1. 31 5月, 2014 6 次提交
  2. 26 5月, 2014 1 次提交
    • P
      netfilter: bridge: fix Kconfig unmet dependencies · 1708803e
      Pablo Neira 提交于
      Before f5efc696 ("netfilter: nf_tables: Add meta expression key for
      bridge interface name"), the entire net/bridge/netfilter/ directory
      depended on BRIDGE_NF_EBTABLES, ie. on ebtables. However, that
      directory already contained the nf_tables bridge extension that
      we should allow to compile separately. In f5efc696, we tried to
      generalize this by using CONFIG_BRIDGE_NETFILTER which was not a good
      idea since this option already existed and it is dedicated to enable
      the Netfilter bridge IP/ARP filtering.
      
      Let's try to fix this mess by:
      
      1) making net/bridge/netfilter/ dependent on the toplevel
         CONFIG_NETFILTER option, just like we do with the net/netfilter and
         net/ipv{4,6}/netfilter/ directories.
      
      2) Changing 'selects' to 'depends on' NETFILTER_XTABLES for
         BRIDGE_NF_EBTABLES. I believe this problem was already before
         f5efc696:
      
      warning: (BRIDGE_NF_EBTABLES) selects NETFILTER_XTABLES which has
      unmet direct dependencies (NET && INET && NETFILTER)
      
      3) Fix ebtables/nf_tables bridge dependencies by making NF_TABLES_BRIDGE
         and BRIDGE_NF_EBTABLES dependent on BRIDGE and NETFILTER:
      
      warning: (NF_TABLES_BRIDGE && BRIDGE_NF_EBTABLES) selects
      BRIDGE_NETFILTER which has unmet direct dependencies (NET && BRIDGE &&
      NETFILTER && INET && NETFILTER_ADVANCED)
      
      net/built-in.o: In function `br_parse_ip_options':
      br_netfilter.c:(.text+0x4a5ba): undefined reference to `ip_options_compile'
      br_netfilter.c:(.text+0x4a5ed): undefined reference to `ip_options_rcv_srr'
      net/built-in.o: In function `br_nf_pre_routing_finish':
      br_netfilter.c:(.text+0x4a8a4): undefined reference to `ip_route_input_noref'
      br_netfilter.c:(.text+0x4a987): undefined reference to `ip_route_output_flow'
      make: *** [vmlinux] Error 1
      Reported-by: NJim Davis <jim.epost@gmail.com>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1708803e
  3. 25 5月, 2014 1 次提交
  4. 24 5月, 2014 8 次提交
    • D
      net: filter: let unattached filters use sock_fprog_kern · b1fcd35c
      Daniel Borkmann 提交于
      The sk_unattached_filter_create() API is used by BPF filters that
      are not directly attached or related to sockets, and are used in
      team, ptp, xt_bpf, cls_bpf, etc. As such all users do their own
      internal managment of obtaining filter blocks and thus already
      have them in kernel memory and set up before calling into
      sk_unattached_filter_create(). As a result, due to __user annotation
      in sock_fprog, sparse triggers false positives (incorrect type in
      assignment [different address space]) when filters are set up before
      passing them to sk_unattached_filter_create(). Therefore, let
      sk_unattached_filter_create() API use sock_fprog_kern to overcome
      this issue.
      Signed-off-by: NDaniel Borkmann <dborkman@redhat.com>
      Acked-by: NAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b1fcd35c
    • D
      net: filter: remove DL macro · 8556ce79
      Daniel Borkmann 提交于
      Lets get rid of this macro. After commit 5bcfedf0 ("net: filter:
      simplify label names from jump-table"), labels have become more
      readable due to omission of BPF_ prefix but at the same time more
      generic, so that things like `git grep -n` would not find them. As
      a middle path, lets get rid of the DL macro as it's not strictly
      needed and would otherwise just hide the full name.
      Signed-off-by: NDaniel Borkmann <dborkman@redhat.com>
      Acked-by: NAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8556ce79
    • T
      l2tp: Add support for zero IPv6 checksums · 6b649fea
      Tom Herbert 提交于
      Added new L2TP configuration options to allow TX and RX of
      zero checksums in IPv6. Default is not to use them.
      Signed-off-by: NTom Herbert <therbert@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6b649fea
    • T
      net: Make enabling of zero UDP6 csums more restrictive · 1c19448c
      Tom Herbert 提交于
      RFC 6935 permits zero checksums to be used in IPv6 however this is
      recommended only for certain tunnel protocols, it does not make
      checksums completely optional like they are in IPv4.
      
      This patch restricts the use of IPv6 zero checksums that was previously
      intoduced. no_check6_tx and no_check6_rx have been added to control
      the use of checksums in UDP6 RX and TX path. The normal
      sk_no_check_{rx,tx} settings are not used (this avoids ambiguity when
      dealing with a dual stack socket).
      
      A helper function has been added (udp_set_no_check6) which can be
      called by tunnel impelmentations to all zero checksums (send on the
      socket, and accept them as valid).
      Signed-off-by: NTom Herbert <therbert@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1c19448c
    • T
      net: Split sk_no_check into sk_no_check_{rx,tx} · 28448b80
      Tom Herbert 提交于
      Define separate fields in the sock structure for configuring disabling
      checksums in both TX and RX-- sk_no_check_tx and sk_no_check_rx.
      The SO_NO_CHECK socket option only affects sk_no_check_tx. Also,
      removed UDP_CSUM_* defines since they are no longer necessary.
      Signed-off-by: NTom Herbert <therbert@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      28448b80
    • T
      net: Eliminate no_check from protosw · b26ba202
      Tom Herbert 提交于
      It doesn't seem like an protocols are setting anything other
      than the default, and allowing to arbitrarily disable checksums
      for a whole protocol seems dangerous. This can be done on a per
      socket basis.
      Signed-off-by: NTom Herbert <therbert@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b26ba202
    • T
      sunrpc: Remove sk_no_check setting · 0f8066bd
      Tom Herbert 提交于
      Setting sk_no_check to UDP_CSUM_NORCV seems to have no effect.
      Signed-off-by: NTom Herbert <therbert@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0f8066bd
    • S
      net-next:v4: Add support to configure SR-IOV VF minimum and maximum Tx rate through ip tool. · ed616689
      Sucheta Chakraborty 提交于
      o min_tx_rate puts lower limit on the VF bandwidth. VF is guaranteed
        to have a bandwidth of at least this value.
        max_tx_rate puts cap on the VF bandwidth. VF can have a bandwidth
        of up to this value.
      
      o A new handler set_vf_rate for attr IFLA_VF_RATE has been introduced
        which takes 4 arguments:
        netdev, VF number, min_tx_rate, max_tx_rate
      
      o ndo_set_vf_rate replaces ndo_set_vf_tx_rate handler.
      
      o Drivers that currently implement ndo_set_vf_tx_rate should now call
        ndo_set_vf_rate instead and reject attempt to set a minimum bandwidth
        greater than 0 for IFLA_VF_TX_RATE when IFLA_VF_RATE is not yet
        implemented by driver.
      
      o If user enters only one of either min_tx_rate or max_tx_rate, then,
        userland should read back the other value from driver and set both
        for IFLA_VF_RATE.
        Drivers that have not yet implemented IFLA_VF_RATE should always
        return min_tx_rate as 0 when read from ip tool.
      
      o If both IFLA_VF_TX_RATE and IFLA_VF_RATE options are specified, then
        IFLA_VF_RATE should override.
      
      o Idea is to have consistent display of rate values to user.
      
      o Usage example: -
      
        ./ip link set p4p1 vf 0 rate 900
      
        ./ip link show p4p1
        32: p4p1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode
        DEFAULT qlen 1000
          link/ether 00:0e:1e:08:b0:f0 brd ff:ff:ff:ff:ff:ff
          vf 0 MAC 3e:a0:ca:bd:ae:5a, tx rate 900 (Mbps), max_tx_rate 900Mbps
          vf 1 MAC f6:c6:7c:3f:3d:6c
          vf 2 MAC 56:32:43:98:d7:71
          vf 3 MAC d6:be:c3:b5:85:ff
          vf 4 MAC ee:a9:9a:1e:19:14
          vf 5 MAC 4a:d0:4c:07:52:18
          vf 6 MAC 3a:76:44:93:62:f9
          vf 7 MAC 82:e9:e7:e3:15:1a
      
        ./ip link set p4p1 vf 0 max_tx_rate 300 min_tx_rate 200
      
        ./ip link show p4p1
        32: p4p1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode
        DEFAULT qlen 1000
          link/ether 00:0e:1e:08:b0:f0 brd ff:ff:ff:ff:ff:ff
          vf 0 MAC 3e:a0:ca:bd:ae:5a, tx rate 300 (Mbps), max_tx_rate 300Mbps,
          min_tx_rate 200Mbps
          vf 1 MAC f6:c6:7c:3f:3d:6c
          vf 2 MAC 56:32:43:98:d7:71
          vf 3 MAC d6:be:c3:b5:85:ff
          vf 4 MAC ee:a9:9a:1e:19:14
          vf 5 MAC 4a:d0:4c:07:52:18
          vf 6 MAC 3a:76:44:93:62:f9
          vf 7 MAC 82:e9:e7:e3:15:1a
      
        ./ip link set p4p1 vf 0 max_tx_rate 600 rate 300
      
        ./ip link show p4p1
        32: p4p1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode
        DEFAULT qlen 1000
          link/ether 00:0e:1e:08:b0:f brd ff:ff:ff:ff:ff:ff
          vf 0 MAC 3e:a0:ca:bd:ae:5, tx rate 600 (Mbps), max_tx_rate 600Mbps,
          min_tx_rate 200Mbps
          vf 1 MAC f6:c6:7c:3f:3d:6c
          vf 2 MAC 56:32:43:98:d7:71
          vf 3 MAC d6:be:c3:b5:85:ff
          vf 4 MAC ee:a9:9a:1e:19:14
          vf 5 MAC 4a:d0:4c:07:52:18
          vf 6 MAC 3a:76:44:93:62:f9
          vf 7 MAC 82:e9:e7:e3:15:1a
      Signed-off-by: NSucheta Chakraborty <sucheta.chakraborty@qlogic.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ed616689
  5. 23 5月, 2014 24 次提交