessary wakeups of vhost wokers as it's
>>>>>>>>>>> > >>>>>>>>> >>only needed when the socket send buffer were exceeded.
>>>>>>>>>> > >>>>>>>> >Why is this a problem?
>>>>>>>>> > >>>>>>> > This issue is when guest driver is able to hit the
>>>>>>>> > >>>>>>-EFAULT, vhost
>>>>>>>>> > >>>>>>> discard the the descriptor and restart the polling. This would wake
>>>>>>>>> > >>>>>>> vhost thread and repeat the loop again which waste cpu.
>>>>>>> > >>>>>Does same thing happen if we get an error from copy from user?
>>>>>>> > >>>>>
>>>>>> > >>>>Right, so do you think it makes sense that we only restart polling
>>>>>> > >>>>on -EAGAIN or -ENOBUFS?
>>>>> > >>>Sounds OK. BTW how do you test this?
>>>>> > >>>
>>>> > >>Not very hard, w/o this patch, we can see almost 100% cpu
>>>> > >>utilization for vhost thread if guest hit EFAULT or EINVAL. With
>>>> > >>this patch, the cpu utilization should be very low I think.
>>> > >Yes but do you have a test that makes guest hit EFAULT or EINVAL?
>> >
>> > Looks like we can do this by supplying an invalid hdr_len in vnet
>> > header as tap does the check for this.
> Ah so you patched qemu to do this? Cool. Can you post the patch for testing pls?
>
No, I mean patch the guest driver like this:
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 019da01..6e2f487 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -582,7 +582,7 @@ static int xmit_skb(struct virtnet_info *vi, struct
sk_buff *skb)
}
if (skb_is_gso(skb)) {
- hdr->hdr.hdr_len = skb_headlen(skb);
+ hdr->hdr.hdr_len = 65535;
hdr->hdr.gso_size = skb_shinfo(skb)->gso_size;
if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
btw, If we still choose to drop the packet, we can hit -EFAULT by send a
descriptor with a large number of pages.
^ permalink raw reply related
* Re: [PATCH 5/6] vhost_net: fix use after free of vq->ubufs
From: Jason Wang @ 2012-04-17 10:47 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: netdev, xma, davem, linux-kernel, ebiederm
In-Reply-To: <20120417102220.GC20905@redhat.com>
On 04/17/2012 06:22 PM, Michael S. Tsirkin wrote:
> On Tue, Apr 17, 2012 at 11:19:42AM +0800, Jason Wang wrote:
>> > On 04/16/2012 09:28 PM, Michael S. Tsirkin wrote:
>>> > >On Mon, Apr 16, 2012 at 02:08:25PM +0800, Jason Wang wrote:
>>>> > >>When zerocopy socket is used, ubufs pointer were used in handle_tx()
>>>> > >>without any validation. This would cause NULL pointer deference after
>>>> > >>it has been freed in vhost_net_set_backend(). Fix this by check the
>>>> > >>pointer before using it.
>>>> > >>
>>>> > >>Signed-off-by: Jason Wang<jasowang@redhat.com>
>>> > >
>>> > >OK so it's NULL dereference and not user after free:)
>>> > >Also could you clarify how does this happen pls?
>>> > >Don't we always initialize ubufs when vhost_sock_zcopy is set?
>> >
>> > The problem happens when we want to disable backend. At this time
>> > ubufs were assigned to NULL and it may be dereferenced by
>> > handle_tx():
> Heh, I see. How about
> - zcopy = vhost_sock_zcopy(sock);
> + zcopy = vq->ubufs;
Yes, It's more is simpler.
^ permalink raw reply
* Re: [patch] Fix handling of overlength pathname in AF_UNIX sun_path
From: Willy Tarreau @ 2012-04-17 10:51 UTC (permalink / raw)
To: Michael Kerrisk
Cc: netdev, Tetsuo Handa, linux-api-u79uwXL29TY76Z2rM5mHXA,
yoshfuji-VfPWfsRibaP+Ru+s062T9g, David Miller, Jan Engelhardt,
Alan Cox
In-Reply-To: <4F8D497F.8060601-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Hi Michael,
On Tue, Apr 17, 2012 at 10:44:15PM +1200, Michael Kerrisk wrote:
(...)
> The accompanying patch changes unix_mkname() to ensure that a terminating
> null byte is always located within the first 108 bytes of sun_path.
> It does change the ABI for the former case where a pathname ran to 108
> bytes without a null terminator: for that case, the call now fails with
> the error -EINVAL. What are people's thoughts on applying this?
My personal opinion is that (as you said), the risk of breaking existing
apps is already fairly low, but we must not deliberately break existing
apps. Eventhough there are currently a log, this is exactly what sysctls
are made for. I would personally like to have a default limit to 107 chars
+ one zero, with a sysctl option to revert to current behaviour if ever it
broke an application. In my opinion it's exactly comparable to the risk of
breaking apps with mmap_min_addr : very low risk but must be covered by a
workaround (sysctl).
Just my 2 cents,
Willy
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox