- 21 Mar, 2006 40 commits
-
-
Steven Whitehouse authored
The typedef for dn_address has been removed in favour of using __le16 or __u16 directly as appropriate. All the DECnet header files are updated accordingly. The byte ordering of dn_eth2dn() and dn_dn2eth() are both changed since just about all their callers wanted network order rather than host order, so the conversion is now done in the functions themselves. Several missed endianess conversions have been picked up during the conversion process. The nh_gw field in struct dn_fib_info has been changed from a 32 bit field to 16 bits as it ought to be. One or two cases of using htons rather than dn_htons in the routing code have been found and fixed. There are still a few warnings to fix, but this patch deals with the important cases. Signed-off-by:
Steven Whitehouse <steve@chygwyn.com> Signed-off-by:
Patrick Caulfield <patrick@tykepenguin.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Catherine Zhang authored
This patch implements an application of the LSM-IPSec networking controls whereby an application can determine the label of the security association its TCP or UDP sockets are currently connected to via getsockopt and the auxiliary data mechanism of recvmsg. Patch purpose: This patch enables a security-aware application to retrieve the security context of an IPSec security association a particular TCP or UDP socket is using. The application can then use this security context to determine the security context for processing on behalf of the peer at the other end of this connection. In the case of UDP, the security context is for each individual packet. An example application is the inetd daemon, which could be modified to start daemons running at security contexts dependent on the remote client. Patch design approach: - Design for TCP The patch enables the SELinux LSM to set the peer security context for a socket based on the security context of the IPSec security association. The application may retrieve this context using getsockopt. When called, the kernel determines if the socket is a connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry cache on the socket to retrieve the security associations. If a security association has a security context, the context string is returned, as for UNIX domain sockets. - Design for UDP Unlike TCP, UDP is connectionless. This requires a somewhat different API to retrieve the peer security context. With TCP, the peer security context stays the same throughout the connection, thus it can be retrieved at any time between when the connection is established and when it is torn down. With UDP, each read/write can have different peer and thus the security context might change every time. As a result the security context retrieval must be done TOGETHER with the packet retrieval. The solution is to build upon the existing Unix domain socket API for retrieving user credentials. Linux offers the API for obtaining user credentials via ancillary messages (i.e., out of band/control messages that are bundled together with a normal message). Patch implementation details: - Implementation for TCP The security context can be retrieved by applications using getsockopt with the existing SO_PEERSEC flag. As an example (ignoring error checking): getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen); printf("Socket peer context is: %s\n", optbuf); The SELinux function, selinux_socket_getpeersec, is extended to check for labeled security associations for connected (TCP_ESTABLISHED == sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of struct dst_entry values that may refer to security associations. If these have security associations with security contexts, the security context is returned. getsockopt returns a buffer that contains a security context string or the buffer is unmodified. - Implementation for UDP To retrieve the security context, the application first indicates to the kernel such desire by setting the IP_PASSSEC option via getsockopt. Then the application retrieves the security context using the auxiliary data mechanism. An example server application for UDP should look like this: toggle = 1; toggle_len = sizeof(toggle); setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len); recvmsg(sockfd, &msg_hdr, 0); if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) { cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr); if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) && cmsg_hdr->cmsg_level == SOL_IP && cmsg_hdr->cmsg_type == SCM_SECURITY) { memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext)); } } ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow a server socket to receive security context of the peer. A new ancillary message type SCM_SECURITY. When the packet is received we get the security context from the sec_path pointer which is contained in the sk_buff, and copy it to the ancillary message space. An additional LSM hook, selinux_socket_getpeersec_udp, is defined to retrieve the security context from the SELinux space. The existing function, selinux_socket_getpeersec does not suit our purpose, because the security context is copied directly to user space, rather than to kernel space. Testing: We have tested the patch by setting up TCP and UDP connections between applications on two machines using the IPSec policies that result in labeled security associations being built. For TCP, we can then extract the peer security context using getsockopt on either end. For UDP, the receiving end can retrieve the security context using the auxiliary data mechanism of recvmsg. Signed-off-by:Catherine Zhang <cxzhang@watson.ibm.com> Acked-by:
James Morris <jmorris@namei.org> Acked-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Patrick McHardy authored
When xfrm_user isn't loaded xfrm_nl is NULL, which makes IPsec crash because xfrm_aevent_is_on passes the NULL pointer to netlink_has_listeners as socket. A second problem is that the xfrm_nl pointer is not cleared when the socket is releases at module unload time. Protect references of xfrm_nl from outside of xfrm_user by RCU, check that the socket is present in xfrm_aevent_is_on and set it to NULL when unloading xfrm_user. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
-
Rick Jones authored
Back in the dark ages, we had to be conservative and only allow 15-bit window fields if the window scale option was not negotiated. Some ancient stacks used a signed 16-bit quantity for the window field of the TCP header and would get confused. Those days are long gone, so we can use the full 16-bits by default now. There is a sysctl added so that we can still interact with such old stacks Signed-off-by:
Rick Jones <rick.jones2@hp.com> Signed-off-by:
-
Neil Horman authored
As John pointed out, I had not added documentation to describe the arp_accpet sysctl that I posted in my last patch. This patch adds that documentation. Signed-off-by:
Neil Horman <nhorman@tuxdriver.com> Signed-off-by:
-
Neil Horman authored
Signed-off-by:
-
Jeff Mahoney authored
Move the netif_carrier_off() call from tg3_init_one()-> tg3_init_link_config() to tg3_open() as is the convention for most other network drivers. I was getting a panic after a tg3 device failed to initialize due to DMA failure. The oops pointed to the link watch queue with spinlock debugging enabled. Without spinlock debugging, the Oops didn't occur. I suspect that the link event was getting queued but not executed until after the DMA test had failed and the device was freed. The link event was then operating on freed memory, which could contain anything. With this patch applied, the Oops no longer occurs. [ Based upon feedback from Michael Chan, we move netif_carrier_off() to the end of tg3_init_one() instead of moving it to tg3_open() -DaveM ] Signed-off-by:
Jeff Mahoney <jeffm@suse.com> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
-
Per Liden authored
Signed-off-by:
Per Liden <per.liden@ericsson.com> Signed-off-by:
-
Per Liden authored
The node_map struct can be quite large (516 bytes) and allocating two of them on the stack is not a good idea since we might only have a 4K stack to start with. Signed-off-by:
-
Adrian Bunk authored
This patch contains the following possible cleanups: - make needlessly global code static - #if 0 the following unused global functions: - name_table.c: tipc_nametbl_print() - name_table.c: tipc_nametbl_dump() - net.c: tipc_net_next_node() Signed-off-by:
Adrian Bunk <bunk@stusta.de> Signed-off-by:
-
Per Liden authored
Signed-off-by:
-
Sam Ravnborg authored
With reference to latest discussions on linux-kernel with respect to inline here is a patch for tipc to remove all inlines as used in the .c files. See also chapter 14 in Documentation/CodingStyle. Before: text data bss dec hex filename 102990 5292 1752 110034 1add2 tipc.o Now: text data bss dec hex filename 101190 5292 1752 108234 1a6ca tipc.o This is a nice text size reduction which will improve icache usage. In some cases bigger (> 4 lines) functions where declared inline and used in many places, they are most probarly no longer inlined by gcc resulting in the size reduction. There are several one liners that no longer are declared inline, but gcc should inline these just fine without the inline hint. With this patch applied one warning is added about an unused static function - that was hidded by utilising inline before. The function in question were kept so this patch is solely a inline removal patch. Signed-off-by:
Sam Ravnborg <sam@ravnborg.org> Signed-off-by:
-
Sam Ravnborg authored
Tried to run the new tipc stack through sparse. Following patch fixes all cases where 0 was used as replacement of NULL. Use NULL to document this is a pointer and to silence sparse. This brough sparse warning count down with 127 to 24 warnings. Signed-off-by:
-
David S. Miller authored
net/ipv4/netfilter/ip_nat_snmp_basic.c: In function 'asn1_header_decode': net/ipv4/netfilter/ip_nat_snmp_basic.c:248: warning: 'len' may be used uninitialized in this function net/ipv4/netfilter/ip_nat_snmp_basic.c:248: warning: 'def' may be used uninitialized in this function net/ipv4/netfilter/ip_nat_snmp_basic.c: In function 'snmp_translate': net/ipv4/netfilter/ip_nat_snmp_basic.c:672: warning: 'l' may be used uninitialized in this function net/ipv4/netfilter/ip_nat_snmp_basic.c:668: warning: 'type' may be used uninitialized in this function Signed-off-by: -
David S. Miller authored
Signed-off-by: -
Ingo Molnar authored
Semaphore to mutex conversion. The conversion was generated via scripts, and the result was validated automatically via a script as well. Signed-off-by:
Ingo Molnar <mingo@elte.hu> Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by:
-
Sam Ravnborg authored
In latest -mm sbni gives following warning: WARNING: drivers/net/wan/sbni.o - Section mismatch: reference to \ .init.data: from .text between 'init_module' (at offset 0x14ef) and \ 'cleanup_module' The warning is caused by init_module() calling a function declared __init. Declare init_module() __init too to fix warning. Signed-off-by:
-
Ingo Molnar authored
Semaphore to mutexes conversion. The conversion was generated via scripts, and the result was validated automatically via a script as well. Signed-off-by:
-
Ingo Molnar authored
Semaphore to mutexes conversion. The conversion was generated via scripts, and the result was validated automatically via a script as well. Signed-off-by:
-
Andrew Morton authored
MODULE_PARM() is deprecated and is about to go away altogether. Signed-off-by:
-
Arjan van de Ven authored
Semaphore to mutex conversion. The conversion was generated via scripts, and the result was validated automatically via a script as well. Signed-off-by:
Arjan van de Ven <arjan@infradead.org> Signed-off-by:
-
Arjan van de Ven authored
Semaphore to mutex conversion. The conversion was generated via scripts, and the result was validated automatically via a script as well. Signed-off-by:
-
Stephen Hemminger authored
Get rid of the old __dev_put macro that is just a hold over from pre 2.6 kernel. And turn dev_hold into an inline instead of a macro. Signed-off-by:
Stephen Hemminger <shemminger@osdl.org> Signed-off-by:
-
Arnaldo Carvalho de Melo authored
And not the silly LIMIT_NETDEBUG and silently return without inserting the option requested. Also drop some old debugging messages associated to option insertion. Signed-off-by:
Arnaldo Carvalho de Melo <acme@mandriva.com> Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Merging it with its only user: dccp_v[46]_reqsk_send_ack. Signed-off-by:
-
Arnaldo Carvalho de Melo authored
Using this also provides opportunities for introducing inet_csk_alloc_skb that would call alloc_skb, account it to the sock and skb_reserve(max_header), but I'll leave this for later, for now using sk_prot->max_header consistently is enough. Signed-off-by:
-
Arnaldo Carvalho de Melo authored
I.e. they should be just ignored, but we have to use 'break', not 'continue', as we have to possibly reset the mandatory flag. Signed-off-by:
-
David S. Miller authored
Signed-off-by: -
Michael Chan authored
Update version to 3.52. Signed-off-by:
Michael Chan <mchan@broadcom.com> Signed-off-by:
-
Michael Chan authored
Add fw_version information to ethtool -i. Signed-off-by:
-
Michael Chan authored
Some nvram related cleanup: 1. Add a tg3_nvram_read_swab() since swabing the data is frequently done. 2. Add a function to convert nvram address to physical address instead of doing it in 2 separate places. Signed-off-by:
-
Michael Chan authored
Ethtool memory test on 5787 requires a new memory table. Signed-off-by:
-
Michael Chan authored
Support one-shot MSI on 5787. This one-shot MSI idea is credited to David Miller. In this mode, MSI disables itself automatically after it is generated, saving the driver a register access to disable it for NAPI. Signed-off-by:
-
Michael Chan authored
Support ipv6 tx csum on 5787 by setting NETIF_F_HW_CSUM. Signed-off-by:
-
Michael Chan authored
Support 5787 hardware TSO using a new flag TG3_FLG2_HW_TSO_2. Since the TSO interface is slightly different and these chips have finally fixed the 4GB DMA problem and do not have the 40-bit DMA problem, a new hard_start_xmit is used for these chips. All previous chips will use the old hard_start_xmit that is now renamed tg3_start_xmit_dma_bug(). Signed-off-by:
-
Michael Chan authored
Support additional nvrams and new nvram format for 5787 and 5754. Signed-off-by:
-
Michael Chan authored
Add basic support for 2 new chips 5787 and 5754. Signed-off-by:
-
Benjamin LaHaise authored
Here's an updated copy of the patch to use fget_light in net/socket.c. Rerunning the tests show a drop of ~80Mbit/s on average, which looks bad until you see the drop in cpu usage from ~89% to ~82%. That will get fixed in another patch... Before: max 8113.70, min 8026.32, avg 8072.34 87380 16384 16384 10.01 8045.55 87.11 87.11 1.774 1.774 87380 16384 16384 10.01 8065.14 90.86 90.86 1.846 1.846 87380 16384 16384 10.00 8077.76 89.85 89.85 1.822 1.822 87380 16384 16384 10.00 8026.32 89.80 89.80 1.833 1.833 87380 16384 16384 10.01 8108.59 89.81 89.81 1.815 1.815 87380 16384 16384 10.01 8034.53 89.01 89.01 1.815 1.815 87380 16384 16384 10.00 8113.70 90.45 90.45 1.827 1.827 87380 16384 16384 10.00 8111.37 89.90 89.90 1.816 1.816 87380 16384 16384 10.01 8077.75 87.96 87.96 1.784 1.784 87380 16384 16384 10.00 8062.70 90.25 90.25 1.834 1.834 After: max 8035.81, min 7963.69, avg 7998.14 87380 16384 16384 10.01 8000.93 82.11 82.11 1.682 1.682 87380 16384 16384 10.01 8016.17 83.67 83.67 1.710 1.710 87380 16384 16384 10.01 7963.69 83.47 83.47 1.717 1.717 87380 16384 16384 10.01 8014.35 81.71 81.71 1.671 1.671 87380 16384 16384 10.00 7967.68 83.41 83.41 1.715 1.715 87380 16384 16384 10.00 7995.22 81.00 81.00 1.660 1.660 87380 16384 16384 10.00 8002.61 83.90 83.90 1.718 1.718 87380 16384 16384 10.00 8035.81 81.71 81.71 1.666 1.666 87380 16384 16384 10.01 8005.36 82.56 82.56 1.690 1.690 87380 16384 16384 10.00 7979.61 82.50 82.50 1.694 1.694 Signed-off-by:
Benjamin LaHaise <bcrl@linux.intel.com> Signed-off-by:
-
