summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'ip_forward_pmtu'David S. Miller2014-01-1314-31/+134
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hannes Frederic Sowa says: ==================== path mtu hardening patches After a lot of back and forth I want to propose these changes regarding path mtu hardening and give an outline why I think this is the best way how to proceed: This set contains the following patches: * ipv4: introduce ip_dst_mtu_maybe_forward and protect forwarding path against pmtu spoofing * ipv6: introduce ip6_dst_mtu_forward and protect forwarding path with it * ipv4: introduce hardened ip_no_pmtu_disc mode The first one switches the forwarding path of IPv4 to use the interface mtu by default and ignore a possible discovered path mtu. It provides a sysctl to switch back to the original behavior (see discussion below). The second patch does the same thing unconditionally for IPv6. I don't provide a knob for IPv6 to switch to original behavior (please see below). The third patch introduces a hardened pmtu mode, where only pmtu information are accepted where the protocol is able to do more stringent checks on the icmp piggyback payload (please see the patch commit msg for further details). Why is this change necessary? First of all, RFC 1191 4. Router specification says: "When a router is unable to forward a datagram because it exceeds the MTU of the next-hop network and its Don't Fragment bit is set, the router is required to return an ICMP Destination Unreachable message to the source of the datagram, with the Code indicating "fragmentation needed and DF set". ..." For some time now fragmentation has been considered problematic, e.g.: * http://www.hpl.hp.com/techreports/Compaq-DEC/WRL-87-3.pdf * http://tools.ietf.org/search/rfc4963 Most of them seem to agree that fragmentation should be avoided because of efficiency, data corruption or security concerns. Recently it was shown possible that correctly guessing IP ids could lead to data injection on DNS packets: <https://sites.google.com/site/hayashulman/files/fragmentation-poisoning.pdf> While we can try to completly stop fragmentation on the end host (this is e.g. implemented via IP_PMTUDISC_INTERFACE), we cannot stop fragmentation completly on the forwarding path. On the end host the application has to deal with MTUs and has to choose fallback methods if fragmentation could be an attack vector. This is already the case for most DNS software, where a maximum UDP packet size can be configured. But until recently they had no control over local fragmentation and could thus emit fragmented packets. On the forwarding path we can just try to delay the fragmentation to the last hop where this is really necessary. Current kernel already does that but only because routers don't receive feedback of path mtus, these are only send back to the end host system. But it is possible to maliciously insert path mtu inforamtion via ICMP packets which have an icmp echo_reply payload, because we cannot validate those notifications against local sockets. DHCP clients which establish an any-bound RAW-socket could also start processing unwanted fragmentation-needed packets. Why does IPv4 has a knob to revert to old behavior while IPv6 doesn't? IPv4 does fragmentation on the path while IPv6 does always respond with packet-too-big errors. The interface MTU will always be greater than the path MTU information. So we would discard packets we could actually forward because of malicious information. After this change we would let the hop, which really could not forward the packet, notify the host of this problem. IPv4 allowes fragmentation mid-path. In case someone does use a software which tries to discover such paths and assumes that the kernel is handling the discovered pmtu information automatically. This should be an extremly rare case, but because I could not exclude the possibility this knob is provided. Also this software could insert non-locked mtu information into the kernel. We cannot distinguish that from path mtu information currently. Premature fragmentation could solve some problems in wrongly configured networks, thus this switch is provided. One frag-needed packet could reduce the path mtu down to 522 bytes (route/min_pmtu). Misc: IPv6 neighbor discovery could advertise mtu information for an interface. These information update the ipv6-specific interface mtu and thus get used by the forwarding path. Tunnel and xfrm output path will still honour path mtu and also respond with Packet-too-Big or fragmentation-needed errors if needed. Changelog for all patches: v2) * enabled ip_forward_use_pmtu by default * reworded v3) * disabled ip_forward_use_pmtu by default * reworded v4) * renamed ip_dst_mtu_secure to ip_dst_mtu_maybe_forward * updated changelog accordingly * removed unneeded !!(... & ...) double negations v2) * by default we honour pmtu information 3) * only honor interface mtu * rewritten and simplified * no knob to fall back to old mode any more v2) * reworded Documentation ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * ipv4: introduce hardened ip_no_pmtu_disc modeHannes Frederic Sowa2014-01-136-6/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new ip_no_pmtu_disc mode only allowes fragmentation-needed errors to be honored by protocols which do more stringent validation on the ICMP's packet payload. This knob is useful for people who e.g. want to run an unmodified DNS server in a namespace where they need to use pmtu for TCP connections (as they are used for zone transfers or fallback for requests) but don't want to use possibly spoofed UDP pmtu information. Currently the whitelisted protocols are TCP, SCTP and DCCP as they check if the returned packet is in the window or if the association is valid. Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: David Miller <davem@davemloft.net> Cc: John Heffner <johnwheffner@gmail.com> Suggested-by: Florian Weimer <fweimer@redhat.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * ipv6: introduce ip6_dst_mtu_forward and protect forwarding path with itHannes Frederic Sowa2014-01-131-1/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the IPv6 forwarding path we are only concerend about the outgoing interface MTU, but also respect locked MTUs on routes. Tunnel provider or IPSEC already have to recheck and if needed send PtB notifications to the sending host in case the data does not fit into the packet with added headers (we only know the final header sizes there, while also using path MTU information). The reason for this change is, that path MTU information can be injected into the kernel via e.g. icmp_err protocol handler without verification of local sockets. As such, this could cause the IPv6 forwarding path to wrongfully emit Packet-too-Big errors and drop IPv6 packets. Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: David Miller <davem@davemloft.net> Cc: John Heffner <johnwheffner@gmail.com> Cc: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * ipv4: introduce ip_dst_mtu_maybe_forward and protect forwarding path against ↵Hannes Frederic Sowa2014-01-138-24/+67
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pmtu spoofing While forwarding we should not use the protocol path mtu to calculate the mtu for a forwarded packet but instead use the interface mtu. We mark forwarded skbs in ip_forward with IPSKB_FORWARDED, which was introduced for multicast forwarding. But as it does not conflict with our usage in unicast code path it is perfect for reuse. I moved the functions ip_sk_accept_pmtu, ip_sk_use_pmtu and ip_skb_dst_mtu along with the new ip_dst_mtu_maybe_forward to net/ip.h to fix circular dependencies because of IPSKB_FORWARDED. Because someone might have written a software which does probe destinations manually and expects the kernel to honour those path mtus I introduced a new per-namespace "ip_forward_use_pmtu" knob so someone can disable this new behaviour. We also still use mtus which are locked on a route for forwarding. The reason for this change is, that path mtus information can be injected into the kernel via e.g. icmp_err protocol handler without verification of local sockets. As such, this could cause the IPv4 forwarding path to wrongfully emit fragmentation needed notifications or start to fragment packets along a path. Tunnel and ipsec output paths clear IPCB again, thus IPSKB_FORWARDED won't be set and further fragmentation logic will use the path mtu to determine the fragmentation size. They also recheck packet size with help of path mtu discovery and report appropriate errors. Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: David Miller <davem@davemloft.net> Cc: John Heffner <johnwheffner@gmail.com> Cc: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* HHF qdisc: fix jiffies-time conversion.Terry Lam2014-01-131-6/+6
| | | | | | | | | This is to be compatible with the use of "get_time" (i.e. default time unit in us) in iproute2 patch for HHF as requested by Stephen. Signed-off-by: Terry Lam <vtlam@google.com> Acked-by: Nandita Dukkipati <nanditad@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: Convert vmalloc/memset to kcallocJoe Perches2014-01-132-11/+7
| | | | | | | | | | | | | | | | | vmalloc is a limited resource. Don't use it unnecessarily. It seems this allocation should work with kcalloc. Remove unnecessary memset(,0,) of buf as it's completely overwritten as the previously only unset field in struct qlcnic_pci_func_cfg is now set to 0. Use kfree instead of vfree. Use ETH_ALEN instead of 6. Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: remove dead code from 3adVeaceslav Falico2014-01-121-78/+0
| | | | | | | | | That code has been around for ages without being used. CC: Jay Vosburgh <fubar@us.ibm.com> CC: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: Veaceslav Falico <vfalico@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: convert 3ad to use pr_warn instead of pr_warningVeaceslav Falico2014-01-121-25/+25
| | | | | | | CC: Jay Vosburgh <fubar@us.ibm.com> CC: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: Veaceslav Falico <vfalico@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bonding: clean up style for bond_3ad.cVeaceslav Falico2014-01-121-270/+349
| | | | | | | | | | | It's a huge mess currently, that is really hard to read. This cleanup doesn't touch the logic at all, it only breaks easy-to-fix long lines and updates comment styles. CC: Jay Vosburgh <fubar@us.ibm.com> CC: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: Veaceslav Falico <vfalico@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'alx_stats'David S. Miller2014-01-126-4/+331
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sabrina Dubroca says: ==================== alx: add statistics Currently, the alx driver doesn't support statistics [1,2]. The original alx driver [3] that Johannes Berg modified provided statistics. This patch is an adaptation of the statistics code from the original driver to the alx driver included in the kernel. v4: - modified the assignements of hw stats to netstats (Ben Hutchings) - added comments to describe the stats fields (copied from atlx) v3: - renamed __alx_update_hw_stats to alx_update_hw_stats (Stephen Hemminger) v2: - use u64 instead of unsigned long (Ben Hutchings) - implement ndo_get_stats64 instead of ndo_get_stats (Ben Hutchings) - use EINVAL instead of ENOTSUPP (Ben Hutchings) - add BUILD_BUG_ON to check the size of the stats (Johannes Berg, Ben Hutchings) - add a comment regarding persistence of the stats (Stephen Hemminger) - align assignments in __alx_update_hw_stats [1] https://bugzilla.kernel.org/show_bug.cgi?id=63401 [2] http://www.spinics.net/lists/netdev/msg245544.html [3] https://github.com/mcgrof/alx ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * alx: add stats to ethtoolSabrina Dubroca2014-01-122-1/+107
| | | | | | | | | | | | Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * alx: add alx_get_stats64 operationSabrina Dubroca2014-01-122-0/+53
| | | | | | | | | | | | Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * alx: add stats update functionSabrina Dubroca2014-01-122-0/+62
| | | | | | | | | | Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * alx: add constants for the stats fieldsSabrina Dubroca2014-01-121-4/+48
| | | | | | | | | | Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * alx: add a hardware stats structureSabrina Dubroca2014-01-121-0/+62
|/ | | | | Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2014-01-1218-62/+887
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-next Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates This series contains updates to i40e and now i40evf. Most notable is Jacob's patch to add PTP support to i40e. Mitch cleans up additional memcpy's and use struct assignment instead. Then fixes long lines to appease checkpatch.pl. Mitch then provides a fix to keep us from spamming the log with confusing errors. If you use ip to change the MAC address of a VF while the VF driver is loaded, closing the VF interface or unloading the VF driver will cause the VF driver to remove the MAC filter for its original (now invalid) MAC address. Jesse cleans up macros which are no longer needed or used. I (Jeff) cleanup function header comments to ensure Doxygen/kdoc works correctly to generate documentation without warnings. Anjali fixes a bug where ethtool set-channels would return failure when configuring only one Rx queue. Then fixes a bug where the driver was erroneously exiting the driver unload path if one part of the unload failed. Shannon fixes if the IPV6EXADD but is set in the Rx descriptor status, there was an optional extension header with an alternate IP address detected and the hardware checksum was not handling the alternate IP address correctly. Then adjusts the ITR max and min values to match the hardware max value and recommended min value. Shannon makes sure to clear the PXE mode after the adminq is initialized. v2: - fix patch 14 "i40e: enable PTP" to address Richard Cochran's spelling catch and Ben Hutchings Kconfig, SIOCGHWTSTAMP and sizeof() suggestions - added Paul Gortmaker's i40evf fix patch v3: - fix patch 14 "i40e: enable PTP" to address Ben Hutchings concerns about a race with PTP init and cleanup and i40e_get_ts_info(). ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * i40evf: fix s390 build failure due to implicit prefetch.hPaul Gortmaker2014-01-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As of commit 7f12ad741a4870b8b6e3aafbcd868d0191770802 ("i40evf: transmit and receive functionality") the s390 builds (allyesconfig) fail with: drivers/net/ethernet/intel/i40evf/i40e_txrx.c: In function 'i40e_clean_rx_irq': drivers/net/ethernet/intel/i40evf/i40e_txrx.c:818:3: error: implicit declaration of function 'prefetch' make[5]: *** [drivers/net/ethernet/intel/i40evf/i40e_txrx.o] Error 1 due to an implicit assumption that the prototype from linux/prefetch.h will be present. Cc: Mitch Williams <mitch.a.williams@intel.com> Cc: Greg Rose <gregory.v.rose@intel.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Acked-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: Bump versionCatherine Sullivan2014-01-111-1/+1
| | | | | | | | | | | | | | | | Update the driver version to 0.3.28-k. Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: fix log message wordingShannon Nelson2014-01-111-1/+1
| | | | | | | | | | | | | | | | | | | | Change the redundant "vsi VSI" to VSI. Change-ID: Ic16ea5820a99abc7831713cde39e7d032a7ba4d3 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: enable PTPJacob Keller2014-01-118-2/+824
| | | | | | | | | | | | | | | | | | | | | | | | New feature: Enable PTP support in the i40e driver. Change-ID: I6a8e799f582705191f9583afb1b9231a8db96cc8 Cc: Richard Cochran <richardcochran@gmail.com> Cc: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: Matthew Vick <matthew.vick@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: call clear_pxe after adminq is initializedShannon Nelson2014-01-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | In the latest firmware the clear_pxe_mode function will use the AdminQ request, so call this after AdminQ is set up rather than relying on i40e_pf_reset() to clear the PXE mode. Change-ID: Ice8cba2e9cbc3c7bde0a0bcf8eaf5009abef040b Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: clear qtx_head before enabling Tx queueShannon Nelson2014-01-111-2/+4
| | | | | | | | | | | | | | | | | | | | | | Make sure the "new" qtx_head[q] register is cleared before enabling the Tx queue. Change-ID: I0c7a12815e343a5ae68807af172a35d6c6857935 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: adjust ITR max and min valuesShannon Nelson2014-01-111-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Set the ITR max and min values to match the hardware max value and the recommended min value. These values are shifted right one bit because the register counts in 2 usec units, so leave a comment to explain. Change-ID: I289c27955cf6c566a6d21b95c3110b88cbb15dad Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: check for possible incorrect ipv6 checksumShannon Nelson2014-01-112-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If the IPV6EXADD bit is set in the Rx descriptor status, there was an optional extension header with an alternate IP address detected. The HW checksum offload doesn't handle the alternate IP address correctly so likely comes up with the wrong answer. Thus, if the bit is set we ignore the checksum offload value. Change-ID: I70ff8d38cdcddccf44107691cae13d0c07c284c8 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: allow VF to remove any MAC filterMitch Williams2014-01-111-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If you use ip to change the MAC address of a VF while the VF driver is loaded, closing the VF interface or unloading the VF driver will cause the VF driver to remove the MAC filter for its original (now invalid) MAC address. This would cause the PF driver to kick an error message to the log, and back to the VF driver. Since the VF driver has not really done anything naughty, let's not punish it. Don't check for MAC address overrides on the delete operation, just make sure it's a valid address. This keeps us from spamming the log with confusing errors. Change-ID: I1f051bd4014e50855457d928c9ee8b0766981b2f Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: do not bail when disabling if Tx queue disable failsAnjali Singhai Jain2014-01-111-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix a bug where the driver was erroneously exiting the driver unload path if one part of the unload failed. Instead of the original way the driver should always continue when disabling and be sure to disable all queues. Change-ID: Ib8c81c596bc87c31d8e9ca97ebf871168475279d Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: Setting queue count to 1 using ethtool is validAnjali Singhai Jain2014-01-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | Fix a bug where ethtool set-channels would return failure when configuring only one Rx queue. Change-ID: Id833c48c17d71e352b30f3249f6acf9e7aaec57e Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: Cleanup Doxygen warningsJeff Kirsher2014-01-114-23/+24
| | | | | | | | | | | | | | | | | | These changes make Doxygen/kdoc work correctly without warnings. Change-ID: I2941f38860be805ff7548d84dae35754c83f1d62 Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com>
| * i40e: fix long linesMitch Williams2014-01-112-3/+4
| | | | | | | | | | | | | | | | | | | | Avoid over-length lines in order to appease checkpatch. Change-ID: I63820a710acf798f49d2f85c610228711af84f72 Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: Bump versionCatherine Sullivan2014-01-111-1/+1
| | | | | | | | | | | | | | | | | | Update driver version to 0.3.27-k Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: Update the Current NVM version Low valueAnjali Singhai Jain2014-01-111-1/+1
| | | | | | | | | | | | | | | | | | | | The current driver will warn the user if the NVM version is out of date, this raises the bar to a newer version. Change-ID: I5ec21d8efa4e7c3fdacb56f85d310bb2229b1483 Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: drop unused macrosJesse Brandeburg2014-01-111-9/+0
| | | | | | | | | | | | | | | | | | A previous commit removed any need for these macros, so remove them too. Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e: use assignment instead of memcpyMitch Williams2014-01-113-8/+5
| | | | | | | | | | | | | | | | | | | | | | | | These instances were found by coccinelle/spatch, and can use struct assignment instead of memcpy. Change-ID: Idc23c3599241bf8a658bda18c80417af3fbfee66 Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Sibai Li <sibai.li@intel.com> Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
* | Merge tag 'batman-adv-for-davem' of git://git.open-mesh.org/linux-mergeDavid S. Miller2014-01-1042-311/+437
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Included changes: - substitute FSF address with URL - deselect current bat-GW when GW-client mode gets deactivated - send every DHCP packet using bat-unicast messages when GW-client mode is enabled - implement the Extended Isolation mechanism (it is an enhancement of the already existing batman-AP-isolation). This mechanism allows the user to drop packets exchanged by selected clients by using netfilter marks. - fix typ0 in header guard - minor code cleanups Signed-off-by: David S. Miller <davem@davemloft.net>
| * | batman-adv: set the isolation mark in the skb if neededAntonio Quartulli2014-01-083-2/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a broadcast packet is coming from a client marked as isolated, then mark the skb using the isolation mark so that netfilter (or any other application) can recognise them. The mark is written in the skb based on the mask value: only bits set in the mask are substitued by those in the mark value Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: create helper function to get AP isolation statusAntonio Quartulli2014-01-083-12/+28
| | | | | | | | | | | | | | | | | | | | | | | | The AP isolation status may be evaluated in different spots. Create an helper function to avoid code duplication. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: extend the ap_isolation mechanismAntonio Quartulli2014-01-081-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change the AP isolation mechanism to not only "isolate" WIFI clients but also all those marked with the more generic "isolation flag" (BATADV_TT_CLIENT_ISOLA). The result is that when AP isolation is on any unicast packet originated by an "isolated" client and directed to another "isolated" client is dropped at the source node. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: print the new BATADV_TT_CLIENT_ISOLA flagAntonio Quartulli2014-01-081-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Print the new BATADV_TT_CLIENT_ISOLA flag properly in the Local and Global Translation Table output. The character 'I' is used in the flags column to indicate that the entry is marked as isolated. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: mark a local client as isolated when neededAntonio Quartulli2014-01-085-5/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A client sending packets which mark matches the value configured via sysfs has to be identified as isolated using the TT_CLIENT_ISOLA flag. The match is mask based, meaning that only bits set in the mask are compared with those in the mark value. If the configured mask is equal to 0 no operation is performed. Such flag is then advertised within the classic client announcement mechanism. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: add isolation_mark sysfs attributeAntonio Quartulli2014-01-084-0/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This attribute can be used to set and read the value and the mask of the skb mark which will be used to classify the source non-mesh client as ISOLATED. In this way a client can be advertised as such and the mark can potentially be restored at the receiving node before delivering the skb. This can be helpful for creating network wide netfilter policies. This sysfs file expects a string of the shape "$mark/$mask". Where $mark has to be a 32-bit number in any base, while $mask must be a 32bit mask expressed in hex base. Only bits in $mark covered by the bitmask are really stored. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: send every DHCP packet as bat-unicastAntonio Quartulli2014-01-087-140/+153
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In different situations it is possible that the DHCP server or client uses broadcast Ethernet frames to send messages to each other. The GW component in batman-adv takes care of using bat-unicast packets to bring broadcast DHCP Discover/Requests to the "best" server. On the way back the DHCP server usually sends unicasts, but upon client request it may decide to use broadcasts as well. This patch improves the GW component so that it now snoops and sends as unicast all the DHCP packets, no matter if they were generated by a DHCP server or client. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: remove parenthesis from return statementsAntonio Quartulli2014-01-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Remove parenthesis around return expression as suggested by checkpatch. Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: rename gw_deselect() to gw_reselect()Antonio Quartulli2014-01-084-18/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function batadv_gw_deselect() is actually not deselecting anything. It is just informing the GW code to perform a re-election procedure when possible. The current gateway is not being touched at all and therefore the name of this function is rather misleading. Rename it to batadv_gw_reselect() to batadv_gw_reselect() to make its behaviour easier to grasp. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: deselect current GW on client mode switch offAntonio Quartulli2014-01-082-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When switching from gw_mode client to either off or server the current selected gateway has to be deselected. In this way when client mode is enabled again a gateway re-election is forced and a GW_ADD event is consequently sent. The current behaviour instead is to keep the current gateway leading to no GW_ADD event when gw_mode client is selected for a second time Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
| * | batman-adv: remove FSF address from GPL disclaimerAntonio Quartulli2014-01-0841-123/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As suggested by checkpatch, remove all the references to the FSF address since the kernel already has one reference in its documentation. In this way it is easier to update it in case of future changes. Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
| * | batman-adv: don't switch byte order too often if not neededAntonio Quartulli2014-01-081-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If possible, operations like ntohs/ntohl should not be performed too often. Use a variable to locally store the converted value and then use it. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
| * | batman-adv: properly rename define in distributed arp table header fileAntonio Quartulli2014-01-081-3/+3
| | | | | | | | | | | | | | | Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
* | | Merge branch 'tcp_metrics_saddr'David S. Miller2014-01-102-48/+105
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Christoph Paasch says: ==================== Make tcp-metrics source-address aware Currently tcp-metrics only stores per-destination addresses. This brings problems, when a host has multiple interfaces (e.g., a smartphone having WiFi/3G): For example, a host contacting a server over WiFi will store the tcp-metrics per destination IP. If then the host contacts the same server over 3G, the same tcp-metrics will be used, although the path-characteristics are completly different (e.g., the ssthresh is probably not the same). In case of TFO this is not a problem, as the server will provide us a new cookie once he saw our SYN+DATA with an incorrect cookie. It may be (in case of carrier-grade NAT), that we keep the same public IP but have a different private IP. Thus, we better reuse the old cookie even if our source-IP has changed. However, this scenario is probably very uncommon, as carriers try to provide the same src-IP to the clients behind their CGN. Patches 1 + 2 add the source-IP to the tcp metrics. Patches 3 to 5 modify the netlink-api to support the source-IP. From now on, when using the command "ip tcp_metrics delete address ADDRESS" all entries which match this destination IP will be deleted. Today's iproute2 will complain when doing "ip tcp_metrics flush PREFIX" if several entries are present for the same destination-IP but with different source-IPs: root@client:~/test# ip tcp_metrics 10.2.1.2 age 3.640sec rtt 16250us rttvar 15000us cwnd 10 10.2.1.2 age 4.030sec rtt 18750us rttvar 15000us cwnd 10 root@client:~/test# ip tcp_metrics flush 10.2.1.2/16 Failed to send flush request : No such process Follow-up patches will modify iproute2 to handle this correctly and allow specifying the source-IP in the get/del commands. v2: Added the patch that allows to selectively get/del of tcp-metrics based on src-IP and moved the patch that adds the new netlink attribute before the other patches. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | tcp: metrics: Allow selective get/del of tcp-metrics based on src IPChristoph Paasch2014-01-101-10/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We want to be able to get/del tcp-metrics based on the src IP. This patch adds the necessary parsing of the netlink attribute and if the source address is set, it will match on this one too. Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | tcp: metrics: Delete all entries matching a certain destinationChristoph Paasch2014-01-101-6/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As we now can have multiple entries per destination-IP, the "ip tcp_metrics delete address ADDRESS" command deletes all of them. Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-17 17:08:16 +0100