1. 23 9月, 2013 11 次提交
  2. 22 9月, 2013 12 次提交
  3. 21 9月, 2013 13 次提交
  4. 20 9月, 2013 1 次提交
    • A
      ip: generate unique IP identificator if local fragmentation is allowed · 703133de
      Ansis Atteka 提交于
      If local fragmentation is allowed, then ip_select_ident() and
      ip_select_ident_more() need to generate unique IDs to ensure
      correct defragmentation on the peer.
      
      For example, if IPsec (tunnel mode) has to encrypt large skbs
      that have local_df bit set, then all IP fragments that belonged
      to different ESP datagrams would have used the same identificator.
      If one of these IP fragments would get lost or reordered, then
      peer could possibly stitch together wrong IP fragments that did
      not belong to the same datagram. This would lead to a packet loss
      or data corruption.
      Signed-off-by: NAnsis Atteka <aatteka@nicira.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      703133de
  5. 18 9月, 2013 1 次提交
  6. 17 9月, 2013 2 次提交
    • P
      KVM: mmu: allow page tables to be in read-only slots · ba6a3541
      Paolo Bonzini 提交于
      Page tables in a read-only memory slot will currently cause a triple
      fault because the page walker uses gfn_to_hva and it fails on such a slot.
      
      OVMF uses such a page table; however, real hardware seems to be fine with
      that as long as the accessed/dirty bits are set.  Save whether the slot
      is readonly, and later check it when updating the accessed and dirty bits.
      Reviewed-by: NXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
      Reviewed-by: NGleb Natapov <gleb@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      ba6a3541
    • J
      netfilter: ipset: Consistent userspace testing with nomatch flag · 0f1799ba
      Jozsef Kadlecsik 提交于
      The "nomatch" commandline flag should invert the matching at testing,
      similarly to the --return-nomatch flag of the "set" match of iptables.
      Until now it worked with the elements with "nomatch" flag only. From
      now on it works with elements without the flag too, i.e:
      
       # ipset n test hash:net
       # ipset a test 10.0.0.0/24 nomatch
       # ipset t test 10.0.0.1
       10.0.0.1 is NOT in set test.
       # ipset t test 10.0.0.1 nomatch
       10.0.0.1 is in set test.
      
       # ipset a test 192.168.0.0/24
       # ipset t test 192.168.0.1
       192.168.0.1 is in set test.
       # ipset t test 192.168.0.1 nomatch
       192.168.0.1 is NOT in set test.
      
       Before the patch the results were
      
       ...
       # ipset t test 192.168.0.1
       192.168.0.1 is in set test.
       # ipset t test 192.168.0.1 nomatch
       192.168.0.1 is in set test.
      Signed-off-by: NJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      0f1799ba