summaryrefslogtreecommitdiffstats
path: root/net/ipv4
Commit message (Collapse)AuthorAgeFilesLines
...
* | | esp4: Add support for IPsec extended sequence numbersSteffen Klassert2011-03-141-18/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds IPsec extended sequence numbers support to esp4. We use the authencesn crypto algorithm to handle esp with separate encryption/authentication algorithms. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | xfrm: Use separate low and high order bits of the sequence numbers in ↵Steffen Klassert2011-03-142-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xfrm_skb_cb To support IPsec extended sequence numbers, we split the output sequence numbers of xfrm_skb_cb in low and high order 32 bits and we add the high order 32 bits to the input sequence numbers. All users are updated accordingly. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Fix PMTU update.Hiroaki SHIMODA2011-03-142-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On current net-next-2.6, when Linux receives ICMP Type: 3, Code: 4 (Destination unreachable (Fragmentation needed)), icmp_unreach -> ip_rt_frag_needed (peer->pmtu_expires is set here) -> tcp_v4_err -> do_pmtu_discovery -> ip_rt_update_pmtu (peer->pmtu_expires is already set, so check_peer_pmtu is skipped.) -> check_peer_pmtu check_peer_pmtu is skipped and MTU is not updated. To fix this, let check_peer_pmtu execute unconditionally. And some minor fixes 1) Avoid potential peer->pmtu_expires set to be zero. 2) In check_peer_pmtu, argument of time_before is reversed. 3) check_peer_pmtu expects peer->pmtu_orig is initialized as zero, but not initialized. Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | net: Put fl4_* macros to struct flowi4 and use them again.David S. Miller2011-03-138-26/+26
| | | | | | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Kill fib_semantic_match declaration from fib_lookup.hDavid S. Miller2011-03-131-3/+0Star
| | | | | | | | | | | | | | | | | | This function no longer exists. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | net: Use flowi4 and flowi6 in xfrm layer.David S. Miller2011-03-132-28/+32
| | | | | | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Use flowi4 in UDPDavid S. Miller2011-03-131-6/+8
| | | | | | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* | | netfilter: Use flowi4 in nf_nat_standalone.cDavid S. Miller2011-03-131-4/+5
| | | | | | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Use flowi4 in ipmr code.David S. Miller2011-03-131-16/+17
| | | | | | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Use flowi4 in FIB layer.David S. Miller2011-03-133-30/+31
| | | | | | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Use flowi4 in public route lookup interfaces.David S. Miller2011-03-139-127/+134
| | | | | | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Use struct flowi4 internally in routing lookups.David S. Miller2011-03-131-115/+115
| | | | | | | | | | | | | | | | | | We will change the externally visible APIs next. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Pass ipv4 flow objects into fib_lookup() paths.David S. Miller2011-03-135-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | To start doing these conversions, we need to add some temporary flow4_* macros which will eventually go away when all the protocol code paths are changed to work on AF specific flowi objects. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | net: Break struct flowi out into AF specific instances.David S. Miller2011-03-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now we have struct flowi4, flowi6, and flowidn for each address family. And struct flowi is just a union of them all. It might have been troublesome to convert flow_cache_uli_match() but as it turns out this function is completely unused and therefore can be simply removed. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | net: Make flowi ports AF dependent.David S. Miller2011-03-139-28/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Create two sets of port member accessors, one set prefixed by fl4_* and the other prefixed by fl6_* This will let us to create AF optimal flow instances. It will work because every context in which we access the ports, we have to be fully aware of which AF the flowi is anyways. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | net: Put flowi_* prefix on AF independent members of struct flowiDavid S. Miller2011-03-1314-107/+116
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I intend to turn struct flowi into a union of AF specific flowi structs. There will be a common structure that each variant includes first, much like struct sock_common. This is the first step to move in that direction. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Create and use route lookup helpers.David S. Miller2011-03-137-133/+75Star
| | | | | | | | | | | | | | | | | | | | | The idea here is this minimizes the number of places one has to edit in order to make changes to how flows are defined and used. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Kill flowi arg to fib_select_multipath()David S. Miller2011-03-112-3/+3
| | | | | | | | | | | | | | | | | | Completely unused. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Remove unnecessary test from ip_mkroute_input()David S. Miller2011-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | fl->oif will always be zero on the input path, so there is no reason to test for that. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Remove redundant RCU locking in ip_check_mc().David S. Miller2011-03-112-7/+6Star
| | | | | | | | | | | | | | | | | | | | | | | | All callers are under rcu_read_lock() protection already. Rename to ip_check_mc_rcu() to make it even more clear. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Merge branch 'master' of ↵David S. Miller2011-03-103-5/+5
|\ \ \ | | |/ | |/| | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/bnx2x/bnx2x_cmn.c
| * | Merge branch 'master' of /home/davem/src/GIT/linux-2.6/David S. Miller2011-03-102-2/+2
| |\ \
| | * | net: don't allow CAP_NET_ADMIN to load non-netdev kernel modulesVasiliy Kulikov2011-03-102-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since a8f80e8ff94ecba629542d9b4b5f5a8ee3eb565c any process with CAP_NET_ADMIN may load any module from /lib/modules/. This doesn't mean that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are limited to /lib/modules/**. However, CAP_NET_ADMIN capability shouldn't allow anybody load any module not related to networking. This patch restricts an ability of autoloading modules to netdev modules with explicit aliases. This fixes CVE-2011-1019. Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior of loading netdev modules by name (without any prefix) for processes with CAP_SYS_MODULE to maintain the compatibility with network scripts that use autoloading netdev modules by aliases like "eth0", "wlan0". Currently there are only three users of the feature in the upstream kernel: ipip, ip_gre and sit. root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) -- root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: fffffff800001000 CapEff: fffffff800001000 CapBnd: fffffff800001000 root@albatros:~# modprobe xfs FATAL: Error inserting xfs (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted root@albatros:~# lsmod | grep xfs root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit sit: error fetching interface information: Device not found root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit0 sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 root@albatros:~# lsmod | grep sit sit 10457 0 tunnel4 2957 1 sit For CAP_SYS_MODULE module loading is still relaxed: root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: ffffffffffffffff CapEff: ffffffffffffffff CapBnd: ffffffffffffffff root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs xfs 745319 0 Reference: https://lkml.org/lkml/2011/2/24/203 Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Acked-by: David S. Miller <davem@davemloft.net> Acked-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: James Morris <jmorris@namei.org>
| * | | ipv4: Fix erroneous uses of ifa_address.David S. Miller2011-03-091-3/+3
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In usual cases ifa_address == ifa_local, but in the case where SIOCSIFDSTADDR sets the destination address on a point-to-point link, ifa_address gets set to that destination address. Therefore we should use ifa_local when we want the local interface address. There were two cases where the selection was done incorrectly: 1) When devinet_ioctl() does matching, it checks ifa_address even though gifconf correct reported ifa_local to the user 2) IN_DEV_ARP_NOTIFY handling sends a gratuitous ARP using ifa_address instead of ifa_local. Reported-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | tcp: mark tcp_congestion_ops read_mostlyStephen Hemminger2011-03-1012-12/+12
| | | | | | | | | | | | | | | Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Optimize flow initialization in fib_validate_source().David S. Miller2011-03-101-7/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Like in commit 44713b67db10c774f14280c129b0d5fd13c70cf2 ("ipv4: Optimize flow initialization in output route lookup." we can optimize the on-stack flow setup to only initialize the members which are actually used. Otherwise we bzero the entire structure, then initialize explicitly the first half of it. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Optimize flow initialization in input route lookup.David S. Miller2011-03-101-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Like in commit 44713b67db10c774f14280c129b0d5fd13c70cf2 ("ipv4: Optimize flow initialization in output route lookup." we can optimize the on-stack flow setup to only initialize the members which are actually used. Otherwise we bzero the entire structure, then initialize explicitly the first half of it. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | tcp: ioctl type SIOCOUTQNSD returns amount of data not sentMario Schuknecht2011-03-091-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In contrast to SIOCOUTQ which returns the amount of data sent but not yet acknowledged plus data not yet sent this patch only returns the data not sent. For various methods of live streaming bitrate control it may be helpful to know how much data are in the tcp outqueue are not sent yet. Signed-off-by: Mario Schuknecht <m.schuknecht@dresearch.de> Signed-off-by: Steffen Sledz <sledz@dresearch.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Lookup multicast routes by rtable using helper.David S. Miller2011-03-091-42/+28Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | Create a common helper for this operation, since we do it identically in three spots. Suggested by Eric Dumazet. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | inetpeer: Don't disable BH for initial fast RCU lookup.David S. Miller2011-03-081-9/+9
| | | | | | | | | | | | | | | | | | | | | If modifications on other cpus are ok, then modifications to the tree during lookup done by the local cpu are ok too. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Fix scope value used in route src-address caching.David S. Miller2011-03-081-2/+3
| | | | | | | | | | | | | | | | | | | | | We have to use cfg->fc_scope not the final nh_scope value. Reported-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Cache source address in nexthop entries.David S. Miller2011-03-082-7/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When doing output route lookups, we have to select the source address if the user has not specified an explicit one. First, if the route has an explicit preferred source address specified, then we use that. Otherwise we search the route's outgoing interface for a suitable address. This search can be precomputed and cached at route insertion time. The only missing part is that we have to refresh this precomputed value any time addresses are added or removed from the interface, and this is accomplished by fib_update_nh_saddrs(). Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Inline fib_semantic_match into check_leafDavid S. Miller2011-03-083-75/+51Star
| | | | | | | | | | | | | | | | | | | | | This elimiates a lot of pure overhead due to parameter passing. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Validate route entry type at insert instead of every lookup.David S. Miller2011-03-071-26/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fib_semantic_match() requires that if the type doesn't signal an automatic error, it must be of type RTN_UNICAST, RTN_LOCAL, RTN_BROADCAST, RTN_ANYCAST, or RTN_MULTICAST. Checking this every route lookup is pointless work. Instead validate it during route insertion, via fib_create_info(). Also, there was nothing making sure the type value was less than RTN_MAX, so add that missing check while we're here. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Remove flowi from struct rtable.David S. Miller2011-03-054-83/+131
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The only necessary parts are the src/dst addresses, the interface indexes, the TOS, and the mark. The rest is unnecessary bloat, which amounts to nearly 50 bytes on 64-bit. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Set rt->rt_iif more sanely on output routes.David S. Miller2011-03-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rt->rt_iif is only ever inspected on input routes, for example DCCP uses this to populate a route lookup flow key when generating replies to another packet. Therefore, setting it to anything other than zero on output routes makes no sense. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Get peer more cheaply in rt_init_metrics().David S. Miller2011-03-051-2/+2
| | | | | | | | | | | | | | | | | | | | | We know this is a new route object, so doing atomics and stuff makes no sense at all. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Optimize flow initialization in output route lookup.David S. Miller2011-03-051-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We burn a lot of useless cycles, cpu store buffer traffic, and memory operations memset()'ing the on-stack flow used to perform output route lookups in __ip_route_output_key(). Only the first half of the flow object members even matter for output route lookups in this context, specifically: FIB rules matching cares about: dst, src, tos, iif, oif, mark FIB trie lookup cares about: dst FIB semantic match cares about: tos, scope, oif Therefore only initialize these specific members and elide the memset entirely. On Niagara2 this kills about ~300 cycles from the output route lookup path. Likely, we can take things further, since all callers of output route lookups essentially throw away the on-stack flow they use. So they don't care if we use it as a scratch-pad to compute the final flow key. Signed-off-by: David S. Miller <davem@davemloft.net> Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
* | | inetpeer: seqlock optimizationEric Dumazet2011-03-041-40/+35Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | David noticed : ------------------ Eric, I was profiling the non-routing-cache case and something that stuck out is the case of calling inet_getpeer() with create==0. If an entry is not found, we have to redo the lookup under a spinlock to make certain that a concurrent writer rebalancing the tree does not "hide" an existing entry from us. This makes the case of a create==0 lookup for a not-present entry really expensive. It is on the order of 600 cpu cycles on my Niagara2. I added a hack to not do the relookup under the lock when create==0 and it now costs less than 300 cycles. This is now a pretty common operation with the way we handle COW'd metrics, so I think it's definitely worth optimizing. ----------------- One solution is to use a seqlock instead of a spinlock to protect struct inet_peer_base. After a failed avl tree lookup, we can easily detect if a writer did some changes during our lookup. Taking the lock and redo the lookup is only necessary in this case. Note: Add one private rcu_deref_locked() macro to place in one spot the access to spinlock included in seqlock. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Merge branch 'master' of ↵David S. Miller2011-03-042-3/+4
|\| | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/bnx2x/bnx2x.h
| * | tcp: undo_retrans counter fixesYuchung Cheng2011-02-212-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a bug that undo_retrans is incorrectly decremented when undo_marker is not set or undo_retrans is already 0. This happens when sender receives more DSACK ACKs than packets retransmitted during the current undo phase. This may also happen when sender receives DSACK after the undo operation is completed or cancelled. Fix another bug that undo_retrans is incorrectly incremented when sender retransmits an skb and tcp_skb_pcount(skb) > 1 (TSO). This case is rare but not impossible. Signed-off-by: Yuchung Cheng <ycheng@google.com> Acked-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Fix __ip_dev_find() to use ifa_local instead of ifa_address.David S. Miller2011-03-031-2/+2
| | | | | | | | | | | | | | | | | | Reported-by: Stephen Hemminger <shemminger@vyatta.com> Reported-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Fix crash in dst_release when udp_sendmsg route lookup fails.David S. Miller2011-03-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As reported by Eric: [11483.697233] IP: [<c12b0638>] dst_release+0x18/0x60 ... [11483.697741] Call Trace: [11483.697764] [<c12fc9d2>] udp_sendmsg+0x282/0x6e0 [11483.697790] [<c12a1c01>] ? memcpy_toiovec+0x51/0x70 [11483.697818] [<c12dbd90>] ? ip_generic_getfrag+0x0/0xb0 The pointer passed to dst_release() is -EINVAL, that's because we leave an error pointer in the local variable "rt" by accident. NULL it out to fix the bug. Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: ip_route_output_key() is better as an inline.David S. Miller2011-03-021-6/+0Star
| | | | | | | | | | | | | | | | | | This avoid a stack frame at zero cost. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Make output route lookup return rtable directly.David S. Miller2011-03-0217-138/+160
| | | | | | | | | | | | | | | | | | Instead of on the stack. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | xfrm: Return dst directly from xfrm_lookup()David S. Miller2011-03-023-25/+24Star
| | | | | | | | | | | | | | | | | | Instead of on the stack. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | inet: Replace left-over references to inet->corkHerbert Xu2011-03-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | The patch to replace inet->cork with cork left out two spots in __ip_append_data that can result in bogus packet construction. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv4: Make icmp route lookup code a bit clearer.David S. Miller2011-03-021-79/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The route lookup code in icmp_send() is slightly tricky as a result of having to handle all of the requirements of RFC 4301 host relookups. Pull the route resolution into a seperate function, so that the error handling and route reference counting is hopefully easier to see and contained wholly within this new routine. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | xfrm: Handle blackhole route creation via afinfo.David S. Miller2011-03-012-13/+8Star
| | | | | | | | | | | | | | | | | | | | | That way we don't have to potentially do this in every xfrm_lookup() caller. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | xfrm: Kill XFRM_LOOKUP_WAIT flag.David S. Miller2011-03-011-3/+1Star
| | | | | | | | | | | | | | | | | | This can be determined from the flow flags instead. Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-15 18:08:44 +0200