- 09 Jun, 2021 4 commits
-
-
Florian Westphal authored
coverity scanner says: 2187 if (nft_is_base_chain(chain)) { vvv CID 1505166: Memory - corruptions (UNINIT) vvv Using uninitialized value "basechain". 2188 basechain->ops.hook_ops_type = NF_HOOK_OP_NF_TABLES; ... I don't see how nft_is_base_chain() can evaluate to true while basechain pointer is garbage. However, it seems better to place the NF_HOOK_OP_NF_TABLES annotation in nft_basechain_hook_init() instead. Reported-by:coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1505166 ("Memory - corruptions") Fixes: 65b8b7bfc5284f ("netfilter: annotate nf_tables base hook ops") Signed-off-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org>
-
Florian Westphal authored
nfnetlink_hook.c: In function 'nfnl_hook_put_nft_chain_info': nfnetlink_hook.c:76:7: error: implicit declaration of 'nft_is_active' This macro is only defined when NF_TABLES is enabled. While its possible to also add an ifdef-guard, the infrastructure is currently not useful without nf_tables. Reported-by:
kernel test robot <lkp@intel.com> Fixes: 252956528caa ("netfilter: add new hook nfnl subsystem") Suggested-by:
-
Colin Ian King authored
Currently the array net->nf.hooks_ipv6 is accessed by index hook before hook is sanity checked. Fix this by moving the sanity check to before the array access. Addresses-Coverity: ("Out-of-bounds access") Fixes: e2cf17d3 ("netfilter: add new hook nfnl subsystem") Signed-off-by:Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Phil Sutter authored
While iterating through an SCTP packet's chunks, skb_header_pointer() is called for the minimum expected chunk header size. If (that part of) the skbuff is non-linear, the following memcpy() may read data past temporary buffer '_sch'. Use skb_copy_bits() instead which does the right thing in this situation. Fixes: 133dc203 ("netfilter: nft_exthdr: Support SCTP chunks") Suggested-by:
Phil Sutter <phil@nwl.cc> Reviewed-by:
-
- 07 Jun, 2021 9 commits
-
-
Florian Westphal authored
This nfnl subsystem allows to dump the list of all active netfiler hooks, e.g. defrag, conntrack, nf/ip/arp/ip6tables and so on. This helps to see what kind of features are currently enabled in the network stack. Sample output from nft tool using this infra: $ nft list hook ip input family ip hook input { +0000000010 nft_do_chain_inet [nf_tables] # nft table firewalld INPUT +0000000100 nf_nat_ipv4_local_in [nf_nat] +2147483647 ipv4_confirm [nf_conntrack] } Signed-off-by: -
Florian Westphal authored
This will allow a followup patch to treat the 'ops->priv' pointer as nft_chain argument without having to first walk the table/chains to check if there is a matching base chain pointer. Signed-off-by:
-
Oz Shlomo authored
Currently the aging period for tcp/udp connections is hard coded to 30 seconds. Aged tcp/udp connections configure a hard coded 120/30 seconds pickup timeout for conntrack. This configuration may be too aggressive or permissive for some users. Dynamically configure the nf flow table GC timeout intervals according to the user defined values. Signed-off-by:
Oz Shlomo <ozsh@nvidia.com> Reviewed-by:
Paul Blakey <paulb@nvidia.com> Signed-off-by:
-
Oz Shlomo authored
UDP connections may be offloaded from nf conntrack to nf flow table. Offloaded connections are aged after 30 seconds of inactivity. Once aged, ownership is returned to conntrack with a hard coded pickup time of 30 seconds, after which the connection may be deleted. eted. The current aging intervals may be too aggressive for some users. Provide users with the ability to control the nf flow table offload aging and pickup time intervals via sysctl parameter as a pre-step for configuring the nf flow table GC timeout intervals. Signed-off-by:
-
Oz Shlomo authored
TCP connections may be offloaded from nf conntrack to nf flow table. Offloaded connections are aged after 30 seconds of inactivity. Once aged, ownership is returned to conntrack with a hard coded pickup time of 120 seconds, after which the connection may be deleted. eted. The current aging intervals may be too aggressive for some users. Provide users with the ability to control the nf flow table offload aging and pickup time intervals via sysctl parameter as a pre-step for configuring the nf flow table GC timeout intervals. Signed-off-by:
-
Pablo Neira Ayuso authored
Consolidate call to net_generic(net, nf_conntrack_net_id) in this wrapper function. Signed-off-by: -
Pablo Neira Ayuso authored
Replace nft_ctx_init_from_setattr() by nft_table_lookup(). This patch also disentangles nf_tables_delset() where NFTA_SET_TABLE is required while nft_ctx_init_from_setattr() allows it to be optional. From the nf_tables_delset() path, this also allows to set up the context structure when it is needed. Removing this helper function saves us 14 LoC, so it is not helping to consolidate code. Signed-off-by: -
Pablo Neira Ayuso authored
Replace nft_ctx_init_from_elemattr() by nft_table_lookup() and set up the context structure right before it is really needed. Moreover, nft_ctx_init_from_elemattr() is setting up the context structure for codepaths where this is not really needed at all. This helper function is also not helping to consolidate code, removing it saves us 4 LoC. Signed-off-by: -
Pablo Neira Ayuso authored
Update the nfnl_info structure to add a pointer to the nfnetlink header. This simplifies the existing codebase since this header is usually accessed. Update existing clients to use this new field. Signed-off-by:
-
- 04 Jun, 2021 26 commits
-
-
George McCollister authored
Add an inbound policy filter which matches the HSR/PRP supervision MAC range and forwards to the CPU port without discarding duplicates. This is required to correctly populate time_in[A] and time_in[B] in the HSR/PRP node_table. Leave the policy disabled by default and enable/disable it when joining/leaving hsr. Signed-off-by:
George McCollister <george.mccollister@gmail.com> Reviewed-by:
Vladimir Oltean <olteanv@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Íñigo Huguet authored
In my last changes in commit 5e0b8928 I introduced a copy-paste bug, leading to cancel twice qresume_task work for OFLD queue, and never the one for CTRL queue. This patch cancels correctly both works. Signed-off-by:
Íñigo Huguet <ihuguet@redhat.com> Signed-off-by:
-
Horatiu Vultur authored
According to the standard IEC 62439-2, the number of transitions needs to be counted for each transition 'between' ring state open and ring state closed and not from open state to closed state. Therefore fix this for both ring and interconnect ring. Signed-off-by:
Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by:
-
Michael Walle authored
The supplied buffer for the MAC address might not be aligned. Thus doing a 32bit (or 16bit) access could be on an unaligned address. For now, enetc is only used on aarch64 which can do unaligned accesses, thus there is no error. In any case, be correct and use the get/put_unaligned helpers. Signed-off-by:
Michael Walle <michael@walle.cc> Reviewed-by:
Claudiu Manoil <claudiu.manoil@nxp.com> Signed-off-by:
-
David S. Miller authored
Peng Li says: ==================== net: hdlc_x25: clean up some code style issues This patchset clean up some code style issues. ==================== Signed-off-by: -
Peng Li authored
Alignment should match open parenthesis. Signed-off-by:
Peng Li <lipeng321@huawei.com> Signed-off-by:
Guangbin Huang <huangguangbin2@huawei.com> Signed-off-by:
-
Peng Li authored
According to the chackpatch.pl, else should follow close brace '}'. Signed-off-by:
-
Peng Li authored
Add spaces required around that '='. Add space required after that ','. Signed-off-by:
-
Peng Li authored
Should not use assignment in if condition. Signed-off-by:
-
Peng Li authored
This patch removes unnecessary out of memory message, to fix the following checkpatch.pl warning: "WARNING: Possible unnecessary 'out of memory' message" Signed-off-by:
-
Peng Li authored
This patch removes some redundant blank lines. Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queueDavid S. Miller authored
Tony Nguyen says: ==================== 1GbE Intel Wired LAN Driver Updates 2021-06-04 This series contains updates to igc driver only. Sasha utilizes the newly introduced ethtool_sprintf() function, removes unused defines, and fixes indentation. Muhammad adds support for hardware VLAN insertion and stripping. ==================== Signed-off-by: -
Zheng Yongjun authored
When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF. Signed-off-by:
Zheng Yongjun <zhengyongjun3@huawei.com> Signed-off-by:
-
David S. Miller authored
Mat Martineau says: ==================== mptcp: Add timestamp support Enable the SO_TIMESTAMP and SO_TIMESTAMPING socket options for MPTCP sockets and add receive path cmsg support for timestamps. Patches 1, 2, and 5 expose existing sock and tcp helpers for timestamps (no new EXPORT_SYMBOLS()s). Patch 3 propagates timestamp options to subflows. Patch 4 cleans up MPTCP handling of SOL_SOCKET options. Patch 6 adds timestamp csmg data when receiving on sockets that have been configured for timestamps. Patch 7 adds self test coverage for timestamps. ==================== Signed-off-by: -
Florian Westphal authored
This extends the existing setsockopt test case to also check for cmsg timestamps. mptcp_connect will abort/fail if the setockopt was passed but the timestamp cmsg isn't present after successful recvmsg(). Acked-by:
Paolo Abeni <pabeni@redhat.com> Signed-off-by:
Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by:
-
Florian Westphal authored
This adds support for SO_TIMESTAMP(NS). Timestamps are passed to userspace in the same way as for plain tcp sockets. Acked-by:
-
Florian Westphal authored
MPTCP is builtin, so no need to add EXPORT_SYMBOL()s. It will be used to support SO_TIMESTAMP(NS) ancillary messages in the mptcp receive path. Acked-by:
-
Florian Westphal authored
Move the pre-check to the function that handles all SOL_SOCKET values. At this point there is complete coverage for all values that were accepted by the pre-check. BUSYPOLL functions are accepted but will not have any functionality yet until its clear how the expected mptcp behaviour should look like. Acked-by:
-
Florian Westphal authored
This adds support for TIMESTAMP(NS) setsockopt. This doesn't make things work yet, because the mptcp receive path doesn't convert the skb timestamps to cmsgs for userspace consumption. receive path cmsg support is added ina followup patch. Acked-by:
-
Florian Westphal authored
Similar to previous patch: expose SO_TIMESTAMPING helper so we do not have to copy & paste this into the mptcp core. Acked-by:
-
Florian Westphal authored
This exports SO_TIMESTAMP_* function for re-use by MPTCP. Without this there is too much copy & paste needed to support this from mptcp setsockopt path. Acked-by:
-
Muhammad Husaini Zulkifli authored
Add HW VLAN acceleration protocol handling. In case of HW VLAN tagging, we need that protocol available in the ndo_start_xmit(), so that it will be stored in a new fields in the skb. HW offloading is set to OFF by default. Users are allow to turn on/off Rx/Tx HW VLAN acceleration via ethtool. Signed-off-by:
Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com> Tested-by:
Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com> Acked-by:
Sasha Neftin <sasha.neftin@intel.com> Signed-off-by:
Tony Nguyen <anthony.l.nguyen@intel.com>
-
Sasha Neftin authored
Minor fix of indentation in igc_defines.h Signed-off-by:
-
Sasha Neftin authored
The MDICNFG register from igc registers is not used so remove it. Signed-off-by:
-
Sasha Neftin authored
The CR_1000T_ASYM_PAUSE bit from igc defines is not used so remove it. Signed-off-by:
-
Sasha Neftin authored
Complete to commit c8d4725e ("intel: Update drivers to use ethtool_sprintf") Update the igc driver to make use of ethtool_sprintf. The general idea is to reduce code size and overhead by replacing the repeated pattern of string printf statements and ETH_STRING_LEN counter increments. Suggested-by:
Alexander Duyck <alexanderduyck@fb.com> Signed-off-by:
-
- 03 Jun, 2021 1 commit
-
-
Colin Ian King authored
The comparison of len < 0 is always false because len is a size_t. Fix this by making len a ssize_t instead. Addresses-Coverity: ("Unsigned compared against 0") Fixes: d3953819 ("netdevsim: Add max_vfs to bus_dev") Signed-off-by:
-
