1. 16 Jun, 2012 7 commits
    • Pablo Neira Ayuso's avatar
      netfilter: add user-space connection tracking helper infrastructure · 12f7a505
      Pablo Neira Ayuso authored
      There are good reasons to supports helpers in user-space instead:
      
      * Rapid connection tracking helper development, as developing code
        in user-space is usually faster.
      
      * Reliability: A buggy helper does not crash the kernel. Moreover,
        we can monitor the helper process and restart it in case of problems.
      
      * Security: Avoid complex string matching and mangling in kernel-space
        running in privileged mode. Going further, we can even think about
        running user-space helpers as a non-root process.
      
      * Extensibility: It allows the development of very specific helpers (most
        likely non-standard proprietary protocols) that are very likely not to be
        accepted for mainline inclusion in the form of kernel-space connection
        tracking helpers.
      
      This patch adds the infrastructure to allow the implementation of
      user-space conntrack helpers by means of the new nfnetlink subsystem
      `nfnetlink_cthelper' and the existing queueing infrastructure
      (nfnetlink_queue).
      
      I had to add the new hook NF_IP6_PRI_CONNTRACK_HELPER to register
      ipv[4|6]_helper which results from splitting ipv[4|6]_confirm into
      two pieces. This change is required not to break NAT sequence
      adjustment and conntrack confirmation for traffic that is enqueued
      to our user-space conntrack helpers.
      
      Basic operation, in a few steps:
      
      1) Register user-space helper by means of `nfct':
      
       nfct helper add ftp inet tcp
      
       [ It must be a valid existing helper supported by conntrack-tools ]
      
      2) Add rules to enable the FTP user-space helper which is
         used to track traffic going to TCP port 21.
      
      For locally generated packets:
      
       iptables -I OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp
      
      For non-locally generated packets:
      
       iptables -I PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
      
      3) Run the test conntrackd in helper mode (see example files under
         doc/helper/conntrackd.conf
      
       conntrackd
      
      4) Generate FTP traffic going, if everything is OK, then conntrackd
         should create expectations (you can check that with `conntrack':
      
       conntrack -E expect
      
          [NEW] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp
      [DESTROY] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp
      
      This confirms that our test helper is receiving packets including the
      conntrack information, and adding expectations in kernel-space.
      
      The user-space helper can also store its private tracking information
      in the conntrack structure in the kernel via the CTA_HELP_INFO. The
      kernel will consider this a binary blob whose layout is unknown. This
      information will be included in the information that is transfered
      to user-space via glue code that integrates nfnetlink_queue and
      ctnetlink.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      12f7a505
    • Pablo Neira Ayuso's avatar
      netfilter: ctnetlink: add CTA_HELP_INFO attribute · ae243bee
      Pablo Neira Ayuso authored
      This attribute can be used to modify and to dump the internal
      protocol information.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      ae243bee
    • Pablo Neira Ayuso's avatar
      netfilter: nfnetlink_queue: add NAT TCP sequence adjustment if packet mangled · 8c88f87c
      Pablo Neira Ayuso authored
      User-space programs that receive traffic via NFQUEUE may mangle packets.
      If NAT is enabled, this usually puzzles sequence tracking, leading to
      traffic disruptions.
      
      With this patch, nfnl_queue will make the corresponding NAT TCP sequence
      adjustment if:
      
      1) The packet has been mangled,
      2) the NFQA_CFG_F_CONNTRACK flag has been set, and
      3) NAT is detected.
      
      There are some records on the Internet complaning about this issue:
      http://stackoverflow.com/questions/260757/packet-mangling-utilities-besides-iptables
      
      By now, we only support TCP since we have no helpers for DCCP or SCTP.
      Better to add this if we ever have some helper over those layer 4 protocols.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      8c88f87c
    • Pablo Neira Ayuso's avatar
      netfilter: add glue code to integrate nfnetlink_queue and ctnetlink · 9cb01766
      Pablo Neira Ayuso authored
      This patch allows you to include the conntrack information together
      with the packet that is sent to user-space via NFQUEUE.
      
      Previously, there was no integration between ctnetlink and
      nfnetlink_queue. If you wanted to access conntrack information
      from your libnetfilter_queue program, you required to query
      ctnetlink from user-space to obtain it. Thus, delaying the packet
      processing even more.
      
      Including the conntrack information is optional, you can set it
      via NFQA_CFG_F_CONNTRACK flag with the new NFQA_CFG_FLAGS attribute.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      9cb01766
    • Pablo Neira Ayuso's avatar
      netfilter: nf_ct_helper: implement variable length helper private data · 1afc5679
      Pablo Neira Ayuso authored
      This patch uses the new variable length conntrack extensions.
      
      Instead of using union nf_conntrack_help that contain all the
      helper private data information, we allocate variable length
      area to store the private helper data.
      
      This patch includes the modification of all existing helpers.
      It also includes a couple of include header to avoid compilation
      warnings.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      1afc5679
    • Pablo Neira Ayuso's avatar
      netfilter: nf_ct_ext: support variable length extensions · 3cf4c7e3
      Pablo Neira Ayuso authored
      We can now define conntrack extensions of variable size. This
      patch is useful to get rid of these unions:
      
      union nf_conntrack_help
      union nf_conntrack_proto
      union nf_conntrack_nat_help
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      3cf4c7e3
    • Pablo Neira Ayuso's avatar
      netfilter: nf_ct_helper: allocate 16 bytes for the helper and policy names · 3a8fc53a
      Pablo Neira Ayuso authored
      This patch modifies the struct nf_conntrack_helper to allocate
      the room for the helper name. The maximum length is 16 bytes
      (this was already introduced in 2.6.24).
      
      For the maximum length for expectation policy names, I have
      also selected 16 bytes.
      
      This patch is required by the follow-up patch to support
      user-space connection tracking helpers.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      3a8fc53a
  2. 12 Jun, 2012 2 commits
    • Thomas Graf's avatar
      ipv4: Add interface option to enable routing of 127.0.0.0/8 · d0daebc3
      Thomas Graf authored
      Routing of 127/8 is tradtionally forbidden, we consider
      packets from that address block martian when routing and do
      not process corresponding ARP requests.
      
      This is a sane default but renders a huge address space
      practically unuseable.
      
      The RFC states that no address within the 127/8 block should
      ever appear on any network anywhere but it does not forbid
      the use of such addresses outside of the loopback device in
      particular. For example to address a pool of virtual guests
      behind a load balancer.
      
      This patch adds a new interface option 'route_localnet'
      enabling routing of the 127/8 address block and processing
      of ARP requests on a specific interface.
      
      Note that for the feature to work, the default local route
      covering 127/8 dev lo needs to be removed.
      
      Example:
        $ sysctl -w net.ipv4.conf.eth0.route_localnet=1
        $ ip route del 127.0.0.0/8 dev lo table local
        $ ip addr add 127.1.0.1/16 dev eth0
        $ ip route flush cache
      
      V2: Fix invalid check to auto flush cache (thanks davem)
      Signed-off-by: default avatarThomas Graf <tgraf@suug.ch>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d0daebc3
    • John W. Linville's avatar
      Merge branch 'master' of... · 0440507b
      John W. Linville authored
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
      0440507b
  3. 11 Jun, 2012 19 commits
  4. 10 Jun, 2012 3 commits
  5. 09 Jun, 2012 5 commits
  6. 08 Jun, 2012 4 commits
    • Eric Dumazet's avatar
      af_unix: speedup /proc/net/unix · 7123aaa3
      Eric Dumazet authored
      /proc/net/unix has quadratic behavior, and can hold unix_table_lock for
      a while if high number of unix sockets are alive. (90 ms for 200k
      sockets...)
      
      We already have a hash table, so its quite easy to use it.
      
      Problem is unbound sockets are still hashed in a single hash slot
      (unix_socket_table[UNIX_HASH_TABLE])
      
      This patch also spreads unbound sockets to 256 hash slots, to speedup
      both /proc/net/unix and unix_diag.
      
      Time to read /proc/net/unix with 200k unix sockets :
      (time dd if=/proc/net/unix of=/dev/null bs=4k)
      
      before : 520 secs
      after : 2 secs
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Steven Whitehouse <swhiteho@redhat.com>
      Cc: Pavel Emelyanov <xemul@parallels.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7123aaa3
    • Gao feng's avatar
      inetpeer: add parameter net for inet_getpeer_v4,v6 · 54db0cc2
      Gao feng authored
      add struct net as a parameter of inet_getpeer_v[4,6],
      use net to replace &init_net.
      
      and modify some places to provide net for inet_getpeer_v[4,6]
      Signed-off-by: default avatarGao feng <gaofeng@cn.fujitsu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      54db0cc2
    • Gao feng's avatar
      inetpeer: add namespace support for inetpeer · c8a627ed
      Gao feng authored
      now inetpeer doesn't support namespace,the information will
      be leaking across namespace.
      
      this patch move the global vars v4_peers and v6_peers to
      netns_ipv4 and netns_ipv6 as a field peers.
      
      add struct pernet_operations inetpeer_ops to initial pernet
      inetpeer data.
      
      and change family_to_base and inet_getpeer to support namespace.
      Signed-off-by: default avatarGao feng <gaofeng@cn.fujitsu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c8a627ed
    • John W. Linville's avatar
      wl18xx: avoid some -Wformat warnings · 934b9d1e
      John W. Linville authored
        CC      drivers/net/wireless/ti/wl18xx/main.o
      drivers/net/wireless/ti/wl18xx/main.c: In function ‘wl18xx_conf_init’:
      drivers/net/wireless/ti/wl18xx/main.c:1024:3: warning: format ‘%d’ expects argument of type ‘int’, but argument 2 has type ‘long unsigned int’ [-Wformat]
      drivers/net/wireless/ti/wl18xx/main.c:1024:3: warning: format ‘%d’ expects argument of type ‘int’, but argument 3 has type ‘size_t’ [-Wformat]
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      934b9d1e