1. 20 2月, 2020 6 次提交
  2. 19 2月, 2020 20 次提交
  3. 18 2月, 2020 5 次提交
  4. 17 2月, 2020 9 次提交
    • F
      netfilter: conntrack: allow insertion of clashing entries · 6a757c07
      Florian Westphal 提交于
      This patch further relaxes the need to drop an skb due to a clash with
      an existing conntrack entry.
      
      Current clash resolution handles the case where the clash occurs between
      two identical entries (distinct nf_conn objects with same tuples), i.e.:
      
                          Original                        Reply
      existing: 10.2.3.4:42 -> 10.8.8.8:53      10.2.3.4:42 <- 10.0.0.6:5353
      clashing: 10.2.3.4:42 -> 10.8.8.8:53      10.2.3.4:42 <- 10.0.0.6:5353
      
      ... existing handling will discard the unconfirmed clashing entry and
      makes skb->_nfct point to the existing one.  The skb can then be
      processed normally just as if the clash would not have existed in the
      first place.
      
      For other clashes, the skb needs to be dropped.
      This frequently happens with DNS resolvers that send A and AAAA queries
      back-to-back when NAT rules are present that cause packets to get
      different DNAT transformations applied, for example:
      
      -m statistics --mode random ... -j DNAT --dnat-to 10.0.0.6:5353
      -m statistics --mode random ... -j DNAT --dnat-to 10.0.0.7:5353
      
      In this case the A or AAAA query is dropped which incurs a costly
      delay during name resolution.
      
      This patch also allows this collision type:
                             Original                   Reply
      existing: 10.2.3.4:42 -> 10.8.8.8:53      10.2.3.4:42 <- 10.0.0.6:5353
      clashing: 10.2.3.4:42 -> 10.8.8.8:53      10.2.3.4:42 <- 10.0.0.7:5353
      
      In this case, clash is in original direction -- the reply direction
      is still unique.
      
      The change makes it so that when the 2nd colliding packet is received,
      the clashing conntrack is tagged with new IPS_NAT_CLASH_BIT, gets a fixed
      1 second timeout and is inserted in the reply direction only.
      
      The entry is hidden from 'conntrack -L', it will time out quickly
      and it can be early dropped because it will never progress to the
      ASSURED state.
      
      To avoid special-casing the delete code path to special case
      the ORIGINAL hlist_nulls node, a new helper, "hlist_nulls_add_fake", is
      added so hlist_nulls_del() will work.
      
      Example:
      
            CPU A:                               CPU B:
      1.  10.2.3.4:42 -> 10.8.8.8:53 (A)
      2.                                         10.2.3.4:42 -> 10.8.8.8:53 (AAAA)
      3.  Apply DNAT, reply changed to 10.0.0.6
      4.                                         10.2.3.4:42 -> 10.8.8.8:53 (AAAA)
      5.                                         Apply DNAT, reply changed to 10.0.0.7
      6. confirm/commit to conntrack table, no collisions
      7.                                         commit clashing entry
      
      Reply comes in:
      
      10.2.3.4:42 <- 10.0.0.6:5353 (A)
       -> Finds a conntrack, DNAT is reversed & packet forwarded to 10.2.3.4:42
      10.2.3.4:42 <- 10.0.0.7:5353 (AAAA)
       -> Finds a conntrack, DNAT is reversed & packet forwarded to 10.2.3.4:42
          The conntrack entry is deleted from table, as it has the NAT_CLASH
          bit set.
      
      In case of a retransmit from ORIGINAL dir, all further packets will get
      the DNAT transformation to 10.0.0.6.
      
      I tried to come up with other solutions but they all have worse
      problems.
      
      Alternatives considered were:
      1.  Confirm ct entries at allocation time, not in postrouting.
       a. will cause uneccesarry work when the skb that creates the
          conntrack is dropped by ruleset.
       b. in case nat is applied, ct entry would need to be moved in
          the table, which requires another spinlock pair to be taken.
       c. breaks the 'unconfirmed entry is private to cpu' assumption:
          we would need to guard all nfct->ext allocation requests with
          ct->lock spinlock.
      
      2. Make the unconfirmed list a hash table instead of a pcpu list.
         Shares drawback c) of the first alternative.
      
      3. Document this is expected and force users to rearrange their
         ruleset (e.g. by using "-m cluster" instead of "-m statistics").
         nft has the 'jhash' expression which can be used instead of 'numgen'.
      
         Major drawback: doesn't fix what I consider a bug, not very realistic
         and I believe its reasonable to have the existing rulesets to 'just
         work'.
      
      4. Document this is expected and force users to steer problematic
         packets to the same CPU -- this would serialize the "allocate new
         conntrack entry/nat table evaluation/perform nat/confirm entry", so
         no race can occur.  Similar drawback to 3.
      
      Another advantage of this patch compared to 1) and 2) is that there are
      no changes to the hot path; things are handled in the udp tracker and
      the clash resolution path.
      
      Cc: rcu@vger.kernel.org
      Cc: "Paul E. McKenney" <paulmck@kernel.org>
      Cc: Josh Triplett <josh@joshtriplett.org>
      Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
      Signed-off-by: NFlorian Westphal <fw@strlen.de>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      6a757c07
    • P
      net: ethernet: dm9000: Handle -EPROBE_DEFER in dm9000_parse_dt() · 9a6a0dea
      Paul Cercueil 提交于
      The call to of_get_mac_address() can return -EPROBE_DEFER, for instance
      when the MAC address is read from a NVMEM driver that did not probe yet.
      
      Cc: H. Nikolaus Schaller <hns@goldelico.com>
      Cc: Mathieu Malaterre <malat@debian.org>
      Signed-off-by: NPaul Cercueil <paul@crapouillou.net>
      Reviewed-by: NAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9a6a0dea
    • R
      skbuff.h: fix all kernel-doc warnings · d2f273f0
      Randy Dunlap 提交于
      Fix all kernel-doc warnings in <linux/skbuff.h>.
      Fixes these warnings:
      
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'list' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'dev_scratch' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'ip_defrag_offset' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'skb_mstamp_ns' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member '__cloned_offset' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'head_frag' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member '__pkt_type_offset' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'encapsulation' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'encap_hdr_csum' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'csum_valid' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member '__pkt_vlan_present_offset' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'vlan_present' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'csum_complete_sw' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'csum_level' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'inner_protocol_type' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'remcsum_offload' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'sender_cpu' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'reserved_tailroom' not described in 'sk_buff'
      ../include/linux/skbuff.h:890: warning: Function parameter or member 'inner_ipproto' not described in 'sk_buff'
      Signed-off-by: NRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d2f273f0
    • R
      skbuff: remove stale bit mask comments · 8955b435
      Randy Dunlap 提交于
      Remove stale comments since this flag is no longer a bit mask
      but is a bit field.
      Signed-off-by: NRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8955b435
    • R
      net/sock.h: fix all kernel-doc warnings · 66256e0b
      Randy Dunlap 提交于
      Fix all kernel-doc warnings for <net/sock.h>.
      Fixes these warnings:
      
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_addrpair' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_portpair' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_ipv6only' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_net_refcnt' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_v6_daddr' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_v6_rcv_saddr' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_cookie' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_listener' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_tw_dr' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_rcv_wnd' not described in 'sock_common'
      ../include/net/sock.h:232: warning: Function parameter or member 'skc_tw_rcv_nxt' not described in 'sock_common'
      
      ../include/net/sock.h:498: warning: Function parameter or member 'sk_rx_skb_cache' not described in 'sock'
      ../include/net/sock.h:498: warning: Function parameter or member 'sk_wq_raw' not described in 'sock'
      ../include/net/sock.h:498: warning: Function parameter or member 'tcp_rtx_queue' not described in 'sock'
      ../include/net/sock.h:498: warning: Function parameter or member 'sk_tx_skb_cache' not described in 'sock'
      ../include/net/sock.h:498: warning: Function parameter or member 'sk_route_forced_caps' not described in 'sock'
      ../include/net/sock.h:498: warning: Function parameter or member 'sk_txtime_report_errors' not described in 'sock'
      ../include/net/sock.h:498: warning: Function parameter or member 'sk_validate_xmit_skb' not described in 'sock'
      ../include/net/sock.h:498: warning: Function parameter or member 'sk_bpf_storage' not described in 'sock'
      
      ../include/net/sock.h:2024: warning: No description found for return value of 'sk_wmem_alloc_get'
      ../include/net/sock.h:2035: warning: No description found for return value of 'sk_rmem_alloc_get'
      ../include/net/sock.h:2046: warning: No description found for return value of 'sk_has_allocations'
      ../include/net/sock.h:2082: warning: No description found for return value of 'skwq_has_sleeper'
      ../include/net/sock.h:2244: warning: No description found for return value of 'sk_page_frag'
      ../include/net/sock.h:2444: warning: Function parameter or member 'tcp_rx_skb_cache_key' not described in 'DECLARE_STATIC_KEY_FALSE'
      ../include/net/sock.h:2444: warning: Excess function parameter 'sk' description in 'DECLARE_STATIC_KEY_FALSE'
      ../include/net/sock.h:2444: warning: Excess function parameter 'skb' description in 'DECLARE_STATIC_KEY_FALSE'
      Signed-off-by: NRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      66256e0b
    • M
      net: ks8851-ml: Fix 16-bit IO operation · 58292104
      Marek Vasut 提交于
      The Micrel KSZ8851-16MLLI datasheet DS00002357B page 12 states that
      BE[3:0] signals are active high. This contradicts the measurements
      of the behavior of the actual chip, where these signals behave as
      active low. For example, to read the CIDER register, the bus must
      expose 0xc0c0 during the address phase, which means BE[3:0]=4'b1100.
      Signed-off-by: NMarek Vasut <marex@denx.de>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: Petr Stetiar <ynezz@true.cz>
      Cc: YueHaibing <yuehaibing@huawei.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      58292104
    • M
      net: ks8851-ml: Fix 16-bit data access · edacb098
      Marek Vasut 提交于
      The packet data written to and read from Micrel KSZ8851-16MLLI must be
      byte-swapped in 16-bit mode, add this byte-swapping.
      Signed-off-by: NMarek Vasut <marex@denx.de>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: Petr Stetiar <ynezz@true.cz>
      Cc: YueHaibing <yuehaibing@huawei.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      edacb098
    • M
      net: ks8851-ml: Remove 8-bit bus accessors · 69233bba
      Marek Vasut 提交于
      This driver is mixing 8-bit and 16-bit bus accessors for reasons unknown,
      however the speculation is that this was some sort of attempt to support
      the 8-bit bus mode.
      
      As per the KS8851-16MLL documentation, all two registers accessed via the
      8-bit accessors are internally 16-bit registers, so reading them using
      16-bit accessors is fine. The KS_CCR read can be converted to 16-bit read
      outright, as it is already a concatenation of two 8-bit reads of that
      register. The KS_RXQCR accesses are 8-bit only, however writing the top
      8 bits of the register is OK as well, since the driver caches the entire
      16-bit register value anyway.
      
      Finally, the driver is not used by any hardware in the kernel right now.
      The only hardware available to me is one with 16-bit bus, so I have no
      way to test the 8-bit bus mode, however it is unlikely this ever really
      worked anyway. If the 8-bit bus mode is ever required, it can be easily
      added by adjusting the 16-bit accessors to do 2 consecutive accesses,
      which is how this should have been done from the beginning.
      Signed-off-by: NMarek Vasut <marex@denx.de>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: Petr Stetiar <ynezz@true.cz>
      Cc: YueHaibing <yuehaibing@huawei.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      69233bba
    • M
      mptcp: select CRYPTO · 357b41ca
      Matthieu Baerts 提交于
      Without this modification and if CRYPTO is not selected, we have this
      warning:
      
        WARNING: unmet direct dependencies detected for CRYPTO_LIB_SHA256
          Depends on [n]: CRYPTO [=n]
          Selected by [y]:
          - MPTCP [=y] && NET [=y] && INET [=y]
      
      MPTCP selects CRYPTO_LIB_SHA256 which seems to depend on CRYPTO. CRYPTO
      is now selected to avoid this issue.
      
      Even though the config system prints that warning, it looks like
      sha256.c is compiled and linked even without CONFIG_CRYPTO. Since MPTCP
      will end up needing CONFIG_CRYPTO anyway in future commits -- currently
      in preparation for net-next -- we propose to add it now to fix the
      warning.
      
      The dependency in the config system comes from the fact that
      CRYPTO_LIB_SHA256 is defined in "lib/crypto/Kconfig" which is sourced
      from "crypto/Kconfig" only if CRYPTO is selected.
      
      Fixes: 65492c5a (mptcp: move from sha1 (v0) to sha256 (v1))
      Signed-off-by: NMatthieu Baerts <matthieu.baerts@tessares.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      357b41ca