1. 24 8月, 2016 4 次提交
  2. 18 8月, 2016 1 次提交
  3. 16 8月, 2016 2 次提交
  4. 14 8月, 2016 2 次提交
  5. 13 8月, 2016 1 次提交
  6. 11 8月, 2016 1 次提交
  7. 09 8月, 2016 1 次提交
  8. 31 7月, 2016 1 次提交
  9. 27 7月, 2016 1 次提交
  10. 26 7月, 2016 2 次提交
  11. 19 7月, 2016 1 次提交
    • F
      netfilter: x_tables: speed up jump target validation · f4dc7771
      Florian Westphal 提交于
      The dummy ruleset I used to test the original validation change was broken,
      most rules were unreachable and were not tested by mark_source_chains().
      
      In some cases rulesets that used to load in a few seconds now require
      several minutes.
      
      sample ruleset that shows the behaviour:
      
      echo "*filter"
      for i in $(seq 0 100000);do
              printf ":chain_%06x - [0:0]\n" $i
      done
      for i in $(seq 0 100000);do
         printf -- "-A INPUT -j chain_%06x\n" $i
         printf -- "-A INPUT -j chain_%06x\n" $i
         printf -- "-A INPUT -j chain_%06x\n" $i
      done
      echo COMMIT
      
      [ pipe result into iptables-restore ]
      
      This ruleset will be about 74mbyte in size, with ~500k searches
      though all 500k[1] rule entries. iptables-restore will take forever
      (gave up after 10 minutes)
      
      Instead of always searching the entire blob for a match, fill an
      array with the start offsets of every single ipt_entry struct,
      then do a binary search to check if the jump target is present or not.
      
      After this change ruleset restore times get again close to what one
      gets when reverting 36472341 (~3 seconds on my workstation).
      
      [1] every user-defined rule gets an implicit RETURN, so we get
      300k jumps + 100k userchains + 100k returns -> 500k rule entries
      
      Fixes: 36472341 ("netfilter: x_tables: validate targets of jumps")
      Reported-by: NJeff Wu <wujiafu@gmail.com>
      Tested-by: NJeff Wu <wujiafu@gmail.com>
      Signed-off-by: NFlorian Westphal <fw@strlen.de>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      f4dc7771
  12. 17 7月, 2016 1 次提交
    • N
      net: ipmr/ip6mr: add support for keeping an entry age · 43b9e127
      Nikolay Aleksandrov 提交于
      In preparation for hardware offloading of ipmr/ip6mr we need an
      interface that allows to check (and later update) the age of entries.
      Relying on stats alone can show activity but not actual age of the entry,
      furthermore when there're tens of thousands of entries a lot of the
      hardware implementations only support "hit" bits which are cleared on
      read to denote that the entry was active and shouldn't be aged out,
      these can then be naturally translated into age timestamp and will be
      compatible with the software forwarding age. Using a lastuse entry doesn't
      affect performance because the members in that cache line are written to
      along with the age.
      Since all new users are encouraged to use ipmr via netlink, this is
      exported via the RTA_EXPIRES attribute.
      Also do a minor local variable declaration style adjustment - arrange them
      longest to shortest.
      Signed-off-by: NNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      CC: Roopa Prabhu <roopa@cumulusnetworks.com>
      CC: Shrijeet Mukherjee <shm@cumulusnetworks.com>
      CC: Satish Ashok <sashok@cumulusnetworks.com>
      CC: Donald Sharp <sharpd@cumulusnetworks.com>
      CC: David S. Miller <davem@davemloft.net>
      CC: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
      CC: James Morris <jmorris@namei.org>
      CC: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
      CC: Patrick McHardy <kaber@trash.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      43b9e127
  13. 12 7月, 2016 1 次提交
  14. 10 7月, 2016 2 次提交
  15. 06 7月, 2016 1 次提交
  16. 03 7月, 2016 1 次提交
    • J
      netfilter: Convert FWINV<[foo]> macros and uses to NF_INVF · c37a2dfa
      Joe Perches 提交于
      netfilter uses multiple FWINV #defines with identical form that hide a
      specific structure variable and dereference it with a invflags member.
      
      $ git grep "#define FWINV"
      include/linux/netfilter_bridge/ebtables.h:#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
      net/bridge/netfilter/ebtables.c:#define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
      net/ipv4/netfilter/arp_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(arpinfo->invflags & (invflg)))
      net/ipv4/netfilter/ip_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
      net/ipv6/netfilter/ip6_tables.c:#define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
      net/netfilter/xt_tcpudp.c:#define FWINVTCP(bool, invflg) ((bool) ^ !!(tcpinfo->invflags & (invflg)))
      
      Consolidate these macros into a single NF_INVF macro.
      
      Miscellanea:
      
      o Neaten the alignment around these uses
      o A few lines are > 80 columns for intelligibility
      Signed-off-by: NJoe Perches <joe@perches.com>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      c37a2dfa
  17. 01 7月, 2016 2 次提交
  18. 28 6月, 2016 13 次提交
  19. 27 6月, 2016 1 次提交
    • P
      ipv6: enforce egress device match in per table nexthop lookups · 48f1dcb5
      Paolo Abeni 提交于
      with the commit 8c14586f ("net: ipv6: Use passed in table for
      nexthop lookups"), net hop lookup is first performed on route creation
      in the passed-in table.
      However device match is not enforced in table lookup, so the found
      route can be later discarded due to egress device mismatch and no
      global lookup will be performed.
      This cause the following to fail:
      
      ip link add dummy1 type dummy
      ip link add dummy2 type dummy
      ip link set dummy1 up
      ip link set dummy2 up
      ip route add 2001:db8:8086::/48 dev dummy1 metric 20
      ip route add 2001:db8:d34d::/64 via 2001:db8:8086::2 dev dummy1 metric 20
      ip route add 2001:db8:8086::/48 dev dummy2 metric 21
      ip route add 2001:db8:d34d::/64 via 2001:db8:8086::2 dev dummy2 metric 21
      RTNETLINK answers: No route to host
      
      This change fixes the issue enforcing device lookup in
      ip6_nh_lookup_table()
      
      v1->v2: updated commit message title
      
      Fixes: 8c14586f ("net: ipv6: Use passed in table for nexthop lookups")
      Reported-and-tested-by: NBeniamino Galvani <bgalvani@redhat.com>
      Signed-off-by: NPaolo Abeni <pabeni@redhat.com>
      Acked-by: NDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      48f1dcb5
  20. 19 6月, 2016 1 次提交
    • E
      ipv6: RFC 4884 partial support for SIT/GRE tunnels · 20e1954f
      Eric Dumazet 提交于
      When receiving an ICMPv4 message containing extensions as
      defined in RFC 4884, and translating it to ICMPv6 at SIT
      or GRE tunnel, we need some extra manipulation in order
      to properly forward the extensions.
      
      This patch only takes care of Time Exceeded messages as they
      are the ones that typically carry information from various
      routers in a fabric during a traceroute session.
      
      It also avoids complex skb logic if the data_len is not
      a multiple of 8.
      
      RFC states :
      
         The "original datagram" field MUST contain at least 128 octets.
         If the original datagram did not contain 128 octets, the
         "original datagram" field MUST be zero padded to 128 octets.
      
      In practice routers use 128 bytes of original datagram, not more.
      
      Initial translation was added in commit ca15a078
      ("sit: generate icmpv6 error when receiving icmpv4 error")
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Oussama Ghorbel <ghorbel@pivasoftware.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      20e1954f