On 06/06/2016 06:31 PM, Pablo Neira Ayuso wrote:
> On Wed, Jun 01, 2016 at 08:23:54PM -0400, Vishwanath Pai wrote:
>> netfilter/nflog: nflog-range does not truncate packets
>>
>> The --nflog-range parameter from userspace is ignored in the kernel and
>> the entire pack
On 06/09/2016 01:57 PM, Vishwanath Pai wrote:
> On 06/08/2016 08:16 AM, Pablo Neira Ayuso wrote:
>> Looking again at your code:
>>
>> case NFULNL_COPY_PACKET:
>> - if (inst->copy_range > skb->len)
>> + data_len = i
On 06/08/2016 08:16 AM, Pablo Neira Ayuso wrote:
> Looking again at your code:
>
> case NFULNL_COPY_PACKET:
> - if (inst->copy_range > skb->len)
> + data_len = inst->copy_range;
> + if (li->u.ulog.copy_len < data_len)
> +
On 06/15/2016 08:39 AM, Pablo Neira Ayuso wrote:
> But nlmsg_len should match len in this.
>
> If we're just sending a part of the packet to userspace, then we
> should adjust nlmsg_len to indicate exactly the netlink message length
> that we're sending to userspace.
>
> Is your patch triggering
-by: Vishwanath Pai <v...@akamai.com>
diff --git a/include/uapi/linux/netfilter/xt_hashlimit.h
b/include/uapi/linux/netfilter/xt_hashlimit.h
index 6db9037..ea8c1c0 100644
--- a/include/uapi/linux/netfilter/xt_hashlimit.h
+++ b/include/uapi/linux/netfilter/xt_hashlimit.h
@@ -5,7 +5,7 @@
#include
/* t
changes, so I have split
those functions and moved all the common code to a *_common function.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
diff --git a/include/uapi/linux/netfilter/xt_hashlimit.h
b/include/uapi/linux/netfilter/xt_hashlimit.h
index ea8c1c0..be5d2e1 100644
--- a/include/uapi
ed-off-by: Vishwanath Pai <v...@akamai.com>
diff --git a/extensions/libxt_hashlimit.c b/extensions/libxt_hashlimit.c
index 4193464..ac67875 100644
--- a/extensions/libxt_hashlimit.c
+++ b/extensions/libxt_hashlimit.c
@@ -67,6 +67,7 @@ enum {
O_HTABLE_MAX,
O_HTABLE_GCINT,
O_H
unless they are similar in
every possible way
3) This behavior has to be forced with a new userspace flag:
--hashlimit-ehanced-procfs, if this flag is not passed we default to
the old behavior. This is to make sure we do not break existing scripts
that rely on the existing behavior.
Signed-off-by: Vish
-by: Vishwanath Pai <v...@akamai.com>
diff --git a/extensions/libxt_hashlimit.c b/extensions/libxt_hashlimit.c
index c5b8d77..ad7fb93 100644
--- a/extensions/libxt_hashlimit.c
+++ b/extensions/libxt_hashlimit.c
@@ -23,7 +23,7 @@
#include
#define XT_HASHLIMIT_BURST 5
-#
and
burst in hashlimit_cfg to 64-bit. Create two new structs hashlimit_cfg2
and xt_hashlimit_mtinfo2 and also create newer versions of all the
functions for match, checkentry and destory.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
diff --git a/extensions/libxt_hashlimit.c b/exte
.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Reviewed-by: Joshua Hunt <joh...@akamai.com>
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 4ef1fae..f40ddba 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -
placed by --nflog-size now. --nflog-range would
still exist but does not do anything.
Reported-by: Joe Dollard <jdoll...@akamai.com>
Reviewed-by: Josh Hunt <joh...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
diff --git a/include/net/netfilter/nf_log.h b/includ
this.
Reported-by: Joe Dollard <jdoll...@akamai.com>
Reviewed-by: Josh Hunt <joh...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
diff --git a/extensions/libxt_NFLOG.c b/extensions/libxt_NFLOG.c
index f611631..8c564a2 100644
--- a/extensions/libxt_NFLOG.
On 06/23/2016 06:25 AM, Pablo Neira Ayuso wrote:
> On Wed, Jun 01, 2016 at 08:17:59PM -0400, Vishwanath Pai wrote:
>> libxt_hashlimit: iptables-restore does not work as expected with xt_hashlimit
>>
>> Add the following iptables rule.
>>
>> $ iptables -A INPUT -
On 06/17/2016 07:22 AM, Pablo Neira Ayuso wrote:
> On Wed, Jun 15, 2016 at 03:13:15PM +, Lubashev, Igor wrote:
>> Vish, Pablo,
>>
>> I wonder about the value of sending more data than a client is
>> willing to consume (setting aside the important fact that the client
>> code crashes due to the
flag XT_NFLOG_F_COPY_LEN.
Also updated the man page to reflect the new option and added tests to
extensions/libxt_NFLOG.t
Reported-by: Joe Dollard <jdoll...@akamai.com>
Reviewed-by: Josh Hunt <joh...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
diff
Hi Jozsef,
On 03/13/2016 08:07 AM, Jozsef Kadlecsik wrote:
> Hi,
>
> On Sat, 12 Mar 2016, Vishwanath Pai wrote:
>
>> netfilter: fix race condition in ipset save and delete
>>
>> This fix adds a new reference counter (ref_kernel) for the struct ip_set.
>&
t do that
anymore.
Reviewed-by: Joshua Hunt <joh...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
--
diff --git a/include/linux/netfilter/ipset/ip_set.h
b/include/linux/netfilter/ipset/ip_set.h
index 0e1f433..86d86db 100644
--- a/include/linux/netfilter/ipset/ip_set
swap will error out if ref_netlink != 0 on the set.
Note: The changes to *_head functions is because previously we would
increment ref whenever we called these functions, we don't do that
anymore.
Reviewed-by: Joshua Hunt <joh...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
On 07/08/2016 07:54 AM, Pablo Neira Ayuso wrote:
> We have to keep the existing behaviour. Yes, it's broken or ambiguos
> but there may be people outthere relying on this.
>
> What I think we can do to resolve this scenario that you describe
> abobe is to provide a new option:
>
>
On 06/25/2016 05:39 AM, Pablo Neira Ayuso wrote:
> I see, but I'm not convinced about this /proc rename feature.
>
> I think the main point of this, as well as other entries in bugzilla
> related to this, is ability to update an existing hashlimit state.
>
> So, I'm not proposing to rename
On 06/23/2016 07:16 AM, Pablo Neira Ayuso wrote:
> On Wed, Jun 01, 2016 at 08:11:38PM -0400, Vishwanath Pai wrote:
>> +static void
>> +cfg_copy(struct hashlimit_cfg2 *to, void *from, int revision)
>> +{
>> +if (revision == 1) {
>> +str
On 07/08/2016 12:54 PM, Vishwanath Pai wrote:
> On 07/08/2016 12:37 PM, David Laight wrote:
>> If you think some users would still want 32bit limits, then you should
>> (probably) use a _64 suffix for the new functions.
>>
>> David
>
> I am propo
On 07/08/2016 12:37 PM, David Laight wrote:
> If you think some users would still want 32bit limits, then you should
> (probably) use a _64 suffix for the new functions.
>
> David
I am proposing a new revision for hashlimit that supports a higher rate
along with a few other changes/fixes
On 07/05/2016 04:13 PM, Vishwanath Pai wrote:
> On 06/25/2016 05:39 AM, Pablo Neira Ayuso wrote:
>> I see, but I'm not convinced about this /proc rename feature.
>>
>> I think the main point of this, as well as other entries in bugzilla
>> related to this, is ab
the
functions for match, checkentry and destory.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Signed-off-by: Joshua Hunt <joh...@akamai.com>
---
extensions/libxt_hashlimit.c | 460 ++---
extensions/libxt_hashlimit.t | 2 +
include/lin
I am planning to add a revision 2 for the hashlimit xtables module to
support higher packets per second rates. This patch renames all the
functions and variables related to revision 1 by adding _v1 at the end of
the names.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Signed-off-by: Joshu
of the functions like hashlimit_mt, hashlimit_mt_check etc are very
similar in both rev1 and rev2 with only minor changes, so I have split
those functions and moved all the common code to a *_common function.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Signed-off-by: Joshua Hunt <joh...@a
I am planning to add a revision 2 for the hashlimit xtables module to
support higher packets per second rates. This patch renames all the
functions and variables related to revision 1 by adding _v1 at the end of
the names.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Signed-off-by: Joshu
igned-off-by: Vishwanath Pai <v...@akamai.com>
Reviewed-by: Josh Hunt <joh...@akamai.com>
---
net/netfilter/ipset/ip_set_list_set.c | 9 ++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_list_set.c
b/net/netfilter/ipset/ip_set_list_set.c
index 51
in hashlimit_cfg to 64-bit. Create two new structs hashlimit_cfg2
and xt_hashlimit_mtinfo2 and also create newer versions of all the
functions for match, checkentry and destory.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Signed-off-by: Joshua Hunt <joh...@akamai.com>
---
the
functions and variables related to revision 1 by adding _v1 at the
end of the names.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Signed-off-by: Joshua Hunt <joh...@akamai.com>
---
extensions/libxt_hashlimit.c | 78 ++--
1 file changed, 3
v2:
Remove unnecessary div64_u64 around constants
v3:
remove backslashes
--
Fix link error in 32bit arch because of 64bit division
Division of 64bit integers will cause linker error undefined reference
to `__udivdi3'. Fix this by replacing divisions with div64_64
Signed-off-by: Vishwanath Pai
On 09/29/2016 02:47 PM, Mark Brown wrote:
> On Thu, Sep 29, 2016 at 12:40:35PM +0100, Build bot for Mark Brown wrote:
>
> For the past couple of days -next has been failing to build an ARM
> allmodconfig due to:
>
>> arm-allmodconfig
>> ERROR: "__aeabi_uldivmod"
; * HZ * CREDITS_PER_JIFFY;
>
> -- 1.9.1
Thanks for fixing this.
Acked-by: Vishwanath Pai <v...@akamai.com>
/2016 12:53 PM, Jan Engelhardt wrote:
> On Thursday 2016-09-22 18:43, Vishwanath Pai wrote:
>> >+struct hashlimit_cfg2 {
>> >+ __u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
>> >+ __u64 avg;/* Average secs between packets * scale */
>> >+ __u64
shlimit_mt, hashlimit_mt_check etc are very
similar in both rev1 and rev2 with only minor changes, so I have split
those functions and moved all the common code to a *_common function.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Signed-off-by: Joshua Hunt <joh...@akamai.com>
---
includ
I am planning to add a revision 2 for the hashlimit xtables module to
support higher packets per second rates. This patch renames all the
functions and variables related to revision 1 by adding _v1 at the
end of the names.
Signed-off-by: Vishwanath Pai <v...@akamai.com>
Signed-off-by: Joshu
v2:
Remove unnecessary div64_u64 around constants
--
Fix link error in 32bit arch because of 64bit division
Division of 64bit integers will cause linker error undefined reference
to `__udivdi3'. Fix this by replacing divisions with div64_64
Signed-off-by: Vishwanath Pai <v...@akamai.
On 09/30/2016 01:46 PM, Pablo Neira Ayuso wrote:
> On Thu, Sep 29, 2016 at 01:39:50PM -0400, Vishwanath Pai wrote:
>> v2:
>> Remove unnecessary div64_u64 around constants
>>
>> v3:
>> remove backslashes
>>
>> --
>>
>> Fix link error in 32b
data to restore the original faster 32-bit division.
>>
>> With both changes combined, we no longer get a link error.
>>
>> Fixes: 11d5f15723c9 ("netfilter: xt_hashlimit: Create revision 2 to support
>> higher pps rates")
>> Signed-off-by: Arnd Bergm
Fix link error in 32bit arch because of 64bit division
Division of 64bit integers will cause linker error undefined reference
to `__udivdi3'. Fix this by replacing divisions with div64_64
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
net/netfilter/xt_hashlimit.c | 15
On Tue, Sep 27, 2016 at 12:15 AM, Liping Zhang <zlpnob...@gmail.com> wrote:
> Hi Vishwanath,
>
> 2016-09-23 0:43 GMT+08:00 Vishwanath Pai <v...@akamai.com>:
>>
>> /* Precision saver. */
>> -static u32 user2credits(u32 user)
>> +s
t. We also don't print it out on 'ipset l'.
I created revision 4 to make this change, revision 3 should work with
older kernels just like before.
Reviewed-by: Josh Hunt <joh...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
lib
Warnings are only printed out for IPSET_CMD_TEST. The user won't see
warnings from other commands.
Reviewed-by: Josh Hunt <joh...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
src/ipset.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/i
for users of
the older revision. It will be a much bigger change if that is
what we need.
Reviewed-by: Josh Hunt <joh...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
net/netfilter/ipset/ip_set_list_set.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git
"Number of entries: 2" but no members are listed. That is
because mtype_list runs "ip_set_timeout_expired" and does not list the
expired entries, but set->elements is never upated (until mtype_gc
cleans it up later).
Reviewed-by: Joshua Hunt <joh...@akamai.com>
Sig
3 for hashlimit. The two new options
we add are:
--hashlimit-rate-match
--hashlimit-rate-interval
I have updated the help text to add these new options. Also added a few
tests for the new options.
Suggested-by: Igor Lubashev <iluba...@akamai.com>
Reviewed-by: Josh Hunt <joh...@akamai.com&g
3 for hashlimit. The two new options
we add are:
--hashlimit-rate-match
--hashlimit-rate-interval
I have updated the help text to add these new options. Also added a few
tests for the new options.
Suggested-by: Igor Lubashev <iluba...@akamai.com>
Reviewed-by: Josh Hunt <joh...@akamai.com&g
On 09/04/2017 06:14 AM, Pablo Neira Ayuso wrote:
> Sounds good, applied, thanks.
>
> A couple of questions: Does it really make sense to expose
> --hashlimit-rate-interval or are you using 1 second always there? I
> always wonder if it makes sense to expose yet another toggle that it's
> not
_u64 instead.
Fixes: bea74641e378 ("netfilter: xt_hashlimit: add rate match mode")
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
net/netfilter/xt_hashlimit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/x
On 09/06/2017 03:57 PM, Arnd Bergmann wrote:
> 64-bit division is expensive on 32-bit architectures, and
> requires a special function call to avoid a link error like:
>
> net/netfilter/xt_hashlimit.o: In function `hashlimit_mt_common':
> xt_hashlimit.c:(.text+0x1328): undefined reference to
n cfg_copy().
Fixes: bea74641e378 ("netfilter: xt_hashlimit: add rate match mode")
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
net/netfilter/xt_hashlimit.c | 14 --
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netf
limit: add rate match mode")
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
net/netfilter/xt_hashlimit.c | 12 +++-
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 10d4823..1c1941e
;
> I modified the comment part: the elements counter can still be incorrect
> in the case of a huge set, because elements might time out during the
> listing.
>
> Thanks for your patience!
>
> Best regards,
> Jozsef
>
> On Thu, 17 Aug 2017, Vishwanath Pai wrote:
>
address 2601::2bb4 on eth0!
b) When we detect DAD failure during address assignment to an interface:
IPv6: eth0: IPv6 duplicate address 2601::2b78 used by 34:ab:cd:56:11:e8
detected!
Suggested-by: Igor Lubashev <iluba...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
::
Suggested-by: Igor Lubashev <iluba...@akamai.com>
Signed-off-by: Vishwanath Pai <v...@akamai.com>
---
include/net/addrconf.h | 2 +-
net/ipv6/addrconf.c| 6 +++---
net/ipv6/ndisc.c | 9 +
3 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/include/net/addrconf
On 10/30/2017 04:43 PM, David Ahern wrote:
> On 10/30/17 2:29 PM, Vishwanath Pai wrote:
>> This patch updates the error messages displayed in kernel log to include
>> hwaddress of the source machine that caused ipv6 duplicate address
>> detection failures.
>>
>> E
Vishwanath,
>> The config will be cached in the device structure
>> (bp->rss_conf_obj.udp_rss_v4) in this scenario, and will be applied in the
>> load path (bnx2x_nic_load() --> bnx2x_init_rss()). Have unit tested the
>> change on my setup.
>>
>> Thanks,
>
local_bh_enable();
> return !(cfg->mode & XT_HASHLIMIT_INVERT);
> } else {
> goto overlimit;
>
Thanks for fixing this.
Acked-by: Vishwanath Pai <v...@akamai.com>
-Vishwanath
Hi,
We recently noticed a kernel panic in the bnx2x driver when trying to set
rx-flow-hash parameters via ethtool during if-pre-up.d. I am running kernel
v4.17.2 from ubuntu-mainline-ppa. I have added the stack trace below:
[ 18.280209] BUG: unable to handle kernel NULL pointer dereference at
; Ariel,
>Could you please review the path (bnx2x_set_rss_flags()--> bnx2x_rss())
> and confirm/correct on the above.
>
> Thanks,
> Sudarsana
>
> -Original Message-
> From: Vishwanath Pai [mailto:v...@akamai.com]
> Sent: 22 June 2018 10:37
l be applied in the
> load path (bnx2x_nic_load() --> bnx2x_init_rss()). Have unit tested the
> change on my setup.
>
> Thanks,
> Sudarsana
>
> -Original Message-
> From: Vishwanath Pai [mailto:v...@akamai.com]
> Sent: 22 June 2018 18:52
> To: Kalluru, Sudarsana
63 matches
Mail list logo
