summaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)Author
2014-06-20Merge remote-tracking branch 'remotes/fsl-linux-sdk/imx_3.10.y' into ↵Ke Qinghua
imx_3.10.y_android Conflicts: arch/arm/boot/dts/Makefile arch/arm/boot/dts/imx6sx.dtsi arch/arm/mach-imx/clk-imx6sx.c arch/arm/mach-imx/mach-imx6sx.c drivers/dma/pxp/pxp_dma_v2.c drivers/media/platform/mxc/capture/csi_v4l2_capture.c drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.c drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.h drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_vg.c drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_video_memory.c drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform.h drivers/pwm/pwm-imx.c include/dt-bindings/clock/imx6sx-clock.h
2014-06-13net: Add a software TSO helper APIEzequiel Garcia
Although the implementation probably needs a lot of work, this initial API allows to implement software TSO in mvneta and mv643xx_eth drivers in a not so intrusive way. Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
2014-05-30Merge remote-tracking branch 'remotes/google/android-3.10' into ↵Ke Qinghua
imx_3.10.y_android Conflicts: arch/arm/common/Kconfig arch/arm/common/Makefile arch/arm/mm/mmu.c drivers/input/Kconfig drivers/input/Makefile drivers/input/evdev.c drivers/input/keyreset.c drivers/input/misc/gpio_event.c drivers/of/fdt.c drivers/staging/android/Kconfig drivers/staging/android/Makefile drivers/staging/android/ion/Kconfig drivers/staging/android/ion/Makefile drivers/staging/android/ion/ion.c drivers/usb/gadget/android.c drivers/usb/phy/Kconfig drivers/usb/phy/Makefile drivers/video/Kconfig drivers/video/adf/adf.c drivers/video/adf/adf_memblock.c include/linux/keyreset.h include/linux/mm_types.h include/linux/wakelock.h include/net/tcp.h include/uapi/linux/prctl.h include/video/adf_fbdev.h kernel/cpu.c kernel/futex.c kernel/power/Kconfig kernel/power/Makefile kernel/power/wakeup_reason.c kernel/sys.c net/ipv4/ping.c net/ipv4/sysctl_net_ipv4.c net/ipv6/ping.c net/ipv6/route.c net/netfilter/xt_IDLETIMER.c
2014-05-18net: Fix "ip rule delete table 256"Andreas Henriksson
[ Upstream commit 13eb2ab2d33c57ebddc57437a7d341995fc9138c ] When trying to delete a table >= 256 using iproute2 the local table will be deleted. The table id is specified as a netlink attribute when it needs more then 8 bits and iproute2 then sets the table field to RT_TABLE_UNSPEC (0). Preconditions to matching the table id in the rule delete code doesn't seem to take the "table id in netlink attribute" into condition so the frh_get_table helper function never gets to do its job when matching against current rule. Use the helper function twice instead of peaking at the table value directly. Originally reported at: http://bugs.debian.org/724783 Reported-by: Nicolas HICHER <nhicher@avencall.com> Signed-off-by: Andreas Henriksson <andreas@fatal.se> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-16net: support marking accepting TCP socketsLorenzo Colitti
When using mark-based routing, sockets returned from accept() may need to be marked differently depending on the incoming connection request. This is the case, for example, if different socket marks identify different networks: a listening socket may want to accept connections from all networks, but each connection should be marked with the network that the request came in on, so that subsequent packets are sent on the correct network. This patch adds a sysctl to mark TCP sockets based on the fwmark of the incoming SYN packet. If enabled, and an unmarked socket receives a SYN, then the SYN packet's fwmark is written to the connection's inet_request_sock, and later written back to the accepted socket when the connection is established. If the socket already has a nonzero mark, then the behaviour is the same as it is today, i.e., the listening socket's fwmark is used. Black-box tested using user-mode linux: - IPv4/IPv6 SYN+ACK, FIN, etc. packets are routed based on the mark of the incoming SYN packet. - The socket returned by accept() is marked with the mark of the incoming SYN packet. - Tested with syncookies=1 and syncookies=2. Change-Id: I26bc1eceefd2c588d73b921865ab70e4645ade57 Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2014-05-16net: Use fwmark reflection in PMTU discovery.Lorenzo Colitti
Currently, routing lookups used for Path PMTU Discovery in absence of a socket or on unmarked sockets use a mark of 0. This causes PMTUD not to work when using routing based on netfilter fwmark mangling and fwmark ip rules, such as: iptables -j MARK --set-mark 17 ip rule add fwmark 17 lookup 100 This patch causes these route lookups to use the fwmark from the received ICMP error when the fwmark_reflect sysctl is enabled. This allows the administrator to make PMTUD work by configuring appropriate fwmark rules to mark the inbound ICMP packets. Black-box tested using user-mode linux by pointing different fwmarks at routing tables egressing on different interfaces, and using iptables mangling to mark packets inbound on each interface with the interface's fwmark. ICMPv4 and ICMPv6 PMTU discovery work as expected when mark reflection is enabled and fail when it is disabled. Change-Id: Id7fefb7ec1ff7f5142fba43db1960b050e0dfaec Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2014-05-16net: add a sysctl to reflect the fwmark on repliesLorenzo Colitti
Kernel-originated IP packets that have no user socket associated with them (e.g., ICMP errors and echo replies, TCP RSTs, etc.) are emitted with a mark of zero. Add a sysctl to make them have the same mark as the packet they are replying to. This allows an administrator that wishes to do so to use mark-based routing, firewalling, etc. for these replies by marking the original packets inbound. Tested using user-mode linux: - ICMP/ICMPv6 echo replies and errors. - TCP RST packets (IPv4 and IPv6). Change-Id: I6873d973196797bcf32e2e91976df647c7e8b85a Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2014-05-16net: ipv6: autoconf routes into per-device tablesLorenzo Colitti
Currently, IPv6 router discovery always puts routes into RT6_TABLE_MAIN. This causes problems for connection managers that want to support multiple simultaneous network connections and want control over which one is used by default (e.g., wifi and wired). To work around this connection managers typically take the routes they prefer and copy them to static routes with low metrics in the main table. This puts the burden on the connection manager to watch netlink to see if the routes have changed, delete the routes when their lifetime expires, etc. Instead, this patch adds a per-interface sysctl to have the kernel put autoconf routes into different tables. This allows each interface to have its own autoconf table, and choosing the default interface (or using different interfaces at the same time for different types of traffic) can be done using appropriate ip rules. The sysctl behaves as follows: - = 0: default. Put routes into RT6_TABLE_MAIN as before. - > 0: manual. Put routes into the specified table. - < 0: automatic. Add the absolute value of the sysctl to the device's ifindex, and use that table. The automatic mode is most useful in conjunction with net.ipv6.conf.default.accept_ra_rt_table. A connection manager or distribution could set it to, say, -100 on boot, and thereafter just use IP rules. Change-Id: I82d16e3737d9cdfa6489e649e247894d0d60cbb1 Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2014-05-16net: ipv6: ping: Use socket mark in routing lookupLorenzo Colitti
Change-Id: I5a61e0f9f22f193c51b1aafd270fb0642a2e0fab Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-24net: ipv4: current group_info should be put after using.Wang, Xiaoming
Plug a group_info refcount leak in ping_init. group_info is only needed during initialization and the code failed to release the reference on exit. While here move grabbing the reference to a place where it is actually needed. Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com> Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com> Signed-off-by: xiaoming wang <xiaoming.wang@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-24nf: Remove compilation error caused byRuchi Kandoi
e8430cbed3ef15fdb1ac26cfd020e010aa5f1c35 Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
2014-04-22nf: IDLETIMER: time-stamp and suspend/resume handling.Ruchi Kandoi
Message notifications contains an additional timestamp field in nano seconds. The expiry time for the timers are modified during suspend/resume. If timer was supposed to expire while the system is suspended then a notification is sent when it resumes with the timestamp of the scheduled expiry. Removes the race condition for multiple work scheduled. Bug: 13247811 Change-Id: I752c5b00225fe7085482819f975cc0eb5af89bff Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
2014-04-21netfilter: xt_qtaguid: 64-bit warning fixesGreg Hackmann
Change-Id: I2adc517c0c51050ed601992fa0ea4de8f1449414 Signed-off-by: Greg Hackmann <ghackmann@google.com>
2014-04-21tcp: add a sysctl to config the tcp_default_init_rwndJP Abgrall
The default initial rwnd is hardcoded to 10. Now we allow it to be controlled via /proc/sys/net/ipv4/tcp_default_init_rwnd which limits the values from 3 to 100 This is somewhat needed because ipv6 routes are autoconfigured by the kernel. See "An Argument for Increasing TCP's Initial Congestion Window" in https://developers.google.com/speed/articles/tcp_initcwnd_paper.pdf Change-Id: I386b2a9d62de0ebe05c1ebe1b4bd91b314af5c54 Signed-off-by: JP Abgrall <jpa@google.com> Conflicts: net/ipv4/sysctl_net_ipv4.c net/ipv4/tcp_input.c
2014-04-21netfilter: xt_IDLETIMER: Revert to retain the kernel API format.Ashish Sharma
Reverted Change-Id: Iaeca5dd2d7878c0733923ae03309a2a7b86979ca Change-Id: I0e0a4f60ec14330d8d8d1c5a508fa058d9919e07 Signed-off-by: Ashish Sharma <ashishsharma@google.com> (cherry picked from commit e0a4e5b0e808d718dd9af500c5754118fc3935db)
2014-04-21ping: prevent NULL pointer dereference on write to msg_nameHannes Frederic Sowa
A plain read() on a socket does set msg->msg_name to NULL. So check for NULL pointer first. [Backport of net-next cf970c002d270c36202bd5b9c2804d3097a52da0] Bug: 12780426 Change-Id: I3df76aca2fa56478b9a33c404f7b1f0940475ef7 Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
2014-04-21net: ipv6: add missing lock in ping_v6_sendmsgLorenzo Colitti
[net-next commit a1bdc45580fc19e968b32ad27cd7e476a4aa58f6] Bug: 12800827 Change-Id: I93d897e5043dc89bc99f111c89ef4f8b1fa1885d Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-21net: ipv6: fix wrong ping_v6_sendmsg return valueLorenzo Colitti
[net-next commit fbfe80c890a1dc521d0b629b870e32fcffff0da5] ping_v6_sendmsg currently returns 0 on success. It should return the number of bytes written instead. Bug: 12800827 Change-Id: I7ed17dc61afbb68a84908e67e44db976ec812bad Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-21ping: always initialize ->sin6_scope_id and ->sin6_flowinfoCong Wang
[net-next commit c26d6b46da3ee86fa8a864347331e5513ca84c2b] If we don't need scope id, we should initialize it to zero. Same for ->sin6_flowinfo. Bug: 12800827 Change-Id: Ic19792cee3f5dc30237562cf48e6bdf49817c96e Cc: Lorenzo Colitti <lorenzo@google.com> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Cong Wang <amwang@redhat.com> Acked-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-21net: ipv6: Add IPv6 support to the ping socket.Lorenzo Colitti
[net-next commit 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67] This adds the ability to send ICMPv6 echo requests without a raw socket. The equivalent ability for ICMPv4 was added in 2011. Instead of having separate code paths for IPv4 and IPv6, make most of the code in net/ipv4/ping.c dual-stack and only add a few IPv6-specific bits (like the protocol definition) to a new net/ipv6/ping.c. Hopefully this will reduce divergence and/or duplication of bugs in the future. Caveats: - Setting options via ancillary data (e.g., using IPV6_PKTINFO to specify the outgoing interface) is not yet supported. - There are no separate security settings for IPv4 and IPv6; everything is controlled by /proc/net/ipv4/ping_group_range. - The proc interface does not yet display IPv6 ping sockets properly. Tested with a patched copy of ping6 and using raw socket calls. Compiles and works with all of CONFIG_IPV6={n,m,y}. Bug: 12800827 Change-Id: I718cd9931823873ab44df22e8a66e12d6a0a6eb1 Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-21netfilter: xt_qtaguid: fix memory leak in seq_file handlersGreg Hackmann
Change-Id: I15b21230d52479d008a00d9e2191dda020f00925 Signed-off-by: Greg Hackmann <ghackmann@google.com>
2014-04-21netfilter: xt_qtaguid: 3.10 fixesArve Hjønnevåg
Stop using obsolete procfs api. Signed-off-by: Arve Hjønnevåg <arve@android.com>
2014-04-21netfilter: xt_quota2: 3.10 fixes.Arve Hjønnevåg
- Stop using obsolete create_proc_entry api. - Use proc_set_user instead of directly accessing the private structure. Signed-off-by: Arve Hjønnevåg <arve@android.com>
2014-04-21net: activity_stats: Stop using obsolete create_proc_read_entry apiArve Hjønnevåg
Convert to use seq_read Signed-off-by: Arve Hjønnevåg <arve@android.com>
2014-04-21netfilter: xt_qtaguid: fix bad tcp_time_wait sock handlingJP Abgrall
Since (41063e9 ipv4: Early TCP socket demux), skb's can have an sk which is not a struct sock but the smaller struct inet_timewait_sock without an sk->sk_socket. Now we bypass sk_state == TCP_TIME_WAIT Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21af_unix: use freezable blocking calls in readColin Cross
Avoid waking up every thread sleeping in read call on an AF_UNIX socket during suspend and resume by calling a freezable blocking call. Previous patches modified the freezer to avoid sending wakeups to threads that are blocked in freezable blocking calls. This call was selected to be converted to a freezable call because it doesn't hold any locks or release any resources when interrupted that might be needed by another freezing task or a kernel driver during suspend, and is a common site where idle userspace tasks are blocked. Change-Id: I788246a76780ea892659526e70be018b18f646c4 Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Colin Cross <ccross@android.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21freezer: add unsafe versions of freezable helpers for NFSColin Cross
NFS calls the freezable helpers with locks held, which is unsafe and will cause lockdep warnings when 6aa9707 "lockdep: check that no locks held at freeze time" is reapplied (it was reverted in dbf520a). NFS shouldn't be doing this, but it has long-running syscalls that must hold a lock but also shouldn't block suspend. Until NFS freeze handling is rewritten to use a signal to exit out of the critical section, add new *_unsafe versions of the helpers that will not run the lockdep test when 6aa9707 is reapplied, and call them from NFS. In practice the likley result of holding the lock while freezing is that a second task blocked on the lock will never freeze, aborting suspend, but it is possible to manufacture a case using the cgroup freezer, the lock, and the suspend freezer to create a deadlock. Silencing the lockdep warning here will allow problems to be found in other drivers that may have a more serious deadlock risk, and prevent new problems from being added. Change-Id: Ia17d32cdd013a6517bdd5759da900970a4427170 Signed-off-by: Colin Cross <ccross@android.com> Acked-by: Pavel Machek <pavel@ucw.cz> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-21netfilter: qtaguid: rate limit some of the printksJP Abgrall
Some of the printks are in the packet handling path. We now ratelimit the very unlikely errors to avoid kmsg spamming. Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21net: bluetooth: Remove the AID_NET_BT* gid numbersJP Abgrall
Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN which are not useful anymore. This is in preparation for getting rid of all the AID_* gids. Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: xt_qtaguid: Allow tracking loopbackJP Abgrall
In the past it would always ignore interfaces with loopback addresses. Now we just treat them like any other. This also helps with writing tests that check for the presence of the qtaguid module. Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: xt_qtaguid: extend iface stat to report protocolsJP Abgrall
In the past the iface_stat_fmt would only show global bytes/packets for the skb-based numbers. For stall detection in userspace, distinguishing tcp vs other protocols makes it easier. Now we report ifname total_skb_rx_bytes total_skb_rx_packets total_skb_tx_bytes total_skb_tx_packets {rx,tx}_{tcp,udp,ohter}_{bytes,packets} Bug: 6818637 Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: xt_qtaguid: remove AID_* dependency for access controlJP Abgrall
qtaguid limits what can be done with /ctrl and /stats based on group membership. This changes removes AID_NET_BW_STATS and AID_NET_BW_ACCT, and picks up the groups from the gid of the matching proc entry files. Signed-off-by: JP Abgrall <jpa@google.com> Change-Id: I42e477adde78a12ed5eb58fbc0b277cdaadb6f94
2014-04-21netfilter: qtaguid: Don't BUG_ON if create_if_tag_stat failsPontus Fuchs
If create_if_tag_stat fails to allocate memory (GFP_ATOMIC) the following will happen: qtaguid: iface_stat: tag stat alloc failed ... kernel BUG at xt_qtaguid.c:1482! Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
2014-04-21netfilter: xt_qtaguid: fix error exit that would keep a spinlock.JP Abgrall
qtudev_open() could return with a uid_tag_data_tree_lock held when an kzalloc(..., GFP_ATOMIC) would fail. Very unlikely to get triggered AND survive the mayhem of running out of mem. Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: xt_qtaguid: report only uid tags to non-privileged processesJP Abgrall
In the past, a process could only see its own stats (uid-based summary, and details). Now we allow any process to see other UIDs uid-based stats, but still hide the detailed stats. Change-Id: I7666961ed244ac1d9359c339b048799e5db9facc Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: xt_IDLETIMER: Rename INTERFACE to LABEL in netlink notification.Ashish Sharma
Change-Id: Iaeca5dd2d7878c0733923ae03309a2a7b86979ca Signed-off-by: Ashish Sharma <ashishsharma@google.com>
2014-04-21netfilter: xt_qtaguid: start tracking iface rx/tx at low levelJP Abgrall
qtaguid tracks the device stats by monitoring when it goes up and down, then it gets the dev_stats(). But devs don't correctly report stats (either they don't count headers symmetrically between rx/tx, or they count internal control messages). Now qtaguid counts the rx/tx bytes/packets during raw:prerouting and mangle:postrouting (nat is not available in ipv6). The results are in /proc/net/xt_qtaguid/iface_stat_fmt which outputs a format line (bash expansion): ifname total_skb_{rx,tx}_{bytes,packets} Added event counters for pre/post handling. Added extra ctrl_*() pid/uid debugging. Change-Id: Id84345d544ad1dd5f63e3842cab229e71d339297 Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: xt_IDLETIMER: Add new netlink msg typeJP Abgrall
Send notifications when the label becomes active after an idle period. Send netlink message notifications in addition to sysfs notifications. Using a uevent with subsystem=xt_idletimer INTERFACE=... STATE={active,inactive} This is backport from common android-3.0 commit: beb914e987cbbd368988d2b94a6661cb907c4d5a with uevent support instead of a new netlink message type. Change-Id: I31677ef00c94b5f82c8457e5bf9e5e584c23c523 Signed-off-by: Ashish Sharma <ashishsharma@google.com> Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: xt_qtaguid: fix ipv6 protocol lookupJP Abgrall
When updating the stats for a given uid it would incorrectly assume IPV4 and pick up the wrong protocol when IPV6. Change-Id: Iea4a635012b4123bf7aa93809011b7b2040bb3d5 Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: qtaguid: initialize a local var to keep compiler happy.JP Abgrall
There was a case that might have seemed like new_tag_stat was not initialized and actually used. Added comment explaining why it was impossible, and a BUG() in case the logic gets changed. Change-Id: I1eddd1b6f754c08a3bf89f7e9427e5dce1dfb081 Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21bridge: Have tx_bytes count headers like rx_bytes.Ashish Sharma
Since rx_bytes accounting does not include Ethernet Headers in br_input.c, excluding ETH_HLEN on the transmit path for consistent measurement of packet length on both the Tx and Rx chains. The clean way would be for Rx to include the eth header, but the skb len has already been adjusted by the time the br code sees the skb. This is only a temporary workaround until we can completely ignore or cleanly fix the skb->len handling. Change-Id: I910de95a4686b2119da7f1f326e2154ef31f9972 Signed-off-by: Ashish Sharma <ashishsharma@google.com>
2014-04-21netfilter: ipv6: fix crash caused by ipv6_find_hdr()JP Abgrall
When calling: ipv6_find_hdr(skb, &thoff, -1, NULL) on a fragmented packet, thoff would be left with a random value causing callers to read random memory offsets with: skb_header_pointer(skb, thoff, ...) Now we force ipv6_find_hdr() to return a failure in this case. Calling: ipv6_find_hdr(skb, &thoff, -1, &fragoff) will set fragoff as expected, and not return a failure. Change-Id: Ib474e8a4267dd2b300feca325811330329684a88 Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: fixup the quota2, and enable.JP Abgrall
The xt_quota2 came from http://sourceforge.net/projects/xtables-addons/develop It needed tweaking for it to compile within the kernel tree. Fixed kmalloc() and create_proc_entry() invocations within a non-interruptible context. Removed useless copying of current quota back to the iptable's struct matchinfo: - those are per CPU: they will change randomly based on which cpu gets to update the value. - they prevent matching a rule: e.g. -A chain -m quota2 --name q1 --quota 123 can't be followed by -D chain -m quota2 --name q1 --quota 123 as the 123 will be compared to the struct matchinfo's quota member. Use the NETLINK NETLINK_NFLOG family to log a single message when the quota limit is reached. It uses the same packet type as ipt_ULOG, but - never copies skb data, - uses 112 as the event number (ULOG's +1) It doesn't log if the module param "event_num" is 0. Change-Id: I021d3b743db3b22158cc49acb5c94d905b501492 Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: adding the original quota2 from xtables-addonsJP Abgrall
The original xt_quota in the kernel is plain broken: - counts quota at a per CPU level (was written back when ubiquitous SMP was just a dream) - provides no way to count across IPV4/IPV6. This patch is the original unaltered code from: http://sourceforge.net/projects/xtables-addons at commit e84391ce665cef046967f796dd91026851d6bbf3 Change-Id: I19d49858840effee9ecf6cff03c23b45a97efdeb Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: have ip*t REJECT set the sock err when an icmp is to be sentJP Abgrall
Allow the REJECT --reject-with icmp*blabla to also set the matching error locally on the socket affected by the reject. This allows the process to see an error almost as if it received it via ICMP. It avoids the local process who's ingress packet is rejected to have to wait for a pseudo-eternity until some timeout kicks in. Ideally, this should be enabled with a new iptables flag similar to --reject-with-sock-err For now it is enabled with CONFIG_IP*_NF_TARGET_REJECT_SKERR option. Change-Id: I649a4fd5940029ec0b3233e5abb205da6984891e Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21netfilter: add xt_qtaguid matching moduleJP Abgrall
This module allows tracking stats at the socket level for given UIDs. It replaces xt_owner. If the --uid-owner is not specified, it will just count stats based on who the skb belongs to. This will even happen on incoming skbs as it looks into the skb via xt_socket magic to see who owns it. If an skb is lost, it will be assigned to uid=0. To control what sockets of what UIDs are tagged by what, one uses: echo t $sock_fd $accounting_tag $the_billed_uid \ > /proc/net/xt_qtaguid/ctrl So whenever an skb belongs to a sock_fd, it will be accounted against $the_billed_uid and matching stats will show up under the uid with the given $accounting_tag. Because the number of allocations for the stats structs is not that big: ~500 apps * 32 per app we'll just do it atomic. This avoids walking lists many times, and the fancy worker thread handling. Slabs will grow when needed later. It use netdevice and inetaddr notifications instead of hooks in the core dev code to track when a device comes and goes. This removes the need for exposed iface_stat.h. Put procfs dirs in /proc/net/xt_qtaguid/ ctrl stats iface_stat/<iface>/... The uid stats are obtainable in ./stats. Change-Id: I01af4fd91c8de651668d3decb76d9bdc1e343919 Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21nf: xt_socket: export the fancy sock finder codeJP Abgrall
The socket matching function has some nifty logic to get the struct sock from the skb or from the connection tracker. We export this so other xt_* can use it, similarly to ho how xt_socket uses nf_tproxy_get_sock. Change-Id: I11c58f59087e7f7ae09e4abd4b937cd3370fa2fd Signed-off-by: JP Abgrall <jpa@google.com>
2014-04-21net: wireless: Skip connect warning for CONFIG_CFG80211_ALLOW_RECONNECTDmitry Shmidt
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2014-04-21net: wireless: Fix CFG80211_ALLOW_RECONNECT option for disconnectDmitry Shmidt
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2014-04-21net: wireless: Add CFG80211_ALLOW_RECONNECT optionDmitry Shmidt
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-26 22:56:32 +0000