linux-dev - Linux kernel development work

Age	Commit message (Collapse)	Author	Files	Lines
2018-03-05	netfilter: nfnetlink_acct: remove useless parameter	Taehee Yoo	1	-1/+1
	parameter skb in nfnl_acct_overquota is not used anywhere. Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-02-14	netfilter: x_tables: use pr ratelimiting in all remaining spots	Florian Westphal	1	-2/+4
	Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-01-31	netfilter: x_tables: fix pointer leaks to userspace	Dmitry Vyukov	1	-0/+1
	Several netfilter matches and targets put kernel pointers into info objects, but don't set usersize in descriptors. This leads to kernel pointer leaks if a match/target is set and then read back to userspace. Properly set usersize for these matches/targets. Found with manual code inspection. Fixes: ec2318904965 ("xtables: extend matches and targets with .usersize") Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2016-11-03	netfilter: x_tables: move hook state into xt_action_param structure	Pablo Neira Ayuso	1	-1/+1
	Place pointer to hook state in xt_action_param structure instead of copying the fields that we need. After this change xt_action_param fits into one cacheline. This patch also adds a set of new wrapper functions to fetch relevant hook state structure fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2016-08-18	netfilter: nfnetlink_acct: report overquota to the right netns	Liping Zhang	1	-1/+1
	We should report the over quota message to the right net namespace instead of the init netns. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-08-07	netfilter: nfacct: per network namespace support	Andreas Schultz	1	-1/+1
	- Move the nfnl_acct_list into the network namespace, initialize and destroy it per namespace - Keep track of refcnt on nfacct objects, the old logic does not longer work with a per namespace list - Adjust xt_nfacct to pass the namespace when registring objects Signed-off-by: Andreas Schultz <aschultz@tpip.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-04-29	netfilter: nfnetlink_acct: Adding quota support to accounting framework	Mathieu Poirier	1	-1/+4
	nfacct objects already support accounting at the byte and packet level. As such it is a natural extension to add the possiblity to define a ceiling limit for both metrics. All the support for quotas itself is added to nfnetlink acctounting framework to stay coherent with current accounting object management. Quota limit checks are implemented in xt_nfacct filter where statistic collection is already done. Pablo Neira Ayuso has also contributed to this feature. Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-12-25	netfilter: xtables: add nfacct match to support extended accounting	Pablo Neira Ayuso	1	-0/+76
	This patch adds the match that allows to perform extended accounting. It requires the new nfnetlink_acct infrastructure. # iptables -I INPUT -p tcp --sport 80 -m nfacct --nfacct-name http-traffic # iptables -I OUTPUT -p tcp --dport 80 -m nfacct --nfacct-name http-traffic Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>