* Re: [PATCH] ipv6:examine the IP source address legitimacy
From: Eric Dumazet @ 2013-08-27 12:05 UTC (permalink / raw)
To: Duan Jiong; +Cc: davem, netdev
In-Reply-To: <521C90A0.60708@cn.fujitsu.com>
On Tue, 2013-08-27 at 19:42 +0800, Duan Jiong wrote:
> From: Duan Jiong <duanj.fnst@cn.fujitsu.com>
>
> RFC4861 8.1:
> The IP source address of the Redirect is the
> same as the current first-hop router for the
> specified ICMP Destination Address.
>
> Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com>
> ---
What about updating the comment around line 1726 ?
/* RFC2461 8.1:
* The IP source address of the Redirect MUST be the same as the current
* first-hop router for the specified ICMP Destination Address.
*/
Thanks
^ permalink raw reply
* Re: [PATCH 0/5] netfilter: SYNPROXY target v3
From: Martin Topholm @ 2013-08-27 12:05 UTC (permalink / raw)
To: Patrick McHardy; +Cc: pablo, netfilter-devel, netdev, jesper.brouer, as
In-Reply-To: <1377586216-7024-1-git-send-email-kaber@trash.net>
Tested-by: Martin Topholm <mph@one.com>
Thanks!
^ permalink raw reply
* Re: [PATCH 0/5] netfilter: SYNPROXY target v3
From: Jesper Dangaard Brouer @ 2013-08-27 12:08 UTC (permalink / raw)
To: Jesper Dangaard Brouer
Cc: Patrick McHardy, pablo, netfilter-devel, netdev, mph, as
In-Reply-To: <Pine.LNX.4.64.1308270951520.25216@ask.diku.dk>
On Tue, 27 Aug 2013 10:35:56 +0200 (CEST) Jesper Dangaard Brouer <hawk@diku.dk> wrote:
> On Tue, 27 Aug 2013, Patrick McHardy wrote:
> > We did some extensive testing on Monday and it verified all retransmit
> > bugs have been fixed. With 1.4Mpps SYNs the load on a 16 way Xeon L6530
> > 2.13 Ghz machine was between 3% and 6%.
>
> It was a Xeon L5630 ;-)
>
> We tested both SYN and ACK flood-attacks, while running ab (Apache
> Benchmark). The 1.4Mpps comes from limitations on the generator host
> (which used trafgen). We also did some short tests with a modified
> pktgen. And Martin wrote a test tool, that would delay conn
> establishment, to test retransmits. And Patritck tested in (simulated)
> drop situations.
>
[...]
> >
> > From my POV, these patches are ready for merging now.
>
> Yes, Martin and Patrick (and I) have done some good testing of the module.
> And we have flushed out and solved several bugs in this process.
Series:
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Sr. Network Kernel Developer at Red Hat
Author of http://www.iptv-analyzer.org
LinkedIn: http://www.linkedin.com/in/brouer
^ permalink raw reply
* [PATCH] net/cadence/macb: fix invalid 0 return if no phy is discovered on mii init
From: Boris BREZILLON @ 2013-08-27 12:36 UTC (permalink / raw)
To: Rob Herring, Pawel Moll, Mark Rutland, Stephen Warren,
Ian Campbell, Russell King, Nicolas Ferre, David S. Miller
Cc: devicetree, linux-arm-kernel, linux-kernel, netdev,
Boris BREZILLON
Replace misleading -1 (-EPERM) by a more appropriate return code (-ENXIO)
in macb_mii_probe function.
Save macb_mii_probe return before branching to err_out_unregister to avoid
erronous 0 return.
Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
---
drivers/net/ethernet/cadence/macb.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index fe06ab0..7660c45 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -276,7 +276,7 @@ static int macb_mii_probe(struct net_device *dev)
phydev = phy_find_first(bp->mii_bus);
if (!phydev) {
netdev_err(dev, "no PHY found\n");
- return -1;
+ return -ENXIO;
}
pdata = dev_get_platdata(&bp->pdev->dev);
@@ -379,9 +379,9 @@ int macb_mii_init(struct macb *bp)
if (err)
goto err_out_free_mdio_irq;
- if (macb_mii_probe(bp->dev) != 0) {
+ err = macb_mii_probe(bp->dev);
+ if (err)
goto err_out_unregister_bus;
- }
return 0;
--
1.7.9.5
^ permalink raw reply related
* [PATCH v2] ARM: at91/dt: fix phy address in sama5xmb to match the reg property
From: Boris BREZILLON @ 2013-08-27 12:41 UTC (permalink / raw)
To: Rob Herring, Pawel Moll, Mark Rutland, Stephen Warren,
Ian Campbell, Russell King, Nicolas Ferre, David S. Miller
Cc: devicetree, linux-arm-kernel, linux-kernel, netdev,
Boris BREZILLON
In-Reply-To: <1377605096-20903-1-git-send-email-b.brezillon@overkiz.com>
Fix phy0 address to match the reg property defined in phy0 node.
Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
---
Changes since v1:
- better commit message
arch/arm/boot/dts/sama5d3xmb.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/sama5d3xmb.dtsi b/arch/arm/boot/dts/sama5d3xmb.dtsi
index e9521d5..dba739b 100644
--- a/arch/arm/boot/dts/sama5d3xmb.dtsi
+++ b/arch/arm/boot/dts/sama5d3xmb.dtsi
@@ -84,7 +84,7 @@
#address-cells = <1>;
#size-cells = <0>;
- phy0: ethernet-phy@0 {
+ phy0: ethernet-phy@1 {
interrupt-parent = <&pioE>;
interrupts = <30 IRQ_TYPE_EDGE_FALLING>;
reg = <1>;
--
1.7.9.5
^ permalink raw reply related
* Re: [PATCH v2] ARM: at91/dt: fix phy address in sama5xmb to match the reg property
From: boris brezillon @ 2013-08-27 12:43 UTC (permalink / raw)
To: Boris BREZILLON
Cc: Rob Herring, Pawel Moll, Mark Rutland, Stephen Warren,
Ian Campbell, Russell King, Nicolas Ferre, David S. Miller,
devicetree, linux-arm-kernel, linux-kernel, netdev
In-Reply-To: <1377607313-21331-1-git-send-email-b.brezillon@overkiz.com>
Sorry for the noise, but the previous commit message was not clear enough.
On 27/08/2013 14:41, Boris BREZILLON wrote:
> Fix phy0 address to match the reg property defined in phy0 node.
>
> Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
> Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
> ---
> Changes since v1:
> - better commit message
>
> arch/arm/boot/dts/sama5d3xmb.dtsi | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/arm/boot/dts/sama5d3xmb.dtsi b/arch/arm/boot/dts/sama5d3xmb.dtsi
> index e9521d5..dba739b 100644
> --- a/arch/arm/boot/dts/sama5d3xmb.dtsi
> +++ b/arch/arm/boot/dts/sama5d3xmb.dtsi
> @@ -84,7 +84,7 @@
>
> #address-cells = <1>;
> #size-cells = <0>;
> - phy0: ethernet-phy@0 {
> + phy0: ethernet-phy@1 {
> interrupt-parent = <&pioE>;
> interrupts = <30 IRQ_TYPE_EDGE_FALLING>;
> reg = <1>;
^ permalink raw reply
* [PATCH v3 net-next] tcp: TSO packets automatic sizing
From: Eric Dumazet @ 2013-08-27 12:46 UTC (permalink / raw)
To: David Miller
Cc: netdev, Neal Cardwell, Yuchung Cheng, Van Jacobson, Tom Herbert
In-Reply-To: <1377491162.8828.116.camel@edumazet-glaptop>
From: Eric Dumazet <edumazet@google.com>
After hearing many people over past years complaining against TSO being
bursty or even buggy, we are proud to present automatic sizing of TSO
packets.
One part of the problem is that tcp_tso_should_defer() uses an heuristic
relying on upcoming ACKS instead of a timer, but more generally, having
big TSO packets makes little sense for low rates, as it tends to create
micro bursts on the network, and general consensus is to reduce the
buffering amount.
This patch introduces a per socket sk_pacing_rate, that approximates
the current sending rate, and allows us to size the TSO packets so
that we try to send one packet every ms.
This field could be set by other transports.
Patch has no impact for high speed flows, where having large TSO packets
makes sense to reach line rate.
For other flows, this helps better packet scheduling and ACK clocking.
This patch increases performance of TCP flows in lossy environments.
A new sysctl (tcp_min_tso_segs) is added, to specify the
minimal size of a TSO packet (default being 2).
A follow-up patch will provide a new packet scheduler (FQ), using
sk_pacing_rate as an input to perform optional per flow pacing.
This explains why we chose to set sk_pacing_rate to twice the current
rate, allowing 'slow start' ramp up.
sk_pacing_rate = 2 * cwnd * mss / srtt
v2: Neal Cardwell reported a suspect deferring of last two segments on
initial write of 10 MSS, I had to change tcp_tso_should_defer() to take
into account tp->xmit_size_goal_segs
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Van Jacobson <vanj@google.com>
Cc: Tom Herbert <therbert@google.com>
---
v3: The change Yuchung suggested added a possibility of a divide by 0:
On some (retransmits) case, srtt can be 0 because
tcp_rtt_estimator() has not yet been called.
Change the computation to remove this, and do not yet use usec
as the units, but HZ. [ Its interesting to see jiffies_to_usecs()
being an out of line function :( ]
This version passed all our tests.
Documentation/networking/ip-sysctl.txt | 9 ++++++
include/net/sock.h | 2 +
include/net/tcp.h | 1
net/ipv4/sysctl_net_ipv4.c | 10 +++++++
net/ipv4/tcp.c | 28 ++++++++++++++++----
net/ipv4/tcp_input.c | 32 ++++++++++++++++++++++-
net/ipv4/tcp_output.c | 2 -
7 files changed, 77 insertions(+), 7 deletions(-)
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index debfe85..ce5bb43 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -482,6 +482,15 @@ tcp_syn_retries - INTEGER
tcp_timestamps - BOOLEAN
Enable timestamps as defined in RFC1323.
+tcp_min_tso_segs - INTEGER
+ Minimal number of segments per TSO frame.
+ Since linux-3.12, TCP does an automatic sizing of TSO frames,
+ depending on flow rate, instead of filling 64Kbytes packets.
+ For specific usages, it's possible to force TCP to build big
+ TSO frames. Note that TCP stack might split too big TSO packets
+ if available window is too small.
+ Default: 2
+
tcp_tso_win_divisor - INTEGER
This allows control over what percentage of the congestion window
can be consumed by a single TSO frame.
diff --git a/include/net/sock.h b/include/net/sock.h
index e4bbcbf..6ba2e7b 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -232,6 +232,7 @@ struct cg_proto;
* @sk_napi_id: id of the last napi context to receive data for sk
* @sk_ll_usec: usecs to busypoll when there is no data
* @sk_allocation: allocation mode
+ * @sk_pacing_rate: Pacing rate (if supported by transport/packet scheduler)
* @sk_sndbuf: size of send buffer in bytes
* @sk_flags: %SO_LINGER (l_onoff), %SO_BROADCAST, %SO_KEEPALIVE,
* %SO_OOBINLINE settings, %SO_TIMESTAMPING settings
@@ -361,6 +362,7 @@ struct sock {
kmemcheck_bitfield_end(flags);
int sk_wmem_queued;
gfp_t sk_allocation;
+ u32 sk_pacing_rate; /* bytes per second */
netdev_features_t sk_route_caps;
netdev_features_t sk_route_nocaps;
int sk_gso_type;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 09cb5c1..73fcd7c 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -281,6 +281,7 @@ extern int sysctl_tcp_early_retrans;
extern int sysctl_tcp_limit_output_bytes;
extern int sysctl_tcp_challenge_ack_limit;
extern unsigned int sysctl_tcp_notsent_lowat;
+extern int sysctl_tcp_min_tso_segs;
extern atomic_long_t tcp_memory_allocated;
extern struct percpu_counter tcp_sockets_allocated;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 8ed7c32..540279f 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -29,6 +29,7 @@
static int zero;
static int one = 1;
static int four = 4;
+static int gso_max_segs = GSO_MAX_SEGS;
static int tcp_retr1_max = 255;
static int ip_local_port_range_min[] = { 1, 1 };
static int ip_local_port_range_max[] = { 65535, 65535 };
@@ -761,6 +762,15 @@ static struct ctl_table ipv4_table[] = {
.extra2 = &four,
},
{
+ .procname = "tcp_min_tso_segs",
+ .data = &sysctl_tcp_min_tso_segs,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = &zero,
+ .extra2 = &gso_max_segs,
+ },
+ {
.procname = "udp_mem",
.data = &sysctl_udp_mem,
.maxlen = sizeof(sysctl_udp_mem),
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 4e42c03..fdf7409 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -283,6 +283,8 @@
int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
+int sysctl_tcp_min_tso_segs __read_mostly = 2;
+
struct percpu_counter tcp_orphan_count;
EXPORT_SYMBOL_GPL(tcp_orphan_count);
@@ -785,12 +787,28 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
xmit_size_goal = mss_now;
if (large_allowed && sk_can_gso(sk)) {
- xmit_size_goal = ((sk->sk_gso_max_size - 1) -
- inet_csk(sk)->icsk_af_ops->net_header_len -
- inet_csk(sk)->icsk_ext_hdr_len -
- tp->tcp_header_len);
+ u32 gso_size, hlen;
+
+ /* Maybe we should/could use sk->sk_prot->max_header here ? */
+ hlen = inet_csk(sk)->icsk_af_ops->net_header_len +
+ inet_csk(sk)->icsk_ext_hdr_len +
+ tp->tcp_header_len;
+
+ /* Goal is to send at least one packet per ms,
+ * not one big TSO packet every 100 ms.
+ * This preserves ACK clocking and is consistent
+ * with tcp_tso_should_defer() heuristic.
+ */
+ gso_size = sk->sk_pacing_rate / (2 * MSEC_PER_SEC);
+ gso_size = max_t(u32, gso_size,
+ sysctl_tcp_min_tso_segs * mss_now);
+
+ xmit_size_goal = min_t(u32, gso_size,
+ sk->sk_gso_max_size - 1 - hlen);
- /* TSQ : try to have two TSO segments in flight */
+ /* TSQ : try to have at least two segments in flight
+ * (one in NIC TX ring, another in Qdisc)
+ */
xmit_size_goal = min_t(u32, xmit_size_goal,
sysctl_tcp_limit_output_bytes >> 1);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index ec492ea..436c7e8 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -688,6 +688,34 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
}
}
+/* Set the sk_pacing_rate to allow proper sizing of TSO packets.
+ * Note: TCP stack does not yet implement pacing.
+ * FQ packet scheduler can be used to implement cheap but effective
+ * TCP pacing, to smooth the burst on large writes when packets
+ * in flight is significantly lower than cwnd (or rwin)
+ */
+static void tcp_update_pacing_rate(struct sock *sk)
+{
+ const struct tcp_sock *tp = tcp_sk(sk);
+ u64 rate;
+
+ /* set sk_pacing_rate to 200 % of current rate (mss * cwnd / srtt) */
+ rate = (u64)tp->mss_cache * 2 * (HZ << 3);
+
+ rate *= max(tp->snd_cwnd, tp->packets_out);
+
+ /* Correction for small srtt : minimum srtt being 8 (1 jiffy << 3),
+ * be conservative and assume srtt = 1 (125 us instead of 1.25 ms)
+ * We probably need usec resolution in the future.
+ * Note: This also takes care of possible srtt=0 case,
+ * when tcp_rtt_estimator() was not yet called.
+ */
+ if (tp->srtt > 8 + 2)
+ do_div(rate, tp->srtt);
+
+ sk->sk_pacing_rate = min_t(u64, rate, ~0U);
+}
+
/* Calculate rto without backoff. This is the second half of Van Jacobson's
* routine referred to above.
*/
@@ -3278,7 +3306,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
u32 ack_seq = TCP_SKB_CB(skb)->seq;
u32 ack = TCP_SKB_CB(skb)->ack_seq;
bool is_dupack = false;
- u32 prior_in_flight;
+ u32 prior_in_flight, prior_cwnd = tp->snd_cwnd, prior_rtt = tp->srtt;
u32 prior_fackets;
int prior_packets = tp->packets_out;
const int prior_unsacked = tp->packets_out - tp->sacked_out;
@@ -3383,6 +3411,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
if (icsk->icsk_pending == ICSK_TIME_RETRANS)
tcp_schedule_loss_probe(sk);
+ if (tp->srtt != prior_rtt || tp->snd_cwnd != prior_cwnd)
+ tcp_update_pacing_rate(sk);
return 1;
no_queue:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 884efff..e63ae4c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1631,7 +1631,7 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
/* If a full-sized TSO skb can be sent, do it. */
if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
- sk->sk_gso_max_segs * tp->mss_cache))
+ tp->xmit_size_goal_segs * tp->mss_cache))
goto send_now;
/* Middle in queue won't get any more data, full sendable already? */
^ permalink raw reply related
* Re: [PATCH 2/3] [RFC] TCP syncookies: introduce sysctl to configure the MSS tables
From: Jiri Bohac @ 2013-08-27 12:55 UTC (permalink / raw)
To: Florian Westphal; +Cc: Jiri Bohac, Jakob Lell, netdev, davem
In-Reply-To: <20130816214057.GE5154@breakpoint.cc>
On Fri, Aug 16, 2013 at 11:40:57PM +0200, Florian Westphal wrote:
> Jiri Bohac <jbohac@suse.cz> wrote:
> > (compile-tested only)
> >
> > This patch introduces two new sysctls
> > net.ipv4.tcp_syncookies_mss_table
> > net.ipv6.tcp_syncookies_mss_table
> > to manipulate the TCP syncookie MSS tables
>
> The cookie MSS table is small to begin with; trying
> to find values that fit all possible clients is a losing game.
not all servers talk to all the clients. I can imagine some may run very
specific services with very specific packet sizes. Having the MSS
values configurable can't hurt.
> I cannot think of any scenarios where 2 machines, connected
> to internet, could have different mss tables whilst _both_
> improving the default values?
The recently disclosed syncookies vulnerability has differrent
impact on differrent servers.
Some services are secure enough at application level and don't
care at all about TCP connection spoofing. These can use the
sysctl to revert back to the MSS table we have now (or anyting
that better serves their traffic).
Other services are not so secure and some MSS values can be
sacrified to mitigate the risk. With a smaller MSS table, tuning
the values for specific traffic may make even more sense.
--
Jiri Bohac <jbohac@suse.cz>
SUSE Labs, SUSE CZ
^ permalink raw reply
* Re: [PATCH net-next] drivers:net: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent
From: Neil Horman @ 2013-08-27 13:07 UTC (permalink / raw)
To: Joe Perches
Cc: netdev, e1000-devel, users, linux-wireless, linux-kernel, b43-dev
In-Reply-To: <1377582323.2658.10.camel@joe-AO722>
On Mon, Aug 26, 2013 at 10:45:23PM -0700, Joe Perches wrote:
> __GFP_ZERO is an uncommon flag and perhaps is better
> not used. static inline dma_zalloc_coherent exists
> so convert the uses of dma_alloc_coherent with __GFP_ZERO
> to the more common kernel style with zalloc.
>
> Remove memset from the static inline dma_zalloc_coherent
> and add just one use of __GFP_ZERO instead.
>
> Trivially reduces the size of the existing uses of
> dma_zalloc_coherent.
>
> Realign arguments as appropriate.
>
> Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
^ permalink raw reply
* Re: [PATCH] tipc: set sk_err correctly when connection fails
From: Paul Gortmaker @ 2013-08-27 13:20 UTC (permalink / raw)
To: erik.hugne; +Cc: jon.maloy, netdev, nhan.tt.vo, tipc-discussion
In-Reply-To: <1377266200-26691-1-git-send-email-erik.hugne@ericsson.com>
On 13-08-23 09:56 AM, erik.hugne@ericsson.com wrote:
> From: Erik Hugne <erik.hugne@ericsson.com>
>
> This fixes a problem when connect() fails and returns the error
> code as a positive value, whereas errno itself is never set. The
> reason is that error codes set in sk_err should never be inverted.
That seems consistent with the other instances at least.
~/git/linux-head$ git grep ECONNREFUSED net|grep sk_err
net/caif/caif_socket.c: cf_sk->sk.sk_err = ECONNREFUSED;
net/decnet/dn_nsp_in.c: sk->sk_err = ECONNREFUSED;
net/ipv4/tcp_input.c: sk->sk_err = ECONNREFUSED;
net/tipc/socket.c: sk->sk_err = -ECONNREFUSED;
~/git/linux-head$
What was the high level user visible symptom in this case?
Stalled connections or ... ?
Thanks,
Paul.
--
>
> Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
> ---
> net/tipc/socket.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/tipc/socket.c b/net/tipc/socket.c
> index ce8249c..6cc7ddd 100644
> --- a/net/tipc/socket.c
> +++ b/net/tipc/socket.c
> @@ -1257,7 +1257,7 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
> /* Accept only ACK or NACK message */
> if (unlikely(msg_errcode(msg))) {
> sock->state = SS_DISCONNECTING;
> - sk->sk_err = -ECONNREFUSED;
> + sk->sk_err = ECONNREFUSED;
> retval = TIPC_OK;
> break;
> }
> @@ -1268,7 +1268,7 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
> res = auto_connect(sock, msg);
> if (res) {
> sock->state = SS_DISCONNECTING;
> - sk->sk_err = res;
> + sk->sk_err = -res;
> retval = TIPC_OK;
> break;
> }
>
------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
^ permalink raw reply
* [PATCH net-next] net: sctp: sctp_verify_init: clean up mandatory checks and add comment
From: Daniel Borkmann @ 2013-08-27 13:23 UTC (permalink / raw)
To: davem; +Cc: netdev, linux-sctp
Add a comment related to RFC4960 explaning why we do not check for initial
TSN, and while at it, remove yoda notation checks and clean up code from
checks of mandatory conditions. That's probably just really minor, but makes
reviewing easier.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
---
net/sctp/sm_make_chunk.c | 26 ++++++++++++--------------
1 file changed, 12 insertions(+), 14 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 01e9783..c6ca3c9 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2240,25 +2240,23 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
struct sctp_chunk **errp)
{
union sctp_params param;
- int has_cookie = 0;
+ bool has_cookie = false;
int result;
- /* Verify stream values are non-zero. */
- if ((0 == peer_init->init_hdr.num_outbound_streams) ||
- (0 == peer_init->init_hdr.num_inbound_streams) ||
- (0 == peer_init->init_hdr.init_tag) ||
- (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
-
+ /* Check for missing mandatory parameters. Note: Initial TSN is also
+ * mandatory, but not checked here since range is possible from 0 to
+ * 2**32-1 (4294967295), RFC4960 3.3.3.
+ */
+ if (peer_init->init_hdr.num_outbound_streams == 0 ||
+ peer_init->init_hdr.num_inbound_streams == 0 ||
+ peer_init->init_hdr.init_tag == 0 ||
+ ntohl(peer_init->init_hdr.a_rwnd) < SCTP_DEFAULT_MINWINDOW)
return sctp_process_inv_mandatory(asoc, chunk, errp);
- }
- /* Check for missing mandatory parameters. */
sctp_walk_params(param, peer_init, init_hdr.params) {
-
- if (SCTP_PARAM_STATE_COOKIE == param.p->type)
- has_cookie = 1;
-
- } /* for (loop through all parameters) */
+ if (param.p->type == SCTP_PARAM_STATE_COOKIE)
+ has_cookie = true;
+ }
/* There is a possibility that a parameter length was bad and
* in that case we would have stoped walking the parameters.
--
1.7.11.7
^ permalink raw reply related
* Re: [PATCH 0/3] nfc: standardize logging styles
From: Samuel Ortiz @ 2013-08-27 13:42 UTC (permalink / raw)
To: Joe Perches
Cc: Paul Bolle, Lauro Ramos Venancio, Aloisio Almeida Jr,
linux-wireless, linux-nfc, linux-kernel, netdev
In-Reply-To: <cover.1365189658.git.joe@perches.com>
Hi Joe,
On Fri, Apr 05, 2013 at 12:27:36PM -0700, Joe Perches wrote:
> Fix some defects in the logging too
>
> Joe Perches (3):
> nfc: Replace nfc_dev_dbg with dev_dbg, remove function tracing
> nfc: Convert nfc_dev_info and nfc_dev_err to nfc_<level>
> nfc: Standardize logging style
All 3 patches applied, sorry for missing those ones.
Cheers,
Samuel.
--
Intel Open Source Technology Centre
http://oss.intel.com/
^ permalink raw reply
* Re: [PATCH net-next] net: sctp: sctp_verify_init: clean up mandatory checks and add comment
From: Neil Horman @ 2013-08-27 13:43 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: davem, netdev, linux-sctp
In-Reply-To: <1377609830-10193-1-git-send-email-dborkman@redhat.com>
On Tue, Aug 27, 2013 at 03:23:50PM +0200, Daniel Borkmann wrote:
> Add a comment related to RFC4960 explaning why we do not check for initial
> TSN, and while at it, remove yoda notation checks and clean up code from
> checks of mandatory conditions. That's probably just really minor, but makes
> reviewing easier.
>
> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
> ---
> net/sctp/sm_make_chunk.c | 26 ++++++++++++--------------
> 1 file changed, 12 insertions(+), 14 deletions(-)
>
> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
> index 01e9783..c6ca3c9 100644
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -2240,25 +2240,23 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
> struct sctp_chunk **errp)
> {
> union sctp_params param;
> - int has_cookie = 0;
> + bool has_cookie = false;
> int result;
>
> - /* Verify stream values are non-zero. */
> - if ((0 == peer_init->init_hdr.num_outbound_streams) ||
> - (0 == peer_init->init_hdr.num_inbound_streams) ||
> - (0 == peer_init->init_hdr.init_tag) ||
> - (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
> -
> + /* Check for missing mandatory parameters. Note: Initial TSN is also
> + * mandatory, but not checked here since range is possible from 0 to
> + * 2**32-1 (4294967295), RFC4960 3.3.3.
> + */
nit: If we're making this easier to review, I think the above would be easier to
read if it said:
Note: Initial TSN is also mandatory, but is not checked here since the valid
range is 0..2**(32-1)
> + if (peer_init->init_hdr.num_outbound_streams == 0 ||
> + peer_init->init_hdr.num_inbound_streams == 0 ||
> + peer_init->init_hdr.init_tag == 0 ||
> + ntohl(peer_init->init_hdr.a_rwnd) < SCTP_DEFAULT_MINWINDOW)
> return sctp_process_inv_mandatory(asoc, chunk, errp);
> - }
>
> - /* Check for missing mandatory parameters. */
> sctp_walk_params(param, peer_init, init_hdr.params) {
> -
> - if (SCTP_PARAM_STATE_COOKIE == param.p->type)
> - has_cookie = 1;
> -
> - } /* for (loop through all parameters) */
> + if (param.p->type == SCTP_PARAM_STATE_COOKIE)
> + has_cookie = true;
> + }
>
> /* There is a possibility that a parameter length was bad and
> * in that case we would have stoped walking the parameters.
> --
> 1.7.11.7
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply
* Re: [PATCH 3/3] [RFC] TCP syncookies: only allow 3 MSS values by default to mitigate spoofing attacks
From: Jiri Bohac @ 2013-08-27 13:52 UTC (permalink / raw)
To: Florian Westphal; +Cc: Jiri Bohac, Jakob Lell, netdev, davem
In-Reply-To: <20130816213101.GD5154@breakpoint.cc>
First of all - I don't really care about the default values as
long as they are tunable at run time. I'm fine with leaving the 8
valye MSS table as a default.
On Fri, Aug 16, 2013 at 11:31:01PM +0200, Florian Westphal wrote:
> Jiri Bohac <jbohac@suse.cz> wrote:
> > Rationale for the new values
> > - most packets are (1500 - headers); (1450 - headers) is not a huge waste and
> > prevents fallback to much lower values
>
> Still, 1410 seems weird.
I was thinking the path MTU would often be 1500 minus something
for various tunnelling/encapsualtion along the path. The packets
may have some options, so the 1450 was just a wild guess.
If we have only 3 differrent MSS values, I feel it is better to
waste 50 bytes on the "standard" 1500 MTU links instead of making
packets with options and tunelled traffic fall back to something
like 500.
> > - clients will rarely send MSS below 536, so that's a safe fallback
>
> Can you elaborate?
> You say 'is a safe fallback', yet it is removed in the patch?
Yeah, sorry, I was writing the patch description before the patch
itself; I noticed the 512 in the original table and thought it
would be a good idea to keep this.
> > - we need to keep the minimum (64)
I don't know - I could imagine there is some embedded hardware
that can't do fragmentation and advertises very low MSS instead, for
example. I just felt removing this fallback could break things.
I'm not sure.
--
Jiri Bohac <jbohac@suse.cz>
SUSE Labs, SUSE CZ
^ permalink raw reply
* Re: pcie_get_minimum_link returns 0 width
From: Bjorn Helgaas @ 2013-08-27 13:57 UTC (permalink / raw)
To: Yuval Mintz
Cc: jacob.e.keller@intel.com, linux-pci@vger.kernel.org,
netdev@vger.kernel.org, Jiang Liu
In-Reply-To: <979A8436335E3744ADCD3A9F2A2B68A52AD13FB9@SJEXCHMB10.corp.ad.broadcom.com>
[+cc Jiang]
On Tue, Aug 27, 2013 at 1:40 AM, Yuval Mintz <yuvalmin@broadcom.com> wrote:
>> On Mon, Aug 26, 2013 at 5:36 PM, Yuval Mintz <yuvalmin@broadcom.com>
>> wrote:
>> >> > Hi,
>> >> >
>> >> > I tried adding support for the newly added 'pcie_get_minimum_link' into
>> >> the
>> >> > bnx2x driver, but found out the some of my devices started showing
>> width
>> >> x0.
>> >> >
>> >> > By adding debug prints, I've found out there were devices up the chain
>> that
>> >> > Showed 0 when their PCI_EXP_LNKSTA was read by said function.
>> >> > However, when I tried looking via lspci the output claimed the width was
>> >> x4.
>> Looking at its implementation, one obvious difference is that
>> pcie_get_minimum_link() traverses up the hierarchy and keeps track of
>> the minimum values it finds. lspci, on the other hand, just reads
>> PCI_EXP_LNKSTA from a single device and decodes it.
>>
>> You said lspci reports x4 for every device from the Root Port all the
>> way down to your NIC, so I would think the minimum from
>> pcie_get_minimum_link() would be x4. But apparently it's not. Maybe
>> there's a bug in it. Can you post the complete "lspci -vv" output
>> along with your debug patch and output?
>>
>> Bjorn
>
> Here's the patch:
> ---
> drivers/pci/pci.c | 8 +++++++-
> 1 files changed, 7 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index c71e78c..72cb87b 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
> @@ -3601,13 +3601,19 @@ int pcie_get_minimum_link(struct pci_dev *dev, enum pci_bus_speed *speed,
> enum pcie_link_width next_width;
>
> ret = pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
> - if (ret)
> + if (ret) {
> + printk(KERN_ERR "Failed to Read LNKSTA\n");
> return ret;
> + }
>
> next_speed = pcie_link_speed[lnksta & PCI_EXP_LNKSTA_CLS];
> next_width = (lnksta & PCI_EXP_LNKSTA_NLW) >>
> PCI_EXP_LNKSTA_NLW_SHIFT;
>
> + printk(KERN_ERR "LnkSta %04x [%04x:%02x.%02x]\n",
> + lnksta, dev->bus->number, PCI_SLOT(dev->devfn),
> + PCI_FUNC(dev->devfn));
I think pcie_cap_has_lnkctl() is incorrect: it currently thinks only
Root Ports, Endpoints, and Legacy Endpoints have link registers. But
I think switch ports (Upstream Ports and Downstream Ports) also have
link registers (PCIe spec r3.0, sec 7.8). Jiang?
> if (next_speed < *speed)
> *speed = next_speed;
>
> --
> 1.7.1
>
> And here are the lscpi results for 09:00.0 and 0a:01.0
> (The two devices for which the loop returns 0 width):
>
> Sysfs do read [Pos 0, len 64]
> 09:00.0 Class 0604: Device 8086:3500 (rev 01)
> Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+ Stepping- SERR+ FastB2B- DisINTx-
> Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
> Latency: 0, Cache Line Size: 64 bytes
> Bus: primary=09, secondary=0a, subordinate=11, sec-latency=0
> Memory behind bridge: fb800000-fd7fffff
> Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
> BridgeCtl: Parity+ SERR+ NoISA- VGA- MAbort- >Reset- FastB2B-
> PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
> Capabilities: Sysfs do read [Pos 68, len 4]
> [44] Express (v1) Upstream Port, MSI 00
> Sysfs do read [Pos 72, len 16]
> DevCap: MaxPayload 256 bytes, PhantFunc 0, Latency L0s <64ns, L1 <1us
> ExtTag- AttnBtn- AttnInd- PwrInd- RBE- FLReset-SlotPowerLimit 0.000W
> DevCtl: Report errors: Correctable- Non-Fatal+ Fatal+ Unsupported-
> RlxdOrd- ExtTag- PhantFunc- AuxPwr- NoSnoop-
> MaxPayload 256 bytes, MaxReadReq 4096 bytes
> DevSta: CorrErr- UncorrErr- FatalErr+ UnsuppReq+ AuxPwr- TransPend-
> LnkCap: Port #0, Speed 2.5GT/s, Width x8, ASPM L0s, Latency L0 unlimited, L1 unlimited
> ClockPM- Surprise- LLActRep- BwNot-
> LnkCtl: ASPM Disabled; Disabled- Retrain- CommClk-
> ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
> LnkSta: Speed 2.5GT/s, Width x4, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
> Capabilities: Sysfs do read [Pos 112, len 4]
> [70] Power Management version 2
> Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
> Sysfs do read [Pos 116, len 4]
> Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
> Capabilities: Sysfs do read [Pos 128, len 4]
> [80] Sysfs do read [Pos 132, len 4]
> Subsystem: Device 0000:0000
> Sysfs do read [Pos 256, len 4]
> Capabilities: [100 v1] Advanced Error Reporting
> Sysfs do read [Pos 260, len 24]
> UESta: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq+ ACSViol-
> UEMsk: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq+ ACSViol-
> UESvrt: DLP+ SDES- TLP+ FCP+ CmpltTO+ CmpltAbrt+ UnxCmplt+ RxOF+ MalfTLP+ ECRC- UnsupReq+ ACSViol-
> CESta: RxErr- BadTLP- BadDLLP- Rollover- Timeout- NonFatalErr-
> CEMsk: RxErr+ BadTLP+ BadDLLP+ Rollover+ Timeout+ NonFatalErr-
> AERCap: First Error Pointer: 14, GenCap- CGenEn- ChkCap- ChkEn-
> Kernel driver in use: pcieport
> Kernel modules: shpchp
>
> Sysfs do read [Pos 0, len 64]
> 0a:01.0 Class 0604: Device 8086:3514 (rev 01)
> Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+ Stepping- SERR+ FastB2B- DisINTx-
> Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
> Latency: 0, Cache Line Size: 64 bytes
> Bus: primary=0a, secondary=0e, subordinate=10, sec-latency=0
> Memory behind bridge: fb800000-fd7fffff
> Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
> BridgeCtl: Parity+ SERR+ NoISA- VGA- MAbort- >Reset- FastB2B-
> PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
> Capabilities: Sysfs do read [Pos 68, len 4]
> [44] Express (v1) Downstream Port (Slot-), MSI 00
> Sysfs do read [Pos 72, len 16]
> DevCap: MaxPayload 256 bytes, PhantFunc 0, Latency L0s <64ns, L1 <1us
> ExtTag- RBE- FLReset-
> DevCtl: Report errors: Correctable- Non-Fatal+ Fatal+ Unsupported-
> RlxdOrd- ExtTag- PhantFunc- AuxPwr- NoSnoop-
> MaxPayload 256 bytes, MaxReadReq 4096 bytes
> DevSta: CorrErr- UncorrErr- FatalErr- UnsuppReq- AuxPwr- TransPend-
> LnkCap: Port #2, Speed 2.5GT/s, Width x4, ASPM L0s, Latency L0 unlimited, L1 unlimited
> ClockPM- Surprise- LLActRep- BwNot-
> LnkCtl: ASPM Disabled; Disabled- Retrain- CommClk-
> ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
> LnkSta: Speed 2.5GT/s, Width x4, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
> Capabilities: Sysfs do read [Pos 96, len 4]
> [60] MSI: Enable- Count=1/1 Maskable- 64bit+
> Sysfs do read [Pos 100, len 10]
> Address: 0000000000000000 Data: 0000
> Capabilities: Sysfs do read [Pos 112, len 4]
> [70] Power Management version 2
> Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
> Sysfs do read [Pos 116, len 4]
> Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
> Capabilities: Sysfs do read [Pos 128, len 4]
> [80] Sysfs do read [Pos 132, len 4]
> Subsystem: Device 0000:0000
> Sysfs do read [Pos 256, len 4]
> Capabilities: [100 v1] Advanced Error Reporting
> Sysfs do read [Pos 260, len 24]
> UESta: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
> UEMsk: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq+ ACSViol-
> UESvrt: DLP+ SDES- TLP+ FCP+ CmpltTO+ CmpltAbrt+ UnxCmplt+ RxOF+ MalfTLP+ ECRC- UnsupReq+ ACSViol-
> CESta: RxErr- BadTLP- BadDLLP- Rollover- Timeout- NonFatalErr-
> CEMsk: RxErr+ BadTLP+ BadDLLP+ Rollover+ Timeout+ NonFatalErr-
> AERCap: First Error Pointer: 00, GenCap- CGenEn- ChkCap- ChkEn-
> Kernel driver in use: pcieport
> Kernel modules: shpchp
>
> Thanks,
> Yuval
>
^ permalink raw reply
* Re: [PATCH net-next] net: sctp: sctp_verify_init: clean up mandatory checks and add comment
From: Daniel Borkmann @ 2013-08-27 13:59 UTC (permalink / raw)
To: Neil Horman; +Cc: davem, netdev, linux-sctp
In-Reply-To: <20130827134302.GB7619@hmsreliant.think-freely.org>
On 08/27/2013 03:43 PM, Neil Horman wrote:
> nit: If we're making this easier to review, I think the above would be easier to
> read if it said:
> Note: Initial TSN is also mandatory, but is not checked here since the valid
> range is 0..2**(32-1)
Ok, will send a v2 in a moment.
^ permalink raw reply
* [PATCH net-next v2] net: sctp: sctp_verify_init: clean up mandatory checks and add comment
From: Daniel Borkmann @ 2013-08-27 14:06 UTC (permalink / raw)
To: davem; +Cc: netdev, linux-sctp
Add a comment related to RFC4960 explaning why we do not check for initial
TSN, and while at it, remove yoda notation checks and clean up code from
checks of mandatory conditions. That's probably just really minor, but makes
reviewing easier.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
---
v1->v2: update comment as Neil suggested
net/sctp/sm_make_chunk.c | 26 ++++++++++++--------------
1 file changed, 12 insertions(+), 14 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 01e9783..e1c1531 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2240,25 +2240,23 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
struct sctp_chunk **errp)
{
union sctp_params param;
- int has_cookie = 0;
+ bool has_cookie = false;
int result;
- /* Verify stream values are non-zero. */
- if ((0 == peer_init->init_hdr.num_outbound_streams) ||
- (0 == peer_init->init_hdr.num_inbound_streams) ||
- (0 == peer_init->init_hdr.init_tag) ||
- (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
-
+ /* Check for missing mandatory parameters. Note: Initial TSN is
+ * also mandatory, but is not checked here since the valid range
+ * is 0..2**(32-1). RFC4960, section 3.3.3.
+ */
+ if (peer_init->init_hdr.num_outbound_streams == 0 ||
+ peer_init->init_hdr.num_inbound_streams == 0 ||
+ peer_init->init_hdr.init_tag == 0 ||
+ ntohl(peer_init->init_hdr.a_rwnd) < SCTP_DEFAULT_MINWINDOW)
return sctp_process_inv_mandatory(asoc, chunk, errp);
- }
- /* Check for missing mandatory parameters. */
sctp_walk_params(param, peer_init, init_hdr.params) {
-
- if (SCTP_PARAM_STATE_COOKIE == param.p->type)
- has_cookie = 1;
-
- } /* for (loop through all parameters) */
+ if (param.p->type == SCTP_PARAM_STATE_COOKIE)
+ has_cookie = true;
+ }
/* There is a possibility that a parameter length was bad and
* in that case we would have stoped walking the parameters.
--
1.7.11.7
^ permalink raw reply related
* Re: [PATCH RFC net-next] net: epoll support for busy poll
From: Amir Vadai @ 2013-08-27 14:11 UTC (permalink / raw)
To: Eliezer Tamir
Cc: Eliezer Tamir, Willem de Bruijn, Eilon Greenstein, Eric Wong,
netdev@vger.kernel.org, e1000-devel@lists.sourceforge.net,
Eric Dumazet, linux-kernel@vger.kernel.org, David Miller
In-Reply-To: <521AEFC2.9010201@linux.intel.com>
On 26/08/2013 09:03, Eliezer Tamir wrote:
> On 26/08/2013 00:30, Amir Vadai wrote:
>> I'm on vacation, will test and have some inputs later this week when I be
>> back.
>>
> Hello Amir,
>
> Ping me when you get back and I will send you my latest so you can
> play with it.
>
Hi Eliezer,
You can send the latest version, so I can play with it and get some numbers.
Thanks,
Amir
^ permalink raw reply
* Re: [PATCH net-next v2] net: sctp: sctp_verify_init: clean up mandatory checks and add comment
From: Neil Horman @ 2013-08-27 14:11 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: davem, netdev, linux-sctp
In-Reply-To: <1377612363-10779-1-git-send-email-dborkman@redhat.com>
On Tue, Aug 27, 2013 at 04:06:03PM +0200, Daniel Borkmann wrote:
> Add a comment related to RFC4960 explaning why we do not check for initial
> TSN, and while at it, remove yoda notation checks and clean up code from
> checks of mandatory conditions. That's probably just really minor, but makes
> reviewing easier.
>
> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Thanks Daniel
Acked-by: Neil Horman <nhorman@tuxdriver.com>
^ permalink raw reply
* Re: [PATCH] ipv6:examine the IP source address legitimacy
From: Hannes Frederic Sowa @ 2013-08-27 14:20 UTC (permalink / raw)
To: Duan Jiong; +Cc: davem, netdev
In-Reply-To: <521C90A0.60708@cn.fujitsu.com>
On Tue, Aug 27, 2013 at 07:42:24PM +0800, Duan Jiong wrote:
> From: Duan Jiong <duanj.fnst@cn.fujitsu.com>
>
> RFC4861 8.1:
> The IP source address of the Redirect is the
> same as the current first-hop router for the
> specified ICMP Destination Address.
>
> Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com>
> ---
> net/ipv6/route.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 8d9a93e..d4f0f72 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1685,6 +1685,7 @@ static int ip6_route_del(struct fib6_config *cfg)
> static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
> {
> struct net *net = dev_net(skb->dev);
> + struct ipv6hdr *iph = ipv6_hdr(skb);
> struct netevent_redirect netevent;
> struct rt6_info *rt, *nrt = NULL;
> struct ndisc_options ndopts;
> @@ -1745,7 +1746,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
> }
>
> rt = (struct rt6_info *) dst;
> - if (rt == net->ipv6.ip6_null_entry) {
> + if (rt == net->ipv6.ip6_null_entry || !ipv6_addr_equal(&rt->rt6i_gateway, &iph->saddr)) {
> net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
> return;
> }
Hmm, that's difficult...
There was once this check:
/*
* RFC 2461 specifies that redirects should only be
* accepted if they come from the nexthop to the target.
* Due to the way default routers are chosen, this notion
* is a bit fuzzy and one might need to check all default
* routers.
*/
if (!ipv6_addr_equal(saddr, &rt->rt6i_gateway)) {
if (rt->rt6i_flags & RTF_DEFAULT) {
struct rt6_info *rt1;
read_lock(&rt6_lock);
for (rt1 = ip6_routing_table.leaf; rt1; rt1 = rt1->u.next) {
if (ipv6_addr_equal(saddr, &rt1->rt6i_gateway)) {
dst_hold(&rt1->u.dst);
dst_release(&rt->u.dst);
read_unlock(&rt6_lock);
rt = rt1;
goto source_ok;
}
}
read_unlock(&rt6_lock);
}
if (net_ratelimit())
printk(KERN_DEBUG "rt6_redirect: source isn't a valid nexthop "
"for redirect target\n");
goto out;
}
And even got more complicated in commit
a6279458c534d01ccc39498aba61c93083ee0372 ("NDISC: Search over all possible
rules on receipt of redirect.").
Today we even have ECMP routes maybe making this decision even a bit
more complicated. But I agree, there should be a check, but it will be
a bit more complicated.
Greetings,
Hannes
^ permalink raw reply
* Re: [PATCH] net: fec: add the initial to set the physical mac address
From: Lucas Stach @ 2013-08-27 14:18 UTC (permalink / raw)
To: Fugang Duan
Cc: b20596, b45643, davem, netdev, shawn.guo, bhutchings, R49496,
stephen
In-Reply-To: <1377170269-8988-1-git-send-email-B38611@freescale.com>
Am Donnerstag, den 22.08.2013, 19:17 +0800 schrieb Fugang Duan:
> For imx6slx evk platform, the fec driver cannot work since there
> have no valid mac address set in physical mac registers.
>
> For imx serial platform, fec/enet IPs both need the physical MAC
> address initial, otherwise it cannot work.
>
> After acquiring the valid MAC address from devices tree/pfuse/
> kernel command line/random mac address, and then set it to the
> physical MAC address registers.
>
Yeah, we have also seen that we need to set this explicitly. The strange
thing is that I recall this used to work without calling
fec_set_mac_address() explicitly, so either the netdev core was calling
it at some point, or our userspace was. I didn't got around to
investigate this further.
So anyway:
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
> Signed-off-by: Fugang Duan <B38611@freescale.com>
> ---
> drivers/net/ethernet/freescale/fec_main.c | 9 ++++++---
> 1 files changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
> index 4349a9e..9b5e08c 100644
> --- a/drivers/net/ethernet/freescale/fec_main.c
> +++ b/drivers/net/ethernet/freescale/fec_main.c
> @@ -1867,10 +1867,12 @@ fec_set_mac_address(struct net_device *ndev, void *p)
> struct fec_enet_private *fep = netdev_priv(ndev);
> struct sockaddr *addr = p;
>
> - if (!is_valid_ether_addr(addr->sa_data))
> - return -EADDRNOTAVAIL;
> + if (p) {
> + if (!is_valid_ether_addr(addr->sa_data))
> + return -EADDRNOTAVAIL;
>
> - memcpy(ndev->dev_addr, addr->sa_data, ndev->addr_len);
> + memcpy(ndev->dev_addr, addr->sa_data, ndev->addr_len);
> + }
>
> writel(ndev->dev_addr[3] | (ndev->dev_addr[2] << 8) |
> (ndev->dev_addr[1] << 16) | (ndev->dev_addr[0] << 24),
> @@ -1969,6 +1971,7 @@ static int fec_enet_init(struct net_device *ndev)
>
> /* Get the Ethernet address */
> fec_get_mac(ndev);
> + fec_set_mac_address(ndev, NULL);
>
> /* Set receive and transmit descriptor base. */
> fep->rx_bd_base = cbd_base;
--
Pengutronix e.K. | Lucas Stach |
Industrial Linux Solutions | http://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-5076 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply
* Re: [PATCH net-next v2] net: sctp: sctp_verify_init: clean up mandatory checks and add comment
From: Sergei Shtylyov @ 2013-08-27 14:23 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: davem, netdev, linux-sctp
In-Reply-To: <1377612363-10779-1-git-send-email-dborkman@redhat.com>
Hello.
On 27-08-2013 18:06, Daniel Borkmann wrote:
> Add a comment related to RFC4960 explaning why we do not check for initial
> TSN, and while at it, remove yoda notation checks and clean up code from
> checks of mandatory conditions. That's probably just really minor, but makes
> reviewing easier.
> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
> ---
> v1->v2: update comment as Neil suggested
> net/sctp/sm_make_chunk.c | 26 ++++++++++++--------------
> 1 file changed, 12 insertions(+), 14 deletions(-)
> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
> index 01e9783..e1c1531 100644
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -2240,25 +2240,23 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
> struct sctp_chunk **errp)
> {
> union sctp_params param;
> - int has_cookie = 0;
> + bool has_cookie = false;
> int result;
>
> - /* Verify stream values are non-zero. */
> - if ((0 == peer_init->init_hdr.num_outbound_streams) ||
> - (0 == peer_init->init_hdr.num_inbound_streams) ||
> - (0 == peer_init->init_hdr.init_tag) ||
> - (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
> -
> + /* Check for missing mandatory parameters. Note: Initial TSN is
> + * also mandatory, but is not checked here since the valid range
> + * is 0..2**(32-1). RFC4960, section 3.3.3.
I don't think you really meant 2**(32-1) == 2**31. Previously you wrote
2**32-1.
WBR, Sergei
^ permalink raw reply
* [PATCH 0/3] Send audit/procinfo/cgroup data in socket-level control message
From: Jan Kaluza @ 2013-08-27 14:39 UTC (permalink / raw)
To: davem; +Cc: LKML, netdev, eparis, rgb, Jan Kaluza
Hi,
this patchset against net-next (applies also to linux-next) adds 3 new types
of "Socket"-level control message (SCM_AUDIT, SCM_PROCINFO and SCM_CGROUP).
This is needed by journald (logging daemon used as part of systemd ecosystem)
to get additional context together with log messages received using UNIX socket.
Jan Kaluza (3):
Send loginuid and sessionid in SCM_AUDIT
Send comm and cmdline in SCM_PROCINFO
Send cgroup_path in SCM_CGROUP
include/linux/socket.h | 9 ++++++
include/net/af_unix.h | 10 ++++++
include/net/scm.h | 67 ++++++++++++++++++++++++++++++++++++++--
net/core/scm.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++
net/unix/af_unix.c | 70 ++++++++++++++++++++++++++++++++++++++++++
5 files changed, 237 insertions(+), 2 deletions(-)
--
1.8.3.1
^ permalink raw reply
* [PATCH 1/3] Send loginuid and sessionid in SCM_AUDIT
From: Jan Kaluza @ 2013-08-27 14:39 UTC (permalink / raw)
To: davem; +Cc: LKML, netdev, eparis, rgb, Jan Kaluza
In-Reply-To: <1377614400-27122-1-git-send-email-jkaluza@redhat.com>
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
---
include/linux/socket.h | 6 ++++++
include/net/af_unix.h | 2 ++
include/net/scm.h | 28 ++++++++++++++++++++++++++--
net/unix/af_unix.c | 7 +++++++
4 files changed, 41 insertions(+), 2 deletions(-)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 445ef75..505047a 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -130,6 +130,7 @@ static inline struct cmsghdr * cmsg_nxthdr (struct msghdr *__msg, struct cmsghdr
#define SCM_RIGHTS 0x01 /* rw: access rights (array of int) */
#define SCM_CREDENTIALS 0x02 /* rw: struct ucred */
#define SCM_SECURITY 0x03 /* rw: security label */
+#define SCM_AUDIT 0x04 /* rw: struct uaudit */
struct ucred {
__u32 pid;
@@ -137,6 +138,11 @@ struct ucred {
__u32 gid;
};
+struct uaudit {
+ __u32 loginuid;
+ __u32 sessionid;
+};
+
/* Supported address families. */
#define AF_UNSPEC 0
#define AF_UNIX 1 /* Unix domain sockets */
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index a175ba4..3b9d22a 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -36,6 +36,8 @@ struct unix_skb_parms {
u32 secid; /* Security ID */
#endif
u32 consumed;
+ kuid_t loginuid;
+ unsigned int sessionid;
};
#define UNIXCB(skb) (*(struct unix_skb_parms *)&((skb)->cb))
diff --git a/include/net/scm.h b/include/net/scm.h
index 8de2d37..e349a25 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -6,6 +6,7 @@
#include <linux/security.h>
#include <linux/pid.h>
#include <linux/nsproxy.h>
+#include <linux/audit.h>
/* Well, we should have at least one descriptor open
* to accept passed FDs 8)
@@ -18,6 +19,11 @@ struct scm_creds {
kgid_t gid;
};
+struct scm_audit {
+ kuid_t loginuid;
+ unsigned int sessionid;
+};
+
struct scm_fp_list {
short count;
short max;
@@ -28,6 +34,7 @@ struct scm_cookie {
struct pid *pid; /* Skb credentials */
struct scm_fp_list *fp; /* Passed files */
struct scm_creds creds; /* Skb credentials */
+ struct scm_audit audit; /* Skb audit */
#ifdef CONFIG_SECURITY_NETWORK
u32 secid; /* Passed security ID */
#endif
@@ -58,6 +65,13 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
scm->creds.gid = gid;
}
+static inline void scm_set_audit(struct scm_cookie *scm,
+ kuid_t loginuid, unsigned int sessionid)
+{
+ scm->audit.loginuid = loginuid;
+ scm->audit.sessionid = sessionid;
+}
+
static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
{
put_pid(scm->pid);
@@ -77,8 +91,12 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
memset(scm, 0, sizeof(*scm));
scm->creds.uid = INVALID_UID;
scm->creds.gid = INVALID_GID;
- if (forcecreds)
- scm_set_cred(scm, task_tgid(current), current_uid(), current_gid());
+ if (forcecreds) {
+ scm_set_cred(scm, task_tgid(current), current_uid(),
+ current_gid());
+ scm_set_audit(scm, audit_get_loginuid(current),
+ audit_get_sessionid(current));
+ }
unix_get_peersec_dgram(sock, scm);
if (msg->msg_controllen <= 0)
return 0;
@@ -123,7 +141,13 @@ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
.uid = from_kuid_munged(current_ns, scm->creds.uid),
.gid = from_kgid_munged(current_ns, scm->creds.gid),
};
+ struct uaudit uaudits = {
+ .loginuid = from_kuid_munged(current_ns,
+ scm->audit.loginuid),
+ .sessionid = scm->audit.sessionid,
+ };
put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds);
+ put_cmsg(msg, SOL_SOCKET, SCM_AUDIT, sizeof(uaudits), &uaudits);
}
scm_destroy_cred(scm);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 86de99a..c410f76 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1393,6 +1393,8 @@ static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool sen
UNIXCB(skb).pid = get_pid(scm->pid);
UNIXCB(skb).uid = scm->creds.uid;
UNIXCB(skb).gid = scm->creds.gid;
+ UNIXCB(skb).loginuid = scm->audit.loginuid;
+ UNIXCB(skb).sessionid = scm->audit.sessionid;
UNIXCB(skb).fp = NULL;
if (scm->fp && send_fds)
err = unix_attach_fds(scm, skb);
@@ -1416,6 +1418,8 @@ static void maybe_add_creds(struct sk_buff *skb, const struct socket *sock,
test_bit(SOCK_PASSCRED, &other->sk_socket->flags)) {
UNIXCB(skb).pid = get_pid(task_tgid(current));
current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
+ UNIXCB(skb).loginuid = audit_get_loginuid(current);
+ UNIXCB(skb).sessionid = audit_get_sessionid(current);
}
}
@@ -1812,6 +1816,7 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
memset(&tmp_scm, 0, sizeof(tmp_scm));
}
scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
+ scm_set_audit(siocb->scm, UNIXCB(skb).loginuid, UNIXCB(skb).sessionid);
unix_set_secdata(siocb->scm, skb);
if (!(flags & MSG_PEEK)) {
@@ -1993,6 +1998,8 @@ again:
} else if (test_bit(SOCK_PASSCRED, &sock->flags)) {
/* Copy credentials */
scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
+ scm_set_audit(siocb->scm, UNIXCB(skb).loginuid,
+ UNIXCB(skb).sessionid);
check_creds = 1;
}
--
1.8.3.1
^ permalink raw reply related
* [PATCH 2/3] Send comm and cmdline in SCM_PROCINFO
From: Jan Kaluza @ 2013-08-27 14:39 UTC (permalink / raw)
To: davem; +Cc: LKML, netdev, eparis, rgb, Jan Kaluza
In-Reply-To: <1377614400-27122-1-git-send-email-jkaluza@redhat.com>
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
---
include/linux/socket.h | 2 ++
include/net/af_unix.h | 11 +++++++--
include/net/scm.h | 24 +++++++++++++++++++
net/core/scm.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++
net/unix/af_unix.c | 57 +++++++++++++++++++++++++++++++++++++------
5 files changed, 150 insertions(+), 9 deletions(-)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 505047a..6c7ace0 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -131,6 +131,8 @@ static inline struct cmsghdr * cmsg_nxthdr (struct msghdr *__msg, struct cmsghdr
#define SCM_CREDENTIALS 0x02 /* rw: struct ucred */
#define SCM_SECURITY 0x03 /* rw: security label */
#define SCM_AUDIT 0x04 /* rw: struct uaudit */
+#define SCM_PROCINFO 0x05 /* rw: comm + cmdline (NULL terminated
+ array of char *) */
struct ucred {
__u32 pid;
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 3b9d22a..05c7678 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -27,6 +27,13 @@ struct unix_address {
struct sockaddr_un name[0];
};
+struct unix_skb_parms_scm {
+ kuid_t loginuid;
+ unsigned int sessionid;
+ char *procinfo;
+ int procinfo_len;
+};
+
struct unix_skb_parms {
struct pid *pid; /* Skb credentials */
kuid_t uid;
@@ -36,12 +43,12 @@ struct unix_skb_parms {
u32 secid; /* Security ID */
#endif
u32 consumed;
- kuid_t loginuid;
- unsigned int sessionid;
+ struct unix_skb_parms_scm *scm;
};
#define UNIXCB(skb) (*(struct unix_skb_parms *)&((skb)->cb))
#define UNIXSID(skb) (&UNIXCB((skb)).secid)
+#define UNIXSCM(skb) (*(UNIXCB((skb)).scm))
#define unix_state_lock(s) spin_lock(&unix_sk(s)->lock)
#define unix_state_unlock(s) spin_unlock(&unix_sk(s)->lock)
diff --git a/include/net/scm.h b/include/net/scm.h
index e349a25..3346030 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -30,11 +30,17 @@ struct scm_fp_list {
struct file *fp[SCM_MAX_FD];
};
+struct scm_procinfo {
+ char *procinfo;
+ int len;
+};
+
struct scm_cookie {
struct pid *pid; /* Skb credentials */
struct scm_fp_list *fp; /* Passed files */
struct scm_creds creds; /* Skb credentials */
struct scm_audit audit; /* Skb audit */
+ struct scm_procinfo procinfo; /* Skb procinfo */
#ifdef CONFIG_SECURITY_NETWORK
u32 secid; /* Passed security ID */
#endif
@@ -45,6 +51,7 @@ extern void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm);
extern int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm);
extern void __scm_destroy(struct scm_cookie *scm);
extern struct scm_fp_list * scm_fp_dup(struct scm_fp_list *fpl);
+extern int scm_get_current_procinfo(char **procinfo);
#ifdef CONFIG_SECURITY_NETWORK
static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm)
@@ -72,10 +79,20 @@ static inline void scm_set_audit(struct scm_cookie *scm,
scm->audit.sessionid = sessionid;
}
+static inline void scm_set_procinfo(struct scm_cookie *scm,
+ char *procinfo, int len)
+{
+ scm->procinfo.procinfo = procinfo;
+ scm->procinfo.len = len;
+}
+
static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
{
put_pid(scm->pid);
scm->pid = NULL;
+ kfree(scm->procinfo.procinfo);
+ scm->procinfo.procinfo = NULL;
+ scm->procinfo.len = 0;
}
static __inline__ void scm_destroy(struct scm_cookie *scm)
@@ -88,6 +105,8 @@ static __inline__ void scm_destroy(struct scm_cookie *scm)
static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
struct scm_cookie *scm, bool forcecreds)
{
+ char *procinfo;
+ int len;
memset(scm, 0, sizeof(*scm));
scm->creds.uid = INVALID_UID;
scm->creds.gid = INVALID_GID;
@@ -96,6 +115,9 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
current_gid());
scm_set_audit(scm, audit_get_loginuid(current),
audit_get_sessionid(current));
+ len = scm_get_current_procinfo(&procinfo);
+ if (len > 0)
+ scm_set_procinfo(scm, procinfo, len);
}
unix_get_peersec_dgram(sock, scm);
if (msg->msg_controllen <= 0)
@@ -148,6 +170,8 @@ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
};
put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds);
put_cmsg(msg, SOL_SOCKET, SCM_AUDIT, sizeof(uaudits), &uaudits);
+ put_cmsg(msg, SOL_SOCKET, SCM_PROCINFO, scm->procinfo.len,
+ scm->procinfo.procinfo);
}
scm_destroy_cred(scm);
diff --git a/net/core/scm.c b/net/core/scm.c
index 03795d0..09ec044 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -339,3 +339,68 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
return new_fpl;
}
EXPORT_SYMBOL(scm_fp_dup);
+
+int scm_get_current_procinfo(char **procinfo)
+{
+ int res = 0;
+ unsigned int len;
+ char *buffer = NULL;
+ struct mm_struct *mm;
+ int comm_len = strlen(current->comm);
+
+ *procinfo = NULL;
+
+ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!buffer)
+ return -ENOMEM;
+
+ mm = get_task_mm(current);
+ if (!mm)
+ goto out;
+ if (!mm->arg_end)
+ goto out_mm; /* Shh! No looking before we're done */
+
+ len = mm->arg_end - mm->arg_start;
+
+ if (len > PAGE_SIZE)
+ len = PAGE_SIZE;
+
+ res = access_process_vm(current, mm->arg_start, buffer, len, 0);
+
+ /* If the nul at the end of args has been overwritten, then
+ * assume application is using setproctitle(3).
+ */
+ if (res > 0 && buffer[res-1] != '\0' && len < PAGE_SIZE) {
+ len = strnlen(buffer, res);
+ if (len < res) {
+ res = len;
+ } else {
+ len = mm->env_end - mm->env_start;
+ if (len > PAGE_SIZE - res)
+ len = PAGE_SIZE - res;
+ res += access_process_vm(current, mm->env_start,
+ buffer+res, len, 0);
+ res = strnlen(buffer, res);
+ }
+ }
+
+ /* strlen(comm) + \0 + len of cmdline */
+ len = comm_len + 1 + res;
+ *procinfo = kmalloc(len, GFP_KERNEL);
+ if (!*procinfo) {
+ res = -ENOMEM;
+ goto out_mm;
+ }
+
+ memcpy(*procinfo, current->comm, comm_len + 1); /* include \0 */
+ if (res > 0)
+ memcpy(*procinfo + comm_len + 1, buffer, res);
+ res = len;
+
+out_mm:
+ mmput(mm);
+out:
+ kfree(buffer);
+ return res;
+}
+EXPORT_SYMBOL(scm_get_current_procinfo);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c410f76..ab0be13 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1341,9 +1341,14 @@ static void unix_destruct_scm(struct sk_buff *skb)
struct scm_cookie scm;
memset(&scm, 0, sizeof(scm));
scm.pid = UNIXCB(skb).pid;
+ if (UNIXCB(skb).scm) {
+ scm.procinfo.procinfo = UNIXSCM(skb).procinfo;
+ scm.procinfo.len = UNIXSCM(skb).procinfo_len;
+ }
if (UNIXCB(skb).fp)
unix_detach_fds(&scm, skb);
+ kfree(UNIXCB(skb).scm);
/* Alas, it calls VFS */
/* So fscking what? fput() had been SMP-safe since the last Summer */
scm_destroy(&scm);
@@ -1390,15 +1395,31 @@ static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool sen
{
int err = 0;
+ if (!UNIXCB(skb).scm) {
+ UNIXCB(skb).scm = kmalloc(sizeof(struct unix_skb_parms_scm),
+ GFP_KERNEL);
+ if (!UNIXCB(skb).scm)
+ return -ENOMEM;
+ }
+
UNIXCB(skb).pid = get_pid(scm->pid);
UNIXCB(skb).uid = scm->creds.uid;
UNIXCB(skb).gid = scm->creds.gid;
- UNIXCB(skb).loginuid = scm->audit.loginuid;
- UNIXCB(skb).sessionid = scm->audit.sessionid;
+ UNIXSCM(skb).loginuid = scm->audit.loginuid;
+ UNIXSCM(skb).sessionid = scm->audit.sessionid;
UNIXCB(skb).fp = NULL;
if (scm->fp && send_fds)
err = unix_attach_fds(scm, skb);
+ UNIXSCM(skb).procinfo = NULL;
+ if (scm->procinfo.procinfo) {
+ UNIXSCM(skb).procinfo_len = scm->procinfo.len;
+ UNIXSCM(skb).procinfo = kmemdup(scm->procinfo.procinfo,
+ scm->procinfo.len, GFP_KERNEL);
+ if (!UNIXSCM(skb).procinfo)
+ return -ENOMEM;
+ }
+
skb->destructor = unix_destruct_scm;
return err;
}
@@ -1418,8 +1439,10 @@ static void maybe_add_creds(struct sk_buff *skb, const struct socket *sock,
test_bit(SOCK_PASSCRED, &other->sk_socket->flags)) {
UNIXCB(skb).pid = get_pid(task_tgid(current));
current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
- UNIXCB(skb).loginuid = audit_get_loginuid(current);
- UNIXCB(skb).sessionid = audit_get_sessionid(current);
+ UNIXSCM(skb).loginuid = audit_get_loginuid(current);
+ UNIXSCM(skb).sessionid = audit_get_sessionid(current);
+ UNIXSCM(skb).procinfo_len = scm_get_current_procinfo(
+ &UNIXSCM(skb).procinfo);
}
}
@@ -1816,7 +1839,17 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
memset(&tmp_scm, 0, sizeof(tmp_scm));
}
scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
- scm_set_audit(siocb->scm, UNIXCB(skb).loginuid, UNIXCB(skb).sessionid);
+ if (UNIXCB(skb).scm) {
+ scm_set_audit(siocb->scm, UNIXSCM(skb).loginuid,
+ UNIXSCM(skb).sessionid);
+ if (UNIXSCM(skb).procinfo) {
+ scm_set_procinfo(siocb->scm,
+ kmemdup(UNIXSCM(skb).procinfo,
+ UNIXSCM(skb).procinfo_len,
+ GFP_KERNEL),
+ UNIXSCM(skb).procinfo_len);
+ }
+ }
unix_set_secdata(siocb->scm, skb);
if (!(flags & MSG_PEEK)) {
@@ -1998,8 +2031,18 @@ again:
} else if (test_bit(SOCK_PASSCRED, &sock->flags)) {
/* Copy credentials */
scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
- scm_set_audit(siocb->scm, UNIXCB(skb).loginuid,
- UNIXCB(skb).sessionid);
+ if (UNIXCB(skb).scm) {
+ scm_set_audit(siocb->scm,
+ UNIXSCM(skb).loginuid,
+ UNIXSCM(skb).sessionid);
+ if (UNIXSCM(skb).procinfo) {
+ scm_set_procinfo(siocb->scm,
+ kmemdup(UNIXSCM(skb).procinfo,
+ UNIXSCM(skb).procinfo_len,
+ GFP_KERNEL),
+ UNIXSCM(skb).procinfo_len);
+ }
+ }
check_creds = 1;
}
--
1.8.3.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox