1. 23 6月, 2015 7 次提交
  2. 22 6月, 2015 19 次提交
  3. 21 6月, 2015 1 次提交
    • D
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · 12011962
      David S. Miller 提交于
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter updates for net-next
      
      The following patchset contains a final Netfilter pull request for net-next
      4.2. This mostly addresses some fallout from the previous pull request, small
      netns updates and a couple of new features for nfnetlink_log and the socket
      match that didn't get in time for the previous pull request. More specifically
      they are:
      
      1) Add security context information to nfnetlink_queue, from Roman Kubiak.
      
      2) Add support to restore the sk_mark into skb->mark through xt_socket,
         from Harout Hedeshian.
      
      3) Force alignment of 16 bytes of per cpu xt_counters, from Eric Dumazet.
      
      4) Rename br_netfilter.c to br_netfilter_hooks.c to prepare split of IPv6 code
         into a separated file.
      
      5) Move the IPv6 code in br_netfilter into a separated file.
      
      6) Remove unused RCV_SKB_FAIL() in nfnetlink_queue and nfetlink_log, from Eric
         Biederman.
      
      7) Two liner to simplify netns logic in em_ipset_match().
      
      8) Add missing includes to net/net_namespace.h to avoid compilation problems
         that result from not including linux/netfilter.h in netns headers.
      
      9) Use a forward declaration instead of including linux/proc_fs.h from
         netns/netfilter.h
      
      10) Add a new linux/netfilter_defs.h to replace the linux/netfilter.h inclusion
          in netns headers.
      
      11) Remove spurious netfilter.h file included in the net tree, also from Eric
          Biederman.
      
      12) Fix x_tables compilation warnings on 32 bits platforms that resulted from
          recent changes in x_tables counters, from Florian Westphal.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      12011962
  4. 19 6月, 2015 8 次提交
  5. 18 6月, 2015 5 次提交
    • P
      netfilter: bridge: rename br_netfilter.c to br_netfilter_hooks.c · c4e70a87
      Pablo Neira Ayuso 提交于
      To prepare separation of the IPv6 code into different file.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      c4e70a87
    • E
      netfilter: x_tables: align per cpu xt_counter · a1a56aaa
      Eric Dumazet 提交于
      Let's force a 16 bytes alignment on xt_counter percpu allocations,
      so that bytes and packets sit in same cache line.
      
      xt_counter being exported to user space, we cannot add __align(16) on
      the structure itself.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Florian Westphal <fw@strlen.de>
      Acked-by: NFlorian Westphal <fw@strlen.de>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      a1a56aaa
    • H
      netfilter: xt_socket: add XT_SOCKET_RESTORESKMARK flag · 01555e74
      Harout Hedeshian 提交于
      xt_socket is useful for matching sockets with IP_TRANSPARENT and
      taking some action on the matching packets. However, it lacks the
      ability to match only a small subset of transparent sockets.
      
      Suppose there are 2 applications, each with its own set of transparent
      sockets. The first application wants all matching packets dropped,
      while the second application wants them forwarded somewhere else.
      
      Add the ability to retore the skb->mark from the sk_mark. The mark
      is only restored if a matching socket is found and the transparent /
      nowildcard conditions are satisfied.
      
      Now the 2 hypothetical applications can differentiate their sockets
      based on a mark value set with SO_MARK.
      
      iptables -t mangle -I PREROUTING -m socket --transparent \
                                                 --restore-skmark -j action
      iptables -t mangle -A action -m mark --mark 10 -j action2
      iptables -t mangle -A action -m mark --mark 11 -j action3
      Signed-off-by: NHarout Hedeshian <harouth@codeaurora.org>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      01555e74
    • R
      netfilter: nfnetlink_queue: add security context information · ef493bd9
      Roman Kubiak 提交于
      This patch adds an additional attribute when sending
      packet information via netlink in netfilter_queue module.
      It will send additional security context data, so that
      userspace applications can verify this context against
      their own security databases.
      Signed-off-by: NRoman Kubiak <r.kubiak@samsung.com>
      Acked-by: NFlorian Westphal <fw@strlen.de>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      ef493bd9
    • D
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue · b67ea97f
      David S. Miller 提交于
      Jeff Kirsher says:
      
      ====================
      This series contains updates to fm10k only.
      
      Alex provides two fixes for the fm10k, first folds the fm10k_pull_tail()
      call into fm10k_add_rx_frag(), this way the fragment does not have to be
      modified after it is added to the skb.  The second fixes missing braces
      to an if statement.
      
      The remaining patches are from Jacob which contain improvements and fixes
      for fm10k.  First fix makes it so that invalid address will simply be
      skipped and allows synchronizing the full list to proceed with using
      iproute2 tool.  Fixed a possible kernel panic by using the correct
      transmit timestamp function.  Simplified the code flow for setting the
      IN_PROGRESS bit of the shinfo for an skb that we will be timestamping.
      Fix a bug in the timestamping transmit enqueue code responsible for a
      NULL pointer dereference and invalid access of the skb list by freeing
      the clone in the cases where we did not add it to the queue.  Update the
      PF code so that it resets the empty TQMAP/RQMAP regirsters post-VFLR to
      prevent innocent VF drivers from triggering malicious driver events.
      The SYSTIME_CFG.Adjust direction bit is actually supposed to indicate
      that the adjustment is positive, so fix the code to align correctly with
      the hardware and documentation.  Cleanup local variable that is no longer
      used after a previous refactor of the code.  Fix the code flow so that we
      actually clear the enabled flag as part of our removal of the LPORT.
      
      v2:
       - updated patch 07 description based on feedback from Sergei Shtylyov
       - updated patch 09 & 10 to use %d in error message based on feedback
         from Sergei Shtylyov
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b67ea97f