1. 17 9月, 2011 2 次提交
  2. 27 7月, 2011 1 次提交
  3. 01 4月, 2011 1 次提交
  4. 31 3月, 2011 1 次提交
  5. 13 3月, 2011 12 次提交
  6. 02 3月, 2011 1 次提交
  7. 23 2月, 2011 2 次提交
  8. 28 1月, 2011 1 次提交
  9. 24 12月, 2010 1 次提交
    • D
      Revert "ipv4: Allow configuring subnets as local addresses" · e0584649
      David S. Miller 提交于
      This reverts commit 4465b469.
      
      Conflicts:
      
      	net/ipv4/fib_frontend.c
      
      As reported by Ben Greear, this causes regressions:
      
      > Change 4465b469 caused rules
      > to stop matching the input device properly because the
      > FLOWI_FLAG_MATCH_ANY_IIF is always defined in ip_dev_find().
      >
      > This breaks rules such as:
      >
      > ip rule add pref 512 lookup local
      > ip rule del pref 0 lookup local
      > ip link set eth2 up
      > ip -4 addr add 172.16.0.102/24 broadcast 172.16.0.255 dev eth2
      > ip rule add to 172.16.0.102 iif eth2 lookup local pref 10
      > ip rule add iif eth2 lookup 10001 pref 20
      > ip route add 172.16.0.0/24 dev eth2 table 10001
      > ip route add unreachable 0/0 table 10001
      >
      > If you had a second interface 'eth0' that was on a different
      > subnet, pinging a system on that interface would fail:
      >
      >   [root@ct503-60 ~]# ping 192.168.100.1
      >   connect: Invalid argument
      Reported-by: NBen Greear <greearb@candelatech.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e0584649
  10. 16 11月, 2010 1 次提交
  11. 29 9月, 2010 1 次提交
    • T
      ipv4: Allow configuring subnets as local addresses · 4465b469
      Tom Herbert 提交于
      This patch allows a host to be configured to respond to any address in
      a specified range as if it were local, without actually needing to
      configure the address on an interface.  This is done through routing
      table configuration.  For instance, to configure a host to respond
      to any address in 10.1/16 received on eth0 as a local address we can do:
      
      ip rule add from all iif eth0 lookup 200
      ip route add local 10.1/16 dev lo proto kernel scope host src 127.0.0.1 table 200
      
      This host is now reachable by any 10.1/16 address (route lookup on
      input for packets received on eth0 can find the route).  On output, the
      rule will not be matched so that this host can still send packets to
      10.1/16 (not sent on loopback).  Presumably, external routing can be
      configured to make sense out of this.
      
      To make this work, we needed to modify the logic in finding the
      interface which is assigned a given source address for output
      (dev_ip_find).  We perform a normal fib_lookup instead of just a
      lookup on the local table, and in the lookup we ignore the input
      interface for matching.
      
      This patch is useful to implement IP-anycast for subnets of virtual
      addresses.
      Signed-off-by: NTom Herbert <therbert@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4465b469
  12. 07 4月, 2010 1 次提交
    • T
      flow: virtualize flow cache entry methods · fe1a5f03
      Timo Teräs 提交于
      This allows to validate the cached object before returning it.
      It also allows to destruct object properly, if the last reference
      was held in flow cache. This is also a prepartion for caching
      bundles in the flow cache.
      
      In return for virtualizing the methods, we save on:
      - not having to regenerate the whole flow cache on policy removal:
        each flow matching a killed policy gets refreshed as the getter
        function notices it smartly.
      - we do not have to call flow_cache_flush from policy gc, since the
        flow cache now properly deletes the object if it had any references
      Signed-off-by: NTimo Teras <timo.teras@iki.fi>
      Acked-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fe1a5f03
  13. 26 11月, 2008 1 次提交
  14. 01 10月, 2008 1 次提交
  15. 05 8月, 2008 1 次提交
  16. 29 1月, 2008 1 次提交
  17. 11 7月, 2007 1 次提交
  18. 30 4月, 2007 1 次提交
    • M
      [XFRM]: Restrict upper layer information by bundle. · 157bfc25
      Masahide NAKAMURA 提交于
      On MIPv6 usage, XFRM sub policy is enabled.
      When main (IPsec) and sub (MIPv6) policy selectors have the same
      address set but different upper layer information (i.e. protocol
      number and its ports or type/code), multiple bundle should be created.
      However, currently we have issue to use the same bundle created for
      the first time with all flows covered by the case.
      
      It is useful for the bundle to have the upper layer information
      to be restructured correctly if it does not match with the flow.
      
      1. Bundle was created by two policies
      Selector from another policy is added to xfrm_dst.
      If the flow does not match the selector, it goes to slow path to
      restructure new bundle by single policy.
      
      2. Bundle was created by one policy
      Flow cache is added to xfrm_dst as originated one. If the flow does
      not match the cache, it goes to slow path to try searching another
      policy.
      Signed-off-by: NMasahide NAKAMURA <nakam@linux-ipv6.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      157bfc25
  19. 03 12月, 2006 2 次提交
  20. 22 10月, 2006 1 次提交
  21. 12 10月, 2006 1 次提交
    • J
      IPsec: propagate security module errors up from flow_cache_lookup · 134b0fc5
      James Morris 提交于
      When a security module is loaded (in this case, SELinux), the
      security_xfrm_policy_lookup() hook can return an access denied permission
      (or other error).  We were not handling that correctly, and in fact
      inverting the return logic and propagating a false "ok" back up to
      xfrm_lookup(), which then allowed packets to pass as if they were not
      associated with an xfrm policy.
      
      The way I was seeing the problem was when connecting via IPsec to a
      confined service on an SELinux box (vsftpd), which did not have the
      appropriate SELinux policy permissions to send packets via IPsec.
      
      The first SYNACK would be blocked, because of an uncached lookup via
      flow_cache_lookup(), which would fail to resolve an xfrm policy because
      the SELinux policy is checked at that point via the resolver.
      
      However, retransmitted SYNACKs would then find a cached flow entry when
      calling into flow_cache_lookup() with a null xfrm policy, which is
      interpreted by xfrm_lookup() as the packet not having any associated
      policy and similarly to the first case, allowing it to pass without
      transformation.
      
      The solution presented here is to first ensure that errno values are
      correctly propagated all the way back up through the various call chains
      from security_xfrm_policy_lookup(), and handled correctly.
      
      Then, flow_cache_lookup() is modified, so that if the policy resolver
      fails (typically a permission denied via the security module), the flow
      cache entry is killed rather than having a null policy assigned (which
      indicates that the packet can pass freely).  This also forces any future
      lookups for the same flow to consult the security module (e.g. SELinux)
      for current security policy (rather than, say, caching the error on the
      flow cache entry).
      Signed-off-by: NJames Morris <jmorris@namei.org>
      134b0fc5
  22. 29 9月, 2006 3 次提交
  23. 23 9月, 2006 2 次提交