linux.git/net/netfilter/ipvs, branch v2.6.33

ipvs: Add boundary check on ioctl arguments

2010-01-04T15:37:12+00:00

The ipvs code has a nifty system for doing the size of ioctl command
copies; it defines an array with values into which it indexes the cmd
to find the right length.

Unfortunately, the ipvs code forgot to check if the cmd was in the
range that the array provides, allowing for an index outside of the
array, which then gives a "garbage" result into the length, which
then gets used for copying into a stack buffer.

Fix this by adding sanity checks on these as well as the copy size.

[ horms@verge.net.au: adjusted limit to IP_VS_SO_GET_MAX ]
Signed-off-by: Arjan van de Ven 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: Patrick McHardy

ipvs: ip_vs_wrr.c: use lib/gcd.c

2009-12-22T08:42:06+00:00

Remove the private version of the greatest common divider to use
lib/gcd.c, the latter also implementing the a < b case.

[akpm@linux-foundation.org: repair neighboring whitespace because the diff looked odd]
Signed-off-by: Florian Fainelli 
Cc: Sergei Shtylyov 
Cc: Takashi Iwai 
Acked-by: Simon Horman 
Cc: Julius Volz 
Cc: David S. Miller 
Cc: Patrick McHardy 
Signed-off-by: Andrew Morton 
Signed-off-by: Patrick McHardy

ipvs: zero usvc and udest

2009-12-15T16:01:25+00:00

Make sure that any otherwise uninitialised fields of usvc are zero.

This has been obvserved to cause a problem whereby the port of
fwmark services may end up as a non-zero value which causes
scheduling of a destination server to fail for persisitent services.

As observed by Deon van der Merwe .
This fix suggested by Julian Anastasov .

For good measure also zero udest.

Cc: Deon van der Merwe 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Cc: stable@kernel.org
Signed-off-by: Patrick McHardy

ipvs: fix synchronization on connection close

2009-12-14T15:38:21+00:00

commit 9d3a0de makes slaves expire as they would do on the master
with much shorter timeouts. But it introduces another problem:
When we close a connection, on master server the connection became
CLOSE_WAIT/TIME_WAIT, it was synced to slaves, but if master is
finished within it's timeouts (CLOSE), it will not be synced to
slaves. Then slaves will be kept on CLOSE_WAIT/TIME_WAIT until
timeout reaches. Thus we should also sync with CLOSE.

Cc: Wensong Zhang 
Cc: Simon Horman 
Cc: Julian Anastasov 
Cc: David S. Miller 
Signed-off-by: Xiaotian Feng 
Acked-by: Simon Horman 
Signed-off-by: Patrick McHardy

sysctl net: Remove unused binary sysctl code

2009-11-12T10:05:06+00:00

Now that sys_sysctl is a compatiblity wrapper around /proc/sys
all sysctl strategy routines, and all ctl_name and strategy
entries in the sysctl tables are unused, and can be
revmoed.

In addition neigh_sysctl_register has been modified to no longer
take a strategy argument and it's callers have been modified not
to pass one.

Cc: "David Miller" 
Cc: Hideaki YOSHIFUJI 
Cc: netdev@vger.kernel.org
Signed-off-by: Eric W. Biederman

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24T14:21:04+00:00

It's unused.

It isn't needed -- read or write flag is already passed and sysctl
shouldn't care about the rest.

It _was_ used in two places at arch/frv for some reason.

Signed-off-by: Alexey Dobriyan 
Cc: David Howells 
Cc: "Eric W. Biederman" 
Cc: Al Viro 
Cc: Ralf Baechle 
Cc: Martin Schwidefsky 
Cc: Ingo Molnar 
Cc: "David S. Miller" 
Cc: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

IPVS: Add handling of incoming ICMPV6 messages

2009-08-31T14:22:23+00:00

Add handling of incoming ICMPv6 messages.
This follows the handling of IPv4 ICMP messages.

Amongst ther things this problem allows IPVS to behave sensibly
when an ICMPV6_PKT_TOOBIG message is received:

This message is received when a realserver sends a packet >PMTU to the
client. The hop on this path with insufficient MTU will generate an
ICMPv6 Packet Too Big message back to the VIP. The LVS server receives
this message, but the call to the function handling this has been
missing. Thus, IPVS fails to forward the message to the real server,
which then does not adjust the path MTU. This patch adds the missing
call to ip_vs_in_icmp_v6() in ip_vs_in() to handle this situation.

Thanks to Rob Gallagher from HEAnet for reporting this issue and for
testing this patch in production (with direct routing mode).

[horms@verge.net.au: tweaked changelog]
Signed-off-by: Julius Volz 
Tested-by: Rob Gallagher 
Signed-off-by: Simon Horman 
Signed-off-by: Patrick McHardy

ipvs: Use atomic operations atomicly

2009-08-31T12:18:48+00:00

A pointed out by Shin Hong, IPVS doesn't always use atomic operations
in an atomic manner. While this seems unlikely to be manifest in
strange behaviour, it seems appropriate to clean this up.

Cc: shin hong 
Signed-off-by: Simon Horman 
Signed-off-by: Patrick McHardy

net: mark read-only arrays as const

2009-08-05T17:42:58+00:00

String literals are constant, and usually, we can also tag the array
of pointers const too, moving it to the .rodata section.

Signed-off-by: Jan Engelhardt 
Signed-off-by: David S. Miller

IPVS: use pr_err and friends instead of IP_VS_ERR and friends

2009-08-03T01:29:30+00:00

Since pr_err and friends are used instead of printk there is no point
in keeping IP_VS_ERR and friends.  Furthermore make use of '__func__'
instead of hard coded function names.

Signed-off-by: Hannes Eder 
Acked-by: Simon Horman 
Signed-off-by: David S. Miller