- 24 Jan, 2017 40 commits
-
-
Colin Ian King authored
Table sctp_timer_tbl is missing a TIMEOUT_RECONF string so add this in. Also compare timeout with the size of the array sctp_timer_tbl rather than SCTP_EVENT_TIMEOUT_MAX. Also add a build time check that SCTP_EVENT_TIMEOUT_MAX is correct so we don't ever get this kind of mismatch between the table and SCTP_EVENT_TIMEOUT_MAX in the future. Kudos to Marcelo Ricardo Leitner for spotting the missing string and suggesting the build time sanity check. Fixes CoverityScan CID#1397639 ("Out-of-bounds read") Fixes: 7b9438de ("sctp: add stream reconf timer") Signed-off-by:Colin Ian King <colin.king@canonical.com> Acked-by:
Neil Horman <nhorman@tuxdriver.com> Reviewed-by:
Xin Long <lucien.xin@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
David S. Miller authored
David VomLehn says: ==================== net: ethernet: aquantia: Add AQtion 2.5/5 GB NIC driver This series introduces the AQtion NIC driver for the aQuantia AQC107/AQC108 network devices. v1: Initial version v2: o Make necessary drivers/net/ethernet changes to integrate software o Drop intermediate atlantic directory o Remove Makefile things only appropriate to out of tree module building v3: o Move changes to drivers/net/ethernet/{Kconfig,Makefile} to the last patch to ensure clean bisection. o Removed inline attribute aq_hw_write_req() as it was defined in only one .c file. o #included pci.h in aq_common.h to get struct pci definition. o Modified code to unlock based execution flow rather than using a flag. o Made a number of functions that were only used in a single file static. o Cleaned up error and return code handling in various places. o Remove AQ_CFG_IP_ALIGN definition. o Other minor code clean up. v4: o Using do_div for 64 bit division. o Modified NIC statistics code. o Using build_skb instead netdev_alloc_skb for single fragment packets. o Removed extra aq_nic.o from Makefile v5: o Removed extra newline at the end of the files. v6: o Removed unnecessary cast from void*. o Reworked strings array for ethtool statistics. o Added stringset == ETH_SS_STATS checking. o AQ_OBJ_HEADER replaced to aq_obj_header_s struct. o AQ_OBJ_SET/TST/CLR macroses replaced to inline functions. o Driver sources placed in to atlantic directory. o Fixed compilation warnings (Make W=1) o Added firmware version checking. o Code cleaning. v7 o Removed unnecessary cast from memory allocation function (aq_ring.c). v8 o Switched to using kcalloc instead kzalloc. o Now provide bus_info for ethtool o Used div() to avoid __bad_udelay build error. Signed-off-by:Alexander Loktionov <Alexander.Loktionov@aquantia.com> Signed-off-by:
Dmitrii Tarakanov <Dmitrii.Tarakanov@aquantia.com> Signed-off-by:
Pavel Belous <Pavel.Belous@aquantia.com> Signed-off-by:
David M. VomLehn <vomlehn@texas.net> ==================== Signed-off-by:
-
David VomLehn authored
Modify the drivers/net/ethernet/{Makefile,Kconfig} file to make them a part of the network drivers build. Signed-off-by:Dmitry Bezrukov <Dmitry.Bezrukov@aquantia.com> Signed-off-by:
-
David VomLehn authored
Add definitions that support receive side scaling. Signed-off-by:
-
David VomLehn authored
Add the driver interfaces required for support by the ethtool utility. Signed-off-by:
-
David VomLehn authored
Add functions to interface with the hardware and some utility functions. Signed-off-by:
-
David VomLehn authored
Add common functions for Atlantic hardware abstraction layer. Signed-off-by:
-
David VomLehn authored
Add functions that handle the PCI bus interface. Signed-off-by:
-
David VomLehn authored
Add functions to manululate the vector of receive and transmit rings. Signed-off-by:
-
David VomLehn authored
Add Atlantic A0 and B0 specific functions. Signed-off-by:
-
David VomLehn authored
Add support for code specific to the Atlantic NIC. Signed-off-by:
-
David VomLehn authored
Add definitions of functions that interface directly with the hardware. Signed-off-by:
-
David VomLehn authored
Add code to support the transmit and receive ring buffers. Signed-off-by:
-
David VomLehn authored
Add files containing the functions and definitions used in common in different functional areas. Signed-off-by:
-
David VomLehn authored
Patches to create the make and configuration files. Signed-off-by:
-
Florian Fainelli authored
We may be able to see invalid Broadcom tags when the hardware and drivers are misconfigured, or just while exercising the error path. Instead of flooding the console with messages, flat out drop the packet. Signed-off-by:
Florian Fainelli <f.fainelli@gmail.com> Signed-off-by:
-
Stephen Boyd authored
After commit 51b7b1c3 (KSZ8851-SNL: Add ethtool support for EEPROM via eeprom_93cx6, 2011-11-21) this structure member is unused. Delete it. Signed-off-by:
Stephen Boyd <stephen.boyd@linaro.org> Signed-off-by:
-
David S. Miller authored
Daniel Borkmann says: ==================== Misc BPF improvements This series adds various misc improvements to BPF, f.e. allowing skb_load_bytes() helper to be used with filter/reuseport programs to facilitate programming, test cases for program tag, etc. For details, please see individual patches. ==================== Signed-off-by: -
Daniel Borkmann authored
William reported couple of issues in relation to direct packet access. Typical scheme is to check for data + [off] <= data_end, where [off] can be either immediate or coming from a tracked register that contains an immediate, depending on the branch, we can then access the data. However, in case of calculating [off] for either the mentioned test itself or for access after the test in a more "complex" way, then the verifier will stop tracking the CONST_IMM marked register and will mark it as UNKNOWN_VALUE one. Adding that UNKNOWN_VALUE typed register to a pkt() marked register, the verifier then bails out in check_packet_ptr_add() as it finds the registers imm value below 48. In the first below example, that is due to evaluate_reg_imm_alu() not handling right shifts and thus marking the register as UNKNOWN_VALUE via helper __mark_reg_unknown_value() that resets imm to 0. In the second case the same happens at the time when r4 is set to r4 &= r5, where it transitions to UNKNOWN_VALUE from evaluate_reg_imm_alu(). Later on r4 we shift right by 3 inside evaluate_reg_alu(), where the register's imm turns into 3. That is, for registers with type UNKNOWN_VALUE, imm of 0 means that we don't know what value the register has, and for imm > 0 it means that the value has [imm] upper zero bits. F.e. when shifting an UNKNOWN_VALUE register by 3 to the right, no matter what value it had, we know that the 3 upper most bits must be zero now. This is to make sure that ALU operations with unknown registers don't overflow. Meaning, once we know that we have more than 48 upper zero bits, or, in other words cannot go beyond 0xffff offset with ALU ops, such an addition will track the target register as a new pkt() register with a new id, but 0 offset and 0 range, so for that a new data/data_end test will be required. Is the source register a CONST_IMM one that is to be added to the pkt() register, or the source instruction is an add instruction with immediate value, then it will get added if it stays within max 0xffff bounds. >From there, pkt() type, can be accessed should reg->off + imm be within the access range of pkt(). [...] from 28 to 30: R0=imm1,min_value=1,max_value=1 R1=pkt(id=0,off=0,r=22) R2=pkt_end R3=imm144,min_value=144,max_value=144 R4=imm0,min_value=0,max_value=0 R5=inv48,min_value=2054,max_value=2054 R10=fp 30: (bf) r5 = r3 31: (07) r5 += 23 32: (77) r5 >>= 3 33: (bf) r6 = r1 34: (0f) r6 += r5 cannot add integer value with 0 upper zero bits to ptr_to_packet [...] from 52 to 80: R0=imm1,min_value=1,max_value=1 R1=pkt(id=0,off=0,r=34) R2=pkt_end R3=inv R4=imm272 R5=inv56,min_value=17,max_value=17 R6=pkt(id=0,off=26,r=34) R10=fp 80: (07) r4 += 71 81: (18) r5 = 0xfffffff8 83: (5f) r4 &= r5 84: (77) r4 >>= 3 85: (0f) r1 += r4 cannot add integer value with 3 upper zero bits to ptr_to_packet Thus to get above use-cases working, evaluate_reg_imm_alu() has been extended for further ALU ops. This is fine, because we only operate strictly within realm of CONST_IMM types, so here we don't care about overflows as they will happen in the simulated but also real execution and interaction with pkt() in check_packet_ptr_add() will check actual imm value once added to pkt(), but it's irrelevant before. With regards to 06c1c049 ("bpf: allow helpers access to variable memory") that works on UNKNOWN_VALUE registers, the verifier becomes now a bit smarter as it can better resolve ALU ops, so we need to adapt two test cases there, as min/max bound tracking only becomes necessary when registers were spilled to stack. So while mask was set before to track upper bound for UNKNOWN_VALUE case, it's now resolved directly as CONST_IMM, and such contructs are only necessary when f.e. registers are spilled. For commit 6b173873 ("bpf: recognize 64bit immediate loads as consts") that initially enabled dw load tracking only for nfp jit/ analyzer, I did couple of tests on large, complex programs and we don't increase complexity badly (my tests were in ~3% range on avg). I've added a couple of tests similar to affected code above, and it works fine with verifier now. Reported-by:William Tu <u9012063@gmail.com> Signed-off-by:
Daniel Borkmann <daniel@iogearbox.net> Cc: Gianluca Borello <g.borello@gmail.com> Cc: William Tu <u9012063@gmail.com> Acked-by:
Alexei Starovoitov <ast@kernel.org> Signed-off-by:
-
Daniel Borkmann authored
Add the test case used to compare the results from fdinfo with af_alg's output on the tag. Tests are from min to max sized programs, with and without maps included. # ./test_tag test_tag: OK (40945 tests) Tested on x86_64 and s390x. Signed-off-by:
-
Daniel Borkmann authored
When programs need to calculate the csum from scratch for small UDP packets and use bpf_l4_csum_replace() to feed the result from helpers like bpf_csum_diff(), then we need a flag besides BPF_F_MARK_MANGLED_0 that would ignore the case of current csum being 0, and which would still allow for the helper to set the csum and transform when needed to CSUM_MANGLED_0. Signed-off-by:
-
Daniel Borkmann authored
BPF_PROG_TYPE_SOCKET_FILTER are used in various facilities such as for SO_REUSEPORT and packet fanout demuxing, packet filtering, kcm, etc, and yet the only facility they can use is BPF_LD with {BPF_ABS, BPF_IND} for single byte/half/word access. Direct packet access is only restricted to tc programs right now, but we can still facilitate usage by allowing skb_load_bytes() helper added back then in 05c74e5e ("bpf: add bpf_skb_load_bytes helper") that calls skb_header_pointer() similarly to bpf_load_pointer(), but for stack buffers with larger access size. Name the previous sk_filter_func_proto() as bpf_base_func_proto() since this is used everywhere else as well, similarly for the ctx converter, that is, bpf_convert_ctx_access(). Signed-off-by: -
Daniel Borkmann authored
The __is_valid_access() test for cb[] from 62c7989b ("bpf: allow b/h/w/dw access for bpf's cb in ctx") was done unnecessarily complex, we can just simplify it the same way as recent fix from 2d071c64 ("bpf, trace: make ctx access checks more robust") did. Overflow can never happen as size is 1/2/4/8 depending on access. Signed-off-by:
-
Arnd Bergmann authored
One line was apparently pasted incorrectly during a new feature patch: drivers/net/phy/marvell.c:2090:15: error: initialized field overwritten [-Werror=override-init] .features = PHY_GBIT_FEATURES, I'm removing the extraneous line here to avoid the W=1 warning and restore the previous flags value, and I'm slightly reordering the lines for consistency to make it less likely to happen again in the future. The ordering in the array is still not the same as in the structure definition, instead I picked the order that is most common in this file and that seems to make more sense here. Fixes: 0b04680f ("phy: marvell: Add support for temperature sensor") Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Signed-off-by:
-
Phil Sutter authored
The idea for this was born when testing VF support in iproute2 which was impeded by hardware requirements. In fact, not every VF-capable hardware driver implements all netdev ops, so testing the interface is still hard to do even with a well-sorted hardware shelf. To overcome this and allow for testing the user-kernel interface, this patch allows to turn dummy into a PF with a configurable amount of VFs. Since my patch series 'bus-agnostic-num-vf' has been accepted, implementing the required interfaces is pretty straightforward: Iff 'num_vfs' module parameter was given a value >0, a dummy bus type is being registered which implements the 'num_vf()' callback. Additionally, a dummy parent device common to all dummy devices is registered which sits on the above dummy bus. Joint work with Sabrina Dubroca. Signed-off-by:
Sabrina Dubroca <sd@queasysnail.net> Signed-off-by:
Phil Sutter <phil@nwl.cc> Signed-off-by:
-
Philippe Reynes authored
The ethtool api {get|set}_settings is deprecated. We move this driver to new api {get|set}_link_ksettings. As I don't have the hardware, I'd be very pleased if someone may test this patch. Signed-off-by:Philippe Reynes <tremyfr@gmail.com> Acked-by:
Yuval Mintz <Yuval.Mintz@cavium.com> Signed-off-by:
-
David S. Miller authored
Jiri Pirko says: ==================== Add support for offloading packet-sampling Yotam says: The first patch introduces the psample module, a netlink channel dedicated to packet sampling implemented using generic netlink. This module provides a generic way for kernel modules to sample packets, while not being tied to any specific subsystem like NFLOG. The second patch adds the sample tc action, which uses psample to randomly sample packets that match a classifier. The user can configure the psample group number, the sampling rate and the packet's truncation (to save kernel-user traffic). The last two patches add the support for offloading the matchall-sample tc command in the mlxsw driver, for ingress qdiscs. An example for psample usage can be found in the libpsample project at: https://github.com/Mellanox/libpsample v1->v2: - Reword first patch's commit message - Fix typo in comment in second patch - Change order of tc_sample uapi enum to match convention - Rename act_sample action callback tcf_sample -> tcf_sample_act ==================== Signed-off-by:
-
Yotam Gigi authored
Using the MPSC register, add the functions that configure port-based packet sampling in hardware and the necessary datatypes in the mlxsw_sp_port struct. In addition, add the necessary trap for sampled packets and integrate with matchall offloading to allow offloading of the sample tc action. The current offload support is for the tc command: tc filter add dev <DEV> parent ffff: \ matchall skip_sw \ action sample rate <RATE> group <GROUP> [trunc <SIZE>] Where only ingress qdiscs are supported, and only a combination of matchall classifier and sample action will lead to activating hardware packet sampling. Signed-off-by:
Yotam Gigi <yotamg@mellanox.com> Signed-off-by:
Jiri Pirko <jiri@mellanox.com> Reviewed-by:
Ido Schimmel <idosch@mellanox.com> Signed-off-by:
-
Yotam Gigi authored
The MPSC register allows to configure ingress packet sampling on specific port of the mlxsw device. The sampled packets are then trapped via PKT_SAMPLE trap. Signed-off-by:
-
Yotam Gigi authored
This action allows the user to sample traffic matched by tc classifier. The sampling consists of choosing packets randomly and sampling them using the psample module. The user can configure the psample group number, the sampling rate and the packet's truncation (to save kernel-user traffic). Example: To sample ingress traffic from interface eth1, one may use the commands: tc qdisc add dev eth1 handle ffff: ingress tc filter add dev eth1 parent ffff: \ matchall action sample rate 12 group 4 Where the first command adds an ingress qdisc and the second starts sampling randomly with an average of one sampled packet per 12 packets on dev eth1 to psample group 4. Signed-off-by:
Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by:
Simon Horman <simon.horman@netronome.com> Signed-off-by:
-
Yotam Gigi authored
Add a general way for kernel modules to sample packets, without being tied to any specific subsystem. This netlink channel can be used by tc, iptables, etc. and allow to standardize packet sampling in the kernel. For every sampled packet, the psample module adds the following metadata fields: PSAMPLE_ATTR_IIFINDEX - the packets input ifindex, if applicable PSAMPLE_ATTR_OIFINDEX - the packet output ifindex, if applicable PSAMPLE_ATTR_ORIGSIZE - the packet's original size, in case it has been truncated during sampling PSAMPLE_ATTR_SAMPLE_GROUP - the packet's sample group, which is set by the user who initiated the sampling. This field allows the user to differentiate between several samplers working simultaneously and filter packets relevant to him PSAMPLE_ATTR_GROUP_SEQ - sequence counter of last sent packet. The sequence is kept for each group PSAMPLE_ATTR_SAMPLE_RATE - the sampling rate used for sampling the packets PSAMPLE_ATTR_DATA - the actual packet bits The sampled packets are sent to the PSAMPLE_NL_MCGRP_SAMPLE multicast group. In addition, add the GET_GROUPS netlink command which allows the user to see the current sample groups, their refcount and sequence number. This command currently supports only netlink dump mode. Signed-off-by:
-
David S. Miller authored
Florian Fainelli says: ==================== net: couple mdio_module_driver changes Small patch series fixing a comment for mdio_module_driver and finally utilizing it in b53_mdio. ==================== Signed-off-by: -
Florian Fainelli authored
Eliminate a bit of boilerplate code. Signed-off-by:
-
Florian Fainelli authored
The module boilerplate macro is named mdio_module_driver and not module_mdio_driver, fix that. Fixes: a9049e0c ("mdio: Add support for mdio drivers.") Signed-off-by:
-
David S. Miller authored
Martin Blumenstingl says: ==================== stmmac: dwmac-meson8b: configurable RGMII TX delay Currently the dwmac-meson8b stmmac glue driver uses a hardcoded 1/4 cycle (= 2ns) TX clock delay. This seems to work fine for many boards (for example Odroid-C2 or Amlogic's reference boards) but there are some others where TX traffic is simply broken. There are probably multiple reasons why it's working on some boards while it's broken on others: - some of Amlogic's reference boards are using a Micrel PHY - hardware circuit design - maybe more... iperf3 results on my Mecool BB2 board (Meson GXM, RTL8211F PHY) with TX clock delay disabled on the MAC (as it's enabled in the PHY driver). TX throughput was virtually zero before: $ iperf3 -c 192.168.1.100 -R Connecting to host 192.168.1.100, port 5201 Reverse mode, remote host 192.168.1.100 is sending [ 4] local 192.168.1.206 port 52828 connected to 192.168.1.100 port 5201 [ ID] Interval Transfer Bandwidth [ 4] 0.00-1.00 sec 108 MBytes 901 Mbits/sec [ 4] 1.00-2.00 sec 94.2 MBytes 791 Mbits/sec [ 4] 2.00-3.00 sec 96.5 MBytes 810 Mbits/sec [ 4] 3.00-4.00 sec 96.2 MBytes 808 Mbits/sec [ 4] 4.00-5.00 sec 96.6 MBytes 810 Mbits/sec [ 4] 5.00-6.00 sec 96.5 MBytes 810 Mbits/sec [ 4] 6.00-7.00 sec 96.6 MBytes 810 Mbits/sec [ 4] 7.00-8.00 sec 96.5 MBytes 809 Mbits/sec [ 4] 8.00-9.00 sec 105 MBytes 884 Mbits/sec [ 4] 9.00-10.00 sec 111 MBytes 934 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bandwidth Retr [ 4] 0.00-10.00 sec 1000 MBytes 839 Mbits/sec 0 sender [ 4] 0.00-10.00 sec 998 MBytes 837 Mbits/sec receiver iperf Done. $ iperf3 -c 192.168.1.100 Connecting to host 192.168.1.100, port 5201 [ 4] local 192.168.1.206 port 52832 connected to 192.168.1.100 port 5201 [ ID] Interval Transfer Bandwidth Retr Cwnd [ 4] 0.00-1.01 sec 99.5 MBytes 829 Mbits/sec 117 139 KBytes [ 4] 1.01-2.00 sec 105 MBytes 884 Mbits/sec 129 70.7 KBytes [ 4] 2.00-3.01 sec 107 MBytes 889 Mbits/sec 106 187 KBytes [ 4] 3.01-4.01 sec 105 MBytes 878 Mbits/sec 92 143 KBytes [ 4] 4.01-5.00 sec 105 MBytes 882 Mbits/sec 140 129 KBytes [ 4] 5.00-6.01 sec 106 MBytes 883 Mbits/sec 115 195 KBytes [ 4] 6.01-7.00 sec 102 MBytes 863 Mbits/sec 133 70.7 KBytes [ 4] 7.00-8.01 sec 106 MBytes 884 Mbits/sec 143 97.6 KBytes [ 4] 8.01-9.01 sec 104 MBytes 875 Mbits/sec 124 107 KBytes [ 4] 9.01-10.01 sec 105 MBytes 876 Mbits/sec 90 139 KBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bandwidth Retr [ 4] 0.00-10.01 sec 1.02 GBytes 874 Mbits/sec 1189 sender [ 4] 0.00-10.01 sec 1.02 GBytes 873 Mbits/sec receiver iperf Done. I get similar TX throughput on my Meson GXBB "MXQ Pro+" board when I disable the PHY's TX-delay and configure a 4ms TX-delay on the MAC. So changes to at least the RTL8211F PHY driver are needed to get it working properly in all situations. Changes since v4: - add a fallback of 2ns (the value which was previously hardcoded) for the TX delay so we are backwards-compatible with older .dts' - update the documentation with the new fallback value and add a small note that the "amlogic,tx-delay" property is ignored when the phy-mode is "rmii". Changes since v3: - rebased to apply against current net-next branch (fixes a conflict with d2ed0a77 "net: ethernet: stmmac: fix of-node and fixed-link-phydev leaks") Changes since v2: - moved all .dts patches (3-7) to a separate series - removed the default 2ns TX delay when phy-mode RGMII is specified - (rebased against current net-next) Changes since v1: - renamed the devicetree property "amlogic,tx-delay" to "amlogic,tx-delay-ns", which makes the .dts easier to read as we can simply specify human-readable values instead of having "preprocessor defines and calculation in human brain". Thanks to Andrew Lunn for the suggestion! - improved documentation to indicate when the MAC TX-delay should be configured and how to use the PHY's TX-delay - changed the default TX-delay in the dwmac-meson8b driver from 2ns to 0ms when any of the rgmii-*id modes are used (the 2ns default value still applies for phy-mode "rgmii") - added patches to properly reset the PHY on Meson GXBB devices and to use a similar configuration than the one we use on Meson GXL devices (by passing a phy-handle to stmmac and defining the PHY in the mdio0 bus - patch 3-6) - add the "amlogic,tx-delay-ns" property to all boards which are using the RGMII PHY (patch 7) ==================== Signed-off-by:
-
Martin Blumenstingl authored
Prior to this patch we were using a hardcoded RGMII TX clock delay of 2ns (= 1/4 cycle of the 125MHz RGMII TX clock). This value works for many boards, but unfortunately not for all (due to the way the actual circuit is designed, sometimes because the TX delay is enabled in the PHY, etc.). Making the TX delay on the MAC side configurable allows us to support all possible hardware combinations. This allows fixing a compatibility issue on some boards, where the RTL8211F PHY is configured to generate the TX delay. We can now turn off the TX delay in the MAC, because otherwise we would be applying the delay twice (which results in non-working TX traffic). Signed-off-by:
Martin Blumenstingl <martin.blumenstingl@googlemail.com> Tested-by:
Neil Armstrong <narmstrong@baylibre.com> Signed-off-by:
-
Martin Blumenstingl authored
This allows configuring the RGMII TX clock delay. The RGMII clock is generated by underlying hardware of the the Meson 8b / GXBB DWMAC glue. The configuration depends on the actual hardware (no delay may be needed due to the design of the actual circuit, the PHY might add this delay, etc.). Signed-off-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Andrew Lunn authored
Remove the wrong !, otherwise we get false positives about having multiple CPU interfaces. Fixes: b22de490 ("net: dsa: store CPU switch structure in the tree") Signed-off-by:
-
Felix Fietkau authored
Implements an optional, per bridge port flag and feature to deliver multicast packets to any host on the according port via unicast individually. This is done by copying the packet per host and changing the multicast destination MAC to a unicast one accordingly. multicast-to-unicast works on top of the multicast snooping feature of the bridge. Which means unicast copies are only delivered to hosts which are interested in it and signalized this via IGMP/MLD reports previously. This feature is intended for interface types which have a more reliable and/or efficient way to deliver unicast packets than broadcast ones (e.g. wifi). However, it should only be enabled on interfaces where no IGMPv2/MLDv1 report suppression takes place. This feature is disabled by default. The initial patch and idea is from Felix Fietkau. Signed-off-by:
Felix Fietkau <nbd@nbd.name> [linus.luessing@c0d3.blue: various bug + style fixes, commit message] Signed-off-by:
Linus Lüssing <linus.luessing@c0d3.blue> Reviewed-by:
Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by:
-
Krister Johansen authored
Add net.ipv4.ip_unprivileged_port_start, which is a per namespace sysctl that denotes the first unprivileged inet port in the namespace. To disable all privileged ports set this to zero. It also checks for overlap with the local port range. The privileged and local range may not overlap. The use case for this change is to allow containerized processes to bind to priviliged ports, but prevent them from ever being allowed to modify their container's network configuration. The latter is accomplished by ensuring that the network namespace is not a child of the user namespace. This modification was needed to allow the container manager to disable a namespace's priviliged port restrictions without exposing control of the network namespace to processes in the user namespace. Signed-off-by:
Krister Johansen <kjlx@templeofstupid.com> Signed-off-by:
-
