linux.git/net/core, branch v4.3-rc2

net: ipv6: use common fib_default_rule_pref

2015-09-09T21:19:50+00:00

This switches IPv6 policy routing to use the shared
fib_default_rule_pref() function of IPv4 and DECnet. It is also used in
multicast routing for IPv4 as well as IPv6.

The motivation for this patch is a complaint about iproute2 behaving
inconsistent between IPv4 and IPv6 when adding policy rules: Formerly,
IPv6 rules were assigned a fixed priority of 0x3FFF whereas for IPv4 the
assigned priority value was decreased with each rule added.

Since then all users of the default_pref field have been converted to
assign the generic function fib_default_rule_pref(), fib_nl_newrule()
may just use it directly instead. Therefore get rid of the function
pointer altogether and make fib_default_rule_pref() static, as it's not
used outside fib_rules.c anymore.

Signed-off-by: Phil Sutter 
Signed-off-by: David S. Miller

sock, diag: fix panic in sock_diag_put_filterinfo

2015-09-02T18:29:29+00:00

diag socket's sock_diag_put_filterinfo() dumps classic BPF programs
upon request to user space (ss -0 -b). However, native eBPF programs
attached to sockets (SO_ATTACH_BPF) cannot be dumped with this method:

Their orig_prog is always NULL. However, sock_diag_put_filterinfo()
unconditionally tries to access its filter length resp. wants to copy
the filter insns from there. Internal cBPF to eBPF transformations
attached to sockets don't have this issue, as orig_prog state is kept.

It's currently only used by packet sockets. If we would want to add
native eBPF support in the future, this needs to be done through
a different attribute than PACKET_DIAG_FILTER to not confuse possible
user space disassemblers that work on diag data.

Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets")
Signed-off-by: Daniel Borkmann 
Acked-by: Nicolas Dichtel 
Acked-by: Alexei Starovoitov 
Signed-off-by: David S. Miller

flow_dissector: Use 'const' where possible.

2015-09-02T04:19:17+00:00

Signed-off-by: David S. Miller

flow: Move __get_hash_from_flowi{4,6} into flow_dissector.c

2015-09-02T00:00:24+00:00

These cannot live in net/core/flow.c which only builds when XFRM is
enabled.

Reported-by: kbuild test robot 
Signed-off-by: David S. Miller

flow_dissector: Don't use bit fields.

2015-09-01T23:46:08+00:00

Just have a flags member instead.

   In file included from include/linux/linkage.h:4:0,
                    from include/linux/kernel.h:6,
                    from net/core/flow_dissector.c:1:
   In function 'flow_keys_hash_start',
       inlined from 'flow_hash_from_keys' at net/core/flow_dissector.c:553:34:
>> include/linux/compiler.h:447:38: error: call to '__compiletime_assert_459' declared with attribute error: BUILD_BUG_ON failed: FLOW_KEYS_HASH_OFFSET % sizeof(u32)

Reported-by: kbuild test robot 
Signed-off-by: David S. Miller

flow_dissector: Ignore flow dissector return value from ___skb_get_hash

2015-09-01T22:06:23+00:00

In ___skb_get_hash ignore return value from skb_flow_dissect_flow_keys.
A failure in that function likely means that there was a parse error,
so we may as well use whatever fields were found before the error was
hit.  This is also good because it means we won't keep trying to derive
the hash on subsequent calls to skb_get_hash for the same packet.

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

flow_dissector: Add control/reporting of encapsulation

2015-09-01T22:06:23+00:00

Add an input flag to flow dissector on rather dissection should stop
when encapsulation is detected (IP/IP or GRE). Also, add a key_control
flag that indicates encapsulation was encountered during the
dissection.

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

flow_dissector: Add flag to stop parsing when an IPv6 flow label is seen

2015-09-01T22:06:23+00:00

Add an input flag to flow dissector on rather dissection should be
stopped when a flow label is encountered. Presumably, the flow label
is derived from a sufficient hash of an inner transport packet so
further dissection is not needed (that is ports are not included in
the flow hash). Using the flow label instead of ports has the additional
benefit that packet fragments should hash to same value as non-fragments
for a flow (assuming that the same flow label is used).

We set this flag by default in for skb_get_hash.

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

flow_dissector: Add flag to stop parsing at L3

2015-09-01T22:06:23+00:00

Add an input flag to flow dissector on rather dissection should be
stopped when an L3 packet is encountered. This would be useful if a
caller just wanted to get IP addresses of the outermost header (e.g.
to do an L3 hash).

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

flow_dissector: Support IPv6 fragment header

2015-09-01T22:06:22+00:00

Parse NEXTHDR_FRAGMENT. When seen account for it in the fragment bits of
key_control. Also, check if first fragment should be parsed.

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller