summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ipset 6.35 releasedv6.35Jozsef Kadlecsik2018-01-063-1/+22
|
* netfilter: mark expected switch fall-throughsGustavo A. R. Silva2018-01-061-1/+1
| | | | | | | | | In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* License cleanup: add SPDX GPL-2.0 license identifier to files with no licenseGreg Kroah-Hartman2018-01-065-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many source files in the tree are missing licensing information, which makes it harder for compliance tools to determine the correct license. By default all files without license information are under the default license of the kernel, which is GPL version 2. Update the files which contain no license information with the 'GPL-2.0' SPDX license identifier. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. How this work was done: Patches were generated and checked against linux-4.14-rc6 for a subset of the use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information, Further patches will be generated in subsequent months to fix up cases where non-standard license headers were used, and references to license had to be inferred by heuristics based on keywords. The analysis to determine which SPDX License Identifier to be applied to a file was done in a spreadsheet of side by side results from of the output of two independent scanners (ScanCode & Windriver) producing SPDX tag:value files created by Philippe Ombredanne. Philippe prepared the base worksheet, and did an initial spot review of a few 1000 files. The 4.13 kernel was the starting point of the analysis with 60,537 files assessed. Kate Stewart did a file by file comparison of the scanner results in the spreadsheet to determine which SPDX license identifier(s) to be applied to the file. She confirmed any determination that was not immediately clear with lawyers working with the Linux Foundation. Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines). All documentation files were explicitly excluded. The following heuristics were used to determine which SPDX license identifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time. In total, over 70 hours of logged manual review was done on the spreadsheet to determine the SPDX license identifiers to apply to the source files by Kate, Philippe, Thomas and, in some cases, confirmation by lawyers working with the Linux Foundation. Kate also obtained a third independent scan of the 4.13 code base from FOSSology, and compared selected files where the other two scanners disagreed against that SPDX file, to see if there was new insights. The Windriver scanner is based on an older version of FOSSology in part, so they are related. Thomas did random spot checks in about 500 files from the spreadsheets for the uapi headers and agreed with SPDX license identifier in the files he inspected. For the non-uapi files Thomas did random spot checks in about 15000 files. In initial set of patches against 4.14-rc6, 3 files were found to have copy/paste license identifier errors, and have been fixed to reflect the correct identifier. Additionally Philippe spent 10 hours this week doing a detailed manual inspection and review of the 12,461 patched files from the initial patch version early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correct This produced a worksheet with 20 files needing minor correction. This worksheet was then exported into 3 different .csv files for the different types of files to be modified. These .csv files were then reviewed by Greg. Thomas wrote a script to parse the csv files and add the proper SPDX tag to the file, in the format that the file expected. This script was further refined by Greg based on the output to detect more types of files automatically and to distinguish between header and source .c files (which need different comment types.) Finally Greg ran the script using the .csv files to generate the patches. Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Backport patch: netfilter: ipset: use nfnl_mutex_is_lockedJozsef Kadlecsik2018-01-042-0/+15
|
* Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit()Jozsef Kadlecsik2018-01-041-0/+2
| | | | | Patch "netfilter: ipset: use nfnl_mutex_is_locked" is added the real mutex locking check, which revealed the missing locking in ip_set_net_exit().
* netfilter: ipset: use nfnl_mutex_is_lockedFlorian Westphal2018-01-041-1/+1
| | | | | | | | Check that we really hold nfnl mutex here instead of relying on correct usage alone. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: add resched points during set listingFlorian Westphal2018-01-043-2/+2
| | | | | | | | | | | | | | When sets are extremely large we can get softlockup during ipset -L. We could fix this by adding cond_resched_rcu() at the right location during iteration, but this only works if RCU nesting depth is 1. At this time entire variant->list() is called under under rcu_read_lock_bh. This used to be a read_lock_bh() but as rcu doesn't really lock anything, it does not appear to be needed, so remove it (ipset increments set reference count before this, so a set deletion should not be possible). Reported-by: Li Shuang <shuali@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* Fix "don't update counters" mode when counters used at the matchingJozsef Kadlecsik2018-01-0410-128/+131
| | | | The matching of the counters was not taken into account, fixed.
* Backport patch: netfilter: ipset: Convert timers to use timer_setup()Jozsef Kadlecsik2018-01-038-15/+67
|
* Userspace revision handling is reworkedJozsef Kadlecsik2018-01-0226-7829/+5122
| | | | | | | | | | | In order to make it simpler and more straightforward to express the revisions of the set type, all keywords and their parsing are separated from the individual set types. All backward compatibility arguments are recognized and ignored arguments are supported. Recognized but ignored arguments will be removed in a later release.
* netfilter: ipset: use swap macro instead of _manually_ swapping valuesGustavo A. R. Silva2017-11-063-18/+6
| | | | | | | | | | Make use of the swap macro and remove unnecessary variables tmp. This makes the code easier to read and maintain. This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Fix race between dump and swapRoss Lagerwall2017-09-281-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a race between ip_set_dump_start() and ip_set_swap(). The race is as follows: * Without holding the ref lock, ip_set_swap() checks ref_netlink of the set and it is 0. * ip_set_dump_start() takes a reference on the set. * ip_set_swap() does the swap (even though it now has a non-zero reference count). * ip_set_dump_start() gets the set from ip_set_list again which is now a different set since it has been swapped. * ip_set_dump_start() calls __ip_set_put_netlink() and hits a BUG_ON due to the reference count being 0. Fix this race by extending the critical region in which the ref lock is held to include checking the ref counts. The race can be reproduced with the following script: while :; do ipset destroy hash_ip1 ipset destroy hash_ip2 ipset create hash_ip1 hash:ip family inet hashsize 1024 \ maxelem 500000 ipset create hash_ip2 hash:ip family inet hashsize 300000 \ maxelem 500000 ipset create hash_ip3 hash:ip family inet hashsize 1024 \ maxelem 500000 ipset save & ipset swap hash_ip3 hash_ip2 ipset destroy hash_ip3 wait done Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: pernet ops must be unregistered lastFlorian Westphal2017-09-261-17/+26
| | | | | | | | | | | | | | | | Removing the ipset module leaves a small window where one cpu performs module removal while another runs a command like 'ipset flush'. ipset uses net_generic(), unregistering the pernet ops frees this storage area. Fix it by first removing the user-visible api handlers and the pernet ops last. Fixes: 1785e8f473082 ("netfiler: ipset: Add net namespace for ipset") Reported-by: Li Shuang <shuali@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Replace the last reference to u_int8_t with uint8_t.Jozsef Kadlecsik2017-09-261-1/+1
|
* Revert "ipset: fix build with musl"Jozsef Kadlecsik2017-09-261-2/+0
| | | | | | This reverts commit 992723e3712a09037338aa9e5506a080e24d1642. The single u_int8_t usage was a leftover.
* ipset: fix build with muslStijn Tintel2017-09-251-0/+2
| | | | | | | | | Include sys/types.h for u_int8_t and define _GNU_SOURCE for musl to expose it. Fixes: 54802b2c2826 ("Report if the option is supported by a newer kernel release") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.34 releasedv6.34Jozsef Kadlecsik2017-09-233-1/+17
|
* testsuite: Make sure it can be run over ssh :-)Jozsef Kadlecsik2017-09-236-32/+43
|
* Reset state after a command failed, when multiple ones are issued.Jozsef Kadlecsik2017-09-231-0/+1
| | | | Fixes bugzilla id #1158 reported by Dimitri Grischin.
* Handle padding attribute properly in userspace.Jozsef Kadlecsik2017-09-232-0/+9
|
* Add test file missing from patch previous patch.Jozsef Kadlecsik2017-09-231-0/+9
|
* Test to check the fix to add an IPv4 range containing more than 2^31 addressesJozsef Kadlecsik2017-09-181-0/+10
|
* Fix adding an IPv4 range containing more than 2^31 addressesJozsef Kadlecsik2017-09-1810-22/+24
| | | | | | | Wrong comparison prevented the hash types to add a range with more than 2^31 addresses but reported as a success. Fixes bugzilla id #1005, reported by Oleg Serditov and Oliver Ford.
* Fix the include guards on the include/libipset/linux_ip_set*.hJozsef Kadlecsik2017-09-145-14/+23
| | | | | | | The include guards did not prevent including the "same" userspace and kernel header files. Fixes bugzilla id #1139, reported and solution suggested by Quentin Armitage.
* New function added in commit 54802b2c is missing from libipset.mapJozsef Kadlecsik2017-09-141-0/+5
| | | | | | The patch title was "Report if the option is supported by a newer kernel release" Fixes bugzilla id #1182, reported by irherder@gmail.com.
* ipset 6.33 releasedv6.33Jozsef Kadlecsik2017-09-123-1/+25
|
* Backport patch: sctp: remove the typedef sctp_sctphdr_tJozsef Kadlecsik2017-09-113-0/+16
|
* Backport patch: netfilter: nfnetlink: extended ACK reportingJozsef Kadlecsik2017-09-113-20/+47
|
* ipset: remove unused function __ip_set_get_netlinkAaron Conole2017-09-111-8/+0
| | | | | | | | There are no in-tree callers. Signed-off-by: Aaron Conole <aconole@bytheb.org> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Backport patch: netlink: pass extended ACK struct to parsing functionsJozsef Kadlecsik2017-09-113-19/+39
|
* Backport patch netlink: extended ACK reportingJozsef Kadlecsik2017-09-113-1/+18
|
* netfilter: Remove exceptional & on function nameArushi Singhal2017-09-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | Remove & from function pointers to conform to the style found elsewhere in the file. Done using the following semantic patch // <smpl> @r@ identifier f; @@ f(...) { ... } @@ identifier r.f; @@ - &f + f // </smpl> Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Backport missing part of patch: netfilter: Remove unnecessary cast on void ↵Jozsef Kadlecsik2017-09-111-2/+1
| | | | pointer
* Backport nfnl_msg_type()Jozsef Kadlecsik2017-09-113-1/+19
|
* Report if the option is supported by a newer kernel releaseJozsef Kadlecsik2017-09-114-7/+54
| | | | | Instead ot printing "Unknown argument: foo", if foo option is supported by a newer kernel release, report that.
* netfilter: ipset: ipset list may return wrong member count for set with timeoutVishwanath Pai2017-09-061-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | Simple testcase: $ ipset create test hash:ip timeout 5 $ ipset add test 1.2.3.4 $ ipset add test 1.2.2.2 $ sleep 5 $ ipset l Name: test Type: hash:ip Revision: 5 Header: family inet hashsize 1024 maxelem 65536 timeout 5 Size in memory: 296 References: 0 Number of entries: 2 Members: We return "Number of entries: 2" but no members are listed. That is because mtype_list runs "ip_set_timeout_expired" and does not list the expired entries, but set->elements is never upated (until mtype_gc cleans it up later). Reviewed-by: Joshua Hunt <johunt@akamai.com> Signed-off-by: Vishwanath Pai <vpai@akamai.com>
* netfilter: ipset: deduplicate prefixlen mapsAaron Conole2017-09-061-258/+137
| | | | | | | | The prefixlen maps used here are identical, and have been since introduction. It seems to make sense to use a single large map, that the preprocessor will fill appropriately. Signed-off-by: Aaron Conole <aconole@bytheb.org>
* ipset: Fix ipset command replacement in runtest.shNeutron Soutmun2017-06-041-1/+1
| | | | | | | | | | | | | Fix the ipset command replacement. For ipset="/sbin/ipset" Actual: /sbin//sbin/ipset 2>.foo.err | ... | xargs -n1 ipset Expected: /sbin/ipset 2>.foo.err | ... | xargs -n1 /sbin/ipset Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix sparse warningsJozsef Kadlecsik2017-03-232-2/+2
|
* Correct a test: number of entries may be outdatedJozsef Kadlecsik2017-03-231-1/+1
| | | | | At listing, timed out entries are not listed but the number of entries counter is updated at garbage collection.
* netfilter: ipset: Compress return logicsimran singhal2017-03-231-4/+1
| | | | | | | | Simplify function returns by merging assignment and return into one command line. Signed-off-by: simran singhal <singhalsimran0@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Remove unnecessary cast on void pointersimran singhal2017-03-232-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | The following Coccinelle script was used to detect this: @r@ expression x; void* e; type T; identifier f; @@ ( *((T *)e) | ((T *)x)[...] | ((T*)x)->f | - (T*) e ) Signed-off-by: simran singhal <singhalsimran0@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Compatibility: handle changes in 4.10 kernel treeJozsef Kadlecsik2017-03-235-17/+85
| | | | | Handle changes in struct xt_action_param and the new xt_family(), xt_net() interfaces (reported by Jan Engelhardt).
* ipset 6.32 releasedv6.32Jozsef Kadlecsik2017-03-122-1/+6
|
* Fix possible truncated output in ipset output buffer handlingJozsef Kadlecsik2017-03-122-36/+39
| | | | | | | | | | Omri Bahumi and Yoni Lavi discovered that due to the inproper handling of the ipset output buffer, the output may be truncated. So for example in an "ipset save" output, instead of 192.168.0.0/24, just 192.168.0.0 printed. If one use "ipset save" and then "ipset restore" to restore the sets, this may lead to wrong firewall rules at the end. The patch fixes the bug in the ipset code.
* Missing prototype added in ipset_hash_ipmac.c (debugging)Jozsef Kadlecsik2017-03-121-0/+1
|
* ipset 6.31 releasedv6.31Jozsef Kadlecsik2017-02-193-1/+14
|
* Update manpage about the size parameter of list:set types.Jozsef Kadlecsik2017-02-191-1/+2
| | | | The parameter is ignored since ipset version 6.24.
* netfilter: ipset: Null pointer exception in ipset list:setVishwanath Pai2017-02-161-3/+6
| | | | | | | | | | | | | | | | | | | If we use before/after to add an element to an empty list it will cause a kernel panic. $> cat crash.restore create a hash:ip create b hash:ip create test list:set timeout 5 size 4 add test b before a $> ipset -R < crash.restore Executing the above will crash the kernel. Signed-off-by: Vishwanath Pai <vpai@akamai.com> Reviewed-by: Josh Hunt <johunt@akamai.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* New test to verify that only the intended entries are deleted at hash types.Jozsef Kadlecsik2017-02-163-1/+5
|