- 30 Mar, 2018 5 commits
-
-
Pablo Neira Ayuso authored
Use nft_ prefix. By when I added chain types, I forgot to use the nftables prefix. Rename enum nft_chain_type to enum nft_chain_types too, otherwise there is an overlap. Signed-off-by:Pablo Neira Ayuso <pablo@netfilter.org>
-
Joe Perches authored
Instead of unnecessary const declarations, use the generic functions to save a little object space. $ size net/bridge/netfilter/ebt_stp.o* text data bss dec hex filename 1250 144 0 1394 572 net/bridge/netfilter/ebt_stp.o.new 1344 144 0 1488 5d0 net/bridge/netfilter/ebt_stp.o.old Signed-off-by:
Joe Perches <joe@perches.com> Signed-off-by:
-
Pablo Neira Ayuso authored
This patch adds initial documentation for the Netfilter flowtable infrastructure. Reviewed-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
-
Bernie Harris authored
This patch is part of a proposal to add a string filter to ebtables, which would be similar to the string filter in iptables. Like iptables, the ebtables filter uses the xt_string module. Signed-off-by:
Bernie Harris <bernie.harris@alliedtelesis.co.nz> Signed-off-by:
-
Bernie Harris authored
Currently ebtables assumes that the revision number of all match modules is 0, which is an issue when trying to use existing xtables matches with ebtables. The solution is to modify ebtables to allow extensions to specify a revision number, similar to iptables. This gets passed down to the kernel, which is then able to find the match module correctly. To main binary backwards compatibility, the size of the ebt_entry structures is not changed, only the size of the name field is decreased by 1 byte to make room for the revision field. Signed-off-by:
-
- 20 Mar, 2018 12 commits
-
-
Matthias Schiffer authored
We already have ICMPv6 type/code matches (which can be used to distinguish different types of MLD packets). Add support for IPv4 IGMP matches in the same way. Signed-off-by:
Matthias Schiffer <mschiffer@universe-factory.net> Acked-by:
-
Matthias Schiffer authored
We already have ICMPv6 type/code matches. This adds support for IPv4 ICMP matches in the same way. Signed-off-by:
-
Pablo Neira Ayuso authored
This patch exposes synproxy information per-conntrack. Moreover, send sequence adjustment events once server sends us the SYN,ACK packet, so we can synchronize the sequence adjustment too for packets going as reply from the server, as part of the synproxy logic. Signed-off-by: -
Arushi Singhal authored
Using pr_<loglevel>() is more concise than printk(KERN_<LOGLEVEL>). This patch: * Replace printks having a log level with the appropriate pr_*() macros. * Define pr_fmt() to include relevant name. * Remove redundant prefixes from pr_*() calls. * Indent the code where possible. * Remove the useless output messages. * Remove periods from messages. Signed-off-by:
Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by:
-
Jack Ma authored
This patch introduces a new feature that allows bitshifting (left and right) operations to co-operate with existing iptables options. Reviewed-by:
Jack Ma <jack.ma@alliedtelesis.co.nz> Signed-off-by:
-
Taehee Yoo authored
xtables uses ADD_COUNTER macro to increase packet and byte count. ebtables also can use this. Signed-off-by:
Taehee Yoo <ap420073@gmail.com> Signed-off-by:
-
Gustavo A. R. Silva authored
In preparation to enabling -Wvla, remove VLA and replace it with dynamic memory allocation. >From a security viewpoint, the use of Variable Length Arrays can be a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug. Also, fixed as part of the directive to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621Signed-off-by:
Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by:
-
Gustavo A. R. Silva authored
In preparation to enabling -Wvla, remove VLA and replace it with dynamic memory allocation. >From a security viewpoint, the use of Variable Length Arrays can be a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug. Also, fixed as part of the directive to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621Signed-off-by:
-
Gustavo A. R. Silva authored
In preparation to enabling -Wvla, remove VLA and replace it with dynamic memory allocation. >From a security viewpoint, the use of Variable Length Arrays can be a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug. Also, fixed as part of the directive to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621 While at it, remove likely() notation which is not necessary from the control plane code. Signed-off-by:
-
Pablo Neira Ayuso authored
All existing keys, except the NFT_CT_SRC and NFT_CT_DST are assumed to have strict datatypes. This is causing problems with sets and concatenations given the specific length of these keys is not known. Signed-off-by:
-
Yi-Hung Wei authored
Currently, nf_conncount_count() counts the number of connections that matches key and inserts a conntrack 'tuple' with the same key into the accounting data structure. This patch supports another use case that only counts the number of connections where 'tuple' is not provided. Therefore, proper changes are made on nf_conncount_count() to support the case where 'tuple' is NULL. This could be useful for querying statistics or debugging purpose. Signed-off-by:
Yi-Hung Wei <yihung.wei@gmail.com> Acked-by:
-
Yi-Hung Wei authored
Remove parameter 'family' in nf_conncount_count() and count_tree(). It is because the parameter is not useful after commit 625c5561 ("netfilter: connlimit: split xt_connlimit into front and backend"). Signed-off-by:
-
- 13 Mar, 2018 2 commits
-
-
Gustavo A. R. Silva authored
Assign true or false to boolean variables instead of an integer value. This issue was detected with the help of Coccinelle. Signed-off-by:
Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by:
Simon Horman <horms@verge.net.au> Signed-off-by:
-
Florian Westphal authored
I placed the helpers within CONFIG_COMPAT section, move them outside. Fixes: 472ebdcd ("netfilter: x_tables: check error target size too") Fixes: 07a9da51 ("netfilter: x_tables: check standard verdicts in core") Signed-off-by:
-
- 05 Mar, 2018 21 commits
-
-
Geert Uytterhoeven authored
Signed-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by:
-
Cong Wang authored
As suggested by Eric, we need to make the xt_rateest hash table and its lock per netns to reduce lock contentions. Cc: Florian Westphal <fw@strlen.de> Cc: Eric Dumazet <edumazet@google.com> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
Cong Wang <xiyou.wangcong@gmail.com> Reviewed-by:
Eric Dumazet <edumazet@google.com> Signed-off-by:
-
Florian Westphal authored
Harmless from kernel point of view, but again iptables assumes that this is true when decoding ruleset coming from kernel. If a (syzkaller generated) ruleset doesn't have the underflow/policy stored as the last rule in the base chain, then iptables will abort() because it doesn't find the chain policy. libiptc assumes that the policy is the last rule in the basechain, which is only true for iptables-generated rulesets. Unfortunately this needs code duplication -- the functions need the struct layout of the rule head, but that is different for ip/ip6/arptables. NB: pr_warn could be pr_debug but in case this break rulesets somehow its useful to know why blob was rejected. Signed-off-by:
-
Florian Westphal authored
Signed-off-by:
-
Florian Westphal authored
no need to bother even trying to allocating huge compat offset arrays, such ruleset is rejected later on anyway becaus we refuse to allocate overly large rule blobs. However, compat translation happens before blob allocation, so we should add a check there too. This is supposed to help with fuzzing by avoiding oom-killer. Signed-off-by:
-
Florian Westphal authored
should have no impact, function still always returns 0. This patch is only to ease review. Signed-off-by:
-
Florian Westphal authored
allows to have size checks in a single spot. This is supposed to reduce oom situations when fuzz-testing xtables. Signed-off-by:
-
Florian Westphal authored
This is a very conservative limit (134217728 rules), but good enough to not trigger frequent oom from syzkaller. Signed-off-by:
-
Florian Westphal authored
Arbitrary limit, however, this still allows huge rulesets (> 1 million rules). This helps with automated fuzzer as it prevents oom-killer invocation. Signed-off-by:
-
Florian Westphal authored
Harmless from kernel point of view, but iptables assumes that this is true when decoding a ruleset. iptables walks the dumped blob from kernel, and, for each entry that creates a new chain it prints out rule/chain information. Base chains (hook entry points) are thus only shown when they appear in the rule blob. One base chain that is referenced multiple times in hook blob is then only printed once. Signed-off-by:
-
Florian Westphal authored
Allow followup patch to change on location instead of three. Signed-off-by:
-
Florian Westphal authored
Check that userspace ERROR target (custom user-defined chains) match expected format, and the chain name is null terminated. This is irrelevant for kernel, but iptables itself relies on sane input when it dumps rules from kernel. Signed-off-by:
-
Florian Westphal authored
Userspace must provide a valid verdict to the standard target. The verdict can be either a jump (signed int > 0), or a return code. Allowed return codes are either RETURN (pop from stack), NF_ACCEPT, DROP and QUEUE (latter is allowed for legacy reasons). Jump offsets (verdict > 0) are checked in more detail later on when loop-detection is performed. Signed-off-by:
-
Xin Long authored
Now it's doing cleanup_entry for oldinfo under the xt_table lock, but it's not really necessary. After the replacement job is done in xt_replace_table, oldinfo is not used elsewhere any more, and it can be freed without xt_table lock safely. The important thing is that rtnl_lock is called in some xt_target destroy, which means rtnl_lock, a big lock is used in xt_table lock, a smaller one. It usually could be the reason why a dead lock may happen. Besides, all xt_target/match checkentry is called out of xt_table lock. It's better also to move all cleanup_entry calling out of xt_table lock, just as do_replace_finish does for ebtables. Signed-off-by:
Xin Long <lucien.xin@gmail.com> Signed-off-by:
-
Gustavo A. R. Silva authored
Return statements in functions returning bool should use true/false instead of 1/0. This issue was detected with the help of Coccinelle. Signed-off-by:
-
Taehee Yoo authored
parameter protoff in nf_conntrack_broadcast_help is not used anywhere. Signed-off-by:
-
Taehee Yoo authored
If use the ipv6_addr_is_multicast instead of xt_cluster_ipv6_is_multicast, then we can reduce code size. Signed-off-by:
-
Taehee Yoo authored
parameter skb in nfnl_acct_overquota is not used anywhere. Signed-off-by:
-
kbuild test robot authored
Fixes: 3ecbfd65 ("netfilter: nf_tables: allocate handle and delete objects via handle") Signed-off-by:
Fengguang Wu <fengguang.wu@intel.com> Signed-off-by:
-
David S. Miller authored
Antoine Tenart says: ==================== net: mvpp2: jumbo frames support This series enable jumbo frames support in the Marvell PPv2 driver. The first 2 patches rework the buffer management, then two patches prepare for the final patch which adds the jumbo frames support into the driver. This is based on top of net-next, and was tested on a mcbin. Thanks! Antoine Since v1: - Improved the Tx FIFO initialization comment. - Improved the pool sanity check in mvpp2_bm_pool_use(). - Fixed pool related comments. - Cosmetic fixes (used BIT() whenever possible). ==================== Signed-off-by:David S. Miller <davem@davemloft.net>
-
Stefan Chulski authored
This patch adds the support for jumbo frames in the Marvell PPv2 driver. A third buffer pool is added with 10KB buffers, which is used if the MTU is higher than 1518B for packets larger than 1518B. Please note only the port 0 supports hardware checksum offload due to the Tx FIFO size limitation. Signed-off-by:
Stefan Chulski <stefanc@marvell.com> [Antoine: cosmetic cleanup, commit message] Signed-off-by:
Antoine Tenart <antoine.tenart@bootlin.com> Signed-off-by:
-
