summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'master' of ↵David S. Miller2011-03-1527-557/+845
|\ | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6 Conflicts: Documentation/feature-removal-schedule.txt
| * netfilter: xt_addrtype: ipv6 supportFlorian Westphal2011-03-153-2/+114
| | | | | | | | | | | | | | | | | | The kernel will refuse certain types that do not work in ipv6 mode. We can then add these features incrementally without risk of userspace breakage. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ipt_addrtype: rename to xt_addrtypeFlorian Westphal2011-03-158-26/+63
| | | | | | | | | | | | | | | | | | | | Followup patch will add ipv6 support. ipt_addrtype.h is retained for compatibility reasons, but no longer used by the kernel. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * ipv6: netfilter: ip6_tables: fix infoleak to userspaceVasiliy Kulikov2011-03-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Structures ip6t_replace, compat_ip6t_replace, and xt_get_revision are copied from userspace. Fields of these structs that are zero-terminated strings are not checked. When they are used as argument to a format string containing "%s" in request_module(), some sensitive information is leaked to userspace via argument of spawned modprobe process. The first bug was introduced before the git epoch; the second was introduced in 3bc3fe5e (v2.6.25-rc1); the third is introduced by 6b7d31fc (v2.6.15-rc1). To trigger the bug one should have CAP_NET_ADMIN. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ip_tables: fix infoleak to userspaceVasiliy Kulikov2011-03-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Structures ipt_replace, compat_ipt_replace, and xt_get_revision are copied from userspace. Fields of these structs that are zero-terminated strings are not checked. When they are used as argument to a format string containing "%s" in request_module(), some sensitive information is leaked to userspace via argument of spawned modprobe process. The first and the third bugs were introduced before the git epoch; the second was introduced in 2722971c (v2.6.17-rc1). To trigger the bug one should have CAP_NET_ADMIN. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: arp_tables: fix infoleak to userspaceVasiliy Kulikov2011-03-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Structures ipt_replace, compat_ipt_replace, and xt_get_revision are copied from userspace. Fields of these structs that are zero-terminated strings are not checked. When they are used as argument to a format string containing "%s" in request_module(), some sensitive information is leaked to userspace via argument of spawned modprobe process. The first bug was introduced before the git epoch; the second is introduced by 6b7d31fc (v2.6.15-rc1); the third is introduced by 6b7d31fc (v2.6.15-rc1). To trigger the bug one should have CAP_NET_ADMIN. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xt_connlimit: remove connlimit_rnd_initedChangli Gao2011-03-151-4/+7
| | | | | | | | | | | | | | A potential race condition when generating connlimit_rnd is also fixed. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xt_connlimit: use hlist insteadChangli Gao2011-03-151-14/+14
| | | | | | | | | | | | | | The header of hlist is smaller than list. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xt_connlimit: use kmalloc() instead of kzalloc()Changli Gao2011-03-151-1/+1
| | | | | | | | | | | | | | All the members are initialized after kzalloc(). Signed-off-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: xt_connlimit: fix daddr connlimit in SNAT scenarioChangli Gao2011-03-151-11/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We use the reply tuples when limiting the connections by the destination addresses, however, in SNAT scenario, the final reply tuples won't be ready until SNAT is done in POSTROUING or INPUT chain, and the following nf_conntrack_find_get() in count_tem() will get nothing, so connlimit can't work as expected. In this patch, the original tuples are always used, and an additional member addr is appended to save the address in either end. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * IPVS: Conditionally include sysctl members of struct netns_ipvsSimon Horman2011-03-151-8/+13
| | | | | | | | | | | | | | There is now no need to include sysctl members of struct netns_ipvs unless CONFIG_SYSCTL is defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Add __ip_vs_control_{init,cleanup}_sysctl()Simon Horman2011-03-151-36/+62
| | | | | | | | | | | | | | | | Break out the portions of __ip_vs_control_init() and __ip_vs_control_cleanup() where aren't necessary when CONFIG_SYSCTL is undefined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Conditionally define and use ip_vs_lblc{r}_tableSimon Horman2011-03-152-9/+20
| | | | | | | | | | | | | | ip_vs_lblc_table and ip_vs_lblcr_table, and code that uses them are unnecessary when CONFIG_SYSCTL is undefined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Minimise ip_vs_leave when CONFIG_SYSCTL is undefinedSimon Horman2011-03-151-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | Much of ip_vs_leave() is unnecessary if CONFIG_SYSCTL is undefined. I tried an approach of breaking the now #ifdef'ed portions out into a separate function. However this appeared to grow the compiled code on x86_64 by about 200 bytes in the case where CONFIG_SYSCTL is defined. So I have gone with the simpler though less elegant #ifdef'ed solution for now. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Conditional ip_vs_conntrack_enabled()Simon Horman2011-03-151-0/+4
| | | | | | | | | | | | | | | | | | ip_vs_conntrack_enabled() becomes a noop when CONFIG_SYSCTL is undefined. In preparation for not including sysctl_conntrack in struct netns_ipvs when CONFIG_SYCTL is not defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: ip_vs_todrop() becomes a noop when CONFIG_SYSCTL is undefinedSimon Horman2011-03-151-0/+4
| | | | | | | | Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Conditinally use sysctl_lblc{r}_expirationSimon Horman2011-03-152-9/+28
| | | | | | | | | | | | | | In preparation for not including sysctl_lblc{r}_expiration in struct netns_ipvs when CONFIG_SYCTL is not defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Add expire_quiescent_template()Simon Horman2011-03-151-2/+11
| | | | | | | | | | | | | | In preparation for not including sysctl_expire_quiescent_template in struct netns_ipvs when CONFIG_SYCTL is not defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Add sysctl_expire_nodest_conn()Simon Horman2011-03-151-1/+7
| | | | | | | | | | | | | | In preparation for not including sysctl_expire_nodest_conn in struct netns_ipvs when CONFIG_SYCTL is not defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Add sysctl_sync_ver()Simon Horman2011-03-152-2/+13
| | | | | | | | | | | | | | In preparation for not including sysctl_sync_ver in struct netns_ipvs when CONFIG_SYCTL is not defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Add {sysctl_sync_threshold,period}()Simon Horman2011-03-154-9/+38
| | | | | | | | | | | | | | In preparation for not including sysctl_sync_threshold in struct netns_ipvs when CONFIG_SYCTL is not defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Add sysctl_nat_icmp_send()Simon Horman2011-03-151-3/+8
| | | | | | | | | | | | | | In preparation for not including sysctl_nat_icmp_send in struct netns_ipvs when CONFIG_SYCTL is not defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Add sysctl_snat_reroute()Simon Horman2011-03-151-4/+16
| | | | | | | | | | | | | | In preparation for not including sysctl_snat_reroute in struct netns_ipvs when CONFIG_SYCTL is not defined. Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Add ip_vs_route_me_harder()Simon Horman2011-03-151-26/+22
| | | | | | | | | | | | Add ip_vs_route_me_harder() to avoid repeating the same code twice. Signed-off-by: Simon Horman <horms@verge.net.au>
| * ipvs: rename estimator functionsJulian Anastasov2011-03-153-10/+10
| | | | | | | | | | | | | | | | | | Rename ip_vs_new_estimator to ip_vs_start_estimator and ip_vs_kill_estimator to ip_vs_stop_estimator to better match their logic. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Simon Horman <horms@verge.net.au>
| * ipvs: optimize rates readingJulian Anastasov2011-03-153-39/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the estimator reading from estimation_timer to user context. ip_vs_read_estimator() will be used to decode the rate values. As the decoded rates are not set by estimation timer there is no need to reset them in ip_vs_zero_stats. There is no need ip_vs_new_estimator() to encode stats to rates, if the destination is in trash both the stats and the rates are inactive. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Simon Horman <horms@verge.net.au>
| * ipvs: remove unused seqcount statsJulian Anastasov2011-03-151-17/+0
| | | | | | | | | | | | | | | | Remove ustats_seq, IPVS_STAT_INC and IPVS_STAT_ADD because they are not used. They were replaced with u64_stats. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Simon Horman <horms@verge.net.au>
| * ipvs: properly zero stats and ratesJulian Anastasov2011-03-153-43/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the new percpu counters are not zeroed and the zero commands do not work as expected, we still show the old sum of percpu values. OTOH, we can not reset the percpu counters from user context without causing the incrementing to use old and bogus values. So, as Eric Dumazet suggested fix that by moving all overhead to stats reading in user context. Do not introduce overhead in timer context (estimator) and incrementing (packet handling in softirqs). The new ustats0 field holds the zero point for all counter values, the rates always use 0 as base value as before. When showing the values to user space just give the difference between counters and the base values. The only drawback is that percpu stats are not zeroed, they are accessible only from /proc and are new interface, so it should not be a compatibility problem as long as the sum stats are correct after zeroing. Signed-off-by: Julian Anastasov <ja@ssi.bg> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Simon Horman <horms@verge.net.au>
| * ipvs: reorganize tot_statsJulian Anastasov2011-03-154-28/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The global tot_stats contains cpustats field just like the stats for dest and svc, so better use it to simplify the usage in estimation_timer. As tot_stats is registered as estimator we can remove the special ip_vs_read_cpu_stats call for tot_stats. Fix ip_vs_read_cpu_stats to be called under stats lock because it is still used as synchronization between estimation timer and user context (the stats readers). Also, make sure ip_vs_stats_percpu_show reads properly the u64 stats from user context. Signed-off-by: Julian Anastasov <ja@ssi.bg> Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Simon Horman <horms@verge.net.au>
| * ipvs: move struct netns_ipvsJulian Anastasov2011-03-153-144/+123
| | | | | | | | | | | | | | | | | | | | | | Remove include/net/netns/ip_vs.h because it depends on structures from include/net/ip_vs.h. As ipvs is pointer in struct net it is better to move struct netns_ipvs into include/net/ip_vs.h, so that we can easily use other structures in struct netns_ipvs. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Simon Horman <horms@verge.net.au>
| * IPVS: Fix variable assignment in ip_vs_notrackJesper Juhl2011-03-151-1/+1
| | | | | | | | | | | | | | | | There's no sense to 'ct = ct = ' in ip_vs_notrack(). Just assign nf_ct_get()'s return value directly to the pointer variable 'ct' once. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: Simon Horman <horms@verge.net.au>
| * netfilter:ipvs: use kmemdupShan Wei2011-03-152-7/+5
| | | | | | | | | | | | | | | | | | | | | | The semantic patch that makes this output is available in scripts/coccinelle/api/memdup.cocci. More information about semantic patching is available at http://coccinelle.lip6.fr/ Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Signed-off-by: Simon Horman <horms@verge.net.au>
| * ipvs: remove _bh from percpu stats readingJulian Anastasov2011-03-151-4/+4
| | | | | | | | | | | | | | | | | | ip_vs_read_cpu_stats is called only from timer, so no need for _bh locks. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Hans Schillstrom <hans@schillstrom.com> Signed-off-by: Simon Horman <horms@verge.net.au>
| * ipvs: avoid lookup for fwmark 0Julian Anastasov2011-03-151-3/+5
| | | | | | | | | | | | | | | | | | Restore the previous behaviour to lookup for fwmark service only when fwmark is non-null. This saves only CPU. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Hans Schillstrom <hans@schillstrom.com> Signed-off-by: Simon Horman <horms@verge.net.au>
| * netfilter: nf_conntrack: fix sysctl memory leakStephen Hemminger2011-03-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | Message in log because sysctl table was not empty at netns exit WARNING: at net/sysctl_net.c:84 sysctl_net_exit+0x2a/0x2c() Instrumenting showed that the nf_conntrack_timestamp was the entry that was being created but not cleared. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: x_tables: return -ENOENT for non-existant matches/targetsPatrick McHardy2011-03-141-2/+2
| | | | | | | | | | | | | | | | | | As Stephen correctly points out, we need to return -ENOENT in xt_find_match()/xt_find_target() after the patch "netfilter: x_tables: misuse of try_then_request_module" in order to properly indicate a non-existant module to the caller. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: x_tables: misuse of try_then_request_moduleStephen Hemminger2011-03-091-7/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since xt_find_match() returns ERR_PTR(xx) on error not NULL, the macro try_then_request_module won't work correctly here. The macro expects its first argument will be zero if condition fails. But ERR_PTR(-ENOENT) is not zero. The correct solution is to propagate the error value back. Found by inspection, and compile tested only. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netfilter: ipset: fix the compile warning in ip_set_createShan Wei2011-03-081-1/+1
| | | | | | | | | | | | | | | | net/netfilter/ipset/ip_set_core.c:615: warning: ‘clash’ may be used uninitialized in this function Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Patrick McHardy <kaber@trash.net>
* | net: dcbnl: Add IEEE app selector value definitionsMark Rustad2011-03-151-0/+5
| | | | | | | | | | | | | | | | | | This adds defines for the app selector values currently defined in the IEEE 802.1Qaz specification. Signed-off-by: Mark Rustad <mark.d.rustad@intel.com> Signed-off-by: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: dcbnl: Fix misspellingsMark Rustad2011-03-151-3/+3
| | | | | | | | | | | | | | | | Fix a few spelling errors in dcbnl.h. Signed-off-by: Mark Rustad <mark.d.rustad@intel.com> Signed-off-by: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: dcbnl: Update copyright datesMark Rustad2011-03-152-2/+2
| | | | | | | | | | | | Signed-off-by: Mark Rustad <mark.d.rustad@intel.com> Signed-off-by: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | fcoe: correct checking for bondingJiri Pirko2011-03-151-3/+1
| | | | | | | | | | | | | | | | | | Check for bonding master and refuse to use that. Signed-off-by: Jiri Pirko <jpirko@redhat.com> Acked-by: Robert Love <robert.w.love@intel.com> Acked-by: James Bottomley <James.Bottomley@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* | CS89x0: Add networking support for QQ2440Domenico Andreoli2011-03-152-2/+13
| | | | | | | | | | | | | | | | QQ2440 is only another non-ISA board using CS89x0. This patch adds the minimum bits required to make QQ2440 work with CS89x0. Signed-off-by: Domenico Andreoli <cavokz@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | CS89x0: Finish transition to CS89x0_NONISA_IRQDomenico Andreoli2011-03-151-4/+4
| | | | | | | | | | | | | | | | CS89x0_NONISA_IRQ is selected by all those non-ISA boards which use CS89x0. This patch only cleans the last bits left after its introduction. Signed-off-by: Domenico Andreoli <cavokz@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ftmac100: use GFP_ATOMIC allocations where neededEric Dumazet2011-03-141-5/+7
| | | | | | | | | | | | | | | | | | | | When running in softirq context, we should use GFP_ATOMIC allocations instead of GFP_KERNEL ones. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Po-Yu Chuang <ratbert@faraday-tech.com> Acked-by: Po-Yu Chuang <ratbert@faraday-tech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | qeth: change some configurations defaultsFrank Blaschka2011-03-143-2/+11
| | | | | | | | | | | | | | | | | | This patch turns on RX checksum and GRO by default. To improve receiving performance and reduce congestion in case of network bursts we also increase the default number of inbound buffers. Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | be2net: changes for BE3 native mode supportSathya Perla2011-03-145-150/+252
| | | | | | | | | | | | | | | | | | So far be2net has been using BE3 in legacy mode. It now checks for native mode capability and if available it sets it. In native mode, the RX_COMPL structure is different from that in legacy mode. Signed-off-by: Sathya Perla <sathya.perla@emulex.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netxen: Notify firmware of Flex-10 interface downSony Chacko2011-03-141-0/+3
| | | | | | | | | | | | | | | | | | Notify firmware when a Flex-10 interface is brought down so that virtual connect manager can display the correct link status. Signed-off-by: Sony Chacko <sony.chacko@qlogic.com> Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | phylib: SIOCGMIIREG/SIOCSMIIREG: allow access to all mdio addressesPeter Korsgaard2011-03-141-3/+5
| | | | | | | | | | | | | | | | | | | | phylib would silently ignore the phy_id argument to these ioctls and perform the read/write with the active phydev address, whereas most non-phylib drivers seem to allow access to all mdio addresses (E.G. pcnet_cs). Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bnx2: Update firmware and versionMichael Chan2011-03-145-2517/+2503
| | | | | | | | | | | | | | | | | | | | | | Update 5709 mips firmware to 6.2.1a to fix iSCSI performance regression. There was an unnecessary context read in the fast path affecting performance. Update bnx2 to 2.1.6. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-16 17:43:02 +0100