1. 13 3月, 2011 12 次提交
  2. 02 3月, 2011 1 次提交
  3. 23 2月, 2011 2 次提交
  4. 28 1月, 2011 1 次提交
  5. 24 12月, 2010 1 次提交
    • D
      Revert "ipv4: Allow configuring subnets as local addresses" · e0584649
      David S. Miller 提交于
      This reverts commit 4465b469.
      
      Conflicts:
      
      	net/ipv4/fib_frontend.c
      
      As reported by Ben Greear, this causes regressions:
      
      > Change 4465b469 caused rules
      > to stop matching the input device properly because the
      > FLOWI_FLAG_MATCH_ANY_IIF is always defined in ip_dev_find().
      >
      > This breaks rules such as:
      >
      > ip rule add pref 512 lookup local
      > ip rule del pref 0 lookup local
      > ip link set eth2 up
      > ip -4 addr add 172.16.0.102/24 broadcast 172.16.0.255 dev eth2
      > ip rule add to 172.16.0.102 iif eth2 lookup local pref 10
      > ip rule add iif eth2 lookup 10001 pref 20
      > ip route add 172.16.0.0/24 dev eth2 table 10001
      > ip route add unreachable 0/0 table 10001
      >
      > If you had a second interface 'eth0' that was on a different
      > subnet, pinging a system on that interface would fail:
      >
      >   [root@ct503-60 ~]# ping 192.168.100.1
      >   connect: Invalid argument
      Reported-by: NBen Greear <greearb@candelatech.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e0584649
  6. 16 11月, 2010 1 次提交
  7. 29 9月, 2010 1 次提交
    • T
      ipv4: Allow configuring subnets as local addresses · 4465b469
      Tom Herbert 提交于
      This patch allows a host to be configured to respond to any address in
      a specified range as if it were local, without actually needing to
      configure the address on an interface.  This is done through routing
      table configuration.  For instance, to configure a host to respond
      to any address in 10.1/16 received on eth0 as a local address we can do:
      
      ip rule add from all iif eth0 lookup 200
      ip route add local 10.1/16 dev lo proto kernel scope host src 127.0.0.1 table 200
      
      This host is now reachable by any 10.1/16 address (route lookup on
      input for packets received on eth0 can find the route).  On output, the
      rule will not be matched so that this host can still send packets to
      10.1/16 (not sent on loopback).  Presumably, external routing can be
      configured to make sense out of this.
      
      To make this work, we needed to modify the logic in finding the
      interface which is assigned a given source address for output
      (dev_ip_find).  We perform a normal fib_lookup instead of just a
      lookup on the local table, and in the lookup we ignore the input
      interface for matching.
      
      This patch is useful to implement IP-anycast for subnets of virtual
      addresses.
      Signed-off-by: NTom Herbert <therbert@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4465b469
  8. 07 4月, 2010 1 次提交
    • T
      flow: virtualize flow cache entry methods · fe1a5f03
      Timo Teräs 提交于
      This allows to validate the cached object before returning it.
      It also allows to destruct object properly, if the last reference
      was held in flow cache. This is also a prepartion for caching
      bundles in the flow cache.
      
      In return for virtualizing the methods, we save on:
      - not having to regenerate the whole flow cache on policy removal:
        each flow matching a killed policy gets refreshed as the getter
        function notices it smartly.
      - we do not have to call flow_cache_flush from policy gc, since the
        flow cache now properly deletes the object if it had any references
      Signed-off-by: NTimo Teras <timo.teras@iki.fi>
      Acked-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fe1a5f03
  9. 26 11月, 2008 1 次提交
  10. 01 10月, 2008 1 次提交
  11. 05 8月, 2008 1 次提交
  12. 29 1月, 2008 1 次提交
  13. 11 7月, 2007 1 次提交
  14. 30 4月, 2007 1 次提交
    • M
      [XFRM]: Restrict upper layer information by bundle. · 157bfc25
      Masahide NAKAMURA 提交于
      On MIPv6 usage, XFRM sub policy is enabled.
      When main (IPsec) and sub (MIPv6) policy selectors have the same
      address set but different upper layer information (i.e. protocol
      number and its ports or type/code), multiple bundle should be created.
      However, currently we have issue to use the same bundle created for
      the first time with all flows covered by the case.
      
      It is useful for the bundle to have the upper layer information
      to be restructured correctly if it does not match with the flow.
      
      1. Bundle was created by two policies
      Selector from another policy is added to xfrm_dst.
      If the flow does not match the selector, it goes to slow path to
      restructure new bundle by single policy.
      
      2. Bundle was created by one policy
      Flow cache is added to xfrm_dst as originated one. If the flow does
      not match the cache, it goes to slow path to try searching another
      policy.
      Signed-off-by: NMasahide NAKAMURA <nakam@linux-ipv6.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      157bfc25
  15. 03 12月, 2006 2 次提交
  16. 22 10月, 2006 1 次提交
  17. 12 10月, 2006 1 次提交
    • J
      IPsec: propagate security module errors up from flow_cache_lookup · 134b0fc5
      James Morris 提交于
      When a security module is loaded (in this case, SELinux), the
      security_xfrm_policy_lookup() hook can return an access denied permission
      (or other error).  We were not handling that correctly, and in fact
      inverting the return logic and propagating a false "ok" back up to
      xfrm_lookup(), which then allowed packets to pass as if they were not
      associated with an xfrm policy.
      
      The way I was seeing the problem was when connecting via IPsec to a
      confined service on an SELinux box (vsftpd), which did not have the
      appropriate SELinux policy permissions to send packets via IPsec.
      
      The first SYNACK would be blocked, because of an uncached lookup via
      flow_cache_lookup(), which would fail to resolve an xfrm policy because
      the SELinux policy is checked at that point via the resolver.
      
      However, retransmitted SYNACKs would then find a cached flow entry when
      calling into flow_cache_lookup() with a null xfrm policy, which is
      interpreted by xfrm_lookup() as the packet not having any associated
      policy and similarly to the first case, allowing it to pass without
      transformation.
      
      The solution presented here is to first ensure that errno values are
      correctly propagated all the way back up through the various call chains
      from security_xfrm_policy_lookup(), and handled correctly.
      
      Then, flow_cache_lookup() is modified, so that if the policy resolver
      fails (typically a permission denied via the security module), the flow
      cache entry is killed rather than having a null policy assigned (which
      indicates that the packet can pass freely).  This also forces any future
      lookups for the same flow to consult the security module (e.g. SELinux)
      for current security policy (rather than, say, caching the error on the
      flow cache entry).
      Signed-off-by: NJames Morris <jmorris@namei.org>
      134b0fc5
  18. 29 9月, 2006 3 次提交
  19. 23 9月, 2006 4 次提交
  20. 21 3月, 2006 1 次提交
    • S
      [DECnet]: Endian annotation and fixes for DECnet. · c4ea94ab
      Steven Whitehouse 提交于
      The typedef for dn_address has been removed in favour of using __le16
      or __u16 directly as appropriate. All the DECnet header files are
      updated accordingly.
      
      The byte ordering of dn_eth2dn() and dn_dn2eth() are both changed
      since just about all their callers wanted network order rather than
      host order, so the conversion is now done in the functions themselves.
      
      Several missed endianess conversions have been picked up during the
      conversion process. The nh_gw field in struct dn_fib_info has been
      changed from a 32 bit field to 16 bits as it ought to be.
      
      One or two cases of using htons rather than dn_htons in the routing
      code have been found and fixed.
      
      There are still a few warnings to fix, but this patch deals with the
      important cases.
      Signed-off-by: NSteven Whitehouse <steve@chygwyn.com>
      Signed-off-by: NPatrick Caulfield <patrick@tykepenguin.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c4ea94ab
  21. 04 1月, 2006 1 次提交
    • T
      [LSM-IPSec]: Security association restriction. · df71837d
      Trent Jaeger 提交于
      This patch series implements per packet access control via the
      extension of the Linux Security Modules (LSM) interface by hooks in
      the XFRM and pfkey subsystems that leverage IPSec security
      associations to label packets.  Extensions to the SELinux LSM are
      included that leverage the patch for this purpose.
      
      This patch implements the changes necessary to the XFRM subsystem,
      pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
      socket to use only authorized security associations (or no security
      association) to send/receive network packets.
      
      Patch purpose:
      
      The patch is designed to enable access control per packets based on
      the strongly authenticated IPSec security association.  Such access
      controls augment the existing ones based on network interface and IP
      address.  The former are very coarse-grained, and the latter can be
      spoofed.  By using IPSec, the system can control access to remote
      hosts based on cryptographic keys generated using the IPSec mechanism.
      This enables access control on a per-machine basis or per-application
      if the remote machine is running the same mechanism and trusted to
      enforce the access control policy.
      
      Patch design approach:
      
      The overall approach is that policy (xfrm_policy) entries set by
      user-level programs (e.g., setkey for ipsec-tools) are extended with a
      security context that is used at policy selection time in the XFRM
      subsystem to restrict the sockets that can send/receive packets via
      security associations (xfrm_states) that are built from those
      policies.
      
      A presentation available at
      www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
      from the SELinux symposium describes the overall approach.
      
      Patch implementation details:
      
      On output, the policy retrieved (via xfrm_policy_lookup or
      xfrm_sk_policy_lookup) must be authorized for the security context of
      the socket and the same security context is required for resultant
      security association (retrieved or negotiated via racoon in
      ipsec-tools).  This is enforced in xfrm_state_find.
      
      On input, the policy retrieved must also be authorized for the socket
      (at __xfrm_policy_check), and the security context of the policy must
      also match the security association being used.
      
      The patch has virtually no impact on packets that do not use IPSec.
      The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
      before.
      
      Also, if IPSec is used without security contexts, the impact is
      minimal.  The LSM must allow such policies to be selected for the
      combination of socket and remote machine, but subsequent IPSec
      processing proceeds as in the original case.
      
      Testing:
      
      The pfkey interface is tested using the ipsec-tools.  ipsec-tools have
      been modified (a separate ipsec-tools patch is available for version
      0.5) that supports assignment of xfrm_policy entries and security
      associations with security contexts via setkey and the negotiation
      using the security contexts via racoon.
      
      The xfrm_user interface is tested via ad hoc programs that set
      security contexts.  These programs are also available from me, and
      contain programs for setting, getting, and deleting policy for testing
      this interface.  Testing of sa functions was done by tracing kernel
      behavior.
      Signed-off-by: NTrent Jaeger <tjaeger@cse.psu.edu>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      df71837d
  22. 17 4月, 2005 1 次提交
    • L
      Linux-2.6.12-rc2 · 1da177e4
      Linus Torvalds 提交于
      Initial git repository build. I'm not bothering with the full history,
      even though we have it. We can create a separate "historical" git
      archive of that later if we want to, and in the meantime it's about
      3.2GB when imported into git - space that would just make the early
      git days unnecessarily complicated, when we don't have a lot of good
      infrastructure for it.
      
      Let it rip!
      1da177e4