* [patch iproute2 v3 2/2] add support for IFA_F_MANAGETEMPADDR
From: Jiri Pirko @ 2014-01-06 9:17 UTC (permalink / raw)
To: netdev; +Cc: stephen, thaller
In-Reply-To: <1388999830-1753-1-git-send-email-jiri@resnulli.us>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
---
include/linux/if_addr.h | 1 +
ip/ipaddress.c | 11 ++++++++++-
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/include/linux/if_addr.h b/include/linux/if_addr.h
index cced59f..e1e95ce 100644
--- a/include/linux/if_addr.h
+++ b/include/linux/if_addr.h
@@ -45,6 +45,7 @@ enum {
#define IFA_F_DEPRECATED 0x20
#define IFA_F_TENTATIVE 0x40
#define IFA_F_PERMANENT 0x80
+#define IFA_F_MANAGETEMPADDR 0x0100
struct ifa_cacheinfo {
__u32 ifa_prefered;
diff --git a/ip/ipaddress.c b/ip/ipaddress.c
index 1e3f22c..b0d54fe 100644
--- a/ip/ipaddress.c
+++ b/ip/ipaddress.c
@@ -82,7 +82,7 @@ static void usage(void)
fprintf(stderr, " tentative | deprecated | dadfailed | temporary |\n");
fprintf(stderr, " CONFFLAG-LIST ]\n");
fprintf(stderr, "CONFFLAG-LIST := [ CONFFLAG-LIST ] CONFFLAG\n");
- fprintf(stderr, "CONFFLAG := [ home | nodad ]\n");
+ fprintf(stderr, "CONFFLAG := [ home | nodad | mngtmpaddr ]\n");
fprintf(stderr, "LIFETIME := [ valid_lft LFT ] [ preferred_lft LFT ]\n");
fprintf(stderr, "LFT := forever | SECONDS\n");
@@ -703,6 +703,10 @@ int print_addrinfo(const struct sockaddr_nl *who, struct nlmsghdr *n,
ifa_flags &= ~IFA_F_NODAD;
fprintf(fp, "nodad ");
}
+ if (ifa_flags & IFA_F_MANAGETEMPADDR) {
+ ifa_flags &= ~IFA_F_MANAGETEMPADDR;
+ fprintf(fp, "mngtmpaddr ");
+ }
if (!(ifa_flags & IFA_F_PERMANENT)) {
fprintf(fp, "dynamic ");
} else
@@ -1126,6 +1130,9 @@ static int ipaddr_list_flush_or_save(int argc, char **argv, int action)
} else if (strcmp(*argv, "nodad") == 0) {
filter.flags |= IFA_F_NODAD;
filter.flagmask |= IFA_F_NODAD;
+ } else if (strcmp(*argv, "mngtmpaddr") == 0) {
+ filter.flags |= IFA_F_MANAGETEMPADDR;
+ filter.flagmask |= IFA_F_MANAGETEMPADDR;
} else if (strcmp(*argv, "dadfailed") == 0) {
filter.flags |= IFA_F_DADFAILED;
filter.flagmask |= IFA_F_DADFAILED;
@@ -1345,6 +1352,8 @@ static int ipaddr_modify(int cmd, int flags, int argc, char **argv)
ifa_flags |= IFA_F_HOMEADDRESS;
} else if (strcmp(*argv, "nodad") == 0) {
ifa_flags |= IFA_F_NODAD;
+ } else if (strcmp(*argv, "mngtmpaddr") == 0) {
+ ifa_flags |= IFA_F_MANAGETEMPADDR;
} else {
if (strcmp(*argv, "local") == 0) {
NEXT_ARG();
--
1.8.3.1
^ permalink raw reply related
* [patch iproute2 v3 1/2] add support for extended ifa_flags
From: Jiri Pirko @ 2014-01-06 9:17 UTC (permalink / raw)
To: netdev; +Cc: stephen, thaller
In-Reply-To: <1388999830-1753-1-git-send-email-jiri@resnulli.us>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
---
include/linux/if_addr.h | 1 +
ip/ipaddress.c | 44 ++++++++++++++++++++++++++++++--------------
2 files changed, 31 insertions(+), 14 deletions(-)
diff --git a/include/linux/if_addr.h b/include/linux/if_addr.h
index 58b39f4..cced59f 100644
--- a/include/linux/if_addr.h
+++ b/include/linux/if_addr.h
@@ -28,6 +28,7 @@ enum {
IFA_ANYCAST,
IFA_CACHEINFO,
IFA_MULTICAST,
+ IFA_FLAGS,
__IFA_MAX,
};
diff --git a/ip/ipaddress.c b/ip/ipaddress.c
index d02eaaf..1e3f22c 100644
--- a/ip/ipaddress.c
+++ b/ip/ipaddress.c
@@ -541,6 +541,13 @@ static int set_lifetime(unsigned int *lifetime, char *argv)
return 0;
}
+static unsigned int get_ifa_flags(struct ifaddrmsg *ifa,
+ struct rtattr *ifa_flags_attr)
+{
+ return ifa_flags_attr ? rta_getattr_u32(ifa_flags_attr) :
+ ifa->ifa_flags;
+}
+
int print_addrinfo(const struct sockaddr_nl *who, struct nlmsghdr *n,
void *arg)
{
@@ -567,6 +574,8 @@ int print_addrinfo(const struct sockaddr_nl *who, struct nlmsghdr *n,
parse_rtattr(rta_tb, IFA_MAX, IFA_RTA(ifa), n->nlmsg_len - NLMSG_LENGTH(sizeof(*ifa)));
+ ifa_flags = get_ifa_flags(ifa, rta_tb[IFA_FLAGS]);
+
if (!rta_tb[IFA_LOCAL])
rta_tb[IFA_LOCAL] = rta_tb[IFA_ADDRESS];
if (!rta_tb[IFA_ADDRESS])
@@ -576,7 +585,7 @@ int print_addrinfo(const struct sockaddr_nl *who, struct nlmsghdr *n,
return 0;
if ((filter.scope^ifa->ifa_scope)&filter.scopemask)
return 0;
- if ((filter.flags^ifa->ifa_flags)&filter.flagmask)
+ if ((filter.flags ^ ifa_flags) & filter.flagmask)
return 0;
if (filter.label) {
SPRINT_BUF(b1);
@@ -670,36 +679,35 @@ int print_addrinfo(const struct sockaddr_nl *who, struct nlmsghdr *n,
abuf, sizeof(abuf)));
}
fprintf(fp, "scope %s ", rtnl_rtscope_n2a(ifa->ifa_scope, b1, sizeof(b1)));
- ifa_flags = ifa->ifa_flags;
- if (ifa->ifa_flags&IFA_F_SECONDARY) {
+ if (ifa_flags & IFA_F_SECONDARY) {
ifa_flags &= ~IFA_F_SECONDARY;
if (ifa->ifa_family == AF_INET6)
fprintf(fp, "temporary ");
else
fprintf(fp, "secondary ");
}
- if (ifa->ifa_flags&IFA_F_TENTATIVE) {
+ if (ifa_flags & IFA_F_TENTATIVE) {
ifa_flags &= ~IFA_F_TENTATIVE;
fprintf(fp, "tentative ");
}
- if (ifa->ifa_flags&IFA_F_DEPRECATED) {
+ if (ifa_flags & IFA_F_DEPRECATED) {
ifa_flags &= ~IFA_F_DEPRECATED;
deprecated = 1;
fprintf(fp, "deprecated ");
}
- if (ifa->ifa_flags&IFA_F_HOMEADDRESS) {
+ if (ifa_flags & IFA_F_HOMEADDRESS) {
ifa_flags &= ~IFA_F_HOMEADDRESS;
fprintf(fp, "home ");
}
- if (ifa->ifa_flags&IFA_F_NODAD) {
+ if (ifa_flags & IFA_F_NODAD) {
ifa_flags &= ~IFA_F_NODAD;
fprintf(fp, "nodad ");
}
- if (!(ifa->ifa_flags&IFA_F_PERMANENT)) {
+ if (!(ifa_flags & IFA_F_PERMANENT)) {
fprintf(fp, "dynamic ");
} else
ifa_flags &= ~IFA_F_PERMANENT;
- if (ifa->ifa_flags&IFA_F_DADFAILED) {
+ if (ifa_flags & IFA_F_DADFAILED) {
ifa_flags &= ~IFA_F_DADFAILED;
fprintf(fp, "dadfailed ");
}
@@ -926,6 +934,8 @@ static void ipaddr_filter(struct nlmsg_chain *linfo, struct nlmsg_chain *ainfo)
for (a = ainfo->head; a; a = a->next) {
struct nlmsghdr *n = &a->h;
struct ifaddrmsg *ifa = NLMSG_DATA(n);
+ struct rtattr *tb[IFA_MAX + 1];
+ unsigned int ifa_flags;
if (ifa->ifa_index != ifi->ifi_index)
continue;
@@ -934,11 +944,13 @@ static void ipaddr_filter(struct nlmsg_chain *linfo, struct nlmsg_chain *ainfo)
continue;
if ((filter.scope^ifa->ifa_scope)&filter.scopemask)
continue;
- if ((filter.flags^ifa->ifa_flags)&filter.flagmask)
+
+ parse_rtattr(tb, IFA_MAX, IFA_RTA(ifa), IFA_PAYLOAD(n));
+ ifa_flags = get_ifa_flags(ifa, tb[IFA_FLAGS]);
+
+ if ((filter.flags ^ ifa_flags) & filter.flagmask)
continue;
if (filter.pfx.family || filter.label) {
- struct rtattr *tb[IFA_MAX+1];
- parse_rtattr(tb, IFA_MAX, IFA_RTA(ifa), IFA_PAYLOAD(n));
if (!tb[IFA_LOCAL])
tb[IFA_LOCAL] = tb[IFA_ADDRESS];
@@ -1252,6 +1264,7 @@ static int ipaddr_modify(int cmd, int flags, int argc, char **argv)
__u32 preferred_lft = INFINITY_LIFE_TIME;
__u32 valid_lft = INFINITY_LIFE_TIME;
struct ifa_cacheinfo cinfo;
+ unsigned int ifa_flags = 0;
memset(&req, 0, sizeof(req));
@@ -1329,9 +1342,9 @@ static int ipaddr_modify(int cmd, int flags, int argc, char **argv)
if (set_lifetime(&preferred_lft, *argv))
invarg("preferred_lft value", *argv);
} else if (strcmp(*argv, "home") == 0) {
- req.ifa.ifa_flags |= IFA_F_HOMEADDRESS;
+ ifa_flags |= IFA_F_HOMEADDRESS;
} else if (strcmp(*argv, "nodad") == 0) {
- req.ifa.ifa_flags |= IFA_F_NODAD;
+ ifa_flags |= IFA_F_NODAD;
} else {
if (strcmp(*argv, "local") == 0) {
NEXT_ARG();
@@ -1349,6 +1362,9 @@ static int ipaddr_modify(int cmd, int flags, int argc, char **argv)
}
argc--; argv++;
}
+ req.ifa.ifa_flags = ifa_flags;
+ addattr32(&req.n, sizeof(req), IFA_FLAGS, ifa_flags);
+
if (d == NULL) {
fprintf(stderr, "Not enough information: \"dev\" argument is required.\n");
return -1;
--
1.8.3.1
^ permalink raw reply related
* [patch iproute2 v3 0/2] add support for IFA_F_MANAGETEMPADDR
From: Jiri Pirko @ 2014-01-06 9:17 UTC (permalink / raw)
To: netdev; +Cc: stephen, thaller
v1->v2: Removed 0xff masking of ifa_flags
v2->v3: Incorporated changes that Thomas suggested
Jiri Pirko (2):
add support for extended ifa_flags
add support for IFA_F_MANAGETEMPADDR
include/linux/if_addr.h | 2 ++
ip/ipaddress.c | 55 +++++++++++++++++++++++++++++++++++--------------
2 files changed, 42 insertions(+), 15 deletions(-)
--
1.8.3.1
^ permalink raw reply
* Re: [PATCH net-next 1/2] ipv4: add forwarding_uses_pmtu knob to protect forward path to use pmtu info
From: Hannes Frederic Sowa @ 2014-01-06 9:14 UTC (permalink / raw)
To: Steffen Klassert; +Cc: netdev, eric.dumazet, davem
In-Reply-To: <20140106090521.GQ31491@secunet.com>
On Mon, Jan 06, 2014 at 10:05:21AM +0100, Steffen Klassert wrote:
> I'm currenlty testing these patches. ipv4 looks good but on
> ipv6 with 'ping6' the packet size is not reduced according
> to the pmtu when forward_use_pmtu is set to 0.
>
> I'll run the tests again with your updated v3 patches.
Thank you very much!
^ permalink raw reply
* Re: [PATCH 4/11] use ether_addr_equal_64bits
From: Julia Lawall @ 2014-01-06 9:09 UTC (permalink / raw)
To: Johannes Berg
Cc: Julia Lawall, Ben Greear, Joe Perches,
Henrique de Moraes Holschuh,
kernel-janitors-u79uwXL29TY76Z2rM5mHXA, Emmanuel Grumbach,
Intel Linux Wireless, John W. Linville,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <1388999147.5891.2.camel-8Nb76shvtaUJvtFkdXX2HixXY32XiHfO@public.gmane.org>
On Mon, 6 Jan 2014, Johannes Berg wrote:
> On Tue, 2013-12-31 at 17:40 +0100, Julia Lawall wrote:
>
> > > If nothing else, then some run-time code that calculates the offset off
> > > and asserts if it is broken in module initialization or similar might
> > > be good enough.
> >
> > Could be OK. Something right in or after the structure declaration would
> > be nicest.
>
> I don't think you can put a BUILD_BUG_ON() into the structure
> declaration (it's code, not declarations), but I think you could just
> put
>
> BUILD_BUG_ON(sizeof(struct foo) - offsetof(struct foo, addr) < 8);
>
> with the user(s?) and that should catch the scenario I was worrying
> about?
OK, thanks. That is what I had in mind. But I was hoping to be able to
put it with the structure. Perhaps there is a way to make a macro that
expands to a dummy function that contains the BUILD_BUG_ON? But I guess
that would waste space?
I think that 8 should be 16?
julia
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* [PATCH net-next v2 3/3] r8152: replace the return value of rtl_ops_init
From: Hayes Wang @ 2014-01-06 9:08 UTC (permalink / raw)
To: netdev; +Cc: nic_swsd, linux-kernel, linux-usb, Hayes Wang
In-Reply-To: <1388999323-9059-1-git-send-email-hayeswang@realtek.com>
Replace the boolean value with the error code for the return value
of the rtl_ops_init().
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
---
drivers/net/usb/r8152.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 8615681..881475f 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -2685,10 +2685,10 @@ static void rtl8153_unload(struct r8152 *tp)
r8153_power_cut_en(tp, 1);
}
-static bool rtl_ops_init(struct r8152 *tp, const struct usb_device_id *id)
+static int rtl_ops_init(struct r8152 *tp, const struct usb_device_id *id)
{
struct rtl_ops *ops = &tp->rtl_ops;
- bool ret = true;
+ int ret = -ENODEV;
switch (id->idVendor) {
case VENDOR_ID_REALTEK:
@@ -2699,6 +2699,7 @@ static bool rtl_ops_init(struct r8152 *tp, const struct usb_device_id *id)
ops->disable = rtl8152_disable;
ops->down = rtl8152_down;
ops->unload = rtl8152_unload;
+ ret = 0;
break;
case PRODUCT_ID_RTL8153:
ops->init = r8153_init;
@@ -2706,9 +2707,9 @@ static bool rtl_ops_init(struct r8152 *tp, const struct usb_device_id *id)
ops->disable = rtl8152_disable;
ops->down = rtl8153_down;
ops->unload = rtl8153_unload;
+ ret = 0;
break;
default:
- ret = false;
break;
}
break;
@@ -2721,18 +2722,20 @@ static bool rtl_ops_init(struct r8152 *tp, const struct usb_device_id *id)
ops->disable = rtl8152_disable;
ops->down = rtl8153_down;
ops->unload = rtl8153_unload;
+ ret = 0;
break;
default:
- ret = false;
break;
}
break;
default:
- ret = false;
break;
}
+ if (ret)
+ netif_err(tp, probe, tp->netdev, "Unknown Device\n");
+
return ret;
}
@@ -2763,10 +2766,9 @@ static int rtl8152_probe(struct usb_interface *intf,
tp->netdev = netdev;
tp->intf = intf;
- if (!rtl_ops_init(tp, id)) {
- netif_err(tp, probe, netdev, "Unknown Device");
- return -ENODEV;
- }
+ ret = rtl_ops_init(tp, id);
+ if (ret)
+ goto out;
tasklet_init(&tp->tl, bottom_half, (unsigned long)tp);
INIT_DELAYED_WORK(&tp->schedule, rtl_work_func_t);
--
1.8.4.2
^ permalink raw reply related
* [PATCH net-next v2 2/3] r8152: move the actions of saving the information of the device
From: Hayes Wang @ 2014-01-06 9:08 UTC (permalink / raw)
To: netdev; +Cc: nic_swsd, linux-kernel, linux-usb, Hayes Wang
In-Reply-To: <1388999323-9059-1-git-send-email-hayeswang@realtek.com>
Some information of the device may be used in other functions. Move
the relative code to make sure it would be initialzed correctly
before using it.
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
---
drivers/net/usb/r8152.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 095f15b..8615681 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -2759,6 +2759,10 @@ static int rtl8152_probe(struct usb_interface *intf,
tp = netdev_priv(netdev);
tp->msg_enable = 0x7FFF;
+ tp->udev = udev;
+ tp->netdev = netdev;
+ tp->intf = intf;
+
if (!rtl_ops_init(tp, id)) {
netif_err(tp, probe, netdev, "Unknown Device");
return -ENODEV;
@@ -2767,9 +2771,6 @@ static int rtl8152_probe(struct usb_interface *intf,
tasklet_init(&tp->tl, bottom_half, (unsigned long)tp);
INIT_DELAYED_WORK(&tp->schedule, rtl_work_func_t);
- tp->udev = udev;
- tp->netdev = netdev;
- tp->intf = intf;
netdev->netdev_ops = &rtl8152_netdev_ops;
netdev->watchdog_timeo = RTL8152_TX_TIMEOUT;
--
1.8.4.2
^ permalink raw reply related
* [PATCH net-next v2 1/3] r8152: replace some tabs with spaces
From: Hayes Wang @ 2014-01-06 9:08 UTC (permalink / raw)
To: netdev; +Cc: nic_swsd, linux-kernel, linux-usb, Hayes Wang
In-Reply-To: <1388999323-9059-1-git-send-email-hayeswang@realtek.com>
Replace the tabs of the variables declaration with the spaces.
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
---
drivers/net/usb/r8152.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 13fabbb..095f15b 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -584,8 +584,8 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size,
void *data, u16 type)
{
- u16 limit = 64;
- int ret = 0;
+ u16 limit = 64;
+ int ret = 0;
if (test_bit(RTL8152_UNPLUG, &tp->flags))
return -ENODEV;
@@ -624,9 +624,9 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size,
static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen,
u16 size, void *data, u16 type)
{
- int ret;
- u16 byteen_start, byteen_end, byen;
- u16 limit = 512;
+ int ret;
+ u16 byteen_start, byteen_end, byen;
+ u16 limit = 512;
if (test_bit(RTL8152_UNPLUG, &tp->flags))
return -ENODEV;
@@ -1812,8 +1812,8 @@ static void r8152b_exit_oob(struct r8152 *tp)
static void r8152b_enter_oob(struct r8152 *tp)
{
- u32 ocp_data;
- int i;
+ u32 ocp_data;
+ int i;
ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
ocp_data &= ~NOW_IS_OOB;
@@ -2340,7 +2340,7 @@ static void r8153_clear_bp(struct r8152 *tp)
static void r8152b_enable_eee(struct r8152 *tp)
{
- u32 ocp_data;
+ u32 ocp_data;
ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
ocp_data |= EEE_RX_EN | EEE_TX_EN;
--
1.8.4.2
^ permalink raw reply related
* [PATCH net-next v2 0/3] adjust the code of r8152
From: Hayes Wang @ 2014-01-06 9:08 UTC (permalink / raw)
To: netdev; +Cc: nic_swsd, linux-kernel, linux-usb, Hayes Wang
In-Reply-To: <1388990366-8508-1-git-send-email-hayeswang@realtek.com>
Replace some tabs and modify the return value of rtl_ops_init().
v2: add the terminating newline for the message of patch #3.
Hayes Wang (3):
r8152: replace some tabs with spaces
r8152: move the actions of saving the information of the device
r8152: replace the return value of rtl_ops_init
drivers/net/usb/r8152.c | 43 +++++++++++++++++++++++--------------------
1 file changed, 23 insertions(+), 20 deletions(-)
--
1.8.4.2
^ permalink raw reply
* Re: [PATCH 4/11] use ether_addr_equal_64bits
From: Johannes Berg @ 2014-01-06 9:07 UTC (permalink / raw)
To: Julia Lawall
Cc: Joe Perches, Henrique de Moraes Holschuh, kernel-janitors,
Emmanuel Grumbach, Intel Linux Wireless, John W. Linville,
linux-wireless, netdev, linux-kernel
In-Reply-To: <alpine.DEB.2.10.1401061001340.2079@hadrien>
On Mon, 2014-01-06 at 10:04 +0100, Julia Lawall wrote:
> OK, the question was expressed badly. Is there any way to use the value
> to trigger an action at build time? The only way I kow to trigger an
> action is with #error, but #error is processed by cpp, which doesn't know
> about the size of types.
That's exactly BUILD_BUG_ON(), I believe.
johannes
^ permalink raw reply
* Re: [PATCH 4/11] use ether_addr_equal_64bits
From: Johannes Berg @ 2014-01-06 9:05 UTC (permalink / raw)
To: Julia Lawall
Cc: Ben Greear, Joe Perches, Henrique de Moraes Holschuh,
kernel-janitors, Emmanuel Grumbach, Intel Linux Wireless,
John W. Linville, linux-wireless, netdev, linux-kernel
In-Reply-To: <alpine.DEB.2.10.1312311732080.2074@hadrien>
On Tue, 2013-12-31 at 17:40 +0100, Julia Lawall wrote:
> > If nothing else, then some run-time code that calculates the offset off
> > and asserts if it is broken in module initialization or similar might
> > be good enough.
>
> Could be OK. Something right in or after the structure declaration would
> be nicest.
I don't think you can put a BUILD_BUG_ON() into the structure
declaration (it's code, not declarations), but I think you could just
put
BUILD_BUG_ON(sizeof(struct foo) - offsetof(struct foo, addr) < 8);
with the user(s?) and that should catch the scenario I was worrying
about?
johannes
^ permalink raw reply
* Re: [PATCH net-next 1/2] ipv4: add forwarding_uses_pmtu knob to protect forward path to use pmtu info
From: Steffen Klassert @ 2014-01-06 9:05 UTC (permalink / raw)
To: Hannes Frederic Sowa, netdev, eric.dumazet, davem
In-Reply-To: <20131231042840.GC27636@order.stressinduktion.org>
On Tue, Dec 31, 2013 at 05:28:40AM +0100, Hannes Frederic Sowa wrote:
> Hi Steffen!
>
> On Fri, Dec 20, 2013 at 02:08:22PM +0100, Hannes Frederic Sowa wrote:
> > Provide a mode where the forwarding path does not use the protocol path
> > MTU to calculate the maximum size for a forwarded packet but instead
> > uses the interface or the per-route locked MTU.
> >
> > It is easy to inject bogus or malicious path mtu information which
> > will cause either unneeded fragmentation-needed icmp errors (in case
> > of DF-bit set) or unnecessary fragmentation of packets (by default down
> > to min_pmtu). This could be used to either create blackholes on routers
> > (if the generated DF-bit gets dropped later on) or to leverage attacks
> > on fragmentation.
> >
> > Forwarded skbs are marked with IPSKB_FORWARDED in ip_forward. This flag
> > was introduced for multicast forwarding, but as it does not conflict with
> > our usage in the unicast code path it is perfect for reuse.
> >
> > I moved the functions ip_sk_accept_pmtu, ip_sk_use_pmtu and ip_skb_dst_mtu
> > along with the new ip_dst_mtu_secure to net/ip.h to fix circular
> > dependencies because of IPSKB_FORWARDED.
>
> IIRC you have a (semi-)automatic test suite to test for (p)mtu problems? Would
> these checks cover such a change?
>
I'm currenlty testing these patches. ipv4 looks good but on
ipv6 with 'ping6' the packet size is not reduced according
to the pmtu when forward_use_pmtu is set to 0.
I'll run the tests again with your updated v3 patches.
^ permalink raw reply
* Re: [PATCH 4/11] use ether_addr_equal_64bits
From: Julia Lawall @ 2014-01-06 9:04 UTC (permalink / raw)
To: Joe Perches
Cc: Julia Lawall, Johannes Berg, Henrique de Moraes Holschuh,
kernel-janitors, Emmanuel Grumbach, Intel Linux Wireless,
John W. Linville, linux-wireless, netdev, linux-kernel
In-Reply-To: <1388998750.5808.43.camel@joe-AO722>
On Mon, 6 Jan 2014, Joe Perches wrote:
> On Mon, 2014-01-06 at 09:48 +0100, Julia Lawall wrote:
> > Is there any way to get sizeof evaluated at build time?
>
> I'm confused a bit by what you want to accomplish.
To check that a field that is an argument od ether_addr_equal_64bits is
a sufficient distance from the end of the structure.
> Except for variable length arrays, isn't sizeof always
> evaluated at build time?
OK, the question was expressed badly. Is there any way to use the value
to trigger an action at build time? The only way I kow to trigger an
action is with #error, but #error is processed by cpp, which doesn't know
about the size of types.
julia
> 6.5.3.4 The sizeof operator
> Constraints
> []
> 2 The sizeof operator yields the size (in bytes) of its operand, which may be an
> expression or the parenthesized name of a type. The size is determined from the type of
> the operand. The result is an integer. If the type of the operand is a variable length array
> type, the operand is evaluated; otherwise, the operand is not evaluated and the result is an
> integer constant.
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply
* Re: [PATCH v2 5/5] alx: add stats to ethtool
From: Johannes Berg @ 2014-01-06 9:03 UTC (permalink / raw)
To: Sabrina Dubroca; +Cc: davem, bhutchings, netdev
In-Reply-To: <1388854031-24142-6-git-send-email-sd@queasysnail.net>
On Sat, 2014-01-04 at 17:47 +0100, Sabrina Dubroca wrote:
> + __alx_update_hw_stats(hw);
> + BUILD_BUG_ON(sizeof(hw->stats) - offsetof(struct alx_hw_stats, rx_ok) <
> + ALX_NUM_STATS * sizeof(u64));
I think you should make that != instead of <, otherwise you won't catch
all possible differences.
johannes
^ permalink raw reply
* Re: [PATCH] net: can: Disable broken flexcan driver build for big endian CPU on ARM
From: Marc Kleine-Budde @ 2014-01-06 9:00 UTC (permalink / raw)
To: Guenter Roeck; +Cc: Wolfgang Grandegger, linux-can, netdev, linux-kernel
In-Reply-To: <1388944283-29990-1-git-send-email-linux@roeck-us.net>
[-- Attachment #1: Type: text/plain, Size: 1624 bytes --]
On 01/05/2014 06:51 PM, Guenter Roeck wrote:
> Building arm:allmodconfig fails with
>
> flexcan.c: In function 'flexcan_read':
> flexcan.c:243:2: error: implicit declaration of function 'in_be32'
> flexcan.c: In function 'flexcan_write':
> flexcan.c:248:2: error: implicit declaration of function 'out_be32'
>
> in_be32 and out_be32 do not (or no longer) exist for ARM targets.
> Mark the build for arm on big endian CPUs as broken.
I think there isn't any ARM with this CAN core that supports BE (at
least on Linux).
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> ---
> If there is a better solution, please let me know and I'll be happy
> to provide a patch.
>
> drivers/net/can/Kconfig | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
> index 3c06947..8d202f4 100644
> --- a/drivers/net/can/Kconfig
> +++ b/drivers/net/can/Kconfig
> @@ -104,7 +104,7 @@ config CAN_JANZ_ICAN3
>
> config CAN_FLEXCAN
> tristate "Support for Freescale FLEXCAN based chips"
> - depends on ARM || PPC
> + depends on (ARM || PPC) && (BROKEN || !ARM || CPU_LITTLE_ENDIAN)
Why not make it:
depends on (ARM && CPU_LITTLE_ENDIAN) || PPC
> ---help---
> Say Y here if you want to support for Freescale FlexCAN.
>
>
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Industrial Linux Solutions | Phone: +49-231-2826-924 |
Vertretung West/Dortmund | Fax: +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686 | http://www.pengutronix.de |
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]
^ permalink raw reply
* Re: [PATCH 4/11] use ether_addr_equal_64bits
From: Joe Perches @ 2014-01-06 8:59 UTC (permalink / raw)
To: Julia Lawall
Cc: Johannes Berg, Henrique de Moraes Holschuh, kernel-janitors,
Emmanuel Grumbach, Intel Linux Wireless, John W. Linville,
linux-wireless, netdev, linux-kernel
In-Reply-To: <alpine.DEB.2.10.1401060947550.2079@hadrien>
On Mon, 2014-01-06 at 09:48 +0100, Julia Lawall wrote:
> Is there any way to get sizeof evaluated at build time?
I'm confused a bit by what you want to accomplish.
Except for variable length arrays, isn't sizeof always
evaluated at build time?
6.5.3.4 The sizeof operator
Constraints
[]
2 The sizeof operator yields the size (in bytes) of its operand, which may be an
expression or the parenthesized name of a type. The size is determined from the type of
the operand. The result is an integer. If the type of the operand is a variable length array
type, the operand is evaluated; otherwise, the operand is not evaluated and the result is an
integer constant.
^ permalink raw reply
* Re: How to add IPv6 multiple routing tables support to 2.6.16.26 kernel
From: Asi Lichtenstein @ 2014-01-06 8:56 UTC (permalink / raw)
To: netdev
In-Reply-To: <CAMBtn_2LttBQ6u5C_GEc1hh4=iSiAnzpN+2+MZO6j6GB2XBtNA@mail.gmail.com>
Does anyone know where I can find this patch:
http://thread.gmane.org/gmane.linux.network/41149
the link is broken, I've sent Thomas an email but did not get any response.
10x
On Sun, Jan 5, 2014 at 4:09 PM, Asi Lichtenstein <asili22@gmail.com> wrote:
> On Sun, Jan 5, 2014 at 3:56 PM, François-Xavier Le Bail
> <fx.lebail@yahoo.com> wrote:
>> On Sun, 1/5/14, Asi Lichtenstein <asili22@gmail.com> wrote:
>>
>>> It does look promising, are there any other related
>>> patches?
>>
>> I dont' know.
>> I just follow the link "(patch)" at the url you sent.
>> Please reply at end of message.
>>
>> BR
>>
>>> On Sun, Jan 5, 2014 at 3:25 PM, François-Xavier Le Bail
>> <fx.lebail@yahoo.com>
>> wrote:
>>> > Hello,
>>> >
>>> > Are you looking for this ?
>>> > http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/patch/?id=c71099acce933455123ee505cc75964610a209ad
>>
>
> I applied the patch you were referring to, but I think I am missing
> some higher level code with netlink.
^ permalink raw reply
* [PATCH net-next v2 3/3] ipv4: introduce hardened ip_no_pmtu_disc mode
From: Hannes Frederic Sowa @ 2014-01-06 8:48 UTC (permalink / raw)
To: netdev; +Cc: eric.dumazet, davem, johnwheffner, fweimer
This new ip_no_pmtu_disc mode only allowes fragmentation-needed errors
to be honored by protocols which do more stringent validation on the
ICMP's packet payload. This knob is useful for people who e.g. want to
run an unmodified DNS server in a namespace where they need to use pmtu
for TCP connections (as they are used for zone transfers or fallback
for requests) but don't want to use possibly spoofed UDP pmtu information.
Currently the whitelisted protocols are TCP, SCTP and DCCP as they check
if the returned packet is in the window or if the association is valid.
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: David Miller <davem@davemloft.net>
Cc: John Heffner <johnwheffner@gmail.com>
Suggested-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
v2)
* reworded Documentation
Documentation/networking/ip-sysctl.txt | 13 ++++++++++++-
include/net/protocol.h | 7 ++++++-
net/dccp/ipv4.c | 1 +
net/ipv4/af_inet.c | 1 +
net/ipv4/icmp.c | 28 ++++++++++++++++++++++++----
net/sctp/protocol.c | 1 +
6 files changed, 45 insertions(+), 6 deletions(-)
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 2d164a3..3b230c5 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -26,7 +26,18 @@ ip_no_pmtu_disc - INTEGER
discarded. Outgoing frames are handled the same as in mode 1,
implicitly setting IP_PMTUDISC_DONT on every created socket.
- Possible values: 0-2
+ Mode 3 is a hardend pmtu discover mode. The kernel will only
+ accept fragmentation-needed errors if the underlying protocol
+ can verify them besides a plain socket lookup. Current
+ protocols for which pmtu events will be honored are TCP, SCTP
+ and DCCP as they verify e.g. the sequence number or the
+ association. This mode should not be enabled globally but is
+ only intended to secure e.g. name servers in namespaces where
+ TCP path mtu must still work but path MTU information of other
+ protocols should be discarded. If enabled globally this mode
+ could break other protocols.
+
+ Possible values: 0-3
Default: FALSE
min_pmtu - INTEGER
diff --git a/include/net/protocol.h b/include/net/protocol.h
index fbf7676..0e5f866 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -43,7 +43,12 @@ struct net_protocol {
int (*handler)(struct sk_buff *skb);
void (*err_handler)(struct sk_buff *skb, u32 info);
unsigned int no_policy:1,
- netns_ok:1;
+ netns_ok:1,
+ /* does the protocol do more stringent
+ * icmp tag validation than simple
+ * socket lookup?
+ */
+ icmp_strict_tag_validation:1;
};
#if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 88299c2..22b5d81 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -989,6 +989,7 @@ static const struct net_protocol dccp_v4_protocol = {
.err_handler = dccp_v4_err,
.no_policy = 1,
.netns_ok = 1,
+ .icmp_strict_tag_validation = 1,
};
static const struct proto_ops inet_dccp_ops = {
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index b8bc1a3..be1f553 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1539,6 +1539,7 @@ static const struct net_protocol tcp_protocol = {
.err_handler = tcp_v4_err,
.no_policy = 1,
.netns_ok = 1,
+ .icmp_strict_tag_validation = 1,
};
static const struct net_protocol udp_protocol = {
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index fb3c563..0134663 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -668,6 +668,16 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
rcu_read_unlock();
}
+static bool icmp_tag_validation(int proto)
+{
+ bool ok;
+
+ rcu_read_lock();
+ ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+ rcu_read_unlock();
+ return ok;
+}
+
/*
* Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, ICMP_QUENCH, and
* ICMP_PARAMETERPROB.
@@ -705,12 +715,22 @@ static void icmp_unreach(struct sk_buff *skb)
case ICMP_PORT_UNREACH:
break;
case ICMP_FRAG_NEEDED:
- if (net->ipv4.sysctl_ip_no_pmtu_disc == 2) {
- goto out;
- } else if (net->ipv4.sysctl_ip_no_pmtu_disc) {
+ /* for documentation of the ip_no_pmtu_disc
+ * values please see
+ * Documentation/networking/ip-sysctl.txt
+ */
+ switch (net->ipv4.sysctl_ip_no_pmtu_disc) {
+ default:
LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: fragmentation needed and DF set\n"),
&iph->daddr);
- } else {
+ break;
+ case 2:
+ goto out;
+ case 3:
+ if (!icmp_tag_validation(iph->protocol))
+ goto out;
+ /* fall through */
+ case 0:
info = ntohs(icmph->un.frag.mtu);
if (!info)
goto out;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 34b7726..7c16108 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1030,6 +1030,7 @@ static const struct net_protocol sctp_protocol = {
.err_handler = sctp_v4_err,
.no_policy = 1,
.netns_ok = 1,
+ .icmp_strict_tag_validation = 1,
};
/* IPv4 address related functions. */
--
1.8.4.2
^ permalink raw reply related
* [PATCH net-next v3 2/3] ipv6: use interface or locked route MTU for determination whether packet is too large
From: Hannes Frederic Sowa @ 2014-01-06 8:48 UTC (permalink / raw)
To: netdev; +Cc: eric.dumazet, davem, johnwheffner, steffen.klassert, fweimer
In the IPv6 forwarding path we are only concerend about the outgoing
interface MTU, but also respect locked MTUs on routes. Tunnel provider
or IPSEC already have to recheck and if needed send PtB notifications
to the sending host in case the data does not fit into the packet with
added headers (we only know the header sizes there, while also using
path MTU information there).
The reason for this change is, that path MTU information can be injected
into the kernel via e.g. icmp_err protocol handler without verification
of local sockets. As such, this could cause the IPv6 forwarding path to
wrongfully emit Packet-too-Big errors and drop IPv6 packets.
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: David Miller <davem@davemloft.net>
Cc: John Heffner <johnwheffner@gmail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
v2)
* default disabled
v3)
* complete rewrite
* always only honor interface mtu
* no knob anymore
net/ipv6/ip6_output.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 788c01a..9ab013ba 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -321,6 +321,27 @@ static inline int ip6_forward_finish(struct sk_buff *skb)
return dst_output(skb);
}
+static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
+{
+ unsigned int mtu;
+ struct inet6_dev *idev;
+
+ if (dst_metric_locked(dst, RTAX_MTU)) {
+ mtu = dst_metric_raw(dst, RTAX_MTU);
+ if (mtu)
+ return mtu;
+ }
+
+ mtu = IPV6_MIN_MTU;
+ rcu_read_lock();
+ idev = __in6_dev_get(dst->dev);
+ if (idev)
+ mtu = idev->cnf.mtu6;
+ rcu_read_unlock();
+
+ return mtu;
+}
+
int ip6_forward(struct sk_buff *skb)
{
struct dst_entry *dst = skb_dst(skb);
@@ -441,7 +462,7 @@ int ip6_forward(struct sk_buff *skb)
}
}
- mtu = dst_mtu(dst);
+ mtu = ip6_dst_mtu_forward(dst);
if (mtu < IPV6_MIN_MTU)
mtu = IPV6_MIN_MTU;
--
1.8.4.2
^ permalink raw reply related
* [PATCH net-next v3 1/3] ipv4: introduce ip_dst_mtu_secure and protect forwarding path against pmtu spoofing
From: Hannes Frederic Sowa @ 2014-01-06 8:48 UTC (permalink / raw)
To: netdev; +Cc: eric.dumazet, davem, johnwheffner, steffen.klassert, fweimer
While forwarding we should not use the protocol path mtu to calculate
the mtu for a forwarded packet but instead use the interface mtu.
We mark forwarded skbs in ip_forward with IPSKB_FORWARDED which was
introduced for multicast forwarding. But as it does not conflict with
our usage in unicast code path it is perfect for reuse.
I moved the functions ip_sk_accept_pmtu, ip_sk_use_pmtu and ip_skb_dst_mtu
along with the new ip_dst_mtu_secure to net/ip.h to fix circular
dependencies because of IPSKB_FORWARDED.
Because someone might have written a software which does probe
destinations manually and expects the kernel to honour those path mtus
I introduced a new per-namespace "forwarding_uses_pmtu" knob so someone
can disable this new behaviour. We also use mtus which are locked on a
route for forwarding.
The reason for this change is, that path MTU information can be injected
into the kernel via e.g. icmp_err protocol handler without verification
of local sockets. As such, this could cause the IPv4 forwarding path to
wrongfully emit fragmentation needed notifications or start to fragment
packets along a path.
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: David Miller <davem@davemloft.net>
Cc: John Heffner <johnwheffner@gmail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
Hi!
I want to put these patches up for discussion again. I did more testing
to them (xfrm, tunnel), did some rewording and rewrote the IPv6 patch.
Thanks,
Hannes
v2)
* forward_use_pmtu default disabled
* reworded from v1
v3)
* forward_use_pmtu default enabled again
* reworded slighly from v1
Documentation/networking/ip-sysctl.txt | 13 +++++++++++++
include/net/ip.h | 33 +++++++++++++++++++++++++++++++++
include/net/netns/ipv4.h | 1 +
include/net/route.h | 19 +++----------------
net/ipv4/ip_forward.c | 7 +++++--
net/ipv4/ip_output.c | 8 +++++---
net/ipv4/route.c | 3 ---
net/ipv4/sysctl_net_ipv4.c | 7 +++++++
8 files changed, 67 insertions(+), 24 deletions(-)
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index d71afa8..2d164a3 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -32,6 +32,19 @@ ip_no_pmtu_disc - INTEGER
min_pmtu - INTEGER
default 552 - minimum discovered Path MTU
+ip_forward_use_pmtu - BOOLEAN
+ By default we don't trust protocol path MTUs while forwarding
+ because they could be easily forged and can lead to unwanted
+ fragmentation by the router.
+ You only need to enable this if you have user-space software
+ which tries to discover path mtus by itself and depends on the
+ kernel honoring this information. This is normally not the
+ case.
+ Default: 0 (disabled)
+ Possible values:
+ 0 - disabled
+ 1 - enabled
+
route/max_size - INTEGER
Maximum number of routes allowed in the kernel. Increase
this when using large numbers of interfaces and/or routes.
diff --git a/include/net/ip.h b/include/net/ip.h
index 5356644..0893483 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -263,6 +263,39 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
!(dst_metric_locked(dst, RTAX_MTU)));
}
+static inline bool ip_sk_accept_pmtu(const struct sock *sk)
+{
+ return inet_sk(sk)->pmtudisc != IP_PMTUDISC_INTERFACE;
+}
+
+static inline bool ip_sk_use_pmtu(const struct sock *sk)
+{
+ return inet_sk(sk)->pmtudisc < IP_PMTUDISC_PROBE;
+}
+
+static inline unsigned int ip_dst_mtu_secure(const struct dst_entry *dst,
+ bool forwarding)
+{
+ struct net *net = dev_net(dst->dev);
+
+ if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
+ dst_metric_locked(dst, RTAX_MTU) ||
+ !forwarding)
+ return dst_mtu(dst);
+
+ return min(dst->dev->mtu, IP_MAX_MTU);
+}
+
+static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
+{
+ if (!skb->sk || ip_sk_use_pmtu(skb->sk)) {
+ bool forwarding = !!(IPCB(skb)->flags & IPSKB_FORWARDED);
+ return ip_dst_mtu_secure(skb_dst(skb), forwarding);
+ } else {
+ return min(skb_dst(skb)->dev->mtu, IP_MAX_MTU);
+ }
+}
+
void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk)
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 929a668..80f500a 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -70,6 +70,7 @@ struct netns_ipv4 {
int sysctl_tcp_ecn;
int sysctl_ip_no_pmtu_disc;
+ int sysctl_ip_fwd_use_pmtu;
kgid_t sysctl_ping_group_range[2];
diff --git a/include/net/route.h b/include/net/route.h
index 638e3eb..9d1f423 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -36,6 +36,9 @@
#include <linux/cache.h>
#include <linux/security.h>
+/* IPv4 datagram length is stored into 16bit field (tot_len) */
+#define IP_MAX_MTU 0xFFFFU
+
#define RTO_ONLINK 0x01
#define RT_CONN_FLAGS(sk) (RT_TOS(inet_sk(sk)->tos) | sock_flag(sk, SOCK_LOCALROUTE))
@@ -311,20 +314,4 @@ static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
return hoplimit;
}
-static inline bool ip_sk_accept_pmtu(const struct sock *sk)
-{
- return inet_sk(sk)->pmtudisc != IP_PMTUDISC_INTERFACE;
-}
-
-static inline bool ip_sk_use_pmtu(const struct sock *sk)
-{
- return inet_sk(sk)->pmtudisc < IP_PMTUDISC_PROBE;
-}
-
-static inline int ip_skb_dst_mtu(const struct sk_buff *skb)
-{
- return (!skb->sk || ip_sk_use_pmtu(skb->sk)) ?
- dst_mtu(skb_dst(skb)) : skb_dst(skb)->dev->mtu;
-}
-
#endif /* _ROUTE_H */
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 694de3b..66d027f 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -54,6 +54,7 @@ static int ip_forward_finish(struct sk_buff *skb)
int ip_forward(struct sk_buff *skb)
{
+ u32 mtu;
struct iphdr *iph; /* Our header */
struct rtable *rt; /* Route we use */
struct ip_options *opt = &(IPCB(skb)->opt);
@@ -88,11 +89,13 @@ int ip_forward(struct sk_buff *skb)
if (opt->is_strictroute && rt->rt_uses_gateway)
goto sr_failed;
- if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
+ IPCB(skb)->flags |= IPSKB_FORWARDED;
+ mtu = ip_dst_mtu_secure(&rt->dst, true);
+ if (unlikely(skb->len > mtu && !skb_is_gso(skb) &&
(ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
- htonl(dst_mtu(&rt->dst)));
+ htonl(mtu));
goto drop;
}
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 9124027..180de0d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -449,6 +449,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
__be16 not_last_frag;
struct rtable *rt = skb_rtable(skb);
int err = 0;
+ bool forwarding = !!(IPCB(skb)->flags & IPSKB_FORWARDED);
dev = rt->dst.dev;
@@ -458,12 +459,13 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
iph = ip_hdr(skb);
+ mtu = ip_dst_mtu_secure(&rt->dst, forwarding);
if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->local_df) ||
(IPCB(skb)->frag_max_size &&
- IPCB(skb)->frag_max_size > dst_mtu(&rt->dst)))) {
+ IPCB(skb)->frag_max_size > mtu))) {
IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
- htonl(ip_skb_dst_mtu(skb)));
+ htonl(mtu));
kfree_skb(skb);
return -EMSGSIZE;
}
@@ -473,7 +475,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
*/
hlen = iph->ihl * 4;
- mtu = dst_mtu(&rt->dst) - hlen; /* Size of data space */
+ mtu = mtu - hlen; /* Size of data space */
#ifdef CONFIG_BRIDGE_NETFILTER
if (skb->nf_bridge)
mtu -= nf_bridge_mtu_reduction(skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f8da282..25071b4 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -112,9 +112,6 @@
#define RT_FL_TOS(oldflp4) \
((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
-/* IPv4 datagram length is stored into 16bit field (tot_len) */
-#define IP_MAX_MTU 0xFFFF
-
#define RT_GC_TIMEOUT (300*HZ)
static int ip_rt_max_size;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 1d2480a..44eba05 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -831,6 +831,13 @@ static struct ctl_table ipv4_net_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec
},
+ {
+ .procname = "ip_forward_use_pmtu",
+ .data = &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
{ }
};
--
1.8.4.2
^ permalink raw reply related
* Re: [PATCH 4/11] use ether_addr_equal_64bits
From: Julia Lawall @ 2014-01-06 8:48 UTC (permalink / raw)
To: Joe Perches
Cc: Johannes Berg, Henrique de Moraes Holschuh, Julia Lawall,
kernel-janitors, Emmanuel Grumbach, Intel Linux Wireless,
John W. Linville, linux-wireless, netdev, linux-kernel
In-Reply-To: <1388445422.26796.38.camel@joe-AO722>
Is there any way to get sizeof evaluated at build time?
julia
^ permalink raw reply
* Re: [RFC PATCH net-next 0/4] net_cls for sys container
From: Gao feng @ 2014-01-06 8:42 UTC (permalink / raw)
To: Libo Chen, Cong Wang
Cc: Simon Horman, Patrick McHardy, Linux Kernel Network Developers,
jasowang-H+wXaHxf7aLQT0dZR+AlfA, Serge Hallyn,
pshelar-l0M0P4e3n4LQT0dZR+AlfA, Eric Dumazet,
cgroups-u79uwXL29TY76Z2rM5mHXA,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
David Miller, LKML, xemul-GEFAQzZX7r8dnm+yROfE0A
In-Reply-To: <52CA614D.6040702-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>
On 01/06/2014 03:54 PM, Libo Chen wrote:
> On 2014/1/3 13:20, Cong Wang wrote:
>> On Thu, Jan 2, 2014 at 7:11 PM, Libo Chen <clbchenlibo.chen-hv44wF8Li93QT0dZR+AlfA@public.gmane.org> wrote:
>>> Hi guys,
>>>
>>> Now, lxc created with veth can not be under control by
>>> cls_cgroup.
>>>
>>> the former discussion:
>>> http://lkml.indiana.edu/hypermail/linux/kernel/1312.1/00214.html
>>>
>>> In short, because cls_cgroup relys classid attached to sock
>>> filter skb, but sock will be cleared inside dev_forward_skb()
>>> in veth_xmit().
>>
>>
>> So what are you trying to achieve here?
>
> sys container using veth can be controlled by cls_cgroup basing on physic network interface
>
It's a problem about virtual nic, not container/net namespace.
If veth device is running in host. the skb is transmitted firstly by veth device and then delivered
by physical device. if you set both qdisc rule on veth and physical device. which qdisc rule will take
effect?
In your patch, both qdisc rule are effective. it looks strange.
^ permalink raw reply
* Re: [PATCH 0/6] phylib: cleanups
From: Richard Cochran @ 2014-01-06 8:35 UTC (permalink / raw)
To: Sergei Shtylyov; +Cc: netdev
In-Reply-To: <52C960B8.1020607@cogentembedded.com>
On Sun, Jan 05, 2014 at 05:40:08PM +0400, Sergei Shtylyov wrote:
> On 05-01-2014 12:31, Richard Cochran wrote:
> >After all, there are not that many phylib drivers.
>
> Really? I find the number to be intimidating enough to not do the
> cleanups on them also in this same patchset. Anyway, the callback
> was intended for the Ethernet drivers.
I once made a list using cscope, in order find all phylib drivers that
are missing skb_tx_timestamp. Here is what I came up with at that
time. Discounting those files under 'phylib' and 'unlikely', I only
found 30 drivers.
Finding files #including file: linux/phy.h
* arm
drivers/net/arm/ixp4xx_eth.c
drivers/net/davinci_emac.c
drivers/net/macb.c
drivers/net/pxa168_eth.c
drivers/net/ax88796.c
drivers/net/smsc911x.c
* powerpc
drivers/net/fec_mpc52xx.c
drivers/net/fs_enet/fs_enet-main.c
drivers/net/ll_temac_main.c
drivers/net/mv643xx_eth.c
drivers/net/ucc_geth.c
drivers/net/xilinx_emaclite.c
* x86
drivers/net/dnet.c
drivers/net/ethoc.c
drivers/net/fec.c
drivers/net/r6040.c
drivers/net/smsc9420.c
drivers/net/stmmac/stmmac_main.c
drivers/net/tg3.c
* mips
drivers/net/au1000_eth.c
drivers/net/bcm63xx_enet.h
drivers/net/cpmac.c
drivers/net/lantiq_etop.c
drivers/net/octeon/octeon_mgmt.c
drivers/net/sb1250-mac.c
drivers/net/tc35815.c
* sparc
drivers/net/greth.h
* superh
drivers/net/sh_eth.c
drivers/net/sh_eth.h
* xtensa
drivers/net/s6gmac.c
* phylib
drivers/net/phy/bcm63xx.c
drivers/net/phy/broadcom.c
drivers/net/phy/cicada.c
drivers/net/phy/davicom.c
drivers/net/phy/dp83640.c
drivers/net/phy/et1011c.c
drivers/net/phy/fixed.c
drivers/net/phy/icplus.c
drivers/net/phy/lxt.c
drivers/net/phy/marvell.c
drivers/net/phy/mdio-octeon.c
drivers/net/phy/mdio_bus.c
drivers/net/phy/micrel.c
drivers/net/phy/national.c
drivers/net/phy/phy.c
drivers/net/phy/phy_device.c
drivers/net/phy/qsemi.c
drivers/net/phy/realtek.c
drivers/net/phy/smsc.c
drivers/net/phy/ste10Xp.c
drivers/net/phy/vitesse.c
* unlikely
drivers/net/pasemi_mac.h
drivers/of/of_mdio.c
drivers/staging/octeon/ethernet-mdio.c
drivers/staging/octeon/ethernet-rgmii.c
drivers/staging/octeon/ethernet.c
include/linux/bfin_mac.h
include/linux/fec.h
include/linux/mdio-bitbang.h
include/linux/of_mdio.h
include/linux/smsc911x.h
net/core/timestamping.c
net/dsa/dsa_priv.h
net/dsa/mv88e6060.c
net/dsa/mv88e6123_61_65.c
net/dsa/mv88e6131.c
net/dsa/mv88e6xxx.c
net/dsa/slave.c
> Thanks I found those eventually. However, my LinkedIn account
> told me that Andy left Freescale about that time (it also gave up
> his private email though).
Okay, so you know more than I do.
Thanks,
Richard
^ permalink raw reply
* Re: [RFC PATCH net-next 1/4] net: introduce backup_classid to struct skbuff
From: Libo Chen @ 2014-01-06 8:16 UTC (permalink / raw)
To: John Fastabend
Cc: netdev-u79uwXL29TY76Z2rM5mHXA, jasowang-H+wXaHxf7aLQT0dZR+AlfA,
serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA, kaber-dcUjhNyLwpNeoWH0uzbU5w,
edumazet-hpIqsD4AKlfQT0dZR+AlfA, horms-/R6kz+dDXgpPR4JQBCEnsQ,
ebiederm-aS9lmoZGLiVWk0Htik3J/w, cgroups-u79uwXL29TY76Z2rM5mHXA,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
David Miller, xemul-GEFAQzZX7r8dnm+yROfE0A
In-Reply-To: <52C656F2.8060803-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
On 2014/1/3 14:21, John Fastabend wrote:
> On 01/02/2014 09:34 PM, David Miller wrote:
>> From: Libo Chen <clbchenlibo.chen-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>
>> Date: Fri, 3 Jan 2014 11:11:04 +0800
>>
>>>
>>> introduce backup_classid to struct skbuff,
>>> we can use it to backup sk_classid when net_ns switch.
>>>
>>> Signed-off-by: Libo Chen <clbchenlibo.chen-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>
>>
>> Sorry, no new sk_buff members unless there is absolutely not other
>> possible implementation.
>>
>> sk_buff is too big as-is.
>
> To get what you want fix the dev_forward_skb() call. But its
> not clear to me why you would expect the sock info to be propagated
> like this. It seems like an incorrect assumption or a misunderstanding
> somewhere. If the virtual link was a physical link you wouldn't expect
> to know anything about the senders socket.
AFAIK, once the sock is created, sock->sk_classid will be set, see sk_alloc()
so I think it is safe.
thanks,
Libo
>
> Thanks,
> John
>
^ permalink raw reply
* Re: [RFC PATCH net-next 0/4] net_cls for sys container
From: Libo Chen @ 2014-01-06 7:54 UTC (permalink / raw)
To: Cong Wang
Cc: David Miller, Jamal Hadi Salim, Li Zefan, Eric Dumazet,
pshelar-l0M0P4e3n4LQT0dZR+AlfA, jasowang-H+wXaHxf7aLQT0dZR+AlfA,
Simon Horman, Serge Hallyn, Linux Kernel Network Developers,
cgroups-u79uwXL29TY76Z2rM5mHXA,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
Patrick McHardy, xemul-GEFAQzZX7r8dnm+yROfE0A, LKML
In-Reply-To: <CAM_iQpW0+Ftvk=QBE+0yMNW00VkBee1+yAEmbPkT+zjij9RX-Q-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
On 2014/1/3 13:20, Cong Wang wrote:
> On Thu, Jan 2, 2014 at 7:11 PM, Libo Chen <clbchenlibo.chen-hv44wF8Li93QT0dZR+AlfA@public.gmane.org> wrote:
>> Hi guys,
>>
>> Now, lxc created with veth can not be under control by
>> cls_cgroup.
>>
>> the former discussion:
>> http://lkml.indiana.edu/hypermail/linux/kernel/1312.1/00214.html
>>
>> In short, because cls_cgroup relys classid attached to sock
>> filter skb, but sock will be cleared inside dev_forward_skb()
>> in veth_xmit().
>
>
> So what are you trying to achieve here?
sys container using veth can be controlled by cls_cgroup basing on physic network interface
thanks,
Libo
>
> .
>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox