1. 21 4月, 2017 1 次提交
  2. 30 3月, 2017 1 次提交
  3. 13 3月, 2017 1 次提交
  4. 28 2月, 2017 1 次提交
  5. 20 2月, 2017 1 次提交
  6. 02 2月, 2017 1 次提交
    • M
      netfilter: allow logging from non-init namespaces · 2851940f
      Michal Kubeček 提交于
      Commit 69b34fb9 ("netfilter: xt_LOG: add net namespace support for
      xt_LOG") disabled logging packets using the LOG target from non-init
      namespaces. The motivation was to prevent containers from flooding
      kernel log of the host. The plan was to keep it that way until syslog
      namespace implementation allows containers to log in a safe way.
      
      However, the work on syslog namespace seems to have hit a dead end
      somewhere in 2013 and there are users who want to use xt_LOG in all
      network namespaces. This patch allows to do so by setting
      
        /proc/sys/net/netfilter/nf_log_all_netns
      
      to a nonzero value. This sysctl is only accessible from init_net so that
      one cannot switch the behaviour from inside a container.
      Signed-off-by: NMichal Kubecek <mkubecek@suse.cz>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      2851940f
  7. 31 1月, 2017 1 次提交
    • R
      net: Avoid receiving packets with an l3mdev on unbound UDP sockets · 63a6fff3
      Robert Shearman 提交于
      Packets arriving in a VRF currently are delivered to UDP sockets that
      aren't bound to any interface. TCP defaults to not delivering packets
      arriving in a VRF to unbound sockets. IP route lookup and socket
      transmit both assume that unbound means using the default table and
      UDP applications that haven't been changed to be aware of VRFs may not
      function correctly in this case since they may not be able to handle
      overlapping IP address ranges, or be able to send packets back to the
      original sender if required.
      
      So add a sysctl, udp_l3mdev_accept, to control this behaviour with it
      being analgous to the existing tcp_l3mdev_accept, namely to allow a
      process to have a VRF-global listen socket. Have this default to off
      as this is the behaviour that users will expect, given that there is
      no explicit mechanism to set unmodified VRF-unaware application into a
      default VRF.
      Signed-off-by: NRobert Shearman <rshearma@brocade.com>
      Acked-by: NDavid Ahern <dsa@cumulusnetworks.com>
      Tested-by: NDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      63a6fff3
  8. 27 1月, 2017 1 次提交
  9. 26 1月, 2017 1 次提交
  10. 25 1月, 2017 1 次提交
    • K
      Introduce a sysctl that modifies the value of PROT_SOCK. · 4548b683
      Krister Johansen 提交于
      Add net.ipv4.ip_unprivileged_port_start, which is a per namespace sysctl
      that denotes the first unprivileged inet port in the namespace.  To
      disable all privileged ports set this to zero.  It also checks for
      overlap with the local port range.  The privileged and local range may
      not overlap.
      
      The use case for this change is to allow containerized processes to bind
      to priviliged ports, but prevent them from ever being allowed to modify
      their container's network configuration.  The latter is accomplished by
      ensuring that the network namespace is not a child of the user
      namespace.  This modification was needed to allow the container manager
      to disable a namespace's priviliged port restrictions without exposing
      control of the network namespace to processes in the user namespace.
      Signed-off-by: NKrister Johansen <kjlx@templeofstupid.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4548b683
  11. 14 1月, 2017 2 次提交
  12. 04 1月, 2017 1 次提交
    • S
      af_packet: TX_RING support for TPACKET_V3 · 7f953ab2
      Sowmini Varadhan 提交于
      Although TPACKET_V3 Rx has some benefits over TPACKET_V2 Rx, *_v3
      does not currently have TX_RING support. As a result an application
      that wants the best perf for Tx and Rx (e.g. to handle request/response
      transacations) ends up needing 2 sockets, one with *_v2 for Tx and
      another with *_v3 for Rx.
      
      This patch enables TPACKET_V2 compatible Tx features in TPACKET_V3
      so that an application can use a single descriptor to get the benefits
      of _v3 RX_RING and _v2 TX_RING. An application may do a block-send by
      first filling up multiple frames in the Tx ring and then triggering a
      transmit. This patch only support fixed size Tx frames for TPACKET_V3,
      and requires that tp_next_offset must be zero.
      Signed-off-by: NSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7f953ab2
  13. 03 1月, 2017 1 次提交
  14. 02 1月, 2017 2 次提交
  15. 11 12月, 2016 1 次提交
  16. 09 12月, 2016 3 次提交
  17. 05 12月, 2016 1 次提交
    • F
      netfilter: conntrack: add nf_conntrack_default_on sysctl · 481fa373
      Florian Westphal 提交于
      This switch (default on) can be used to disable automatic registration
      of connection tracking functionality in newly created network
      namespaces.
      
      This means that when net namespace goes down (or the tracker protocol
      module is unloaded) we *might* have to unregister the hooks.
      
      We can either add another per-netns variable that tells if
      the hooks got registered by default, or, alternatively, just call
      the protocol _put() function and have the callee deal with a possible
      'extra' put() operation that doesn't pair with a get() one.
      
      This uses the latter approach, i.e. a put() without a get has no effect.
      
      Conntrack is still enabled automatically regardless of the new sysctl
      setting if the new net namespace requires connection tracking, e.g. when
      NAT rules are created.
      Signed-off-by: NFlorian Westphal <fw@strlen.de>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      481fa373
  18. 04 12月, 2016 2 次提交
  19. 03 12月, 2016 1 次提交
  20. 30 11月, 2016 2 次提交
    • F
      tcp: SOF_TIMESTAMPING_OPT_STATS option for SO_TIMESTAMPING · 1c885808
      Francis Yan 提交于
      This patch exports the sender chronograph stats via the socket
      SO_TIMESTAMPING channel. Currently we can instrument how long a
      particular application unit of data was queued in TCP by tracking
      SOF_TIMESTAMPING_TX_SOFTWARE and SOF_TIMESTAMPING_TX_SCHED. Having
      these sender chronograph stats exported simultaneously along with
      these timestamps allow further breaking down the various sender
      limitation.  For example, a video server can tell if a particular
      chunk of video on a connection takes a long time to deliver because
      TCP was experiencing small receive window. It is not possible to
      tell before this patch without packet traces.
      
      To prepare these stats, the user needs to set
      SOF_TIMESTAMPING_OPT_STATS and SOF_TIMESTAMPING_OPT_TSONLY flags
      while requesting other SOF_TIMESTAMPING TX timestamps. When the
      timestamps are available in the error queue, the stats are returned
      in a separate control message of type SCM_TIMESTAMPING_OPT_STATS,
      in a list of TLVs (struct nlattr) of types: TCP_NLA_BUSY_TIME,
      TCP_NLA_RWND_LIMITED, TCP_NLA_SNDBUF_LIMITED. Unit is microsecond.
      Signed-off-by: NFrancis Yan <francisyyan@gmail.com>
      Signed-off-by: NYuchung Cheng <ycheng@google.com>
      Signed-off-by: NSoheil Hassas Yeganeh <soheil@google.com>
      Acked-by: NNeal Cardwell <ncardwell@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1c885808
    • S
      docs: ieee802154: update main documentation file · 6bf0d84d
      Stefan Schmidt 提交于
      This updates some out of date documentation and fixes some wrong assumptions as
      well as pure grammar fixes. This file needs to move towards the new kernel doc
      system and getting an overhaul during this work.
      Signed-off-by: NStefan Schmidt <stefan@osg.samsung.com>
      6bf0d84d
  21. 29 11月, 2016 4 次提交
  22. 24 11月, 2016 1 次提交
  23. 10 11月, 2016 2 次提交
  24. 08 11月, 2016 1 次提交
  25. 24 10月, 2016 1 次提交
  26. 17 10月, 2016 5 次提交