lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Browse Source
This commit is contained in:
Linus Torvalds
2006-02-27 15:22:14 -08:00
parent 051d3cbd96 ba13c98405
commit 272a5322d5
11 changed files with 109 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/netfilter_bridge/ebt_log.h
View File

@@ -3,6 +3,7 @@
#define EBT_LOG_IP 0x01 /* if the frame is made by ip, log the ip information */ #define EBT_LOG_IP 0x01 /* if the frame is made by ip, log the ip information */
#define EBT_LOG_ARP 0x02 #define EBT_LOG_ARP 0x02
#define EBT_LOG_NFLOG 0x04
#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP) #define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP)
#define EBT_LOG_PREFIX_SIZE 30 #define EBT_LOG_PREFIX_SIZE 30
#define EBT_LOG_WATCHER "log" #define EBT_LOG_WATCHER "log"

3
include/linux/netfilter_ipv4/ipt_LOG.h
View File

@@ -6,7 +6,8 @@
#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ #define IPT_LOG_TCPOPT 0x02 /* Log TCP options */
#define IPT_LOG_IPOPT 0x04 /* Log IP options */ #define IPT_LOG_IPOPT 0x04 /* Log IP options */
#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ #define IPT_LOG_UID 0x08 /* Log UID owning local socket */
#define IPT_LOG_MASK 0x0f #define IPT_LOG_NFLOG 0x10 /* Log using nf_log backend */
#define IPT_LOG_MASK 0x1f
struct ipt_log_info { struct ipt_log_info {
unsigned char level; unsigned char level;

3
include/linux/netfilter_ipv6/ip6t_LOG.h
View File

@@ -6,7 +6,8 @@
#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ #define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */
#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ #define IP6T_LOG_IPOPT 0x04 /* Log IP options */
#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ #define IP6T_LOG_UID 0x08 /* Log UID owning local socket */
#define IP6T_LOG_MASK 0x0f #define IP6T_LOG_NFLOG 0x10 /* Log using nf_log backend */
#define IP6T_LOG_MASK 0x1f
struct ip6t_log_info { struct ip6t_log_info {
unsigned char level; unsigned char level;

1
include/net/xfrm.h
View File

@@ -233,7 +233,6 @@ struct xfrm_type
int (*init_state)(struct xfrm_state *x); int (*init_state)(struct xfrm_state *x);
void (*destructor)(struct xfrm_state *); void (*destructor)(struct xfrm_state *);
int (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb); int (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
int (*post_input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
int (*output)(struct xfrm_state *, struct sk_buff *pskb); int (*output)(struct xfrm_state *, struct sk_buff *pskb);
/* Estimate maximal size of result of transformation of a dgram */ /* Estimate maximal size of result of transformation of a dgram */
u32 (*get_max_size)(struct xfrm_state *, int size); u32 (*get_max_size)(struct xfrm_state *, int size);

7
net/bridge/netfilter/ebt_log.c
View File

@@ -166,7 +166,12 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
li.u.log.level = info->loglevel; li.u.log.level = info->loglevel;
li.u.log.logflags = info->bitmask; li.u.log.logflags = info->bitmask;
nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li, info->prefix); if (info->bitmask & EBT_LOG_NFLOG)
nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
info->prefix);
else
ebt_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
info->prefix);
} }
static struct ebt_watcher log = static struct ebt_watcher log =

1
net/core/request_sock.c
View File

@@ -52,7 +52,6 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd)); get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd));
rwlock_init(&queue->syn_wait_lock); rwlock_init(&queue->syn_wait_lock);
queue->rskq_accept_head = queue->rskq_accept_head = NULL; queue->rskq_accept_head = queue->rskq_accept_head = NULL;
queue->rskq_defer_accept = 0;
lopt->nr_table_entries = nr_table_entries; lopt->nr_table_entries = nr_table_entries;
write_lock_bh(&queue->syn_wait_lock); write_lock_bh(&queue->syn_wait_lock);

109
net/ipv4/esp4.c
View File

@@ -12,13 +12,6 @@
#include <net/protocol.h> #include <net/protocol.h>
#include <net/udp.h> #include <net/udp.h>
/* decapsulation data for use when post-processing */
struct esp_decap_data {
xfrm_address_t saddr;
__u16 sport;
__u8 proto;
};
static int esp_output(struct xfrm_state *x, struct sk_buff *skb) static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
{ {
int err; int err;
@@ -150,6 +143,10 @@ static int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
int elen = skb->len - sizeof(struct ip_esp_hdr) - esp->conf.ivlen - alen; int elen = skb->len - sizeof(struct ip_esp_hdr) - esp->conf.ivlen - alen;
int nfrags; int nfrags;
int encap_len = 0; int encap_len = 0;
u8 nexthdr[2];
struct scatterlist *sg;
u8 workbuf[60];
int padlen;
if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr))) if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr)))
goto out; goto out;
@@ -185,11 +182,7 @@ static int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
if (esp->conf.ivlen) if (esp->conf.ivlen)
crypto_cipher_set_iv(esp->conf.tfm, esph->enc_data, crypto_tfm_alg_ivsize(esp->conf.tfm)); crypto_cipher_set_iv(esp->conf.tfm, esph->enc_data, crypto_tfm_alg_ivsize(esp->conf.tfm));
{ sg = &esp->sgbuf[0];
u8 nexthdr[2];
struct scatterlist *sg = &esp->sgbuf[0];
u8 workbuf[60];
int padlen;
if (unlikely(nfrags > ESP_NUM_FAST_SG)) { if (unlikely(nfrags > ESP_NUM_FAST_SG)) {
sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC); sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
@@ -210,73 +203,28 @@ static int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
/* ... check padding bits here. Silly. :-) */ /* ... check padding bits here. Silly. :-) */
if (x->encap && decap && decap->decap_type) {
struct esp_decap_data *encap_data;
struct udphdr *uh = (struct udphdr *) (iph+1);
encap_data = (struct esp_decap_data *) (decap->decap_data);
encap_data->proto = 0;
switch (decap->decap_type) {
case UDP_ENCAP_ESPINUDP:
case UDP_ENCAP_ESPINUDP_NON_IKE:
encap_data->proto = AF_INET;
encap_data->saddr.a4 = iph->saddr;
encap_data->sport = uh->source;
encap_len = (void*)esph - (void*)uh;
break;
default:
goto out;
}
}
iph->protocol = nexthdr[1];
pskb_trim(skb, skb->len - alen - padlen - 2);
memcpy(workbuf, skb->nh.raw, iph->ihl*4);
skb->h.raw = skb_pull(skb, sizeof(struct ip_esp_hdr) + esp->conf.ivlen);
skb->nh.raw += encap_len + sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
memcpy(skb->nh.raw, workbuf, iph->ihl*4);
skb->nh.iph->tot_len = htons(skb->len);
}
return 0;
out:
return -EINVAL;
}
static int esp_post_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
{
if (x->encap) { if (x->encap) {
struct xfrm_encap_tmpl *encap; struct xfrm_encap_tmpl *encap = x->encap;
struct esp_decap_data *decap_data; struct udphdr *uh;
encap = x->encap;
decap_data = (struct esp_decap_data *)(decap->decap_data);
/* first, make sure that the decap type == the encap type */
if (encap->encap_type != decap->decap_type) if (encap->encap_type != decap->decap_type)
return -EINVAL; goto out;
uh = (struct udphdr *)(iph + 1);
encap_len = (void*)esph - (void*)uh;
switch (encap->encap_type) {
default:
case UDP_ENCAP_ESPINUDP:
case UDP_ENCAP_ESPINUDP_NON_IKE:
/* /*
* 1) if the NAT-T peer's IP or port changed then * 1) if the NAT-T peer's IP or port changed then
* advertize the change to the keying daemon. * advertize the change to the keying daemon.
* This is an inbound SA, so just compare * This is an inbound SA, so just compare
* SRC ports. * SRC ports.
*/ */
if (decap_data->proto == AF_INET && if (iph->saddr != x->props.saddr.a4 ||
(decap_data->saddr.a4 != x->props.saddr.a4 || uh->source != encap->encap_sport) {
decap_data->sport != encap->encap_sport)) {
xfrm_address_t ipaddr; xfrm_address_t ipaddr;
ipaddr.a4 = decap_data->saddr.a4; ipaddr.a4 = iph->saddr;
km_new_mapping(x, &ipaddr, decap_data->sport); km_new_mapping(x, &ipaddr, uh->source);
/* XXX: perhaps add an extra /* XXX: perhaps add an extra
* policy check here, to see * policy check here, to see
@@ -291,16 +239,25 @@ static int esp_post_input(struct xfrm_state *x, struct xfrm_decap_state *decap,
* 2) ignore UDP/TCP checksums in case * 2) ignore UDP/TCP checksums in case
* of NAT-T in Transport Mode, or * of NAT-T in Transport Mode, or
* perform other post-processing fixes * perform other post-processing fixes
* as per * draft-ietf-ipsec-udp-encaps-06, * as per draft-ietf-ipsec-udp-encaps-06,
* section 3.1.2 * section 3.1.2
*/ */
if (!x->props.mode) if (!x->props.mode)
skb->ip_summed = CHECKSUM_UNNECESSARY; skb->ip_summed = CHECKSUM_UNNECESSARY;
}
iph->protocol = nexthdr[1];
pskb_trim(skb, skb->len - alen - padlen - 2);
memcpy(workbuf, skb->nh.raw, iph->ihl*4);
skb->h.raw = skb_pull(skb, sizeof(struct ip_esp_hdr) + esp->conf.ivlen);
skb->nh.raw += encap_len + sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
memcpy(skb->nh.raw, workbuf, iph->ihl*4);
skb->nh.iph->tot_len = htons(skb->len);
break;
}
}
return 0; return 0;
out:
return -EINVAL;
} }
static u32 esp4_get_max_size(struct xfrm_state *x, int mtu) static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
@@ -458,7 +415,6 @@ static struct xfrm_type esp_type =
.destructor = esp_destroy, .destructor = esp_destroy,
.get_max_size = esp4_get_max_size, .get_max_size = esp4_get_max_size,
.input = esp_input, .input = esp_input,
.post_input = esp_post_input,
.output = esp_output .output = esp_output
}; };
@@ -470,15 +426,6 @@ static struct net_protocol esp4_protocol = {
static int __init esp4_init(void) static int __init esp4_init(void)
{ {
struct xfrm_decap_state decap;
if (sizeof(struct esp_decap_data) >
sizeof(decap.decap_data)) {
extern void decap_data_too_small(void);
decap_data_too_small();
}
if (xfrm_register_type(&esp_type, AF_INET) < 0) { if (xfrm_register_type(&esp_type, AF_INET) < 0) {
printk(KERN_INFO "ip esp init: can't add xfrm type\n"); printk(KERN_INFO "ip esp init: can't add xfrm type\n");
return -EAGAIN; return -EAGAIN;

7
net/ipv4/netfilter/ipt_LOG.c
View File

@@ -425,7 +425,12 @@ ipt_log_target(struct sk_buff **pskb,
li.u.log.level = loginfo->level; li.u.log.level = loginfo->level;
li.u.log.logflags = loginfo->logflags; li.u.log.logflags = loginfo->logflags;
nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li, loginfo->prefix); if (loginfo->logflags & IPT_LOG_NFLOG)
nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
loginfo->prefix);
else
ipt_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
loginfo->prefix);
return IPT_CONTINUE; return IPT_CONTINUE;
} }

7
net/ipv6/netfilter/ip6t_LOG.c
View File

@@ -436,7 +436,12 @@ ip6t_log_target(struct sk_buff **pskb,
li.u.log.level = loginfo->level; li.u.log.level = loginfo->level;
li.u.log.logflags = loginfo->logflags; li.u.log.logflags = loginfo->logflags;
nf_log_packet(PF_INET6, hooknum, *pskb, in, out, &li, loginfo->prefix); if (loginfo->logflags & IP6T_LOG_NFLOG)
nf_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
loginfo->prefix);
else
ip6t_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
loginfo->prefix);
return IP6T_CONTINUE; return IP6T_CONTINUE;
} }

42
net/netfilter/nf_queue.c
View File

@@ -6,6 +6,7 @@
#include <linux/skbuff.h> #include <linux/skbuff.h>
#include <linux/netfilter.h> #include <linux/netfilter.h>
#include <linux/seq_file.h> #include <linux/seq_file.h>
#include <linux/rcupdate.h>
#include <net/protocol.h> #include <net/protocol.h>
#include "nf_internals.h" #include "nf_internals.h"
@@ -16,7 +17,7 @@
* for queueing and must reinject all packets it receives, no matter what. * for queueing and must reinject all packets it receives, no matter what.
*/ */
static struct nf_queue_handler *queue_handler[NPROTO]; static struct nf_queue_handler *queue_handler[NPROTO];
static struct nf_queue_rerouter *queue_rerouter; static struct nf_queue_rerouter *queue_rerouter[NPROTO];
static DEFINE_RWLOCK(queue_handler_lock); static DEFINE_RWLOCK(queue_handler_lock);
@@ -64,7 +65,7 @@ int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer)
return -EINVAL; return -EINVAL;
write_lock_bh(&queue_handler_lock); write_lock_bh(&queue_handler_lock);
memcpy(&queue_rerouter[pf], rer, sizeof(queue_rerouter[pf])); rcu_assign_pointer(queue_rerouter[pf], rer);
write_unlock_bh(&queue_handler_lock); write_unlock_bh(&queue_handler_lock);
return 0; return 0;
@@ -77,8 +78,9 @@ int nf_unregister_queue_rerouter(int pf)
return -EINVAL; return -EINVAL;
write_lock_bh(&queue_handler_lock); write_lock_bh(&queue_handler_lock);
memset(&queue_rerouter[pf], 0, sizeof(queue_rerouter[pf])); rcu_assign_pointer(queue_rerouter[pf], NULL);
write_unlock_bh(&queue_handler_lock); write_unlock_bh(&queue_handler_lock);
synchronize_rcu();
return 0; return 0;
} }
EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter); EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);
@@ -114,16 +116,17 @@ int nf_queue(struct sk_buff **skb,
struct net_device *physindev = NULL; struct net_device *physindev = NULL;
struct net_device *physoutdev = NULL; struct net_device *physoutdev = NULL;
#endif #endif
struct nf_queue_rerouter *rerouter;
/* QUEUE == DROP if noone is waiting, to be safe. */ /* QUEUE == DROP if noone is waiting, to be safe. */
read_lock(&queue_handler_lock); read_lock(&queue_handler_lock);
if (!queue_handler[pf] || !queue_handler[pf]->outfn) { if (!queue_handler[pf]) {
read_unlock(&queue_handler_lock); read_unlock(&queue_handler_lock);
kfree_skb(*skb); kfree_skb(*skb);
return 1; return 1;
} }
info = kmalloc(sizeof(*info)+queue_rerouter[pf].rer_size, GFP_ATOMIC); info = kmalloc(sizeof(*info)+queue_rerouter[pf]->rer_size, GFP_ATOMIC);
if (!info) { if (!info) {
if (net_ratelimit()) if (net_ratelimit())
printk(KERN_ERR "OOM queueing packet %p\n", printk(KERN_ERR "OOM queueing packet %p\n",
@@ -155,15 +158,13 @@ int nf_queue(struct sk_buff **skb,
if (physoutdev) dev_hold(physoutdev); if (physoutdev) dev_hold(physoutdev);
} }
#endif #endif
if (queue_rerouter[pf].save) rerouter = rcu_dereference(queue_rerouter[pf]);
queue_rerouter[pf].save(*skb, info); if (rerouter)
rerouter->save(*skb, info);
status = queue_handler[pf]->outfn(*skb, info, queuenum, status = queue_handler[pf]->outfn(*skb, info, queuenum,
queue_handler[pf]->data); queue_handler[pf]->data);
if (status >= 0 && queue_rerouter[pf].reroute)
status = queue_rerouter[pf].reroute(skb, info);
read_unlock(&queue_handler_lock); read_unlock(&queue_handler_lock);
if (status < 0) { if (status < 0) {
@@ -189,6 +190,7 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
{ {
struct list_head *elem = &info->elem->list; struct list_head *elem = &info->elem->list;
struct list_head *i; struct list_head *i;
struct nf_queue_rerouter *rerouter;
rcu_read_lock(); rcu_read_lock();
@@ -212,7 +214,7 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
break; break;
} }
if (elem == &nf_hooks[info->pf][info->hook]) { if (i == &nf_hooks[info->pf][info->hook]) {
/* The module which sent it to userspace is gone. */ /* The module which sent it to userspace is gone. */
NFDEBUG("%s: module disappeared, dropping packet.\n", NFDEBUG("%s: module disappeared, dropping packet.\n",
__FUNCTION__); __FUNCTION__);
@@ -225,6 +227,12 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
verdict = NF_ACCEPT; verdict = NF_ACCEPT;
} }
if (verdict == NF_ACCEPT) {
rerouter = rcu_dereference(queue_rerouter[info->pf]);
if (rerouter && rerouter->reroute(&skb, info) < 0)
verdict = NF_DROP;
}
if (verdict == NF_ACCEPT) { if (verdict == NF_ACCEPT) {
next_hook: next_hook:
verdict = nf_iterate(&nf_hooks[info->pf][info->hook], verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
@@ -322,22 +330,12 @@ int __init netfilter_queue_init(void)
{ {
#ifdef CONFIG_PROC_FS #ifdef CONFIG_PROC_FS
struct proc_dir_entry *pde; struct proc_dir_entry *pde;
#endif
queue_rerouter = kmalloc(NPROTO * sizeof(struct nf_queue_rerouter),
GFP_KERNEL);
if (!queue_rerouter)
return -ENOMEM;
#ifdef CONFIG_PROC_FS
pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter); pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter);
if (!pde) { if (!pde)
kfree(queue_rerouter);
return -1; return -1;
}
pde->proc_fops = &nfqueue_file_ops; pde->proc_fops = &nfqueue_file_ops;
#endif #endif
memset(queue_rerouter, 0, NPROTO * sizeof(struct nf_queue_rerouter));
return 0; return 0;
} }

7
net/xfrm/xfrm_policy.c
View File

@@ -996,13 +996,6 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
struct sec_decap_state *xvec = &(skb->sp->x[i]); struct sec_decap_state *xvec = &(skb->sp->x[i]);
if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family)) if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family))
return 0; return 0;
/* If there is a post_input processor, try running it */
if (xvec->xvec->type->post_input &&
(xvec->xvec->type->post_input)(xvec->xvec,
&(xvec->decap),
skb) != 0)
return 0;
} }
} }