linux.git/net/ipv4, branch v2.6.14

[TCP]: Clear stale pred_flags when snd_wnd changes

2005-10-27T17:11:04+00:00

This bug is responsible for causing the infamous "Treason uncloaked"
messages that's been popping up everywhere since the printk was added.
It has usually been blamed on foreign operating systems.  However,
some of those reports implicate Linux as both systems are running
Linux or the TCP connection is going across the loopback interface.

In fact, there really is a bug in the Linux TCP header prediction code
that's been there since at least 2.1.8.  This bug was tracked down with
help from Dale Blount.

The effect of this bug ranges from harmless "Treason uncloaked"
messages to hung/aborted TCP connections.  The details of the bug
and fix is as follows.

When snd_wnd is updated, we only update pred_flags if
tcp_fast_path_check succeeds.  When it fails (for example,
when our rcvbuf is used up), we will leave pred_flags with
an out-of-date snd_wnd value.

When the out-of-date pred_flags happens to match the next incoming
packet we will again hit the fast path and use the current snd_wnd
which will be wrong.

In the case of the treason messages, it just happens that the snd_wnd
cached in pred_flags is zero while tp->snd_wnd is non-zero.  Therefore
when a zero-window packet comes in we incorrectly conclude that the
window is non-zero.

In fact if the peer continues to send us zero-window pure ACKs we
will continue making the same mistake.  It's only when the peer
transmits a zero-window packet with data attached that we get a
chance to snap out of it.  This is what triggers the treason
message at the next retransmit timeout.

Signed-off-by: Herbert Xu 
Signed-off-by: Arnaldo Carvalho de Melo

[SK_BUFF]: ipvs_property field must be copied

2005-10-22T19:06:01+00:00

IPVS used flag NFC_IPVS_PROPERTY in nfcache but as now nfcache was removed the
new flag 'ipvs_property' still needs to be copied. This patch should be
included in 2.6.14.

Further comments from Harald Welte:

Sorry, seems like the bug was introduced by me.

Signed-off-by: Julian Anastasov 
Signed-off-by: Harald Welte 
Signed-off-by: Arnaldo Carvalho de Melo

[TCP] Allow len == skb->len in tcp_fragment

2005-10-20T19:13:13+00:00

It is legitimate to call tcp_fragment with len == skb->len since
that is done for FIN packets and the FIN flag counts as one byte.
So we should only check for the len > skb->len case.

Signed-off-by: Herbert Xu 
Signed-off-by: Arnaldo Carvalho de Melo

[TCP]: Ratelimit debugging warning.

2005-10-13T21:42:24+00:00

Better safe than sorry.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[NETFILTER]: Fix OOPSes on machines with discontiguous cpu numbering.

2005-10-13T21:41:23+00:00

Original patch by Harald Welte, with feedback from Herbert Xu
and testing by S�bastien Bernard.

EBTABLES, ARP tables, and IP/IP6 tables all assume that cpus
are numbered linearly.  That is not necessarily true.

This patch fixes that up by calculating the largest possible
cpu number, and allocating enough per-cpu structure space given
that.

Signed-off-by: David S. Miller

[TCP]: Add code to help track down "BUG at net/ipv4/tcp_output.c:438!"

2005-10-12T22:59:39+00:00

This is the second report of this bug.  Unfortunately the first
reporter hasn't been able to reproduce it since to provide more
debugging info.

So let's apply this patch for 2.6.14 to

1) Make this non-fatal.
2) Provide the info we need to track it down.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[TWSK]: Grab the module refcount for timewait sockets

2005-10-11T04:25:23+00:00

This is required to avoid unloading a module that has active timewait
sockets, such as DCCP.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

[NETFILTER] ctnetlink: add support to change protocol info

2005-10-11T04:23:46+00:00

This patch add support to change the state of the private protocol
information via conntrack_netlink.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] ctnetlink: allow userspace to change TCP state

2005-10-11T04:23:28+00:00

This patch adds the ability of changing the state a TCP connection. I know
that this must be used with care but it's required to provide a complete
conntrack creation via conntrack_netlink. So I'll document this aspect on
the upcoming docs.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER]: Use only 32bit counters for CONNTRACK_ACCT

2005-10-11T04:21:10+00:00

Initially we used 64bit counters for conntrack-based accounting, since we
had no event mechanism to tell userspace that our counters are about to
overflow.  With nfnetlink_conntrack, we now have such a event mechanism and
thus can save 16bytes per connection.

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller