1. 21 10月, 2010 6 次提交
  2. 19 10月, 2010 3 次提交
    • E
      Fixed race condition at ip_vs.ko module init. · d86bef73
      Eduardo Blanco 提交于
      Lists were initialized after the module was registered.  Multiple ipvsadm
      processes at module load triggered a race condition that resulted in a null
      pointer dereference in do_ip_vs_get_ctl(). As a result, __ip_vs_mutex
      was left locked preventing all further ipvsadm commands.
      Signed-off-by: NEduardo J. Blanco <ejblanco@google.com>
      Signed-off-by: NSimon Horman <horms@verge.net.au>
      d86bef73
    • H
      ipvs: IPv6 tunnel mode · 714f095f
      Hans Schillstrom 提交于
      IPv6 encapsulation uses a bad source address for the tunnel.
      i.e. VIP will be used as local-addr and encap. dst addr.
      Decapsulation will not accept this.
      
      Example
      LVS (eth1 2003::2:0:1/96, VIP 2003::2:0:100)
         (eth0 2003::1:0:1/96)
      RS  (ethX 2003::1:0:5/96)
      
      tcpdump
      2003::2:0:100 > 2003::1:0:5: IP6 (hlim 63, next-header TCP (6) payload length: 40)  2003::3:0:10.50991 > 2003::2:0:100.http: Flags [S], cksum 0x7312 (correct), seq 3006460279, win 5760, options [mss 1440,sackOK,TS val 1904932 ecr 0,nop,wscale 3], length 0
      
      In Linux IPv6 impl. you can't have a tunnel with an any cast address
      receiving packets (I have not tried to interpret RFC 2473)
      To have receive capabilities the tunnel must have:
       - Local address set as multicast addr or an unicast addr
       - Remote address set as an unicast addr.
       - Loop back addres or Link local address are not allowed.
      
      This causes us to setup a tunnel in the Real Server with the
      LVS as the remote address, here you can't use the VIP address since it's
      used inside the tunnel.
      
      Solution
      Use outgoing interface IPv6 address (match against the destination).
      i.e. use ip6_route_output() to look up the route cache and
      then use ipv6_dev_get_saddr(...) to set the source address of the
      encapsulated packet.
      
      Additionally, cache the results in new destination
      fields: dst_cookie and dst_saddr and properly check the
      returned dst from ip6_route_output. We now add xfrm_lookup
      call only for the tunneling method where the source address
      is a local one.
      Signed-off-by: NHans Schillstrom <hans.schillstrom@ericsson.com>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      714f095f
    • P
      netfilter: ctnetlink: add expectation deletion events · ebbf41df
      Pablo Neira Ayuso 提交于
      This patch allows to listen to events that inform about
      expectations destroyed.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      ebbf41df
  3. 18 10月, 2010 2 次提交
  4. 14 10月, 2010 6 次提交
  5. 05 10月, 2010 5 次提交
  6. 04 10月, 2010 12 次提交
  7. 29 9月, 2010 1 次提交
    • P
      netfilter: ctnetlink: add support for user-space expectation helpers · bc01befd
      Pablo Neira Ayuso 提交于
      This patch adds the basic infrastructure to support user-space
      expectation helpers via ctnetlink and the netfilter queuing
      infrastructure NFQUEUE. Basically, this patch:
      
      * adds NF_CT_EXPECT_USERSPACE flag to identify user-space
        created expectations. I have also added a sanity check in
        __nf_ct_expect_check() to avoid that kernel-space helpers
        may create an expectation if the master conntrack has no
        helper assigned.
      * adds some branches to check if the master conntrack helper
        exists, otherwise we skip the code that refers to kernel-space
        helper such as the local expectation list and the expectation
        policy.
      * allows to set the timeout for user-space expectations with
        no helper assigned.
      * a list of expectations created from user-space that depends
        on ctnetlink (if this module is removed, they are deleted).
      * includes USERSPACE in the /proc output for expectations
        that have been created by a user-space helper.
      
      This patch also modifies ctnetlink to skip including the helper
      name in the Netlink messages if no kernel-space helper is set
      (since no user-space expectation has not kernel-space kernel
      assigned).
      
      You can access an example user-space FTP conntrack helper at:
      http://people.netfilter.org/pablo/userspace-conntrack-helpers/nf-ftp-helper-userspace-POC.tar.bzSigned-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      bc01befd
  8. 22 9月, 2010 4 次提交
  9. 21 9月, 2010 1 次提交