linux-stable.git/net/ipv6/netfilter, branch v3.17

netfilter: fix missing dependencies in NETFILTER_XT_TARGET_LOG

2014-09-02T20:59:54+00:00

make defconfig reports:

warning: (NETFILTER_XT_TARGET_LOG) selects NF_LOG_IPV6 which has unmet direct dependencies (NET && INET && IPV6 && NETFILTER && NETFILTER_ADVANCED)

Fixes: d79a61d netfilter: NETFILTER_XT_TARGET_LOG selects NF_LOG_*
Reported-by: kbuild test robot 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: move NAT Kconfig switches out of the iptables scope

2014-08-18T19:55:54+00:00

Currently, the NAT configs depend on iptables and ip6tables. However,
users should be capable of enabling NAT for nft without having to
switch on iptables.

Fix this by adding new specific IP_NF_NAT and IP6_NF_NAT config
switches for iptables and ip6tables NAT support. I have also moved
the original NF_NAT_IPV4 and NF_NAT_IPV6 configs out of the scope
of iptables to make them independent of it.

This patch also adds NETFILTER_XT_NAT which selects the xt_nat
combo that provides snat/dnat for iptables. We cannot use NF_NAT
anymore since nf_tables can select this.

Reported-by: Matteo Croce 
Signed-off-by: Pablo Neira Ayuso

inet: frags: use kmem_cache for inet_frag_queue

2014-08-02T22:31:31+00:00

Use kmem_cache to allocate/free inet_frag_queue objects since they're
all the same size per inet_frags user and are alloced/freed in high volumes
thus making it a perfect case for kmem_cache.

Signed-off-by: Nikolay Aleksandrov 
Acked-by: Florian Westphal 
Signed-off-by: David S. Miller

inet: frags: rename last_in to flags

2014-08-02T22:31:31+00:00

The last_in field has been used to store various flags different from
first/last frag in so give it a more descriptive name: flags.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

inet: frag: set limits and make init_net's high_thresh limit global

2014-07-28T05:34:36+00:00

This patch makes init_net's high_thresh limit to be the maximum for all
namespaces, thus introducing a global memory limit threshold equal to the
sum of the individual high_thresh limits which are capped.
It also introduces some sane minimums for low_thresh as it shouldn't be
able to drop below 0 (or > high_thresh in the unsigned case), and
overall low_thresh should not ever be above high_thresh, so we make the
following relations for a namespace:
init_net:
 high_thresh - max(not capped), min(init_net low_thresh)
 low_thresh - max(init_net high_thresh), min (0)

all other namespaces:
 high_thresh = max(init_net high_thresh), min(namespace's low_thresh)
 low_thresh = max(namespace's high_thresh), min(0)

The major issue with having low_thresh > high_thresh is that we'll
schedule eviction but never evict anything and thus rely only on the
timers.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

inet: frag: use seqlock for hash rebuild

2014-07-28T05:34:36+00:00

rehash is rare operation, don't force readers to take
the read-side rwlock.

Instead, we only have to detect the (rare) case where
the secret was altered while we are trying to insert
a new inetfrag queue into the table.

If it was changed, drop the bucket lock and recompute
the hash to get the 'new' chain bucket that we have to
insert into.

Joint work with Nikolay Aleksandrov.

Signed-off-by: Florian Westphal 
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

inet: frag: remove periodic secret rebuild timer

2014-07-28T05:34:36+00:00

merge functionality into the eviction workqueue.

Instead of rebuilding every n seconds, take advantage of the upper
hash chain length limit.

If we hit it, mark table for rebuild and schedule workqueue.
To prevent frequent rebuilds when we're completely overloaded,
don't rebuild more than once every 5 seconds.

ipfrag_secret_interval sysctl is now obsolete and has been marked as
deprecated, it still can be changed so scripts won't be broken but it
won't have any effect. A comment is left above each unused secret_timer
variable to avoid confusion.

Joint work with Nikolay Aleksandrov.

Signed-off-by: Florian Westphal 
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

inet: frag: remove lru list

2014-07-28T05:34:36+00:00

no longer used.

Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller

inet: frag: move evictor calls into frag_find function

2014-07-28T05:34:35+00:00

First step to move eviction handling into a work queue.

We lose two spots that accounted evicted fragments in MIB counters.

Accounting will be restored since the upcoming work-queue evictor
invokes the frag queue timer callbacks instead.

Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller

inet: frag: remove hash size assumptions from callers

2014-07-28T05:34:35+00:00

hide actual hash size from individual users: The _find
function will now fold the given hash value into the required range.

Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller