-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJXwrqoAAoJEE44bZycYXAvXY0P/0ggO2AAwJONCzFgBk3yZKi1
aHiSvhq4JLkFnHk3KRQJwBqAPzDkc9C41If65RTZcNwdczzPMVRBxpzIrQhzjTpg
xv2MwuuuTFQpOaJStmRbYSa8uiNs9KCmO357E6Rtz47bNrngqTk6TcXV2qIJxjl9
P5s8+l5iUIfLsPx1AIN9vCiSAeWdL2FLcVvJiIFrfpLfJd0FI0un2Z21/Cw14OLM
uoK2I8wf+DzwQdRXTUij+8+yC80IMh+bPmQR5QRcJ/jZx5xj5cdhhabWHZPw2InQ
PzPbX/xG514qNosRkALFM0xOgdpsikhOZwr4LzXJoYreFr3uarUiIQ2pGXR/DANY
nDmFNuvfwRxJTF8wXNW7J9jxLAhgqlJ5mOfWnNTI1filpUg+zCrp9O2DzyjBZOJA
7bzvCQgFG6pIawicIYX1cLZ+rdEB+oEmpQJtXkAUK9jg84jqluoq/NTQ4leNbjtl
1Vk0Gbvz28FX821lpcrNbEibkmN7MAbAr3LXYKYFtGd3RqED7LlSe1B1bxk4dS+6
FhKcZXpYXlofwGrZieGgdq/NieCUClbfTmBSbqmX7vCM3k0p5pIak+GGFoJW+rAl
VTqrxyrB5eBr4T1m04EuK6tIxbFo/SF78CgkjbOE6ghTkqe6BLuntMqXIcKn/lrO
8t0Tg0S+MrzTv3LWsnzx
=9dk8
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqdbgACgkQmXOSYMts
txa6FA//biC/xNB75MuS7nVE/4mDKnpzjejjiIWgtWFkcp+NHXIHa2JS8E1hfAfN
3oCifMMDIF8+QoQvjz6MBuxzxc4BoqxEju0Ez+/ktm8R6fTw7SEholmo+nGh4fGW
LlXwf2r2HcDrS+MzepCCVK5H2ewso4cDmnqJNVRME/R2CgTf1U+ALQ/Vv+UzXEYp
m+LbIRzWx6QcrGd9FiPg8uJ08vy/E5hZBjehKWTm1hMNvPuCysDhL6Cy7mfJhrOm
2/FypjVZHgkj+6ZMTkDOSS9mXvPmZSJ91rQCjt+Mk52OfYycbiALtBWiz3ekwYHc
wGkyzRHFMLCnjNTNBAk9LHMOdEHfR4hnvb7zaKvrAui7QyweDgX86SuqS+Okyb6Y
DXvPkzSMIs/cQc+0y1d9nSJ+ASTVAJBGewrvqENza0UDO+7r8OF+Yuu9ttlZSzVI
ABoCqcE2lqIJEVaCbjGD+r3fAclGQEJHzGhUxBvrvgBz4pKn5E3FMuB+Ll72BQo0
od1uUvP1TIBf9Sy0/k54tYusMR6pZ+0q5ffpAcVHwYg4ScUIv3e2DNlS2YwaAhg0
zUG5Is5jfIjOSzZ1cxNtlicCKKEWZgECI7i013Hx5AP3Im1ZwXZr82plOnGg16pl
Yt1pusfixkqhdi6S2gbULO4JfMN5WUDB0PvZAWCJ3US0uqi3ftE=
=9Iqv
-----END PGP SIGNATURE-----
Merge 3.10.103 into android-msm-bullhead-3.10-oreo-m5
Changes in 3.10.103: (178 commits)
X.509: remove possible code fragility: enumeration values not handled
x86, asmlinkage, apm: Make APM data structure used from assembler visible
netfilter: x_tables: validate e->target_offset early
netfilter: x_tables: make sure e->next_offset covers remaining blob size
netfilter: x_tables: fix unconditional helper
netfilter: x_tables: don't move to non-existent next rule
netfilter: x_tables: add and use xt_check_entry_offsets
netfilter: x_tables: kill check_entry helper
netfilter: x_tables: assert minimum target size
netfilter: x_tables: add compat version of xt_check_entry_offsets
netfilter: x_tables: check standard target size too
netfilter: x_tables: check for bogus target offset
netfilter: x_tables: validate all offsets and sizes in a rule
netfilter: x_tables: don't reject valid target size on some architectures
netfilter: arp_tables: simplify translate_compat_table args
netfilter: ip_tables: simplify translate_compat_table args
netfilter: ip6_tables: simplify translate_compat_table args
netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
netfilter: ensure number of counters is >0 in do_replace()
netfilter: x_tables: do compat validation via translate_table
Revert "netfilter: ensure number of counters is >0 in do_replace()"
netfilter: x_tables: introduce and use xt_copy_counters_from_user
perf/x86: Honor the architectural performance monitoring version
perf/x86: Fix undefined shift on 32-bit kernels
signal: remove warning about using SI_TKILL in rt_[tg]sigqueueinfo
PCI/ACPI: Fix _OSC ordering to allow PCIe hotplug use when available
udp: properly support MSG_PEEK with truncated buffers
USB: fix invalid memory access in hub_activate()
USB: usbfs: fix potential infoleak in devio
USB: fix up faulty backports
USB: EHCI: declare hostpc register as zero-length array
USB: serial: option: add support for Telit LE910 PID 0x1206
usb: musb: Stop bulk endpoint while queue is rotated
usb: musb: Ensure rx reinit occurs for shared_fifo endpoints
usb: renesas_usbhs: protect the CFIFOSEL setting in usbhsg_ep_enable()
x86/mm: Add barriers and document switch_mm()-vs-flush synchronization
pipe: limit the per-user amount of pages allocated in pipes
cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind
KEYS: potential uninitialized variable
mm: migrate dirty page without clear_page_dirty_for_io etc
printk: do cond_resched() between lines while outputting to consoles
HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
libceph: apply new_state before new_up_client on incrementals
tmpfs: don't undo fallocate past its last page
tmpfs: fix regression hang in fallocate undo
tcp: make challenge acks less predictable
tcp: record TLP and ER timer stats in v6 stats
tcp: consider recv buf for the initial window scale
MIPS: KVM: Fix mapped fault broken commpage handling
MIPS: KVM: Add missing gfn range check
MIPS: KVM: Fix gfn range check in kseg0 tlb faults
MIPS: KVM: Propagate kseg0/mapped tlb fault errors
MIPS: math-emu: Fix jalr emulation when rd == $0
MIPS: Fix siginfo.h to use strict posix types
MIPS: ath79: make bootconsole wait for both THRE and TEMT
MIPS: Fix 64k page support for 32 bit kernels.
MIPS: KVM: Fix modular KVM under QEMU
Input: uinput - handle compat ioctl for UI_SET_PHYS
Input: wacom_w8001 - w8001_MAX_LENGTH should be 13
Input: xpad - validate USB endpoint count during probe
ath5k: Change led pin configuration for compaq c700 laptop
aacraid: Relinquish CPU during timeout wait
aacraid: Fix for aac_command_thread hang
PCI: Disable all BAR sizing for devices with non-compliant BARs
rtlwifi: Fix logic error in enter/exit power-save mode
powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel
powerpc: Fix definition of SIAR and SDAR registers
powerpc: Use privileged SPR number for MMCR2
powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge
powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism
powerpc/pseries: Fix PCI config address for DDW
powerpc/tm: Always reclaim in start_thread() for exec() class syscalls
sunrpc: fix stripping of padded MIC tokens
drm/gma500: Fix possible out of bounds read
drm/fb_helper: Fix references to dev->mode_config.num_connector
drm/radeon: fix asic initialization for virtualized environments
drm/radeon: add a delay after ATPX dGPU power off
drm/radeon: Poll for both connect/disconnect on analog connectors
drm/radeon: fix firmware info version checks
ext4: fix hang when processing corrupted orphaned inode list
ext4: address UBSAN warning in mb_find_order_for_block()
ext4: silence UBSAN in ext4_mb_init()
ext4: verify extent header depth
ext4: check for extents that wrap around
ext4: don't call ext4_should_journal_data() on the journal inode
ext4: short-cut orphan cleanup on error
ext4: fix reference counting bug on block allocation error
dma-debug: avoid spinlock recursion when disabling dma-debug
xfs: xfs_iflush_cluster fails to abort on error
xfs: fix inode validity check in xfs_iflush_cluster
xfs: skip stale inodes in xfs_iflush_cluster
KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS
ARM: fix PTRACE_SETVFPREGS on SMP systems
arm: oabi compat: add missing access checks
parisc: Fix pagefault crash in unaligned __get_user() call
ecryptfs: forbid opening files without mmap handler
fix d_walk()/non-delayed __d_free() race
crypto: ux500 - memmove the right size
crypto: gcm - Filter out async ghash if necessary
crypto: scatterwalk - Fix test in scatterwalk_done
sit: correct IP protocol used in ipip6_err
ipmr/ip6mr: Initialize the last assert time of mfc entries.
net: alx: Work around the DMA RX overflow issue
mac80211: mesh: flush mesh paths unconditionally
mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL
IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs
IB/security: Restrict use of the write() interface
IB/IPoIB: Don't update neigh validity for unresolved entries
IB/mlx4: Fix the SQ size of an RC QP
x86, build: copy ldlinux.c32 to image.iso
kprobes/x86: Clear TF bit in fault on single-stepping
x86/amd_nb: Fix boot crash on non-AMD systems
NFS: Fix another OPEN_DOWNGRADE bug
mm: Export migrate_page_move_mapping and migrate_page_copy
UBIFS: Implement ->migratepage()
cdc_ncm: workaround for EM7455 "silent" data interface
kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
tracing: Handle NULL formats in hold_module_trace_bprintk_format()
base: make module_create_drivers_dir race-free
iio: Fix error handling in iio_trigger_attach_poll_func
staging: iio: accel: fix error check
iio: accel: kxsd9: fix the usage of spi_w8r8()
iio:ad7266: Fix broken regulator error handling
iio:ad7266: Fix probe deferral for vref
tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
ALSA: dummy: Fix a use-after-free at closing
ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
ALSA: ctl: Stop notification after disconnection
ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
ALSA: timer: Fix leak in events via snd_timer_user_ccallback
ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
scsi: fix race between simultaneous decrements of ->host_failed
scsi: remove scsi_end_request
Fix reconnect to not defer smb3 session reconnect long after socket reconnect
xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
s390/seccomp: fix error return for filtered system calls
fs/nilfs2: fix potential underflow in call to crc32_le
arc: unwind: warn only once if DW2_UNWIND is disabled
xen/pciback: Fix conf_space read/write overlap check.
Revert "ecryptfs: forbid opening files without mmap handler"
ecryptfs: don't allow mmap when the lower fs doesn't support it
ARC: use ASL assembler mnemonic
qeth: delete napi struct when removing a qeth device
mmc: block: fix packed command header endianness
can: at91_can: RX queue could get stuck at high bus load
can: fix oops caused by wrong rtnl dellink usage
ipr: Clear interrupt on croc/crocodile when running with LSI
net: mvneta: set real interrupt per packet for tx_done
sctp: Prevent soft lockup when sctp_accept() is called during a timeout event
x86/mm: Improve switch_mm() barrier comments
KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace
scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands
block: fix use-after-free in seq file
fuse: fix wrong assignment of ->flags in fuse_send_init()
net/irda: fix NULL pointer dereference on memory allocation failure
gpio: pca953x: Fix NBANK calculation for PCA9536
hp-wmi: Fix wifi cannot be hard-unblocked
s5p-mfc: Set device name for reserved memory region devs
s5p-mfc: Add release callback for memory region devs
Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU
cifs: Check for existing directory when opening file with O_CREAT
netlabel: add address family checks to netlbl_{sock,req}_delattr()
balloon: check the number of available pages in leak balloon
ftrace/recordmcount: Work around for addition of metag magic but not relocations
metag: Fix __cmpxchg_u32 asm constraint for CMP
ubi: Make volume resize power cut aware
ubi: Fix race condition between ubi device creation and udev
dm flakey: error READ bios during the down_interval
module: Invalidate signatures on force-loaded modules
be2iscsi: Fix bogus WARN_ON length check
squash mm: Export migrate_page_... : also make it non-static
HID: hid-input: Add parentheses to quell gcc warning
ALSA: oxygen: Fix logical-not-parentheses warning
net: rfkill: Do not ignore errors from regulator_enable()
isdn: hfcpci_softirq: get func return to suppress compiler warning
stb6100: fix buffer length check in stb6100_write_reg_range()
spi: spi-xilinx: cleanup a check in xilinx_spi_txrx_bufs()
Linux 3.10.103
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Conflicts:
drivers/usb/core/quirks.c
fs/fuse/inode.c
kernel/panic.c
net/ipv4/tcp_input.c
To prevent protential risk of memory leak caused by closing socket with
out untag it from qtaguid module, the qtaguid module now do not hold any
socket file reference count. Instead, it will increase the sk_refcnt of
the sk struct to prevent a reuse of the socket pointer. And when a socket
is released. It will delete the tag if the socket is previously tagged so
no more resources is held by xt_qtaguid moudle. A flag is added to the untag
process to prevent possible kernel crash caused by fail to delete
corresponding socket_tag_entry list.
Bug: 36374484
Test: compile and run test under system/extra/test/iptables,
run cts -m CtsNetTestCases -t android.net.cts.SocketRefCntTest
Signed-off-by: Chenbo Feng <fengc@google.com>
Change-Id: Iea7c3bf0c59b9774a5114af905b2405f6bc9ee52
commit 63ecb81aadf1c823c85c70a2bfd1ec9df3341a72 upstream.
commit d7591f0c41ce3e67600a982bab6989ef0f07b3ce upstream
The three variants use same copy&pasted code, condense this into a
helper and use that.
Make sure info.name is 0-terminated.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
commit ce683e5f9d045e5d67d1312a42b359cb2ab2a13c upstream.
We're currently asserting that targetoff + targetsize <= nextoff.
Extend it to also check that targetoff is >= sizeof(xt_entry).
Since this is generic code, add an argument pointing to the start of the
match/target, we can then derive the base structure size from the delta.
We also need the e->elems pointer in a followup change to validate matches.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
commit fc1221b3a163d1386d1052184202d5dc50d302d1 upstream.
32bit rulesets have different layout and alignment requirements, so once
more integrity checks get added to xt_check_entry_offsets it will reject
well-formed 32bit rulesets.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
commit 7d35812c3214afa5b37a675113555259cfd67b98 upstream.
Currently arp/ip and ip6tables each implement a short helper to check that
the target offset is large enough to hold one xt_entry_target struct and
that t->u.target_size fits within the current rule.
Unfortunately these checks are not sufficient.
To avoid adding new tests to all of ip/ip6/arptables move the current
checks into a helper, then extend this helper in followup patches.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
The original xt_quota in the kernel is plain broken:
- counts quota at a per CPU level
(was written back when ubiquitous SMP was just a dream)
- provides no way to count across IPV4/IPV6.
This patch is the original unaltered code from:
http://sourceforge.net/projects/xtables-addons
at commit e84391ce665cef046967f796dd91026851d6bbf3
Change-Id: I19d49858840effee9ecf6cff03c23b45a97efdeb
Signed-off-by: JP Abgrall <jpa@google.com>
This module allows tracking stats at the socket level for given UIDs.
It replaces xt_owner.
If the --uid-owner is not specified, it will just count stats based on
who the skb belongs to. This will even happen on incoming skbs as it
looks into the skb via xt_socket magic to see who owns it.
If an skb is lost, it will be assigned to uid=0.
To control what sockets of what UIDs are tagged by what, one uses:
echo t $sock_fd $accounting_tag $the_billed_uid \
> /proc/net/xt_qtaguid/ctrl
So whenever an skb belongs to a sock_fd, it will be accounted against
$the_billed_uid
and matching stats will show up under the uid with the given
$accounting_tag.
Because the number of allocations for the stats structs is not that big:
~500 apps * 32 per app
we'll just do it atomic. This avoids walking lists many times, and
the fancy worker thread handling. Slabs will grow when needed later.
It use netdevice and inetaddr notifications instead of hooks in the core dev
code to track when a device comes and goes. This removes the need for
exposed iface_stat.h.
Put procfs dirs in /proc/net/xt_qtaguid/
ctrl
stats
iface_stat/<iface>/...
The uid stats are obtainable in ./stats.
Change-Id: I01af4fd91c8de651668d3decb76d9bdc1e343919
Signed-off-by: JP Abgrall <jpa@google.com>
The new revision of the set match supports to match the counters
and to suppress updating the counters at matching too.
At the set:list types, the updating of the subcounters can be
suppressed as well.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Introduce extensions to elements in the core and prepare timeout as
the first one.
This patch also modifies the em_ipset classifier to use the new
extension struct layout.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Conflicts:
drivers/net/ethernet/emulex/benet/be_main.c
drivers/net/ethernet/intel/igb/igb_main.c
drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
include/net/scm.h
net/batman-adv/routing.c
net/ipv4/tcp_input.c
The e{uid,gid} --> {uid,gid} credentials fix conflicted with the
cleanup in net-next to now pass cred structs around.
The be2net driver had a bug fix in 'net' that overlapped with the VLAN
interface changes by Patrick McHardy in net-next.
An IGB conflict existed because in 'net' the build_skb() support was
reverted, and in 'net-next' there was a comment style fix within that
code.
Several batman-adv conflicts were resolved by making sure that all
calls to batadv_is_my_mac() are changed to have a new bat_priv first
argument.
Eric Dumazet's TS ECR fix in TCP in 'net' conflicted with the F-RTO
rewrite in 'net-next', mostly overlapping changes.
Thanks to Stephen Rothwell and Antonio Quartulli for help with several
of these merge resolutions.
Signed-off-by: David S. Miller <davem@davemloft.net>
Get rid of the confusing mix of pid and portid and use portid consistently
for all netlink related socket identities.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
If a resize is triggered the nomatch flag is not excluded at hashing,
which leads to the element missed at lookup in the resized set.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Pablo Neira Ayuso says:
====================
The following patchset contains two bugfixes for netfilter/ipset via
Jozsef Kadlecsik, they are:
* Fix timeout corruption if sets are resized, by Josh Hunt.
* Fix bogus error report if the flag nomatch is set, from Jozsef.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
If a resize is triggered on a set with timeouts enabled, the timeout
values will get corrupted when copying them to the new set. This occured
b/c the wrong timeout value is supplied to type_pf_elem_tadd().
This also adds simple debug statement similar to the one in type_pf_resize().
Signed-off-by: Josh Hunt <johunt@akamai.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
This patch replaces the global lock to one lock per subsystem.
The per-subsystem lock avoids that processes operating
with different subsystems are synchronized.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Most SIP devices use a source port of 5060/udp on SIP requests, so the
response automatically comes back to port 5060:
phone_ip:5060 -> proxy_ip:5060 REGISTER
proxy_ip:5060 -> phone_ip:5060 100 Trying
The newer Cisco IP phones, however, use a randomly chosen high source
port for the SIP request but expect the response on port 5060:
phone_ip:49173 -> proxy_ip:5060 REGISTER
proxy_ip:5060 -> phone_ip:5060 100 Trying
Standard Linux NAT, with or without nf_nat_sip, will send the reply back
to port 49173, not 5060:
phone_ip:49173 -> proxy_ip:5060 REGISTER
proxy_ip:5060 -> phone_ip:49173 100 Trying
But the phone is not listening on 49173, so it will never see the reply.
This patch modifies nf_*_sip to work around this quirk by extracting
the SIP response port from the Via: header, iff the source IP in the
packet header matches the source IP in the SIP request.
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Remove non-UAPI Kbuild files that have become empty as a result of UAPI
disintegration. They used to have only header-y lines in them and those have
now moved to the Kbuild files in the corresponding uapi/ directories.
Possibly these should not be removed but rather have a comment inserted to say
they are intentionally left blank. This would make it easier to add generated
header lines in future without having to restore the infrastructure.
Note that at this point not all the UAPI disintegration parts have been merged,
so it is likely that more empty Kbuild files will turn up.
It is probably necessary to make the files non-empty to prevent the patch
program from automatically deleting them when it reduces them to nothing.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Dave Jones <davej@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Dave Jones <davej@redhat.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIVAwUAUGsfSBOxKuMESys7AQIQug/+LyViiXFmCSlM+lCGkp64/BfUvy0QHqN4
K/dMvbZKOQbvmgps/xj8G+6diDzeO4hz8e1I3c/SEZ3M9TTz/Ppv1slfET9uUZ4X
aLLHKqXihsxEOslw7mgp91KTd1Nr+e41f/5hr3j5Ap1HQB4yJa2mmj3reb48VfjD
jmXo/dID66c2ExaVO7C8yyZXWgMGTfiy27qmEnMTxW7xQPt1oYsV2Bq0PCC/zEcq
JgnwMatDVMy9en9wuEVMNelImE+XLm1T3XpLHL2WkV2JWSai98TcvGZnNKIxpFqu
PueHWWCs5F5bZfn4bf6QOEstRTW76NL2qFNYrBPi0Zuq8Pm53ucnnzJUY8JFPPoR
kXYmv8K73Jb10eHFuc3X4UyzvnhmJ7y3kG3jx7WoJVkW1KPgEFNmvMHkLyHgPZOU
nT1tZiO0QHF4zi0JWMfK+7aeEY7EKfqRSce0F3Jw91vaIlEOIqgMgVJ1Y/nMhu3s
92mpg8JDoAcgCghok4m4Pc1qO06Fe8Iw5Qap5KMdPutp5Br2ebLL5NrwdAE8LNpR
7826r9RTMhyVRgNJ71JMFDY1IBeLeY0bxipN8dh6VYqMiKgClUeNwv7/tIgI4YS7
acQ+GdcsgTtg5qx3xwX5N2TSJVvdwnXdnWhAw7wN48tbzH8LvMV61Pq8Ytc7iK3M
cAMgkbxdZRk=
=VtEQ
-----END PGP SIGNATURE-----
Merge tag 'uapi-prep-20121002' of git://git.infradead.org/users/dhowells/linux-headers
Pull preparatory patches for user API disintegration from David Howells:
"The patches herein prepare for the extraction of the Userspace API
bits from the various header files named in the Kbuild files.
New subdirectories are created under either include/uapi/ or
arch/x/include/uapi/ that correspond to the subdirectory containing
that file under include/ or arch/x/include/.
The new subdirs under the uapi/ directory are populated with Kbuild
files that mostly do nothing at this time. Further patches will
disintegrate the headers in each original directory and fill in the
Kbuild files as they do it.
These patches also:
(1) fix up #inclusions of "foo.h" rather than <foo.h>.
(2) Remove some redundant #includes from the DRM code.
(3) Make the kernel build infrastructure handle Kbuild files both in
the old places and the new UAPI place that both specify headers
to be exported.
(4) Fix some kernel tools that #include kernel headers during their
build.
I have compile tested this with allyesconfig against x86_64,
allmodconfig against i386 and a scattering of additional defconfigs of
other arches. Prepared for main script
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Dave Jones <davej@redhat.com>
Acked-by: H. Peter Anvin <hpa@zytor.com>"
* tag 'uapi-prep-20121002' of git://git.infradead.org/users/dhowells/linux-headers:
UAPI: Plumb the UAPI Kbuilds into the user header installation and checking
UAPI: x86: Differentiate the generated UAPI and internal headers
UAPI: Remove the objhdr-y export list
UAPI: Move linux/version.h
UAPI: Set up uapi/asm/Kbuild.asm
UAPI: x86: Fix insn_sanity build failure after UAPI split
UAPI: x86: Fix the test_get_len tool
UAPI: (Scripted) Set up UAPI Kbuild files
UAPI: Partition the header include path sets and add uapi/ header directories
UAPI: (Scripted) Convert #include "..." to #include <path/...> in kernel system headers
UAPI: (Scripted) Convert #include "..." to #include <path/...> in drivers/gpu/
UAPI: (Scripted) Remove redundant DRM UAPI header #inclusions from drivers/gpu/.
UAPI: Refer to the DRM UAPI headers with <...> and from certain headers only
Convert #include "..." to #include <path/...> in kernel system headers.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Dave Jones <davej@redhat.com>
This patch adds the NFQA_CAP_LEN attribute that allows us to know
what is the real packet size from user-space (even if we decided
to retrieve just a few bytes from the packet instead of all of it).
Security software that inspects packets should always check for
this new attribute to make sure that it is inspecting the entire
packet.
This also helps to provide a workaround for the problem described
in: http://marc.info/?l=netfilter-devel&m=134519473212536&w=2
Original idea from Florian Westphal.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This patch allows the FTP helper to pickup the sequence tracking from
the first packet seen. This is useful to fix the breakage of the first
FTP command after the failover while using conntrackd to synchronize
states.
The seq_aft_nl_num field in struct nf_ct_ftp_info has been shrinked to
16-bits (enough for what it does), so we can use the remaining 16-bits
to store the flags while using the same size for the private FTP helper
data.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Currently, if you want to do something like:
"match Monday, starting 23:00, for two hours"
You need two rules, one for Mon 23:00 to 0:00 and one for Tue 0:00-1:00.
The rule: --weekdays Mo --timestart 23:00 --timestop 01:00
looks correct, but it will first match on monday from midnight to 1 a.m.
and then again for another hour from 23:00 onwards.
This permits userspace to explicitly ignore the day transition and
match for a single, continuous time period instead.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Exceptions can now be matched and we can branch according to the
possible cases:
a. match in the set if the element is not flagged as "nomatch"
b. match in the set if the element is flagged with "nomatch"
c. no match
i.e.
iptables ... -m set --match-set ... -j ...
iptables ... -m set --match-set ... --nomatch-entries -j ...
...
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Add IPv6 support to the SIP NAT helper. There are no functional differences
to IPv4 NAT, just different formats for addresses.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Convert the IPv4 NAT implementation to a protocol independent core and
address family specific modules.
Signed-off-by: Patrick McHardy <kaber@trash.net>
For mangling IPv6 packets the protocol header offset needs to be known
by the NAT packet mangling functions. Add a so far unused protoff argument
and convert the conntrack and NAT helpers to use it in preparation of
IPv6 NAT.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Within SIP messages IPv6 addresses are enclosed in square brackets in most
cases, with the exception of the "received=" header parameter. Currently
the helper fails to parse enclosed addresses.
This patch:
- changes the SIP address parsing function to enforce square brackets
when required, and accept them when not required but present, as
recommended by RFC 5118.
- adds a new SDP address parsing function that never accepts square
brackets since SDP doesn't use them.
With these changes, the SIP helper correctly parses all test messages
from RFC 5118 (Session Initiation Protocol (SIP) Torture Test Messages
for Internet Protocol Version 6 (IPv6)).
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Allow setting of only supported flag bits in queue->flags.
Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This patch adds the following messages to ctnetlink:
IPCTNL_MSG_CT_GET_STATS_CPU
IPCTNL_MSG_CT_GET_STATS
IPCTNL_MSG_EXP_GET_STATS_CPU
To display connection tracking system per-cpu and global statistics.
This provides a replacement for the following /proc interfaces:
/proc/net/stat/nf_conntrack
/proc/sys/net/netfilter/nf_conntrack_count
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Pablo says:
====================
This is the second batch of Netfilter updates for net-next. It contains the
kernel changes for the new user-space connection tracking helper
infrastructure.
More details on this infrastructure are provides here:
http://lwn.net/Articles/500196/
Still, I plan to provide some official documentation through the
conntrack-tools user manual on how to setup user-space utilities for this.
So far, it provides two helper in user-space, one for NFSv3 and another for
Oracle/SQLnet/TNS. Yet in my TODO list.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
There are good reasons to supports helpers in user-space instead:
* Rapid connection tracking helper development, as developing code
in user-space is usually faster.
* Reliability: A buggy helper does not crash the kernel. Moreover,
we can monitor the helper process and restart it in case of problems.
* Security: Avoid complex string matching and mangling in kernel-space
running in privileged mode. Going further, we can even think about
running user-space helpers as a non-root process.
* Extensibility: It allows the development of very specific helpers (most
likely non-standard proprietary protocols) that are very likely not to be
accepted for mainline inclusion in the form of kernel-space connection
tracking helpers.
This patch adds the infrastructure to allow the implementation of
user-space conntrack helpers by means of the new nfnetlink subsystem
`nfnetlink_cthelper' and the existing queueing infrastructure
(nfnetlink_queue).
I had to add the new hook NF_IP6_PRI_CONNTRACK_HELPER to register
ipv[4|6]_helper which results from splitting ipv[4|6]_confirm into
two pieces. This change is required not to break NAT sequence
adjustment and conntrack confirmation for traffic that is enqueued
to our user-space conntrack helpers.
Basic operation, in a few steps:
1) Register user-space helper by means of `nfct':
nfct helper add ftp inet tcp
[ It must be a valid existing helper supported by conntrack-tools ]
2) Add rules to enable the FTP user-space helper which is
used to track traffic going to TCP port 21.
For locally generated packets:
iptables -I OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp
For non-locally generated packets:
iptables -I PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
3) Run the test conntrackd in helper mode (see example files under
doc/helper/conntrackd.conf
conntrackd
4) Generate FTP traffic going, if everything is OK, then conntrackd
should create expectations (you can check that with `conntrack':
conntrack -E expect
[NEW] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp
[DESTROY] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp
This confirms that our test helper is receiving packets including the
conntrack information, and adding expectations in kernel-space.
The user-space helper can also store its private tracking information
in the conntrack structure in the kernel via the CTA_HELP_INFO. The
kernel will consider this a binary blob whose layout is unknown. This
information will be included in the information that is transfered
to user-space via glue code that integrates nfnetlink_queue and
ctnetlink.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This patch allows you to include the conntrack information together
with the packet that is sent to user-space via NFQUEUE.
Previously, there was no integration between ctnetlink and
nfnetlink_queue. If you wanted to access conntrack information
from your libnetfilter_queue program, you required to query
ctnetlink from user-space to obtain it. Thus, delaying the packet
processing even more.
Including the conntrack information is optional, you can set it
via NFQA_CFG_F_CONNTRACK flag with the new NFQA_CFG_FLAGS attribute.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This patch uses the new variable length conntrack extensions.
Instead of using union nf_conntrack_help that contain all the
helper private data information, we allocate variable length
area to store the private helper data.
This patch includes the modification of all existing helpers.
It also includes a couple of include header to avoid compilation
warnings.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Conflicts:
MAINTAINERS
drivers/net/wireless/iwlwifi/pcie/trans.c
The iwlwifi conflict was resolved by keeping the code added
in 'net' that turns off the buggy chip feature.
The MAINTAINERS conflict was merely overlapping changes, one
change updated all the wireless web site URLs and the other
changed some GIT trees to be Johannes's instead of John's.
Signed-off-by: David S. Miller <davem@davemloft.net>
The mask option allows you put all address belonging that mask into
the same recent slot. This can be useful in case that recent is used
to detect attacks from the same network segment.
Tested for backward compatibility.
Signed-off-by: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Nathan Chancellor