1. 18 Dec, 2015 10 commits
    • Daniel Borkmann's avatar
      bpf: add bpf_skb_load_bytes helper · 05c74e5e
      Daniel Borkmann authored
      When hacking tc programs with eBPF, one of the issues that come up
      from time to time is to load addresses from headers. In eBPF as in
      classic BPF, we have BPF_LD | BPF_ABS | BPF_{B,H,W} instructions that
      extract a byte, half-word or word out of the skb data though helpers
      such as bpf_load_pointer() (interpreter case).
      
      F.e. extracting a whole IPv6 address could possibly look like ...
      
        union v6addr {
          struct {
            __u32 p1;
            __u32 p2;
            __u32 p3;
            __u32 p4;
          };
          __u8 addr[16];
        };
      
        [...]
      
        a.p1 = htonl(load_word(skb, off));
        a.p2 = htonl(load_word(skb, off +  4));
        a.p3 = htonl(load_word(skb, off +  8));
        a.p4 = htonl(load_word(skb, off + 12));
      
        [...]
      
        /* access to a.addr[...] */
      
      This work adds a complementary helper bpf_skb_load_bytes() (we also
      have bpf_skb_store_bytes()) as an alternative where the same call
      would look like from an eBPF program:
      
        ret = bpf_skb_load_bytes(skb, off, addr, sizeof(addr));
      
      Same verifier restrictions apply as in ffeedafb ("bpf: introduce
      current->pid, tgid, uid, gid, comm accessors") case, where stack memory
      access needs to be statically verified and thus guaranteed to be
      initialized in first use (otherwise verifier cannot tell whether a
      subsequent access to it is valid or not as it's runtime dependent).
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      05c74e5e
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · 59ce9670
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter updates for net-next
      
      The following patchset contains the first batch of Netfilter updates for
      the upcoming 4.5 kernel. This batch contains userspace netfilter header
      compilation fixes, support for packet mangling in nf_tables, the new
      tracing infrastructure for nf_tables and cgroup2 support for iptables.
      More specifically, they are:
      
      1) Two patches to include dependencies in our netfilter userspace
         headers to resolve compilation problems, from Mikko Rapeli.
      
      2) Four comestic cleanup patches for the ebtables codebase, from Ian Morris.
      
      3) Remove duplicate include in the netfilter reject infrastructure,
         from Stephen Hemminger.
      
      4) Two patches to simplify the netfilter defragmentation code for IPv6,
         patch from Florian Westphal.
      
      5) Fix root ownership of /proc/net netfilter for unpriviledged net
         namespaces, from Philip Whineray.
      
      6) Get rid of unused fields in struct nft_pktinfo, from Florian Westphal.
      
      7) Add mangling support to our nf_tables payload expression, from
         Patrick McHardy.
      
      8) Introduce a new netlink-based tracing infrastructure for nf_tables,
         from Florian Westphal.
      
      9) Change setter functions in nfnetlink_log to be void, from
          Rami Rosen.
      
      10) Add netns support to the cttimeout infrastructure.
      
      11) Add cgroup2 support to iptables, from Tejun Heo.
      
      12) Introduce nfnl_dereference_protected() in nfnetlink, from Florian.
      
      13) Add support for mangling pkttype in the nf_tables meta expression,
          also from Florian.
      
      BTW, I need that you pull net into net-next, I have another batch that
      requires changes that I don't yet see in net.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      59ce9670
    • Jakub Kicinski's avatar
      nfp: call netif_carrier_off() during init · 4b402d71
      Jakub Kicinski authored
      Netdevs default to carrier on, we should call netif_carrier_off()
      during initialization since we handle carrier state changes in the
      driver.
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Reviewed-by: default avatarRolf Neugebauer <rolf.neugebauer@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4b402d71
    • David S. Miller's avatar
      Merge branch 'l3mdev-accept' · 6462de8c
      David S. Miller authored
      David Ahern says:
      
      ====================
      net: Allow accepted sockets to be bound to l3mdev domain
      
      Allow accepted sockets to derive their sk_bound_dev_if setting from the
      l3mdev domain in which the packets originated. This version adds a sysctl
      to control whether the setting is inherited, making the functionality
      similar to sk_mark and its sysctl_tcp_fwmark_accept setting.
      
      This effectively allow a process to have a "VRF-global" listen socket,
      with child sockets bound to the VRF device in which the packet originated.
      A similar behavior can be achieved using sk_mark, but a solution using marks
      is incomplete as it does not handle duplicate addresses in different L3
      domains/VRFs. Allowing sockets to inherit the sk_bound_dev_if from l3mdev
      domain provides a complete solution.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6462de8c
    • David Ahern's avatar
      net: Allow accepted sockets to be bound to l3mdev domain · 6dd9a14e
      David Ahern authored
      Allow accepted sockets to derive their sk_bound_dev_if setting from the
      l3mdev domain in which the packets originated. A sysctl setting is added
      to control the behavior which is similar to sk_mark and
      sysctl_tcp_fwmark_accept.
      
      This effectively allow a process to have a "VRF-global" listen socket,
      with child sockets bound to the VRF device in which the packet originated.
      A similar behavior can be achieved using sk_mark, but a solution using marks
      is incomplete as it does not handle duplicate addresses in different L3
      domains/VRFs. Allowing sockets to inherit the sk_bound_dev_if from l3mdev
      domain provides a complete solution.
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6dd9a14e
    • David Ahern's avatar
      net: l3mdev: Add master device lookup by index · 1a852479
      David Ahern authored
      Add helper to lookup l3mdev master index given a device index.
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a852479
    • Bjørn Mork's avatar
      ipv6: addrconf: use stable address generator for ARPHRD_NONE · cc9da6cc
      Bjørn Mork authored
      Add a new address generator mode, using the stable address generator
      with an automatically generated secret. This is intended as a default
      address generator mode for device types with no EUI64 implementation.
      The new generator is used for ARPHRD_NONE interfaces initially, adding
      default IPv6 autoconf support to e.g. tun interfaces.
      
      If the addrgenmode is set to 'random', either by default or manually,
      and no stable secret is available, then a random secret is used as
      input for the stable-privacy address generator.  The secret can be
      read and modified like manually configured secrets, using the proc
      interface.  Modifying the secret will change the addrgen mode to
      'stable-privacy' to indicate that it operates on a known secret.
      
      Existing behaviour of the 'stable-privacy' mode is kept unchanged. If
      a known secret is available when the device is created, then the mode
      will default to 'stable-privacy' as before.  The mode can be manually
      set to 'random' but it will behave exactly like 'stable-privacy' in
      this case. The secret will not change.
      
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Cc: 吉藤英明 <hideaki.yoshifuji@miraclelinux.com>
      Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cc9da6cc
    • Arnd Bergmann's avatar
      ila: add NETFILTER dependency · 8cb964da
      Arnd Bergmann authored
      The recently added generic ILA translation facility fails to
      build when CONFIG_NETFILTER is disabled:
      
      net/ipv6/ila/ila_xlat.c:229:20: warning: 'struct nf_hook_state' declared inside parameter list
      net/ipv6/ila/ila_xlat.c:235:27: error: array type has incomplete element type 'struct nf_hook_ops'
       static struct nf_hook_ops ila_nf_hook_ops[] __read_mostly = {
      
      This adds an explicit Kconfig dependency to avoid that case.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: 7f00feaf ("ila: Add generic ILA translation facility")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8cb964da
    • Florian Westphal's avatar
      netfilter: meta: add support for setting skb->pkttype · b4aae759
      Florian Westphal authored
      This allows to redirect bridged packets to local machine:
      
      ether type ip ether daddr set aa:53:08:12:34:56 meta pkttype set unicast
      Without 'set unicast', ip stack discards PACKET_OTHERHOST skbs.
      
      It is also useful to add support for a '-m cluster like' nft rule
      (where switch floods packets to several nodes, and each cluster node
       node processes a subset of packets for load distribution).
      
      Mangling is restricted to HOST/OTHER/BROAD/MULTICAST, i.e. you cannot set
      skb->pkt_type to PACKET_KERNEL or change PACKET_LOOPBACK to PACKET_HOST.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      b4aae759
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · b3e0d3d7
      David S. Miller authored
      Conflicts:
      	drivers/net/geneve.c
      
      Here we had an overlapping change, where in 'net' the extraneous stats
      bump was being removed whilst in 'net-next' the final argument to
      udp_tunnel6_xmit_skb() was being changed.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b3e0d3d7
  2. 17 Dec, 2015 21 commits
  3. 16 Dec, 2015 9 commits